Method and apparatus for determining safety-of-intended-functionality requirement in vehicle control system, and processor

Abstract

Provided in the present disclosure are a method and apparatus for determining a safety-of-the-intended-functionality requirement in a vehicle control system, and a processor. The method comprises: acquiring a control element set of a vehicle control system of a vehicle, and an output information set and a control action set that correspond to the control element set; determining at least one abnormal control action corresponding to at least one control action in the control action set, and determining at least one abnormal action result associated with the at least one abnormal control action; linking the relationships between the control element set, the output information set, the control action set, the abnormal control action, and the abnormal action result, so as to obtain a linking result; on the basis of the linking result, determining a functional defect result set corresponding to the control element set; and on the basis of the linking result and the functional defect result set, determining a safety-of-the-intended-functionality requirement in the vehicle control system.

Description

Method, device and processor for determining expected functional safety requirements in a vehicle control system TECHNICAL FIELD

[0001] The present disclosure claims priority from a Chinese patent application No. 202411296265.0 filed on September 14, 2024, and entitled "Method, device and processor for determining expected functional safety requirements in a vehicle control system", the whole content of which is incorporated herein by reference.

[0002] TECHNICAL FIELD

[0003] The present disclosure relates to the technical field of vehicles, and in particular, to a method, device and processor for determining expected functional safety requirements in a vehicle control system. BACKGROUND

[0004] At present, intelligent driving, as an innovative technology, brings the vehicle industry into a new era. It not only provides a more convenient transportation mode, but also improves traffic safety and efficiency. However, due to the limitation of current scientific and technological level, the vehicle control system for intelligent driving, such as intelligent driving system, still has some potential risks and challenges. Therefore, how to determine the expected functional safety (SOTIF) requirements of the vehicle control system is crucial to ensure the stable and reliable operation of the vehicle control system.

[0005] In the related art, due to the lack of clear and quantitative analysis, design, testing, evaluation methods and indicators for analyzing the SOTIF requirements of the vehicle control system, there is a lack of perfect and unified requirement analysis, so that the determined functional safety requirements are not accurate, thereby there are potential risks and vulnerabilities in the design and implementation process of the vehicle control system. Therefore, there is still a technical problem that the expected functional safety requirements in the vehicle control system cannot be effectively determined.

[0006] In view of the above technical problem that the expected functional safety requirements in the vehicle control system cannot be effectively determined, no effective solution has been proposed so far. SUMMARY

[0007] The embodiments of the present disclosure provide a method, device and processor for determining expected functional safety requirements in a vehicle control system, to at least solve the technical problem that the expected functional safety requirements in the vehicle control system cannot be effectively determined.

[0008] According to an aspect of embodiments of the present disclosure, a method for determining expected functional safety requirements in a vehicle control system is provided. The method can include: obtaining a control element set of a vehicle control system of a vehicle, and an output information set and a control behavior set corresponding to the control element set, wherein the control element set includes at least one control element, the output information set includes at least one output information, the output information is obtained by controlling the control element, and the control behavior set includes at least one control behavior, the control behavior is used to represent a behavior of controlling the control element to execute; determining at least one abnormal control behavior corresponding to at least one control behavior in the control behavior set, and determining at least one abnormal behavior result associated with the at least one abnormal control behavior, wherein the abnormal behavior result is used to represent an abnormal influence on the vehicle caused by executing the abnormal control behavior; linking a relationship between the control element set, the output information set, the control behavior set, the abnormal control behavior, and the abnormal behavior result to obtain a linking result; determining a functional defect result set corresponding to the control element set based on the linking result, wherein the functional defect result set includes at least one functional defect result, and the functional defect result is used to represent a functional defect existing in a corresponding control element in the control element set; and determining expected functional safety requirements of the vehicle control system based on the linking result and the functional defect result set, wherein the expected functional safety requirements are used to represent a strategy to be executed to overcome the functional defect.

[0009] Optionally, obtaining the output information set corresponding to the control element set includes: obtaining input information of at least one control element in the control element set, wherein the input information is a system architecture element input of the vehicle control system; determining output information corresponding to the at least one control element based on the input information and the corresponding control element, wherein the output information is a system architecture element output of the vehicle control system; and obtaining the output information set based on the output information corresponding to the at least one control element in the control element set.

[0010] Optionally, determining the at least one abnormal control behavior corresponding to the at least one control behavior in the control behavior set includes: applying a keyword to the at least one control behavior in the control behavior set to obtain the corresponding abnormal control behavior, wherein the keyword is used to identify a problem existing when the control behavior is executed.

[0011] Optionally, the keywords include at least one of the following: a first keyword, a second keyword, a third keyword, a fourth keyword, a fifth keyword, and a sixth keyword, wherein the first keyword is used to represent that the control behavior is not performed in a case where the control behavior needs to be performed, the second keyword is used to represent that a time of performing the control behavior exceeds a time range threshold, the third keyword is used to represent that a degree of performing the control behavior exceeds a degree range threshold, the fourth keyword is used to represent that a direction of performing the control behavior is abnormal, the fifth keyword is used to represent that a time of ending the control behavior is earlier than a target time, and / or a time length of performing the control behavior exceeds a time length threshold, and the sixth keyword is used to represent that the control behavior is performed in a case where the control behavior does not need to be performed.

[0012] Optionally, the linking result is a linking relationship table, wherein the relationships among the control element set, the output information set, the control behavior set, the abnormal control behavior, and the abnormal behavior result are linked to obtain the linking result, including: detecting at least one output information in the output information set and at least one control behavior in the control behavior set to obtain a detection result, wherein the detection result is used to represent whether the output information can affect the corresponding control behavior; and based on the control element set, the output information set, the control behavior set, the abnormal control behavior, the abnormal behavior result, and the detection result, obtaining the linking relationship table.

[0013] Optionally, based on the linking result, the function defect result set corresponding to the control element set is determined, including: obtaining type information of at least one control element in the control element set in the linking result; based on the type information, determining a defect analysis dimension corresponding to the at least one control element and defect analysis information under the defect analysis dimension; determining a function defect information set and a trigger condition set corresponding to the defect analysis information; and linking the relationship between the function defect information set and the trigger condition set to obtain the function defect result set.

[0014] Optionally, the defect analysis dimension includes a first defect analysis dimension and a second defect analysis dimension, the first defect analysis dimension is a defect analysis dimension common to control elements, and the second defect analysis dimension is a defect analysis dimension unique to different control elements, wherein based on the type information, the defect analysis dimension corresponding to the at least one control element and the defect analysis information under the defect analysis dimension are determined, including: in response to the type information being a sensor type, determining that the first defect analysis dimension includes at least one of the following: an installation position of the control element, a vibration condition of the control element, a temperature condition of the control element, and an aging degree of the control element; and in response to the type information being an algorithm type, determining that the first defect analysis dimension includes at least one of the following: model robustness of the control element and model generalization of the control element.

[0015] Optionally, the types of the trigger conditions in the set of trigger conditions at least include one of the following: a control element exists a disturbance condition, an environment where the vehicle is located exists a disturbance condition, a vehicle control exists a disturbance condition, and a target object in the vehicle exists a misuse condition.

[0016] Optionally, before determining the expected functional safety requirement of the vehicle control system based on the linking result and the set of functional defect results, the method further includes: linking a relationship between the linking result and the set of functional defect results to obtain a target linking result; and determining an abnormal behavior result from the target linking result and an association attribute between the set of defect information and the set of trigger conditions, wherein the association attribute is used to represent a degree of association between the abnormal behavior result and the set of defect information and the set of trigger conditions.

[0017] Optionally, determining the expected functional safety requirement of the vehicle control system based on the linking result and the set of functional defect results includes: determining the expected functional safety requirement based on the target linking result and the association attribute.

[0018] According to another aspect of the embodiments of the present disclosure, a device for determining an expected functional safety requirement of a vehicle control system is also provided. The device can include: an acquisition component configured to acquire a set of control elements of a vehicle control system of a vehicle, and a set of output information and a set of control behaviors corresponding to the set of control elements, wherein the set of control elements includes at least one control element, the set of output information includes at least one output information, the output information is obtained by controlling the control element, and the set of control behaviors includes at least one control behavior, the control behavior is used to represent a behavior of executing the control element; a first determination component configured to determine at least one abnormal control behavior corresponding to at least one control behavior in the set of control behaviors, and determine at least one abnormal behavior result associated with the at least one abnormal control behavior, wherein the abnormal behavior result is used to represent an abnormal influence on the vehicle caused by executing the abnormal control behavior; a linking component configured to link a relationship between the set of control elements, the set of output information, the set of control behaviors, the abnormal control behavior, and the abnormal behavior result to obtain a linking result; a second determination component configured to determine a set of functional defect results corresponding to the set of control elements based on the linking result, wherein the set of functional defect results includes at least one functional defect result, and the functional defect result is used to represent a functional defect existing in the control element corresponding to the set of control elements; and a third determination component configured to determine an expected functional safety requirement of the vehicle control system based on the linking result and the set of functional defect results, wherein the expected functional safety requirement is used to represent a strategy to be executed to overcome the functional defect.

[0019] According to another aspect of the embodiments of the present disclosure, a computer readable storage medium is also provided. The computer readable storage medium includes a stored program, wherein the program, when executed, controls a device in which the computer readable storage medium is located to perform the method for determining the expected functional safety requirement in the vehicle control system according to the embodiments of the present disclosure.

[0020] According to another aspect of the embodiments of the present disclosure, a processor is also provided. The processor is configured to execute a program, wherein the program, when executed, performs the method for determining the expected functional safety requirement in the vehicle control system according to the embodiments of the present disclosure.

[0021] According to another aspect of the embodiments of the present disclosure, a computer program product is also provided. The computer program product includes a computer program, which, when executed by a processor, implements the method for determining the expected functional safety requirement in the vehicle control system according to the embodiments of the present disclosure.

[0022] In the embodiments of the present disclosure, if it is necessary to determine the expected functional safety requirement of the vehicle control system, the set of control elements and the set of output information in the vehicle control system can be determined, and the corresponding set of control behaviors can be sorted out. Each control behavior in the set of control behaviors is analyzed to determine the risk implied therein, and the corresponding abnormal control behavior is obtained. The abnormal behavior result caused in the vehicle by the abnormal control behavior can be determined. The relationship between the set of control elements, the set of output information, the set of control behaviors, the abnormal control behavior and the abnormal behavior result is linked to obtain the corresponding linking result. The functional defects of each control element in the set of control elements are analyzed from the linking result to obtain the set of functional defect results. According to the set of functional defect results and the linking result, the expected functional safety requirement of the vehicle control system can be proposed. In the embodiments, the hazard behavior of the whole vehicle can be traced back from each control element in the vehicle control system by the above method, thereby forming a perfect and unified requirement analysis. Furthermore, the technical effect of effectively determining the expected functional safety requirement in the vehicle control system is achieved, and the technical problem of being unable to effectively determine the expected functional safety requirement in the vehicle control system is solved. BRIEF DESCRIPTION OF DRAWINGS

[0023] The accompanying drawings, which are included to provide a further understanding of the present disclosure and constitute a part of the present disclosure, illustrate the exemplary embodiments of the present disclosure and are used to explain the present disclosure, but do not limit the present disclosure. In the drawings:

[0024] FIG. 1 is a flowchart of a method for determining an expected functional safety requirement in a vehicle control system according to an embodiment of the present disclosure;

[0025] FIG. 2 is a flowchart of an expected functional safety requirement analysis method according to an embodiment of the present disclosure;

[0026] FIG. 3 is a schematic diagram of a determination apparatus of expected functional safety requirements in a vehicle control system according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0027] In order to better understand the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, but not all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative work should fall within the scope of the present disclosure.

[0028] It should be noted that the terms "first", "second", and the like in the specification and claims of the present disclosure and the above-described accompanying drawings are used to distinguish similar objects, and do not necessarily have to describe a specific order or a chronological sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or components does not have to be limited to those steps or components clearly listed, but can include other steps or components that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] According to an embodiment of the present disclosure, an embodiment of a method for determining expected functional safety requirements in a vehicle control system is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in a different order.

[0030] FIG. 1 is a flowchart of a method for determining expected functional safety requirements in a vehicle control system according to an embodiment of the present disclosure. As shown in FIG. 1, the method can include the following steps:

[0031] In step S102, a set of control elements of a vehicle control system of a vehicle is obtained, and a set of output information and a set of control behaviors corresponding to the set of control elements are obtained.

[0032] In the technical solution provided in the foregoing step S102 of the present disclosure, if the vehicle is an intelligent driving vehicle, the vehicle control system can be an intelligent driving system, which can be referred to as a driving system. The set of control elements includes at least one control element. The control element can be a system architecture element in the control architecture of the vehicle control system, which can be referred to as an architecture element. The set of control elements can be represented in the form of an element list, which can include the number and name of the control element.

[0033] Optionally, the element list refers to listing each element in the control architecture, including all control elements, components, and subsystems in the vehicle control system. The element list can include sensors, controllers, actuators, algorithm components, and the like. By listing the element list, all components and functional components in the vehicle control system can be clearly understood.

[0034] It should be noted that the control element described above is only an example and is not specifically limited herein, as long as the control element can ensure the functional safety and stable operation of the vehicle control system.

[0035] Optionally, the set of output information includes at least one output information, which is obtained by controlling the control element. The output information can be an architecture element output or a control element output. The set of output information can be represented in the form of an output list, which can include the number, name, and output of the control element. For example, it can be information collected by controlling the control element, or it can be the control result executed by controlling the control element. For example, if the control element is a camera, the corresponding output information can be a video stream; if the control element is a visual perception component, the corresponding output information can be information such as obstacles around the vehicle and traffic lights on the road. It should be noted that the output information described above is only an example and is not specifically limited herein.

[0036] Optionally, the output list refers to the output list of each element in the control architecture, i.e., the output that can be generated by each element. The output list can include sensor detection data, controller instructions, actuator actions, and the like. By sorting out the output list, the function and role of each element and the influence of each element on the entire vehicle control system can be determined.

[0037] Optionally, the set of control behaviors includes at least one control behavior. The control behavior can be issued by the vehicle control system to control the behavior executed by the control element. For example, it can be a steering instruction or a deceleration instruction provided by the driving controller in the driving system, which is only an example and is not specifically limited herein.

[0038] Optionally, the control behavior refers to various operations and behaviors performed by the automatic driving system (intelligent driving system) during operation, including vehicle acceleration, braking, steering, obstacle avoidance, following, and other control actions. By sorting and defining the control behavior of the system, the behavior logic of the vehicle control system under different conditions can be clearly understood.

[0039] In this embodiment, the control element set and output information set of the control architecture of the vehicle control system can be sorted out, and the control behavior can be sorted out, wherein the control architecture refers to the overall structure and organization method used to realize vehicle control and driving decision in the automatic driving system. The control architecture defines the connection relationship and interaction logic between various control elements in the vehicle control system to ensure that the vehicle can be correctly controlled and operated according to the environment and user input. In the control architecture, various control elements play different roles and functions and work together to realize the automatic driving function of the vehicle. For example, sensors are used to collect environmental information, controllers are used to process and analyze sensor data, and actuators are used to execute control instructions. The design of the control architecture takes into account the stability, reliability, real-time performance, and other aspects of the automatic driving system to ensure that the automatic driving system can operate safely and efficiently. In summary, the control architecture is a key component of the automatic driving system, which defines the relationship and interaction between various control elements in the automatic driving system, and is the basis for the design and development of the vehicle control system.

[0040] In the embodiments of the present disclosure, the control behavior, element list, and output list are closely related in the design of the intelligent driving system and jointly constitute the control architecture and operation logic of the vehicle control system. The control behavior is various operations and behaviors performed by the automatic driving system during automatic driving, such as acceleration, braking, steering, and other control actions. The element list includes all control elements in the vehicle control system, such as sensors, controllers, actuators, and the like. Each control behavior corresponds to one or more control elements in the vehicle control system, and the above control elements cooperate to realize the control behavior. The relationship between the control behavior and the control element is the basis of the control architecture of the vehicle control system, and the element list listed by the list can clearly define the control elements involved in the control behavior to sort out the working principle and function allocation of the vehicle control system. The output list includes the output that each control element may generate, such as sensor data, controller instructions, actuator actions, and the like. The data and instructions in the output list play a key role in the execution process of the control behavior and are the basis and basis for the realization of the control behavior. The result of the control behavior can be verified and monitored through the output list to ensure that the vehicle control system operates normally and produces correct output during execution.

[0041] Therefore, the control behaviors, the element list, and the output list are closely related. The control behaviors define the operation and behavior logic of the system, the element list lists the control elements in the system, and the output list reflects the output results of each control element. By understanding and integrating the relationship between the above three, the control architecture of the intelligent driving system can be better designed and managed to ensure that the vehicle control system can operate efficiently and safely.

[0042] In step S104, at least one abnormal control behavior corresponding to at least one control behavior in the control behavior set is determined, and at least one abnormal behavior result associated with the at least one abnormal control behavior is determined.

[0043] In the technical solution provided by step S104 of the present disclosure, the abnormal control behavior can be an unsafe control behavior corresponding to the control behavior, which can be caused by a mistake in the control timing, duration, etc. of the control behavior. This is only an example and is not limited. If the control behavior provides a steering instruction to the intelligent driving controller, the unsafe control behavior can be that the intelligent driving controller does not send a steering instruction to the actuator. The abnormal behavior result can be used to represent the abnormal influence of the vehicle caused by the execution of the abnormal control behavior, which can also be referred to as a harmful behavior. For example, if the abnormal control behavior is that the intelligent driving controller unexpectedly sends a steering instruction to the actuator, the corresponding abnormal behavior result is to unexpectedly provide a steering torque. This is only an example and is not limited.

[0044] Optionally, the unsafe control behavior refers to a control operation or behavior that may cause safety problems or risks during the process of analyzing the control behaviors. The unsafe control behavior can include abnormal braking, incorrect steering, misjudgment of traffic signals, etc., which can cause the vehicle control system to lose control or produce dangerous behaviors. The harmful behavior refers to the possible dangerous or accident behaviors caused by the unsafe control behavior, which can cause the vehicle to lose control, collide, reverse, etc. In this embodiment, by analyzing and linking the unsafe control behavior and the harmful behavior, potential safety risks and problems can be identified.

[0045] In this embodiment, after the control behavior set is determined, the abnormal control behavior corresponding to each control behavior in the control behavior set can be determined, and the abnormal behavior result associated with each abnormal control behavior can be determined.

[0046] Optionally, by analyzing the control behaviors of the vehicle control system, the possible unsafe control behaviors can be identified, and the unsafe control behaviors can be linked with the possible harmful behaviors, which helps to identify potential safety hazards and risk points in the vehicle control system.

[0047] In step S106, the relationships between the control element set, the output information set, the control behavior set, the abnormal control behavior, and the abnormal behavior result are linked to obtain a linking result.

[0048] In the technical solution of step S106 of the present disclosure, the linking result can be a link relationship table.

[0049] Optionally, the link relationship table is a table used to record and display the association and link relationship between each element in the vehicle control system. Through the link relationship table, the interaction and influence between each component in the vehicle control system can be clearly understood, which helps the decision-making and improvement in the design and analysis process of the vehicle control system. The link relationship table can help to sort out the structure and components of the vehicle control system, clearly show the relationship and connection mode between each element in the vehicle control system, and help to understand the overall architecture of the vehicle control system. Through the link relationship table, potential problems and risk points in the vehicle control system can be identified. According to the link relationship between elements, factors that may cause unsafe behavior or harmful behavior can be predicted and analyzed. It can also help to identify bottlenecks and contradictions in the vehicle control system, guide the optimization and improvement of the vehicle control system design. By analyzing the link relationship, unreasonable places in the system can be found, and corresponding improvement schemes can be proposed, which can better help the risk management and safety evaluation of the vehicle control system. By analyzing the link relationship between elements, safety hazards and problems in the vehicle control system can be identified, thereby effectively reducing the risk of the vehicle control system and ensuring the safety and reliability of the vehicle control system. It can also provide important reference for the design and decision-making of the vehicle control system. According to the information in the link relationship table, reasonable decisions and adjustments can be made to ensure that the vehicle control system can operate as expected.

[0050] In summary, the link relationship table can be used to better understand the structure and operation logic of the vehicle control system, identify potential problems and risks, and propose effective solutions. By reasonably using the link relationship table, the safety, stability and reliability of the vehicle control system can be improved, providing important support for the design and development of intelligent driving systems.

[0051] In this embodiment, after determining the control behavior set and the abnormal control behavior and abnormal behavior result corresponding to each control behavior in the control behavior set, the relationship between the above-mentioned determined control element set, output information set, control behavior set, abnormal control behavior and abnormal behavior result can be analyzed and linked to obtain a linking result.

[0052] Optionally, starting from the architecture elements, it is judged whether each output of the architecture elements affects each control behavior. A link relationship table of the architecture elements, element outputs, control behaviors, unsafe control behaviors, and harmful behaviors is obtained. That is, starting from the architecture elements of the system, it is analyzed whether the output of each element will affect the control behavior of the vehicle control system. By establishing the link relationship table between the architecture elements, element outputs, control behaviors, unsafe control behaviors, and harmful behaviors, the influence relationship between each element and behavior in the vehicle control system can be clearly understood, and potential safety risks can be identified.

[0053] In the embodiments of the present disclosure, starting from the architecture elements of the system, the output of each architecture element is analyzed to determine whether the output will affect each control behavior. Through the above process, a correlation and link relationship table between the architecture elements, element outputs, control behaviors, unsafe control behaviors, and harmful behaviors can be established to better understand the operation logic and potential safety risks of the vehicle control system.

[0054] Optionally, starting from the architecture elements: the architecture elements are the basic components in the vehicle control system, including sensors, controllers, actuators, etc. Each architecture element can be analyzed to understand the corresponding functions and effects, and the possible outputs. For the output of each architecture element, it can be judged that each control behavior in the vehicle control system is affected. That is, it is determined whether the output will affect a particular control behavior, and the degree and manner of the influence. According to the analysis of the architecture elements, element outputs, control behaviors, unsafe control behaviors, and harmful behaviors, a correlation and link relationship table can be established. The correlation and link relationship table can clearly show the influence of the output of each architecture element on each control behavior, and the relationship between the unsafe control behaviors and the harmful behaviors. According to the analysis of the influence of the output on the control behavior, the architecture element output that may cause the unsafe control behavior and the harmful behavior can be identified. The unsafe control behavior refers to a control operation that may cause the vehicle control system to lose control or produce a dangerous behavior, while the harmful behavior refers to a possible danger or accident behavior caused by the unsafe control behavior.

[0055] Through the above method, the effects and influences of each architecture element in the vehicle control system can be better analyzed to ensure the matching and coordination between the control behaviors and the outputs of the vehicle control system, and potential safety hazards and risk points can be identified. The establishment of the link relationship table between the architecture elements, element outputs, control behaviors, unsafe control behaviors, and harmful behaviors helps to comprehensively evaluate the functional safety of the vehicle control system, and corresponding improvement measures and preventive measures can be proposed to ensure that the vehicle control system can safely and reliably operate in various situations.

[0056] In step S108, based on the link results, a function defect result set corresponding to the control element set is determined.

[0057] In the technical solution provided in the step S108 of the present disclosure, the function defect result set can include at least one function defect result. The function defect result is used to represent the function defect of the corresponding control element in the control element set. The function defect can be used to represent the potential function deficiency in the control element. The function defect result can include the potential function deficiency and the trigger condition.

[0058] Optionally, the potential function deficiency refers to the case that the control element in the vehicle control system fails to meet certain function or performance requirements in design or actual operation. In the intelligent driving system, the potential function deficiency can be manifested as that the intelligent driving system cannot correctly identify obstacles, cannot make correct decisions or control behaviors, etc. Through the deductive analysis, the possible function defects or deficiencies in the design of the intelligent driving system can be identified, so as to timely improve and adjust. It should be noted that the above-mentioned potential function deficiency is only for example and is not specifically limited here.

[0059] Optionally, the trigger condition is a condition or situation that causes the system to produce a specific behavior or event. In the intelligent driving system, the trigger condition can include environmental changes, sensor data abnormalities, user operations and other factors. By analyzing the trigger condition in a deductive manner, it can be determined that the system will produce a specific response or behavior under what conditions and how to effectively respond to the trigger condition. It should be noted that the above-mentioned trigger condition is only for example and is not specifically limited here.

[0060] For example, assuming that the architecture element of an intelligent driving system is a front-view camera, the following potential function deficiency and trigger condition can be obtained through deductive analysis: the potential function deficiency can be the performance deficiency of the color contrast and brightness contrast of the front-view camera, which can cause the intelligent driving system to fail to accurately identify road signs or obstacles. The trigger condition can be that the camera cannot correctly identify road signs under strong light conditions, and the trigger condition is that the light intensity exceeds the recognition range of the camera.

[0061] In the embodiment of the present disclosure, through the analysis of the potential function deficiency and the trigger condition, the possible problems and risks in the intelligent driving system can be identified, so that corresponding improvement measures and optimization strategies can be taken to improve the safety and reliability of the intelligent driving system. Deductive analysis helps to comprehensively understand the potential risks of the intelligent driving system, so as to ensure that the intelligent driving system can safely operate under various conditions.

[0062] In this embodiment, after linking the relationships among the control element set, the output information set, the control behavior set, the abnormal control behavior and the abnormal behavior result to obtain the linking result, the function defect result set corresponding to the control element set can be determined based on the linking result.

[0063] Optionally, each functional deficiency and trigger condition is linked to a hazardous behavior through the architectural elements, and judgment and sorting are performed. Each identified functional deficiency and trigger condition is linked to a possible hazardous behavior that may be triggered through the architectural elements. The links are judged and sorted to determine how individual functional deficiencies and trigger conditions in the intelligent driving system may lead to the occurrence of hazardous behaviors.

[0064] Optionally, each functional deficiency and trigger condition is linked to a hazardous behavior through the architectural elements, and judgment and sorting are performed. The above method is very important because only when the relationship between functional deficiencies and trigger conditions and hazardous behaviors is clear can risk assessment and risk management be effectively performed. Each functional deficiency can be explicitly listed, such as intelligent driving system crash, data loss, etc. The trigger condition, i.e., the specific situation or event that leads to the occurrence of functional deficiencies, such as network failure, user error operation, etc. can also be determined. Each functional deficiency and trigger condition can also be associated with a possible hazardous behavior, such as intelligent driving system crash may cause service interruption, data loss may cause information leakage, etc.

[0065] After the association is performed, the above association can be judged and sorted to evaluate the impact of each functional deficiency and trigger condition on the safety of the intelligent driving system to determine which are the most critical and need to be focused on, so that targeted risk management can be performed to take appropriate measures to reduce the likelihood and impact of risks. In summary, by linking functional deficiencies, trigger conditions and hazardous behaviors through architectural elements and performing judgment and sorting, it is helpful to more comprehensively understand the security risks existing in intelligent driving systems and provide effective reference for risk management.

[0066] Optionally, potential functional deficiencies and trigger conditions are analyzed using a deductive approach from the architectural elements. Potential functional deficiencies and trigger conditions can be analyzed using a deductive approach from the architectural elements of the intelligent driving system. Through logical reasoning and analysis, functional defects or trigger condition deficiencies that may exist in the design of the intelligent driving system are identified, which helps to prevent potential problems in advance.

[0067] Optionally, potential functional deficiencies and trigger conditions are analyzed using a deductive approach from the architectural elements of the system. The above method aims to identify functional defects or trigger condition deficiencies that may exist in the design of the intelligent driving system through logical reasoning and analysis, so as to prevent the occurrence of problems or unsafe behaviors in the intelligent driving system.

[0068] Optionally, a comprehensive review and analysis of the architecture elements of the intelligent driving system can be performed to understand the functions and roles of each architecture element, as well as its position and influence in the system, which is crucial for subsequent deductive analysis. Deduction is a method of logical reasoning that draws new conclusions or results through reasoning and inference from known conditions and rules. In the above process, the architecture elements, functions and roles of the system are analyzed by deductive method, and the possible functional deficiencies and trigger condition deficiencies are inferred, i.e., the intelligent driving system cannot correctly perform the expected functions or respond to specific trigger conditions in some cases. In the process of deductive analysis, it is necessary to identify possible functional deficiencies, i.e., the situation that some functions of the intelligent driving system cannot meet the user's demand or design requirements. This can include situations such as some control behaviors cannot be implemented, some outputs cannot be triggered correctly, etc. At the same time, it can also be determined that there may be trigger condition deficiencies, i.e., the intelligent driving system cannot correctly respond to some specific trigger conditions, which may cause the control behavior of the intelligent driving system to be incorrect or unstable. By analyzing potential functional deficiencies and trigger conditions through deductive method, problems can be found early and corresponding preventive measures and improvement schemes can be proposed, which helps to solve potential risks in time and improve the safety and reliability of the intelligent driving system.

[0069] In the embodiments of the present disclosure, by starting from the architecture elements and analyzing potential functional deficiencies and trigger conditions through deductive method, it can help to prevent problems that may occur in the design and development process of the intelligent driving system, and improve the stability and safety of the intelligent driving system. The above method is an important link in the design and development process of the intelligent driving system, which helps to identify potential risks in advance and take corresponding measures to ensure that the intelligent driving system can operate as expected.

[0070] Step S110, based on the link result and the function defect result set, determining the expected functional safety requirement of the vehicle control system.

[0071] In the technical solution provided by the above step S110 of the present disclosure, the expected functional safety requirement can be used to represent the strategy to be executed to overcome the functional defects, and the expected functional safety requirement can also be referred to as the functional safety requirement.

[0072] Optionally, the expected functional safety requirement refers to the safety performance requirement that must be met when designing the intelligent driving system, to ensure that the intelligent driving system can still provide safe and reliable functions in the event of a failure or abnormal situation. By analyzing the correlation between the elements of the control architecture, the control behavior, the unsafe control behavior, and the harmful behavior, the functional safety requirements required by the intelligent driving system are determined. The expected functional safety requirement mainly includes the following aspects: ensuring the correctness and reliability of the intelligent driving system function, the functional safety requirement should ensure that the intelligent driving system can correctly perform the designed function and maintain reliability under various conditions, avoiding insufficient or failure functions. Guarantee the robustness of the intelligent driving system to external environment and interference, the functional safety requirement should consider the robustness of the intelligent driving system under various external environmental conditions, including the influence of weather, light, road conditions, etc. on the intelligent driving system, to ensure that the intelligent driving system can run stably and respond correctly. Improve the fault diagnosis and fault tolerance capability of the intelligent driving system, the functional safety requirement should include the diagnosis and processing capability of the intelligent driving system to faults, which can identify problems in time and take measures to ensure that the intelligent driving system can safely park or enter a safe mode in the event of a failure. Ensure the safe interaction of the intelligent driving system with other vehicles and traffic participants, the functional safety requirement should consider the safe interaction of the intelligent driving system with other vehicles, pedestrians, bicycles and other traffic participants, to ensure that the intelligent driving system can predict and avoid potential collision risks. Ensure the data security and privacy protection of the intelligent driving system, the functional safety requirement should include the protection of vehicle data and the safe handling of privacy information by the intelligent driving system, to prevent data leakage and unauthorized access.

[0073] By clearly defining and analyzing the expected functional safety requirement, the safety performance requirements that the intelligent driving system needs to meet during the design and development process can be better considered, thereby ensuring that the intelligent driving system has high safety and reliability. At the same time, the expected functional safety requirement also provides an important basis for the verification, testing and certification of the intelligent driving system.

[0074] For example, if the architecture element is a camera, the potential insufficient function is the insufficient performance of the camera color contrast and brightness contrast, and the triggering condition is that the target object has weak color contrast or sensitive contrast. The corresponding expected functional safety requirement can be "avoiding the reduction of sensor accuracy for target objects, lane lines, road edges, etc. with weak color contrast or sensitive contrast". It should be noted that the above expected functional safety requirement is only for illustration and is not specifically limited here.

[0075] In this embodiment, after determining the functional defect result set corresponding to the control element set based on the link result, the expected functional safety requirement of the vehicle control system can be determined based on the link result and the functional defect result set.

[0076] Optionally, based on the functional deficiencies, trigger conditions, and harmful behaviors, the expected functional safety requirements are proposed. These requirements can be improvements or requirements for the functional deficiencies, trigger conditions, and harmful behaviors to ensure that the intelligent driving system can operate safely and reliably in various situations. The above method helps to improve the safety and reliability of the intelligent driving system and reduce the risk of failure or accidents of the intelligent driving system.

[0077] Optionally, based on the functional deficiencies, trigger conditions, and harmful behaviors obtained from the previous analysis, the expected functional safety requirements are proposed. This process is very critical because functional safety requirements are the basis for ensuring system safety and can guide how to design, develop, and test intelligent driving systems to ensure that intelligent driving systems can remain stable and reliable when facing various threats and risks.

[0078] Optionally, based on the functional deficiencies, the corresponding functional safety requirements are proposed, such as ensuring that the intelligent driving system can remain normal operation when encountering specific abnormal situations, ensuring that the intelligent driving system can correctly process all input data, etc. Based on the trigger conditions, the corresponding safety requirements can be proposed, such as ensuring that the intelligent driving system can timely detect and respond to specific trigger conditions, ensuring that the intelligent driving system can prevent trigger conditions that may cause functional deficiencies, etc. Based on the harmful behaviors, the corresponding safety requirements can be proposed, such as ensuring that the intelligent driving system can avoid or mitigate situations that may cause harmful behaviors, ensuring that the intelligent driving system can timely recover and repair, etc.

[0079] When proposing functional safety requirements, it can be ensured that the above requirements have measurability, verifiability, and traceability, so that in the subsequent design, development, and testing process, it can be verified whether the intelligent driving system meets these requirements. In addition, functional safety requirements also need to be coordinated and integrated with other system requirements to ensure that the intelligent driving system can meet the safety requirements while also achieving other functional and performance requirements. In summary, based on the functional deficiencies, trigger conditions, and harmful behaviors, the expected functional safety requirements are proposed, which is an important step to ensure the safety of the intelligent driving system and can provide clear guidance for the subsequent design and development of the intelligent driving system to establish a more secure and reliable intelligent driving system.

[0080] If it is necessary to determine the expected functional safety requirement of the vehicle control system, the control element set and the output information set in the vehicle control system can be determined, and the corresponding control behavior set can be sorted out. Each control behavior in the control behavior set is analyzed to determine the risk implied therein, and the corresponding abnormal control behavior is obtained. The abnormal behavior result caused in the vehicle by the abnormal control behavior can be determined. The relationship between the control element set, the output information set, the control behavior set, the abnormal control behavior, and the abnormal behavior result is linked to obtain the corresponding linking result. The functional defects of each control element in the control element set are analyzed from the linking result to obtain a functional defect result set. According to the functional defect result set and the linking result, the expected functional safety requirement of the vehicle control system can be proposed. In this embodiment, the above method can trace the hazard behavior of the whole vehicle from each control element in the vehicle control system, thereby forming a perfect and unified requirement analysis. Furthermore, the technical effect of effectively determining the expected functional safety requirement of the vehicle control system is achieved, and the technical problem of being unable to effectively determine the expected functional safety requirement of the vehicle control system is solved.

[0081] The above method of this embodiment will be further introduced below.

[0082] As an optional embodiment, in step S102, the output information set corresponding to the control element set is obtained, including: obtaining the input information of at least one control element in the control element set, wherein the input information is the system architecture element input of the vehicle control system; determining the output information corresponding to the at least one control element based on the input information and the corresponding control element, wherein the output information is the system architecture element output of the vehicle control system; and obtaining the output information set based on the output information corresponding to the at least one control element in the control element set.

[0083] In this embodiment, in the process of obtaining the output information set corresponding to the control element set, the input information of each control element in the control element set can be obtained, and the output information corresponding to the control element can be determined according to the input information and the corresponding control element. The output information of all control elements is summarized to obtain the output information set, wherein the input information can be the system architecture element input. The output information can be the system architecture element output.

[0084] Optionally, the system architecture elements can include vehicle internal elements, vehicle external elements, and intelligent driving controller internal elements. The vehicle internal elements can include sensors such as cameras, radars, etc., actuators such as steering systems, braking systems, acceleration systems, etc., and vehicle control components, etc. The vehicle external elements can include road signs, other vehicles, pedestrians, and other external environmental elements, etc. The intelligent driving controller internal elements can include decision components, planning components, perception components, and other functional components within the intelligent driving controller.

[0085] Optionally, the system architecture element inputs can include sensor data, external environment data, and user inputs, etc. The sensor data can be information about the environment around the vehicle obtained by sensors inside the vehicle, such as road conditions, other vehicles, pedestrians, etc. The external environment data can include information from external elements such as road signs, other vehicles, pedestrians, etc. The user input can include driver instructions or system user interface inputs. It should be noted that the above system architecture element inputs are only for illustration and are not specifically limited here.

[0086] Optionally, the system architecture element outputs can be control instructions, status information, and alarm information. The control instructions can be generated by the decision components within the intelligent driving controller based on sensor data and environmental data, including steering, acceleration, braking, and other control instructions. The status information can be the current vehicle status, predicted driving path, surrounding environment information, and other status information that the system may output in real time for the driver or other systems to monitor. The alarm information can be output to the driver or other systems when the intelligent driving system detects dangerous or abnormal situations. It should be noted that the above system architecture element outputs are only for illustration and are not specifically limited here.

[0087] Optionally, the system architecture element inputs refer to the input data, signals, or information received and processed by each component or component in the system. These inputs are usually used to trigger specific functions, algorithms, or control behaviors of the system. The content and format of the system architecture element inputs depend on the design and functional requirements of the intelligent driving system, which can be environmental data collected by sensors, user input commands, outputs from other system components, etc.

[0088] In the embodiments of the present disclosure, the inputs of the system architecture elements can be various forms of data or signals, which are determined according to the design and requirements of the intelligent driving system. For the two sensors of cameras and radars, the input of the camera is visual information, and the input of the radar is radar wave echo data. These input data are very important for the environmental perception and decision-making of the intelligent driving system. Through processing and analysis of these input data, the intelligent driving system can realize the perception of the surrounding environment and the decision-making of the driving behavior.

[0089] Optionally, designing the control architecture of intelligent driving functions is a key step to ensure that the system can effectively implement the automatic driving function. When designing the control architecture of intelligent driving functions, it is necessary to ensure that the cooperation and information transmission between system architecture elements are effective and reliable, while considering the real-time, safety and scalability of the intelligent driving system. The control architecture should be able to comprehensively cover all elements within the functional range, ensuring that the intelligent driving system can stably and efficiently implement the automatic driving function.

[0090] Optionally, it is very important to define the control architecture of intelligent driving functions according to the range of functions, because the design of the control architecture should be able to cover all elements within the functional range to ensure that the intelligent driving system can effectively implement the automatic driving function. Setting up a complete control architecture requires considering the cooperation and interaction between these elements to ensure that the intelligent driving system can stably and efficiently implement the automatic driving function and effectively cope with various driving scenarios and environmental changes.

[0091] Optionally, through the input and output of architecture elements, different functional components can realize the transmission and exchange of data, realize the cooperation and coordination between various components within the intelligent driving system. Sensor data and external environment data provide real-time environmental information for the system, user input provides operation instructions for the intelligent driving system, and state information and control instructions are the output of the intelligent driving system, used to guide the driving and control of the vehicle. By reasonably designing and managing input and output, it can be ensured that the intelligent driving system can efficiently run, implement intelligent driving functions, and improve driving safety and comfort.

[0092] As an optional embodiment, in step S104, determining at least one abnormal control behavior corresponding to at least one control behavior in the control behavior set comprises: applying a keyword to at least one control behavior in the control behavior set to obtain a corresponding abnormal control behavior, wherein the keyword is used to identify problems existing when the control behavior is executed.

[0093] In this embodiment, in the process of determining the abnormal control behavior corresponding to each control behavior in the control behavior set, a keyword can be applied to each control behavior in the control behavior set to obtain the corresponding abnormal control behavior, wherein the keyword can be used to identify problems existing when the control behavior is executed.

[0094] Optionally, for each external output of the intelligent driving master controller, the output can be defined as a control behavior, and then the control behavior list is sorted and organized. The control behavior list is a clear definition and organization of the control instructions or behaviors output by the intelligent driving system, so that the intelligent driving system can accurately and stably implement the required functions.

[0095] Optionally, for each external output of the intelligent driving master controller, such as steering control, acceleration control, brake control, etc., the specific control behavior can be explicitly defined, including the purpose of control, the action performed, the target state, etc. For example, the control behavior of steering control can be defined as "according to the position of the obstacle in front of the vehicle and the lane line information, perform steering action to keep the vehicle in the safe driving lane". By sorting out the various outputs of the intelligent driving master controller, each output is defined as a control behavior, and a list is formed. This list should include all the control behaviors involved, sorted by function or priority, to ensure that each control behavior is clearly defined and described. In the process of forming the control behavior list, the correlation and influence between each control behavior can be analyzed to ensure the coordination and consistency between each control behavior. For example, there may be interaction between steering control and acceleration control, which needs to be coordinated and synchronized. By listing and organizing the control behaviors of the intelligent driving system, the intelligent driving system development team can better understand the functional requirements and implementation logic of the intelligent driving system, improving the maintainability and reliability of the intelligent driving system. At the same time, the control behavior list can also be used as the basis for testing and verification of the intelligent driving system, to verify whether the intelligent driving system performs the control behavior as expected, thereby ensuring the safety and stability of the intelligent driving system.

[0096] Optionally, after applying the keywords to each control behavior, the unsafe control behavior is obtained, and then linking the unsafe control behavior with the hazard behavior is very important to help identify potential risks and safety problems in the intelligent driving system.

[0097] Optionally, for each unsafe control behavior, it needs to be linked with the possible hazard behavior to analyze its potential safety risks and consequences. For example, providing steering control instructions too late may cause the vehicle to deviate from the lane, increasing the risk of collision with other vehicles. By linking and analyzing the unsafe control behavior and the hazard behavior, the intelligent driving system designer can better identify and handle potential safety problems and take appropriate measures to reduce the likelihood of risk occurrence.

[0098] As an optional embodiment, the keywords include at least one of a first keyword, a second keyword, a third keyword, a fourth keyword, a fifth keyword, and a sixth keyword, wherein the first keyword is used to represent that the control action is not performed in a case where the control action is required to be performed, the second keyword is used to represent that the time of performing the control action exceeds a time range threshold, the third keyword is used to represent that the degree of performing the control action exceeds a degree range threshold, the fourth keyword is used to represent that the direction of performing the control action is abnormal, the fifth keyword is used to represent that the time of ending the control action is earlier than a target time, and / or the time length of performing the control action exceeds a time length threshold, and the sixth keyword is used to represent that the control action is performed in a case where the control action is not required to be performed.

[0099] In this embodiment, the keywords can include at least one of the first keyword, the second keyword, the third keyword, the fourth keyword, the fifth keyword, and the sixth keyword. The first keyword can be used to represent that the control action is not performed in a case where the control action is required to be performed, i.e., the control action is not provided when it should be provided. The second keyword can be used to represent that the time of performing the control action exceeds the time range threshold, i.e., the control action is provided too early or too late. The third keyword can be used to represent that the degree of performing the control action exceeds the degree range threshold, i.e., the control action is provided too much or too little. The fourth keyword can be used to represent that the direction of performing the control action is abnormal, i.e., the direction of providing the control action is opposite. The fifth keyword can be used to represent that the time of ending the control action is earlier than the target time, and / or the time length of performing the control action exceeds the time length threshold, i.e., the control action is provided too early or the control action is performed for too long. The sixth keyword can be used to represent that the control action is performed in a case where the control action is not required to be performed, i.e., the control action is provided unexpectedly.

[0100] It should be noted that the keywords described above are only for illustration and are not specifically limited herein.

[0101] Optionally, if the provision is not provided, it may lead to the intelligent driving system failing to make critical control decisions in a timely manner, thus causing safety hazards. For example, failure to provide brake control instructions in an emergency situation may result in an unavoidable collision. Providing too early or too late, the timing of the provision of control instructions may result in the intelligent driving system reacting too late or action delay, affecting driving safety. For example, providing steering control instructions too late may cause the vehicle to deviate from the lane. Providing too much or too little, excessive or insufficient control instructions may cause the vehicle to travel unstably or out of control. For example, excessive provision of acceleration control instructions may cause the vehicle to lose control and accelerate. Providing in the opposite direction, providing reverse control instructions may cause the vehicle to travel in the wrong direction, increasing the risk of traffic accidents. Providing too early or applying for too long, if the provided brake control instructions are too early or have a long duration, it may cause the vehicle to fail to stop in time and cause a collision accident. Unexpected provision, unexpected control instructions may cause the intelligent driving system to behave abnormally, increasing the risk of vehicle out of control.

[0102] As an optional embodiment, the linking result is a linking relationship table, wherein, in step S106, the relationship between the control element set, the output information set, the control behavior set, the abnormal control behavior and the abnormal behavior result is linked to obtain the linking result, including: detecting at least one output information in the output information set and at least one control behavior in the control behavior set to obtain a detection result, wherein the detection result is used to indicate whether the output information can affect the corresponding control behavior; based on the control element set, the output information set, the control behavior set, the abnormal control behavior, the abnormal behavior result and the detection result, a linking relationship table is obtained.

[0103] In this embodiment, in the process of linking the relationship between the control element set, the output information set, the control behavior set, the abnormal control behavior and the abnormal behavior result, the output information in the output information set and the control behavior in the control behavior set can be detected to obtain a detection result. If the detection result is that the output information can affect the corresponding control behavior, the above-mentioned various sets and the detection result can be linked to obtain a linking relationship table, wherein the linking result can be a linking relationship table. The detection result can be used to indicate whether the output information can affect the control result.

[0104] Optionally, starting from the architecture element, it is judged whether each item of output affects each item of control behavior, and then through the linking relationship from the architecture element to the control behavior, to the unsafe control behavior, and finally to the harmful behavior, it can help to identify potential risks and safety problems in the intelligent driving system.

[0105] Optionally, the output of each architecture element of the intelligent driving system is analyzed to determine whether the output has an impact on each control behavior. For example, whether the information output by the sensor will affect the decision component to generate a corresponding control instruction. After determining the impact of the output of the architecture element on the control behavior, it is further analyzed whether there is an unsafe control behavior. For example, if the information output by the sensor is incorrect, it can cause the intelligent driving master controller to provide incorrect steering instructions. The unsafe control behavior can be linked to the possible dangerous behavior to explicitly indicate the potential risks and hazards that can be caused by the unsafe control behavior. For example, the intelligent driving master controller providing incorrect steering instructions can cause the intelligent driving system to lose lateral control function in the active state, increasing the risk of collision with other vehicles.

[0106] In the embodiments of the present disclosure, through the above analysis process, the possible safety hazards and risks in the intelligent driving system can be comprehensively understood, and targeted improvement and optimization can be performed to improve the safety and reliability of the intelligent driving system. The above method of linking relationship analysis helps the safety evaluation and risk management of the intelligent driving system, and ensures that the intelligent driving system can safely and reliably operate in various situations.

[0107] As an optional embodiment, in step S108, based on the linking result, a function defect result set corresponding to the control element set is determined, including: obtaining type information of at least one control element in the control element set in the linking result; based on the type information, determining a defect analysis dimension corresponding to the at least one control element, and corresponding defect analysis information under the defect analysis dimension; determining a corresponding function defect information set and a trigger condition set under the defect analysis information; and linking the relationship between the function defect information set and the trigger condition set to obtain the function defect result set.

[0108] In this embodiment, in the process of determining the function defect result set corresponding to the control element set based on the linking result, the type information of each control element in the control element set in the linking result can be obtained. Based on the type information, the defect analysis dimension corresponding to the control element and the defect analysis information under the defect analysis dimension can be determined. The corresponding function defect information set and trigger condition set under the defect analysis information can be determined. The relationship between the function defect information set and the trigger condition set is linked to obtain the function defect result set, wherein the function defect information set can be a potential function deficiency. The trigger condition set can be a trigger condition. The type information can be the type of different control elements, such as sensor type, algorithm type, etc. It should be noted that the above type information is only for illustration and is not limited herein. The type information can be determined according to the actual control element.

[0109] Optionally, starting from each architecture element, analyzing potential functional deficiencies and triggering conditions in a deductive manner can help identify possible defects and risks in the design of the intelligent driving system, so that appropriate measures can be taken to improve the safety and reliability of the intelligent driving system.

[0110] Optionally, for each architecture element in the intelligent driving system, such as sensors, perception components, decision components, etc., the functions of each architecture element are analyzed respectively, considering possible functional deficiencies and potential risks. Starting from the output of each architecture element, consider the possible missing functions or deficiencies in the intelligent driving system through deductive reasoning. For example, if the data output by a sensor is unstable or has errors, it may cause the perception component to fail to accurately identify obstacles, resulting in decision errors of the intelligent driving system. Analyze the possible functional deficiencies of each architecture element, such as data accuracy, real-time performance, fault tolerance, etc., and the conditions or situations that trigger these functional deficiencies. For example, when a sensor is disturbed or blocked, it may cause inaccurate data, and the triggering condition can be severe weather or environmental conditions. By analyzing potential functional deficiencies and triggering conditions, identify risk points in the intelligent driving system, and propose corresponding improvement suggestions and measures to reduce the likelihood of risks. For example, consider adding sensor redundancy, improving data processing algorithms, or strengthening the fault tolerance of the intelligent driving system.

[0111] In the embodiments of the present disclosure, by starting from each architecture element and analyzing potential functional deficiencies and triggering conditions in a deductive manner, the design and implementation of the intelligent driving system can be comprehensively reviewed, potential risks and safety hazards can be identified, and prevention and improvement can be made in advance, thereby improving the safety and reliability of the intelligent driving system. The above analysis method helps intelligent driving system designers and developers to fully understand the potential problems of the intelligent driving system and take timely measures to improve it, ensuring that the intelligent driving system can operate safely and reliably under various conditions.

[0112] As an optional embodiment, the defect analysis dimension includes a first defect analysis dimension and a second defect analysis dimension, the first defect analysis dimension is a defect analysis dimension common to control elements, and the second defect analysis dimension is a defect analysis dimension unique to different control elements. Based on the type information, the defect analysis dimension corresponding to at least one control element and the defect analysis information corresponding to the defect analysis dimension are determined, including: in response to the type information being a sensor type, determining that the first defect analysis dimension includes at least one of the following: installation position of the control element, vibration condition of the control element, temperature condition of the control element, and aging degree of the control element; in response to the type information being an algorithm type, determining that the first defect analysis dimension includes at least one of the following: model robustness of the control element and model generalization of the control element.

[0113] In this embodiment, in the process of determining the defect analysis dimension corresponding to the control element and the defect analysis information therein based on the type information, if the type information is a sensor type, it can be determined that the first defect analysis dimension can at least include the safe position, vibration condition, temperature condition and aging degree of the control element. If the type information is an algorithm type, it can be determined that the first defect analysis dimension can at least include the model robustness and model generalization of the control element. The defect analysis dimension can include the first defect analysis dimension and the second defect analysis dimension. The first defect analysis dimension can be a defect analysis dimension common to the control element. The second defect analysis dimension can be a defect analysis dimension unique to different control elements, i.e., an analysis dimension of a special characteristic.

[0114] Optionally, for sensor class analysis, analysis can be performed according to two different dimensions, including a common analysis dimension and a sensor-specific characteristic analysis dimension.

[0115] Optionally, the common analysis dimension under the sensor class can include: installation position, internal and external parameter calibration, vibration, temperature influence, aging / corrosion and electromagnetic interference. The installation position plays an important role in the performance and function of the sensor, and different installation positions can affect the observation range, sensitivity and accuracy of the sensor. The calibration of internal and external parameters is crucial to the accuracy and stability of the sensor output data, and needs to be calibrated and calibrated regularly. The vehicle may be affected by vibration during operation, and the performance and stability of the sensor in a vibrating environment need to be considered. Temperature changes can affect the performance and accuracy of the sensor, especially in extreme temperature conditions, the sensor may fail. The sensor may be subject to aging or corrosion over time, affecting the performance of the sensor, which needs to be checked and maintained regularly. Electromagnetic interference can cause interference or distortion of the sensor output data, and appropriate shielding measures need to be taken to ensure normal operation of the sensor.

[0116] It should be noted that the above common analysis dimension is only for illustration and is not specifically limited herein.

[0117] Optionally, the analysis dimension of the sensor-specific characteristic can include: light conditions, color contrast or light-dark contrast. For example, for cameras and other sensors, color contrast, light-dark contrast, strong light conditions, weak light conditions and other characteristics can be analyzed. For example, strong light conditions can cause image overexposure, and weak light conditions can cause increased image noise. For radar sensors, the detection distance, angle resolution, speed measurement accuracy and other characteristics can be analyzed to understand the performance of the radar in different environmental conditions. For lidar, the ranging accuracy, angle resolution, scanning speed and other characteristics can be analyzed, and the reflection characteristics of various terrains and objects are also considered.

[0118] It should be noted that the analysis dimensions of the above-mentioned sensor-specific characteristics are only for illustration and are not specifically limited here.

[0119] In the embodiments of the present disclosure, through the above method, the importance and influencing factors of sensors in intelligent driving systems can be comprehensively understood, which helps to consider various potential influencing factors when designing and deploying sensor systems, thereby improving the performance, stability and safety of intelligent driving systems. For different types of sensors, more detailed analysis and consideration can be made according to sensor-specific characteristics to ensure that the intelligent driving system can work normally in various scenarios.

[0120] Optionally, for algorithm analysis, the analysis can also be performed according to two different dimensions, including a general analysis dimension and an algorithm-specific characteristic analysis dimension.

[0121] Optionally, the general analysis dimension of the algorithm can include model robustness, systematic errors in the labeling process, insufficient training data sets, model generalization, vehicle motion posture, communication bandwidth and computing load, etc. The robustness of the algorithm model refers to the stability and adaptability of the algorithm model to noise, interference and abnormal conditions, and the robustness of the algorithm in different environments needs to be considered. The labeling data set may have systematic errors, such as inaccurate labeling or missing labels, which will affect the training and performance of the algorithm. The quality and quantity of the training data set are crucial to the performance of the algorithm, and insufficient training data may cause the model to overfit or underfit. The generalization ability of the algorithm model refers to the performance of the algorithm model on unseen data, and the generalization performance of the algorithm model needs to be considered. The motion of the vehicle in different postures may affect the perception and decision-making of the algorithm, and the influence of the vehicle motion posture on the algorithm needs to be considered. Algorithms in real-time scenarios require a large amount of data transmission and processing, and the limitation of communication bandwidth may affect the performance and real-time performance of the algorithm. The computational complexity and load of the algorithm have an important influence on the real-time performance and efficiency of the system, and the limitation of computing resources needs to be considered.

[0122] It should be noted that the analysis dimensions of the above-mentioned algorithm general characteristics are only for illustration and are not specifically limited here.

[0123] Optionally, the analysis dimensions of algorithm-specific characteristics can include visual perception, radar perception, lidar perception, etc. For visual perception algorithms, analysis can be performed from characteristics such as floating objects, weather, unconventional vehicles, unconventional pedestrians, unconventional lane lines, construction areas, etc. These characteristics can affect the accuracy and stability of visual perception algorithms. For radar perception algorithms, the ability to identify different materials, shapes, and stray signals, as well as the performance of radar in different environments, can be analyzed. For lidar perception algorithms, characteristics such as complex terrain and obstacle detection can be analyzed to understand the perception capabilities of lidar in different scenarios.

[0124] It should be noted that the above analysis dimensions of algorithm-specific characteristics are only for illustration and are not specifically limited here.

[0125] In the embodiments of the present disclosure, the importance and influencing factors of algorithms in intelligent driving systems can be fully considered by the above method, which helps to consider various potential influencing factors when designing and deploying algorithm systems, and improves the performance, stability and safety of intelligent driving systems. According to different types of algorithms, more detailed analysis and consideration can be made for their specific characteristics to ensure that the intelligent driving system can work normally in various scenarios. The above analysis method helps intelligent driving system designers and developers to identify potential problems in the system and take timely measures to improve it, ensuring that the intelligent driving system can operate safely and reliably in various situations.

[0126] As an optional embodiment, the types of trigger conditions in the trigger condition set at least include one of the following: a control element exists a disturbance condition, an environment where the vehicle is located exists a disturbance condition, a vehicle control exists a disturbance condition, and a target object in the vehicle exists a misuse condition.

[0127] In this embodiment, the types of trigger conditions in the trigger condition set can include control element exists a disturbance condition, vehicle environment exists a disturbance condition, vehicle control exists a disturbance condition, and target object in the vehicle exists a misuse condition. Among them, the control element exists a disturbance condition can be a sensor disturbance. The vehicle environment exists a disturbance condition can be a traffic disturbance. The vehicle control exists a disturbance condition can be a vehicle control disturbance. The target object in the vehicle exists a misuse condition can be a person misuse. It should be noted that the above types of trigger conditions are only for illustration and are not specifically limited here.

[0128] Optionally, analyzing potential functional deficiencies and trigger conditions is a very important step in the safety analysis of intelligent driving systems. Trigger conditions can be specific situations or events that cause functional deficiencies or safety problems of intelligent driving systems, which helps to identify potential risks and safety hazards in intelligent driving systems.

[0129] Optionally, the types of trigger conditions can include sensor disturbances, traffic disturbances, vehicle control disturbances, and human misuse, etc. Sensor disturbances can include sensor data anomalies, sensor failures, sensor errors, etc., which can cause the intelligent driving system to have decreased or failed perception capabilities. Traffic disturbances can include sudden changes in road traffic conditions, abnormal behaviors of other vehicles or pedestrians, etc., which can affect the decision-making and planning of the intelligent driving system. Vehicle control disturbances can include vehicle control system failures, control command errors, actuator failures, etc., which can cause the vehicle to lose control or fail to operate normally. Human misuse can include driver misoperation, system operator parameter configuration errors, etc., which can affect the normal operation and safety of the intelligent driving system.

[0130] Optionally, each trigger condition can be analyzed in detail to understand the possible causes and impact levels. The trigger conditions are associated with system functional deficiencies or safety problems, and the specific functional deficiencies or hazardous behaviors that can be caused by each trigger condition are analyzed. The intelligent driving system can be risk assessed and prioritized according to the importance and impact level of the trigger conditions to determine which trigger conditions need to be focused on and handled. Based on the analysis results, appropriate measures and preventive measures are developed to reduce the likelihood of trigger conditions occurring and ensure that the intelligent driving system can safely and reliably operate in the face of various situations.

[0131] In the embodiments of the present disclosure, through the analysis of trigger conditions, the designers and developers of intelligent driving systems can identify potential risks and safety hazards in intelligent driving systems and conduct targeted risk management and safety improvement. Based on the analysis of potential functional deficiencies and trigger conditions, the safety of the intelligent driving system can be comprehensively evaluated, and appropriate measures can be taken to ensure the safe and reliable operation of the intelligent driving system. The above analysis method helps to improve the safety and reliability of the intelligent driving system and ensure the normal operation of the intelligent driving system.

[0132] As an optional embodiment, before determining the expected functional safety requirements of the vehicle control system based on the linking results and the functional defect result set, the method further includes: linking the relationship between the linking results and the functional defect results to obtain target linking results; determining abnormal behavior results from the target linking results, and the association attributes between the defect information set and the trigger condition set, wherein the association attributes are used to represent the association degree between the abnormal behavior results and the defect information set and the trigger condition set.

[0133] In this embodiment, between determining the expected functional safety requirements of the vehicle control system based on the linking results and the functional defect result set, the relationship between the linking results and the functional defect results can be linked to obtain target linking results. The abnormal behavior results can be determined from the target linking results, and the association attributes between the defect information set and the trigger condition set, wherein the association attributes are used to represent the high degree of association between the abnormal behavior results and the defect information set and the trigger condition set, and can be used to represent the correlation between the functional deficiencies and the trigger conditions and the hazardous behaviors.

[0134] Optionally, the architecture elements are associated with the functional deficiencies and the trigger conditions to determine the correlation between them and the hazardous behaviors. This can help better understand the potential problems existing in the intelligent driving system and determine which functional deficiencies or trigger conditions may cause specific hazardous behaviors to occur.

[0135] Optionally, each functional deficiency and trigger condition is matched with a hazardous behavior. The corresponding association can be quickly found according to the previously established links. Each match can be evaluated to determine the degree of correlation. The above evaluation can be based on the likelihood and severity of affecting the occurrence of hazardous behaviors. Functional deficiencies or trigger conditions with high correlation may directly cause the occurrence of hazardous behaviors, or increase the likelihood and severity of hazardous behaviors. In this case, these problems can be focused on and measures can be considered to address or mitigate the impact. Functional deficiencies or trigger conditions with medium correlation may have some impact on the occurrence of hazardous behaviors, but not as significant as those with high correlation. In this case, improvements can be considered in future designs to improve the safety and reliability of the intelligent driving system. Functional deficiencies or trigger conditions with low correlation may only have a small impact on hazardous behaviors, or may not directly cause the occurrence of hazardous behaviors. In this case, these problems can be used as alternatives for improvement and left for further optimization later.

[0136] In the embodiments of the present disclosure, by evaluating and sorting the correlation between functional deficiencies, trigger conditions and hazardous behaviors, the potential problems existing in the intelligent driving system can be better understood, and the settings can be improved in a targeted manner to improve the safety and reliability of the intelligent driving system.

[0137] As an optional embodiment, in step S110, determining the expected functional safety requirements of the vehicle control system based on the linking results and the functional defect result set comprises: determining the expected functional safety requirements based on the target linking results and the association attributes.

[0138] In this embodiment, the expected functional safety requirements can be determined based on the target linking results and the association attributes.

[0139] Optionally, it is very important to propose expected functional safety requirements for functional deficiencies, trigger conditions and harmful behaviors. Functional safety requirements refer to the safety performance requirements that intelligent driving systems must meet to ensure that intelligent driving systems can still provide safe and reliable functions in the event of a failure or abnormal situation.

[0140] In the embodiments of the present disclosure, if it is necessary to determine the expected functional safety requirements of the vehicle control system, the set of control elements and the set of output information in the vehicle control system can be determined, and the corresponding set of control behaviors can be sorted out. Each control behavior in the set of control behaviors is analyzed to determine the risks implied therein, and the corresponding abnormal control behavior is obtained. The abnormal behavior result caused in the vehicle by the abnormal control behavior can be determined. The relationship between the control element set, the output information set, the control behavior set, the abnormal control behavior and the abnormal behavior result is linked to obtain the corresponding linking result. The functional defects of each control element in the control element set are analyzed from the linking result to obtain a functional defect result set. According to the functional defect result set and the linking result, the expected functional safety requirements of the vehicle control system can be proposed. In this embodiment, through the above method, the harmful behaviors of the whole vehicle can be traced back from each control element in the vehicle control system, thereby forming a perfect and unified requirement analysis. Further, the technical effect of effectively determining the expected functional safety requirements of the vehicle control system is realized, and the technical problem of being unable to effectively determine the expected functional safety requirements of the vehicle control system is solved.

[0141] The technical solutions of the embodiments of the present disclosure will be described below in conjunction with preferred embodiments.

[0142] At present, intelligent driving, as an innovative technology, brings the vehicle industry into a new era, not only providing a more convenient transportation mode, but also improving traffic safety and efficiency. However, due to the limitations of current scientific and technological level, intelligent driving systems still have some potential risks and challenges.

[0143] Optionally, the intelligent driving system may be affected by the performance limitations of the equipment. If the hardware equipment of the intelligent driving system is not advanced enough or is unstable, it may cause the intelligent driving system to run unstably or fail, thereby increasing the risk of traffic accidents. The algorithm of the intelligent driving system may also have defects. If the algorithm design of the intelligent driving system is unreasonable or has vulnerabilities, it may cause the intelligent driving system to make wrong judgments, thereby causing traffic accidents. In addition, the intelligent driving system is also susceptible to interference from the running environment factors. For example, adverse weather conditions, complex road conditions, etc. may affect the normal operation of the system and increase the risk of accidents. Human misuse is also a potential risk factor. Some drivers may over-rely on the capabilities of the intelligent driving system or use the intelligent driving system incorrectly, thereby causing accidents.

[0144] Therefore, in the process of popularizing and applying intelligent driving technology, attention must be paid to the safety and stability of intelligent driving systems, and the research and optimization of hardware devices and algorithms must be strengthened to ensure that intelligent driving systems can operate stably and reliably. At the same time, it is also necessary to strengthen the training and education of drivers and guide them to use intelligent driving systems correctly to avoid risks caused by human misuse. Only in this way can intelligent driving technology truly play its advantages and bring greater impetus to the development of the vehicle industry. Intelligent driving systems rely on various sensors, processors, and communication devices and other hardware devices to achieve automatic driving functions. If the performance of these devices is limited, it may affect the accuracy and stability of intelligent driving systems. For example, if the resolution of a laser radar sensor is not high enough, it may not be able to accurately identify obstacles on the road, leading to errors in the judgment of intelligent driving systems.

[0145] Optionally, the activities and requirements of each stage in the life cycle of the autonomous driving system refer to the different stages that the autonomous driving system needs to go through and the specific activities that need to be carried out and the requirements that need to be met in each stage during the development, deployment, and operation of the autonomous driving system. The above stages and activities are to ensure that the autonomous driving system can operate safely and reliably, meet user needs and regulatory requirements.

[0146] Optionally, in the requirement analysis stage, the user's needs and expectations can be clearly defined, and the functions and performance requirements of the intelligent driving system can be determined. The activities in this stage include communication with users, requirement collection and analysis, determination of functional requirements and performance indicators of the intelligent driving system. In the design stage, the overall architecture of the intelligent driving system and the design of each component can be designed according to the results of the requirement analysis. The activities in this stage include system architecture design, component design, algorithm design, etc. In the development and testing stage, the software and hardware of the intelligent driving system can be actually developed and tested. The activities in this stage include coding, integration testing, system testing, performance testing, etc. In the deployment and operation stage, the intelligent driving system will be deployed to actual vehicles and start running. The activities in this stage include system deployment, user training, operation monitoring, etc.

[0147] In the activities of each stage, there are corresponding activity requirements, including but not limited to requirement documents, design documents, test plans, verification reports, etc. The above requirements files record the design ideas, implementation methods, test results, etc. of the intelligent driving system in each stage, which helps to ensure that the intelligent driving system can meet user needs and quality standards throughout its life cycle.

[0148] In summary, understanding the activities and requirements of each stage in the life cycle of an autonomous driving system helps the autonomous driving system to clearly define the process and requirements of autonomous driving system development, ensuring the safety, reliability, and performance of the autonomous driving system meet the requirements of users and regulations.

[0149] Optionally, to improve the safety of intelligent driving, the International Organization for Standardization Working Group (ISO / TC22 / SC32 / WG8) launched the research work of ISO 21448 in February 2016. After 6 years of development, the first edition of the expected functional safety standard was released in June 2022. ISO 21448 gives the activities and requirements of each stage in the life cycle of an autonomous driving system. In China, to improve the importance of enterprises on the development of expected functional safety, the Ministry of Industry and Information Technology "Guidelines for Access Management of Intelligent Connected Vehicle Production Enterprises and Products (Trial)" and "Road Traffic Safety Law (Revised Draft)" etc. all make clear requirements for SOTIF, and include expected functional safety in vehicle access assessment items.

[0150] Optionally, although international standards and domestic laws and regulations attach great importance to and require expected functional safety, in the specific implementation process, there is a lack of clear and quantitative analysis, design, testing, and evaluation methods and indicators, leading to a lack of unified path for the implementation and landing of the standard. Especially in the aspect of SOTIF demand analysis, due to the lack of unified and perfect methods, there are certain challenges in the completeness and accuracy of demand analysis. The lack of clear and quantitative SOTIF analysis, design, testing, and evaluation methods and indicators may bring the following difficulties and challenges to enterprises and related institutions when implementing intelligent driving technology: 1) The lack of consistency in the methods used by different enterprises and institutions in SOTIF analysis, design, testing, and evaluation due to the lack of clear and quantitative methods and indicators, making it difficult to compare and verify the results; 2) The lack of clear and quantitative indicators and methods may result in the incompleteness and inaccuracy of SOTIF demand analysis, leading to potential risks and vulnerabilities in the design and implementation of the system; 3) In the absence of clear SOTIF analysis, design, testing, and evaluation methods and indicators, it may be difficult to ensure the safety and reliability of intelligent driving systems to meet the requirements of regulations and users, increasing the risk of problems in intelligent driving systems.

[0151] The embodiment of the present disclosure proposes a method for analyzing expected functional safety requirements, which has systematicity, completeness and rationality, and is used to ensure that the automatic driving system meets the expected functional safety requirements during the design and development process. By deductive analysis of expected functional safety function deficiency and trigger condition, the functions of the automatic driving system are analyzed to identify possible functional deficiencies or trigger condition deficiencies in the automatic driving system. Functional deficiency refers to the function that the automatic driving system cannot meet the user's expectations or design requirements, and trigger condition deficiency refers to the condition that the automatic driving system cannot correctly respond to certain specific trigger conditions. Through deductive analysis of these problems, the potential risks and problems existing in the automatic driving system can be determined. The analysis from the architecture elements to the vehicle-level hazard behavior analyzes the architecture elements of the automatic driving system and traces back to the hazard behavior that may be caused at the vehicle level. This process helps to determine the correlation between the elements in the automatic driving system and the hazard behavior that may be caused. This helps to identify potential risk points in the design of the automatic driving system and ensures that the automatic driving system does not cause hazard behavior during normal operation. By linking the functional deficiency and trigger condition with the hazard behavior through the architecture elements, the previously identified functional deficiency and trigger condition deficiency are associated and linked with the hazard behavior that may be caused. This helps to determine the key problems and risk points in the design of the automatic driving system and lays the foundation for proposing expected functional safety requirements. By connecting these elements, potential problems in the automatic driving system can be more clearly identified, and corresponding solutions can be proposed.

[0152] Through the above method, the systematicity, completeness and rationality of the expected functional safety requirement analysis can be ensured. This helps to identify potential safety risks early in the design and development process of the automatic driving system and propose corresponding preventive measures and improvement schemes, thereby ensuring the functional safety and reliability of the automatic driving system. The application of this method helps to improve the safety level of the automatic driving system and protect the safety of users and road traffic, thereby achieving the technical effect of effectively determining the expected functional safety requirements in the vehicle control system and solving the technical problem of being unable to effectively determine the expected functional safety requirements in the vehicle control system.

[0153] The embodiment of the present disclosure is further introduced as follows.

[0154] In the embodiment of the present disclosure, three analysis methods are proposed to solve the problems of expected functional safety design for intelligent driving systems.

[0155] Optionally, the method of analyzing functional safety deficiencies and trigger conditions is expected to identify potential functional deficiencies and trigger condition deficiencies in intelligent driving systems through deductive analysis. By analyzing and deducing the functions and trigger conditions of intelligent driving systems, it can help to determine the possible functional defects or error responses of intelligent driving systems in specific situations. This helps to identify potential problems in advance and avoid functional defects in intelligent driving system design that may cause safety risks.

[0156] Optionally, the analysis method from architecture elements to vehicle hazard behavior is to analyze the relationship between the architecture elements of the system, trace how these elements are related to each other, and identify potential risk points that may lead to vehicle hazard behavior. By deeply understanding the overall architecture of the system and the interaction between elements, it can help to identify key issues and potential risks in system design, so as to prevent potential hazard behavior in advance.

[0157] Optionally, the method of linking functional deficiencies and trigger conditions to hazard behavior through architecture elements and proposing expected functional safety requirements is to connect and associate the previously identified functional deficiencies and trigger condition deficiencies with the potential hazard behavior that may be triggered, and propose corresponding expected functional safety requirements. Through linkage analysis, potential problems in the system can be identified and corresponding solutions can be proposed to ensure that the system can operate safely in various situations. This helps to improve the safety and reliability of the system and ensures that safety factors are fully considered in the design and implementation process.

[0158] In the embodiments of the present disclosure, through the application of the above three analysis methods, the functions and architecture of intelligent driving systems can be better understood, and potential safety problems and risks can be identified, so as to improve the safety and reliability of intelligent driving systems and ensure that intelligent driving systems can operate safely in various situations. The comprehensive application of these methods helps to improve the safety level of intelligent driving systems and ensure the safety of users and road traffic.

[0159] In this embodiment, Figure 2 is a flowchart of an expected functional safety requirement analysis method according to an embodiment of the present disclosure, as shown in Figure 2, the method can include the following steps:

[0160] Step S201, design the control architecture of the intelligent driving system, and sort out the element list and output list of the control architecture.

[0161] In this embodiment, the control architecture of the intelligent driving function is designed. The contents include at least: system architecture elements; system architecture element inputs; system architecture element outputs.

[0162] Optionally, the control architecture should be defined according to the scope of functions, all elements within the scope of functions should be included, including vehicle internal elements, vehicle external elements, intelligent driving controller internal elements, etc.

[0163] For example, Table 1 is an example list of intelligent driving function system architecture elements in an embodiment of the present disclosure, as shown in Table 1, which lists an example list of elements of the intelligent driving function system architecture, including sensors, perception components, decision components, planning components, control components, and human-computer interaction components, etc. The sensors can include: front main view camera (sensor-01), front narrow view camera (sensor-02), panoramic view camera (sensor-03), rear view camera (sensor-04), the above camera sensors are used to obtain visual information of the environment around the vehicle, including the scene in front, side and rear. Laser radar (sensor-05), millimeter wave radar (sensor-06), the above radar sensors are used to measure the distance and shape information of the environment around the vehicle, which can provide more accurate obstacle detection and tracking. The perception components can include: front visual perception component (HAD-01), all-visual perception component (HAD-02), Lidar perception component (HAD-03), the above perception components are responsible for processing the data obtained by the sensors, perceiving and identifying the environment around the vehicle, and providing real-time environmental perception information. Map positioning component (HAD-04) is used for positioning of the vehicle and processing of map data, which helps the vehicle to accurately locate and navigate. Multi-sensor fusion component (HAD-05) processes the data fused by different sensors to improve the accuracy and robustness of environmental perception. Prediction component (HAD-06) predicts the behavior of other vehicles, pedestrians, etc. according to environmental perception information and historical data, and provides reference for decision-making.

[0164] For example, as shown in Table 1, a decision component, a planning component, and a control component can also be included. The decision component (HAD-07) makes specific driving decisions such as acceleration, deceleration, steering, etc. according to the information provided by the perception component and the prediction component. The planning component (HAD-08) plans the driving path of the vehicle according to the driving instructions generated by the decision component to ensure that the vehicle can safely and efficiently drive. The control component (HAD-09) is responsible for converting the path generated by the planning component into actual control instructions to control the steering, acceleration, braking, etc. of the vehicle. Control actuators such as steering actuators (control-01), drive actuators (control-02), braking actuators (control-03), and parking actuators (control-04) can also be included. The above actuators are responsible for executing the control instructions generated by the control component to realize the automatic control function of the vehicle. A human-machine interaction component (Human-Machine Interface, HMI) (HMI-01) can also be included, which is used to interact with the driver, display system status to the driver, provide warning information, and accept driver input, etc.

[0165] The above architecture elements constitute the key components of the intelligent driving function system, and the cooperation and interaction between the architecture elements can realize the automatic driving function of the vehicle and improve the safety, comfort and efficiency of driving. Through detailed analysis of the above architecture elements, the working principle and function implementation of the intelligent driving system can be better understood.

[0166] Table 1: Example list of intelligent driving function system architecture elements

[0167] For example, the input and output of the architecture elements are used to clarify the interaction relationship between the architecture elements, and the output of the architecture elements is shown in Table 2. Table 2 is an example list of intelligent driving function system architecture element outputs according to the embodiment of the present disclosure. As shown in Table 2, in the intelligent driving function system architecture, the output of the architecture element plays a crucial role in the normal operation and decision-making of the system. The output information of the architecture element is the key data of the intelligent driving system, through which the intelligent driving system can perceive and understand the environment around the vehicle in real time, identify obstacles, traffic signs and lines, etc. to provide accurate input for the decision component and the planning component, helping the intelligent driving system to make safe and efficient driving decisions. These output information is crucial for the correct operation of the intelligent driving system and the safety of driving.

[0168] Table 2: Example list of intelligent driving function system architecture element outputs

[0169] In step S202, the control behavior is sorted out, the keywords are applied to obtain unsafe control behavior, and the unsafe control behavior is linked with the dangerous behavior.

[0170] In this embodiment, for each external output of the intelligent driving master controller, each external output can be defined as a control action, and the control action list is sorted out. For each control action, by applying keywords, unsafe control actions are obtained. The selected keywords are: should be provided but not provided, provided too early or too late, provided too much or too little, provided in the opposite direction, provided too early or applied for too long, provided unexpectedly. For each unsafe control action, link with the hazard behavior.

[0171] For example, Table 3 is an example list of unsafe control actions obtained by the embodiment of the present disclosure. As shown in Table 3, by linking the unsafe control actions with the hazard behaviors, the specific hazards that each unsafe control action may cause can be clearly pointed out. For example, when the intelligent driving master controller provides a steering instruction, if the steering instruction provided is in the opposite direction, it may cause the intelligent driving system to provide an opposite steering torque, thereby causing the hazard behavior of the intelligent driving system to lose the lateral control function in the intelligent driving function activated state. Through the analysis of unsafe control actions and potential hazards, the intelligent driving system designers and developers can identify potential safety risks and take appropriate measures to reduce the probability of these risks occurring, thereby improving the safety and reliability of the intelligent driving system. This analysis method helps to comprehensively evaluate and improve the intelligent driving system.

[0172] Table 3 Unsafe Control Action Example List

[0173] Step S203, triggered from the architecture element, for each output, determine whether it affects each control action, and obtain the link relationship table of architecture element, element output, control action, unsafe control action, and hazard behavior.

[0174] In this embodiment, starting from the architecture element, for each output, determine whether it affects each control action. The link relationship from the architecture element to the control action, to the unsafe control action, and to the hazard behavior.

[0175] For example, Table 4 is an example list of intelligent driving function system architecture element outputs according to an embodiment of the present disclosure. As shown in Table 4, an example list of intelligent driving function system architecture element outputs is shown, as well as their linkages with control behaviors, unsafe control behaviors, and hazardous behaviors. The numbers and names of different architecture elements are listed, as well as their output contents, such as the video stream output by the front main camera, the obstacle output by the front vision perception component, etc. The numbers and descriptions of control behaviors are listed, as well as the judgment of whether the output of the architecture element will affect the control behavior. For example, the video stream output by the architecture element front main camera has an impact on the control behavior "intelligent driving master controller provides steering instruction". Specific unsafe control behaviors and possible hazardous behaviors are shown. For example, for the control behavior "intelligent driving master controller provides steering instruction", if the intelligent driving master controller does not send a steering instruction to the actuator, the hazardous behavior of loss of lateral control function in the intelligent driving function active state may occur.

[0176] Through this way of display and analysis, the correlation between the architecture element output, the control behavior, the unsafe control behavior, and the hazardous behavior can be clearly understood. This helps system designers and developers to identify potential risks and safety problems in the system, take timely measures for improvement and optimization, and improve the safety and reliability of the system. The above analysis method is helpful for safety evaluation and risk management of the system, to ensure that the intelligent driving system can safely and reliably operate in various situations.

[0177] Table 4: Example list of intelligent driving function system architecture element outputs

[0178] Step S204: Starting from the architecture elements, the potential functional deficiencies and triggering conditions are analyzed in a deductive manner.

[0179] In this embodiment, starting from each architecture element, the potential functional deficiencies and triggering conditions are analyzed in a deductive manner.

[0180] Optionally, for sensors, there are two analysis dimensions, one of which is a general analysis dimension including installation position, internal and external parameter calibration, vibration, temperature influence, aging / corrosion, electromagnetic interference, etc. The other is a sensor-specific property analysis dimension, for example, a camera can be analyzed from the dimensions of weak color contrast or light and dark contrast, strong light conditions, weak light conditions, etc.

[0181] Optionally, for the algorithm class, there are also two analysis dimensions, among which the common analysis dimensions include: model robustness, labeling process systematic error, training data set insufficiency, model generalization, vehicle motion posture, communication bandwidth, and computing load, etc. The other is the analysis dimension of algorithm-specific characteristics, such as visual perception, which can be analyzed from the dimensions of floating objects, weather, unconventional vehicles, unconventional pedestrians, unconventional lane lines, construction areas, etc.

[0182] Optionally, the potential functional deficiencies can also be analyzed first, or the trigger conditions can also be analyzed first. Among them, the types of trigger conditions include: sensor disturbance, traffic disturbance, vehicle control disturbance, and personnel misuse, etc.

[0183] For example, Table 5 is a potential functional deficiency and trigger condition analysis example list according to an embodiment of the present disclosure. As shown in Table 5, potential functional deficiency and trigger condition analysis examples of two architecture elements are given, which are sensor-01 and HAD-01 respectively. For sensor-01 (front main-view camera), its potential functional deficiency description includes installation position, internal and external parameter calibration, vibration, temperature influence, aging / corrosion, and electromagnetic interference, etc. Specifically, its specific characteristic is that the color contrast or light and dark contrast is weak, which leads to the inability to correctly identify the target object under strong light or weak light conditions. The trigger conditions include strong light conditions (such as strong sunlight in the afternoon, and the opposite vehicle turning on high beam) and weak light conditions, etc. For HAD-01 (front visual perception component), its potential functional deficiency description includes model robustness, labeling process systematic error, training data set insufficiency, model generalization, vehicle motion posture, communication bandwidth, and computing load, etc. Its specific characteristic is the inability to correctly recognize floating objects (such as fallen leaves, paper, garbage bags, etc.), weather influence (such as rain, snow, fog, and high-density dust, etc.), and unconventional target objects (such as unconventional vehicles, unconventional pedestrians, unconventional lane lines, and construction areas, etc.). The trigger conditions include floating objects blocking the sensor surface, weather influence leading to target pixel blur, and unconventional target objects appearing in the field of view.

[0184] In summary, detailed analysis of potential functional deficiencies and trigger conditions of architecture elements can help identify problems and propose solutions to ensure the stability and reliability of the system.

[0185] Table 5 Potential functional deficiency and trigger condition analysis example list

[0186] Step S205, link each item of functional deficiency and trigger condition with the hazardous behavior through the architecture element, and make judgment and arrangement.

[0187] In this embodiment, the link between the architecture element and the hazardous behavior has been formed in step S203, and the link between the architecture element and the potential functional deficiency and trigger condition has been formed in step S204. Therefore, each functional deficiency and trigger condition can be linked to the hazardous behavior through the architecture element, and then judged and sorted, mainly to judge the relevance of the functional deficiency and trigger condition to the hazardous behavior, which is divided into three levels of high / medium / low.

[0188] For example, Table 6 is an example list of relevance analysis between potential functional deficiencies and trigger conditions and hazardous behaviors according to an embodiment of the present disclosure. As shown in Table 6, an example of relevance analysis between potential functional deficiencies and trigger conditions and hazardous behaviors is listed.

[0189] For another example, as shown in Table 6, taking sensor-01 and HAD-01 as an example, sensor-01 is a front-facing camera, the potential functional deficiency is described as the performance deficiency of color contrast and brightness contrast of the front-facing camera, and the trigger condition is described as the target object having weak color contrast or light-dark contrast, for example, white lane lines in strong light, green vehicles in green forest background, black clothing pedestrians in front of black vehicles, etc. The relevance analysis shows that in the activated state of the intelligent driving function, it may cause the loss of lateral control function, the system provides unintended steering torque, provides too large / too small steering torque, provides reverse steering torque, the loss of longitudinal control function, the system provides unintended excessive deceleration, provides too small / loss of deceleration, etc. Hazardous behaviors. Among them, the abnormal provision degree of steering torque and the loss degree of longitudinal control function are evaluated as high risk. HAD-01 is a front vision perception component, the potential functional deficiency is described as the vision perception component being unable to correctly recognize, and the trigger condition is described as the items shielding the sensor surface causing the vision sensor to have incomplete consecutive frames. The relevance analysis shows that in the activated state of the intelligent driving function, it may cause the loss of lateral control function, the system provides unintended steering torque, provides too large / too small steering torque, provides reverse steering torque, the loss of longitudinal control function, the system provides unintended excessive deceleration, provides too small / loss of deceleration, etc. Hazardous behaviors. Among them, the abnormal provision degree of steering torque and the loss degree of longitudinal control function are evaluated as high risk.

[0190] By comprehensively analyzing the examples in Table 6, it can be concluded that there is a certain correlation between potential functional deficiencies and trigger conditions and hazardous behaviors. By analyzing these correlations, potential safety problems can be better identified and solved, thereby improving the safety and reliability of intelligent driving systems.

[0191] Table 6: Example list of relevance analysis between potential functional deficiencies and trigger conditions and hazardous behaviors

[0192] Step S206, according to the functional deficiency, trigger condition, harmful behavior, the expected functional safety requirement is proposed.

[0193] In this embodiment, according to the result analyzed in step S205, the expected functional safety requirement is proposed for the functional deficiency, trigger condition, and harmful behavior.

[0194] For example, Table 7 is an example list of expected functional safety requirement analysis according to an embodiment of the present disclosure, as shown in Table 7, if the potential functional deficiency, trigger condition, harmful behavior, relevance analysis and expected functional safety requirement of the front main view camera for the architecture element are described in detail. Potential functional deficiency description: the color contrast and brightness contrast performance of the front main view camera is insufficient, which may cause the camera to fail to accurately identify the target object in the case of the target object having weak color contrast or light and dark contrast, such as white lane lines in strong light, green vehicles in green forest background, etc. Trigger condition description: the trigger condition is that the target object has weak color contrast or light and dark contrast in the intelligent driving function activated state, for example, white lane lines in strong light, green vehicles in green forest background, etc. These conditions may cause the system to lose, provide unexpected steering torque or provide excessive steering torque in the lateral control function. Harmful behavior description: according to the trigger condition, it may cause the loss of lateral control function, the system to provide unexpected steering torque or provide excessive steering torque in the intelligent driving function activated state, which may affect the handling and safety of the vehicle.

[0195] As shown in Table 7, through relevance analysis, the relevance between potential functional deficiency, trigger condition and harmful behavior is evaluated, and the risk level of different harmful behaviors is determined from low to high. According to the analysis of potential functional deficiency and trigger condition, the expected functional safety requirement is proposed, that is, the sensor should avoid reducing the sensing accuracy for target objects, lane lines, road edges, etc. with weak color contrast or light and dark contrast, in order to avoid causing harmful behaviors such as loss of lateral control function, system to provide unexpected steering torque or provide excessive steering torque.

[0196] By analyzing the content in Table 7, it can be seen that the detailed analysis of the functional deficiency, trigger condition and harmful behavior of the system architecture element is to identify potential problems and risks, and to propose corresponding functional safety requirements to ensure the safety and reliability of the intelligent driving system. Such analysis helps designers to understand the potential risks that may exist in the system, and to take timely measures to improve and optimize.

[0197] Table 7: Example list of expected functional safety requirement analysis

[0198] In the embodiment of the present disclosure, if it is necessary to determine the expected functional safety requirement of the vehicle control system, the set of control elements and the set of output information in the vehicle control system can be determined, and the corresponding set of control behaviors can be sorted out. Each control behavior in the set of control behaviors is analyzed to determine the risk implied therein, and the corresponding abnormal control behavior is obtained. The abnormal behavior result caused in the vehicle by the abnormal control behavior can be determined. The relationship between the above-mentioned set of control elements, set of output information, set of control behaviors, abnormal control behavior and abnormal behavior result is linked to obtain the corresponding linking result. The functional defects of each control element in the set of control elements are analyzed from the linking result to obtain the set of functional defect results. According to the set of functional defect results and the linking result, the expected functional safety requirement of the vehicle control system can be proposed. In this embodiment, through the above-mentioned method, the hazard behavior of the whole vehicle can be traced back from each control element in the vehicle control system, thereby forming a perfect and unified requirement analysis. Further, the technical effect that the expected functional safety requirement of the vehicle control system can be effectively determined is realized, and the technical problem that the expected functional safety requirement of the vehicle control system cannot be effectively determined is solved.

[0199] According to the embodiment of the present disclosure, a determination device for expected functional safety requirement of vehicle control system is also provided. It should be noted that the determination device for expected functional safety requirement of vehicle control system can be used to execute the determination method for expected functional safety requirement of vehicle control system in the above-mentioned embodiments.

[0200] FIG. 3 is a schematic diagram of a determination device for expected functional safety requirement of vehicle control system according to an embodiment of the present disclosure. As shown in FIG. 3, the determination device 300 for expected functional safety requirement of vehicle control system can include an acquisition component 302, a first determination component 304, a linking component 306, a second determination component 308 and a third determination component 310.

[0201] The acquisition component 302 is configured to acquire a set of control elements of a vehicle control system of a vehicle, and a set of output information and a set of control behaviors corresponding to the set of control elements, wherein the set of control elements includes at least one control element, the set of output information includes at least one output information, the output information is obtained by controlling the control element, and the set of control behaviors includes at least one control behavior, the control behavior is used to represent the behavior of controlling the control element to execute.

[0202] The first determining component 304 is configured to determine at least one abnormal control behavior corresponding to at least one control behavior in the control behavior set, and determine at least one abnormal behavior result associated with the at least one abnormal control behavior, wherein the abnormal behavior result is used to represent an abnormal influence on the vehicle caused by the execution of the abnormal control behavior.

[0203] The linking component 306 is configured to link the relationships among the control element set, the output information set, the control behavior set, the abnormal control behavior and the abnormal behavior result, to obtain a linking result.

[0204] The second determining component 308 is configured to determine a function defect result set corresponding to the control element set based on the linking result, wherein the function defect result set includes at least one function defect result, and the function defect result is used to represent a function defect existing in a control element corresponding to the control element set.

[0205] The third determining component 310 is configured to determine an expected function safety requirement of the vehicle control system based on the linking result and the function defect result set, wherein the expected function safety requirement is used to represent a strategy to be executed to overcome the function defect.

[0206] Optionally, the obtaining component 302 can include a first obtaining component configured to obtain input information of at least one control element in the control element set, wherein the input information is a system architecture element input of the vehicle control system; a fourth determining component configured to determine output information corresponding to the at least one control element based on the input information and the corresponding control element, wherein the output information is a system architecture element output of the vehicle control system; and a fifth determining component configured to obtain the output information set based on the output information corresponding to at least one control element in the control element set.

[0207] Optionally, the first determining component 304 can include an applying component configured to apply a keyword to at least one control behavior in the control behavior set to obtain the corresponding abnormal control behavior, wherein the keyword is used to identify a problem existing in the execution of the control behavior.

[0208] Optionally, the linking component 306 can include a detecting component configured to detect at least one output information in the output information set and at least one control behavior in the control behavior set to obtain a detection result, wherein the detection result is used to represent whether the output information can affect the corresponding control behavior; and a sixth determining component configured to obtain a linking relationship table based on the control element set, the output information set, the control behavior set, the abnormal control behavior, the abnormal behavior result and the detection result.

[0209] Optionally, the second determining component 308 can comprise a second obtaining component configured to obtain type information of at least one control element in the control element set in the linking result; a seventh determining component configured to determine, based on the type information, a defect analysis dimension corresponding to the at least one control element and defect analysis information corresponding to the defect analysis dimension; and an eighth determining component configured to determine a set of functional defect information and a set of trigger conditions corresponding to the defect analysis information; and a linking component configured to link a relationship between the set of functional defect information and the set of trigger conditions to obtain a set of functional defect results.

[0210] Optionally, the seventh determining component can comprise a first determining sub-component configured to, in response to the type information being of a sensor type, determine that the first defect analysis dimension comprises at least one of an installation position of the control element, a vibration condition of the control element, a temperature condition of the control element, and an aging degree of the control element; and a second determining sub-component configured to, in response to the type information being of an algorithm type, determine that the first defect analysis dimension comprises at least one of a model robustness of the control element and a model generalization of the control element.

[0211] Optionally, the apparatus can further comprise a first linking component configured to link a relationship between the linking result and the set of functional defect results to obtain a target linking result; and a seventh determining component configured to determine, from the target linking result, an abnormal behavior result and an association attribute between the set of defect information and the set of trigger conditions, wherein the association attribute is used to represent an association degree between the abnormal behavior result and the set of defect information and the set of trigger conditions.

[0212] Optionally, the third determining component 310 can comprise a ninth determining component configured to determine, based on the target linking result and the association attribute, an expected functional safety requirement.

[0213] In the embodiments of the present disclosure, the obtaining component 302 obtains a control element set of a vehicle control system of a vehicle, and an output information set and a control behavior set corresponding to the control element set; the first determining component 304 determines at least one abnormal control behavior corresponding to at least one control behavior in the control behavior set, and determines at least one abnormal behavior result associated with the at least one abnormal control behavior; the linking component 306 links relationships between the control element set, the output information set, the control behavior set, the abnormal control behavior, and the abnormal behavior result to obtain a linking result; the second determining component 308 determines, based on the linking result, a set of functional defect results corresponding to the control element set; and the third determining component 310 determines, based on the linking result and the set of functional defect results, an expected functional safety requirement of the vehicle control system, thereby solving the technical problem that the expected functional safety requirement in the vehicle control system cannot be effectively determined, and achieving the technical effect that the expected functional safety requirement in the vehicle control system can be effectively determined.

[0214] According to the embodiment of the present disclosure, a computer readable storage medium is also provided, which includes a stored program. The program performs the method for determining the expected functional safety requirement in the vehicle control system in the above embodiment.

[0215] According to the embodiment of the present disclosure, a processor is also provided, which is used to run a program. The program performs the method for determining the expected functional safety requirement in the vehicle control system in the above embodiment when running.

[0216] The embodiment of the present disclosure also provides a computer program product. Optionally, in the embodiment, the computer program product can include a computer program. The computer program, when executed by a processor, implements the method for determining the expected functional safety requirement in the vehicle control system in the above embodiment of the present disclosure.

[0217] According to the embodiment of the present disclosure, a vehicle is also provided, which is used to perform the method for determining the expected functional safety requirement in the vehicle control system in the embodiment of the present disclosure.

[0218] In the above embodiments of the present disclosure, the description of each embodiment has its own focus, and the parts not described in detail in an embodiment can be referred to the related description of other embodiments.

[0219] In the several embodiments provided by the present disclosure, it should be understood that the disclosed technology can be implemented in other ways. Of course, the embodiment described above is only illustrative. For example, the division of components is only a logical function division. There can be another division manner in actual implementation, for example, a plurality of components or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the components shown or discussed can be indirect coupling or communication connection through some interfaces, components or components, which can be electrical or other forms.

[0220] The components described as separate components can or can not be physically separate, and the components shown as components can or can not be physical components, that is, they can be located in one place or distributed on multiple components. Part or all of the components can be selected according to actual needs to achieve the purpose of the embodiment.

[0221] In addition, each functional component in each embodiment of the present disclosure can be integrated into a processing component, or each component can exist physically, or two or more components can be integrated into one component. The above integrated component can be realized in the form of hardware or in the form of software functional component.

[0222] The integrated component, if implemented in the form of a software function component and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present disclosure, essentially or in other words, the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present disclosure. The aforementioned storage medium includes: a U disk, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and various other media that can store program codes.

[0223] The above only describes the preferred embodiments of the present disclosure, and it should be noted that, for those skilled in the art, without departing from the principles of the present disclosure, several improvements and refinements can be made, and these improvements and refinements should also be considered as the protection scope of the present disclosure. Industrial applicability

[0224] The scheme provided by the embodiments of the present disclosure can be applied to a vehicle control system. If it is necessary to determine the expected functional safety requirement of the vehicle control system, the control element set and the output information set in the vehicle control system can be determined, and the corresponding control behavior set can be sorted out. Each control behavior in the control behavior set can be analyzed to determine the risk implied therein, and the corresponding abnormal control behavior can be obtained. The abnormal behavior result caused in the vehicle by the abnormal control behavior can be determined. The relationship between the control element set, the output information set, the control behavior set, the abnormal control behavior and the abnormal behavior result is linked to obtain the corresponding linking result. The functional defects of each control element in the control element set can be analyzed from the linking result to obtain a functional defect result set. According to the functional defect result set and the linking result, the expected functional safety requirement of the vehicle control system can be proposed. In this embodiment, through the above method, the hazard behavior of the whole vehicle can be traced back from each control element in the vehicle control system, so that a perfect and unified requirement analysis is formed. Further, the technical effect of effectively determining the expected functional safety requirement of the vehicle control system is realized, and the technical problem of being unable to effectively determine the expected functional safety requirement of the vehicle control system is solved.

Claims

1. A method for determining expected functional safety requirements in a vehicle control system, comprising: obtaining a control element set of a vehicle control system of a vehicle, and an output information set and a control action set corresponding to the control element set, wherein the control element set comprises at least one control element, the output information set comprises at least one output information, the output information is obtained by controlling the control element, and the control action set comprises at least one control action, the control action is used to represent an action performed by controlling the control element; determining at least one abnormal control action corresponding to at least one control action in the control action set, and determining at least one abnormal action result associated with the at least one abnormal control action, wherein the abnormal action result is used to represent an abnormal influence on the vehicle caused by performing the abnormal control action; linking a relationship between the control element set, the output information set, the control action set, the abnormal control action and the abnormal action result to obtain a linking result; determining a functional defect result set corresponding to the control element set based on the linking result, wherein the functional defect result set comprises at least one functional defect result, and the functional defect result is used to represent a functional defect existing in a control element corresponding to the control element set; determining expected functional safety requirements of the vehicle control system based on the linking result and the functional defect result set, wherein the expected functional safety requirements are used to represent a strategy to be performed to overcome the functional defect.

2. The method of claim 1, wherein, obtaining the output information set corresponding to the control element set comprises: obtaining input information of at least one control element in the control element set, wherein the input information is a system architecture element input of the vehicle control system; determining the output information corresponding to at least one control element based on the input information and the corresponding control element; obtaining the output information set based on the output information corresponding to at least one control element in the control element set, wherein the output information is a system architecture element output of the vehicle control system.

3. The method of claim 1, wherein, determining at least one abnormal control action corresponding to at least one control action in the control action set comprises: applying a keyword to at least one control action in the control action set to obtain the corresponding abnormal control action, wherein the keyword is used to identify a problem existing when the control action is performed.

4. The method of claim 3, wherein, The keywords include at least one of a first keyword, a second keyword, a third keyword, a fourth keyword, a fifth keyword, and a sixth keyword, wherein the first keyword is used to represent that the control action is not performed in a case where the control action needs to be performed, the second keyword is used to represent that a time of performing the control action exceeds a time range threshold, the third keyword is used to represent that a degree of performing the control action exceeds a degree range threshold, the fourth keyword is used to represent that a direction of performing the control action is abnormal, the fifth keyword is used to represent that a time of ending the control action is earlier than a target time, and / or a time length of performing the control action exceeds a time length threshold, and the sixth keyword is used to represent that the control action is performed in a case where the control action does not need to be performed.

5. The method of claim 4, wherein, The link result is a link relationship table, wherein a relationship between the control element set, the output information set, the control action set, the abnormal control action, and the abnormal behavior result is linked to obtain a link result, including: detecting at least one output information in the output information set and at least one control action in the control action set to obtain a detection result, wherein the detection result is used to represent whether the output information can affect the corresponding control action; obtaining the link relationship table based on the control element set, the output information set, the control action set, the abnormal control action, the abnormal behavior result, and the detection result.

6. The method of claim 1, wherein, Based on the link result, a function defect result set corresponding to the control element set is determined, including: obtaining type information of at least one control element in the control element set in the link result; based on the type information, determining a defect analysis dimension corresponding to at least one control element and defect analysis information corresponding to the defect analysis dimension; determining a corresponding function defect information set and a trigger condition set under the defect analysis information; linking a relationship between the function defect information set and the trigger condition set to obtain the function defect result set.

7. The method of claim 6, wherein, The defect analysis dimension includes a first defect analysis dimension and a second defect analysis dimension, the first defect analysis dimension is a defect analysis dimension common to the control elements, and the second defect analysis dimension is a defect analysis dimension unique to different control elements, wherein based on the type information, determining a defect analysis dimension corresponding to at least one control element and defect analysis information corresponding to the defect analysis dimension, includes: in response to the type information being a sensor type, determining that the first defect analysis dimension includes at least one of a mounting position of the control element, a vibration condition of the control element, a temperature condition of the control element, and an aging degree of the control element; in response to the type information being an algorithm type, determining that the first defect analysis dimension includes at least one of model robustness of the control element and model generalization of the control element.

8. The method of claim 6, wherein, The types of the trigger conditions in the trigger condition set at least include one of the following: the control element has a disturbance condition, the environment where the vehicle is located has a disturbance condition, the vehicle control has a disturbance condition, and a target object in the vehicle has a misuse condition.

9. The method of claim 6, wherein, Before determining the expected functional safety requirement of the vehicle control system based on the linking result and the functional defect result set, the method further comprises: linking the relationship between the linking result and the functional defect result to obtain a target linking result; determining the abnormal behavior result from the target linking result and an association attribute between the defect information set and the trigger condition set, wherein the association attribute is used to represent the association degree between the abnormal behavior result and the defect information set and the trigger condition set.

10. The method of claim 9, wherein, determining the expected functional safety requirement of the vehicle control system based on the linking result and the functional defect result set, comprises: determining the expected functional safety requirement based on the target linking result and the association attribute.

11. A device for determining an expected functional safety requirement in a vehicle control system, comprising: an acquisition component configured to acquire a control element set of a vehicle control system of a vehicle, and an output information set and a control behavior set corresponding to the control element set, wherein the control element set includes at least one control element, the output information set includes at least one output information, the output information is obtained by controlling the control element, and the control behavior set includes at least one control behavior, the control behavior is used to represent a behavior of controlling the control element to execute; a first determination component configured to determine at least one abnormal control behavior corresponding to at least one control behavior in the control behavior set, and determine at least one abnormal behavior result associated with the at least one abnormal control behavior, wherein the abnormal behavior result is used to represent an abnormal influence on the vehicle caused by executing the abnormal control behavior; a linking component configured to link the relationship between the control element set, the output information set, the control behavior set, the abnormal control behavior, and the abnormal behavior result to obtain a linking result; a second determination component configured to determine a functional defect result set corresponding to the control element set based on the linking result, wherein the functional defect result set includes at least one functional defect result, and the functional defect result is used to represent a functional defect existing in the control element corresponding to the control element in the control element set; a third determination component configured to determine an expected functional safety requirement of the vehicle control system based on the linking result and the functional defect result set, wherein the expected functional safety requirement is used to represent a strategy to be executed to overcome the functional defect.

12. A processor for running a program, wherein, The program is executed by the processor to perform the method for determining the expected functional safety requirement in the vehicle control system according to any one of claims 1 to 10.

13. A computer readable storage medium, the computer readable storage medium comprising a stored program, wherein, The program is executed by the processor to perform the method for determining the expected functional safety requirement in the vehicle control system according to any one of claims 1 to 10.

14. An electronic device comprising a memory and a processor, the memory having stored therein a computer program, the processor being arranged to run the computer program to perform the method of determining a required functional safety demand in a vehicle control system according to any one of claims 1 to 10.

15. A computer program product comprising a computer program which, when executed by a processor, implements the method of determining a required functional safety demand in a vehicle control system according to any one of claims 1 to 10.

16. A vehicle configured to perform the method of determining a required functional safety demand in a vehicle control system according to any one of claims 1 to 10.

17. A computer program product, comprising: a non-transitory computer readable storage medium storing a computer program which, when executed by a processor, implements the method of any one of claims 1 to 10.

18. A computer program which, when executed by a processor, implements the method of any one of claims 1 to 10.

Images