CN112883500A

CN112883500A - Intelligent vehicle system early function safety assessment method based on fault injection

Info

Publication number: CN112883500A
Application number: CN202110330537.4A
Authority: CN
Inventors: 赵健; 卜纯研; 朱冰; 王志伟; 杨港; 戴景霜; 冯浩
Original assignee: Jilin University
Current assignee: Jilin University
Priority date: 2021-03-26
Filing date: 2021-03-26
Publication date: 2021-06-01
Anticipated expiration: 2041-03-26
Also published as: CN112883500B

Abstract

The invention discloses an intelligent vehicle system early function safety assessment method based on fault injection, which comprises the following steps: step one, setting; secondly, configuring a vehicle running scene; thirdly, configuring a fault injection test; fourthly, fault injection is carried out; and fifthly, analyzing data. Has the advantages that: the method provided by the invention combines the model-based design with the simulation-based fault injection technology and the virtual vehicle, provides a promising solution for the early functional safety evaluation of the intelligent vehicle system, and more intuitively shows the influence of the component level and the system level fault on the whole vehicle layer through the simulation-based fault injection mode, so that the functional safety target and the attribute value of the system can be more accurately defined, the defects of the traditional safety analysis method are made up, and the method is helpful for assisting engineers in reasonably designing the subsequent safety control strategy and fault-tolerant control algorithm.

Description

Intelligent vehicle system early function safety assessment method based on fault injection

Technical Field

The invention relates to an intelligent vehicle system early function safety assessment method, in particular to an intelligent vehicle system early function safety assessment method based on fault injection.

Background

In recent years, a major trend in the automotive industry is to continuously increase the level of automation of vehicles, and in the long term, to achieve fully automated driving of vehicles. In order to ensure the safety of the autonomous vehicle and promote the benign development of the autonomous automobile industry, the society of automotive engineers (SAE for short) in the united states classifies the autonomous driving technology into six grades of 0, 1, 2, 3, 4 and 5. Wherein 0 belongs to traditional driving, namely manual driving; 1 and 2 belong to assisted driving, i.e. the system provides driving assistance to the driver; 3, the vehicle can realize the automatic driving of most road conditions under the condition of automatic driving; 4. and 5, belonging to an automatic driving system, namely the vehicle can realize unmanned driving.

It can be seen from the automatic driving traffic accidents occurring in recent years by companies such as Uber, Google, tesla, and the like that with the improvement of the automatic driving level, the compensation role of the driver in the safety concept gradually disappears, and a new challenge is presented to the reliability evaluation of the intelligent vehicle system, and fault injection is considered as a potentially powerful technology, can be applied to the safety evaluation of manual and automatic driving systems and the critical condition verification of fault tolerance mechanisms, is recommended by ISO26262 and widely applied to the design stage, and lacks of effective application in the early concept stage.

The method and the device have the advantages that functional safety assessment is carried out on the early concept stage of the intelligent vehicle system, the traditional safety analysis technology is supplemented, the functional safety target of the system is defined more accurately, and the method and the device have important significance for the formulation of the subsequent safety control strategy and the development of the fault-tolerant control algorithm.

Disclosure of Invention

The invention aims to solve the problem that fault injection is not applied to early function safety assessment of the existing intelligent vehicle system, and provides a fault injection-based early function safety assessment method for the intelligent vehicle system.

The invention provides a fault injection-based intelligent vehicle system early function safety evaluation method, which comprises the following steps:

step one, setting: selecting an intelligent vehicle system model to be tested without implementing a safety mechanism as a related item of functional safety concept stage analysis, and specifically comprising the following steps of:

step one, defining related items: defining functions and related items of the selected intelligent vehicle system, and defining the functions and the related item ranges of the system;

step two, building a system nominal model: establishing a nominal model of the system in Matlab/Simulink, wherein the model of the whole system comprises a model representing the functions of the electronic control unit, and is also called a controller model or a control strategy;

secondly, configuring a vehicle running scene: setting an intelligent vehicle operation scene, wherein elements of the operation scene mainly comprise a geographic position, a road condition, a traffic condition, an environmental condition and an operation mode, and setting a vehicle dynamics model and constructing a required operation scene in vehicle dynamics simulation software CarSim, wherein the vehicle dynamics simulation software CarSim mainly comprises the vehicle dynamics model, the road environment model, some predefined sensor models and actuator models, such as an engine, a transmission, a steering system and a braking system model;

step three, configuring a fault injection test: the method comprises the following steps of combining a hazard analysis result of an intelligent vehicle system function safety concept stage and a built system nominal model to configure a fault injection test, wherein the method comprises the following specific steps:

step one, generating a fault list: adopting an analysis method of hazard and maneuverability analysis, referring to HAZOP research-application guide, IEC61882:2001, selecting a proper guide word, combining a set intelligent vehicle operation scene, carrying out hazard analysis on an intelligent vehicle system to obtain a failure form of system functions, and generating a fault list accordingly, wherein the fault list is only used for generating a fault model of a system to be tested according to a repeatable and prearranged fault model, and the characteristics of the fault model comprise type, target position, triggering mode and duration;

step two, building a monitoring model: building a signal monitoring module in the system nominal model according to the fault list information, wherein the signal monitoring module is used for acquiring the operation results of the system nominal model and the injected fault system model;

step four, fault injection: according to the generated fault list and standard fault library information, a fault injection module is built in a system nominal model;

fifthly, data analysis: and operating a system nominal model and a fault model, comparing and analyzing the acquired data, visually seeing the influence of component level and system level faults on the whole vehicle level from a simulation result, and more accurately defining safety targets and related attributes of the safety concept stage of the system function through the dynamic response characteristic of the vehicle, wherein the safety targets and the related attributes comprise fault tolerance time intervals, safety states, safety measurement and the complete safety level of the vehicle.

The invention has the beneficial effects that:

the method provided by the invention combines the model-based design with the simulation-based fault injection technology and the virtual vehicle, provides a promising solution for the early functional safety evaluation of the intelligent vehicle system, and more intuitively shows the influence of the component level and the system level fault on the whole vehicle layer through the simulation-based fault injection mode, so that the functional safety target and the attribute value of the system can be more accurately defined, the defects of the traditional safety analysis method are made up, and the method is helpful for assisting engineers in reasonably designing the subsequent safety control strategy and fault-tolerant control algorithm.

Drawings

Fig. 1 is a schematic diagram of a security assessment method according to the present invention.

FIG. 2 is a schematic diagram of a fault behavior model of the intelligent vehicle lateral control system according to the invention.

FIG. 3 is a diagram illustrating a vertical control architecture according to the present invention.

FIG. 4 is a schematic diagram of a lateral control architecture according to the present invention.

FIG. 5 is a schematic view of a test road model according to the present invention.

Fig. 6 is a schematic view of a reverse fault model of the steering angle according to the present invention.

FIG. 7 is a schematic diagram of steering angle inputs at different failure durations of 80Km/h according to the present invention.

FIG. 8 is a diagram illustrating the lateral deviation of the present invention at different failure durations of 80 Km/h.

FIG. 9 is a schematic view of steering angle inputs at different fault durations of 100Km/h according to the present invention.

FIG. 10 is a schematic diagram of the lateral deviation of the present invention at different fault durations of 100 Km/h.

FIG. 11 is a schematic view of the steering angle input at different failure durations of 120Km/h according to the present invention.

FIG. 12 is a schematic diagram of the lateral deviation of the present invention at different failure durations of 120 Km/h.

Detailed Description

Please refer to fig. 1 to 12:

step one, setting: an intelligent vehicle system model to be tested (without implementing a safety mechanism) is selected as a relevant item of functional safety concept stage analysis, and an intelligent vehicle transverse control system is selected as an example. The method comprises the following specific steps:

step one, defining related items: the intelligent vehicle transverse control system is a part of an automatic driving complete control system structure and mainly comprises a decision-making part and an execution part, wherein the decision-making part mainly refers to a top layer controller, namely a path tracking controller, and the execution part refers to an EPS system. On a highly structured road, a path tracking controller calculates expected corner information according to expected path information sent by an upper layer and vehicle state information and sends the expected corner information to an actuator EPS system, and the EPS system tracks an expected steering wheel corner in a corner control mode, so that the transverse motion control of a vehicle is realized.

Step two, building a system nominal model: as shown in fig. 2, a nominal model of the system is built in Matlab/Simulink, wherein the module (i) is a path planning module, and according to the built road model, expected position, speed, acceleration information, expected abscissa, ordinate, yaw angle, road curvature and road gradient information are sent to a longitudinal control module (ii) and a transverse control module (iii) in real time, wherein a control framework adopted by the longitudinal control module (ii) is as shown in fig. 3, and according to the received expected information and the actual position, speed, acceleration and motor rotation speed information of the vehicle obtained from a vehicle dynamics module (iv), the brake and the accelerator of the vehicle are controlled to track the expected longitudinal position and speed. The lateral control module (c) adopts a control architecture as shown in fig. 4, calculates a desired turning angle according to received desired information and actual abscissa, ordinate, yaw angle, lateral speed, longitudinal speed, and yaw rate information of the vehicle obtained from the vehicle dynamics module (c), and sends the calculated desired turning angle to the torque PID control module (c), and the torque PID control module (c) controls the torque of the EPS system in the vehicle dynamics module (c) according to the desired turning angle information and the actual turning angle information obtained from the vehicle dynamics module (c), thereby tracking the desired lateral position and yaw angle.

Secondly, configuring a vehicle running scene: setting an intelligent vehicle operation scene, wherein the operation scene mainly comprises a geographical position, a road condition, a traffic condition, an environmental condition and an operation mode, setting the intelligent vehicle to automatically run along a highway lane line under the condition of good road and traffic condition as an example, building a test road in Carsim according to a highway design standard specified in the current highway engineering technical standard in China, and planning a reference path running along the lane line as shown in FIG. 5.

TABLE I freeway design Standard

step one, generating a fault list: analysis method using hazard and maneuverability analysis (HAZOP), with reference to HAZOP research-application guide, IEC61882:2001, enumerates the following 5 guide words to perform hazard analysis for lateral control system functions and to consider the driving scenario of an autonomous vehicle driving along a lane on an expressway, as shown in Table two below

TABLE II lateral control system hazard analysis

Generation of fault list information from the results of hazard analysis is shown in Table three below

TABLE III Fault List information

Step two, building a monitoring model: and (2) according to the fault list information, building a signal monitor (shown in fig. 2) in Matlab/Simulink, wherein the signal monitor (collects fault injection time information and hazard event occurrence time information according to the transverse deviation of the vehicle as an observation point.

Step four, fault injection: according to the generated fault list information and the standard fault library information, an automatic fault injection model of the system is built in Matlab/Simulink, and as shown in FIG. 2, the automatic fault injection model mainly comprises a corner fault injection module and a torque fault injection module. Wherein, a steering angle reverse fault form is selected as an example to build an automatic fault injection model shown in fig. 6 in Matlab/Simulink, and a general fault model algorithm thereof is shown in the following table five

Table five steering angle reverse fault model

Fifthly, data analysis: the method comprises the following steps that a nominal model and a fault model of the operation system can more intuitively obtain the influence of the fault of a component layer or a system layer on the whole vehicle layer through vehicle state information reflected in a vehicle dynamics module, and the method comprises the following specific steps:

step one, determining a safety target: the severity (E), exposure probability (S) and controllability (C) are used for carrying out automobile complete safety level Analysis (ASIL) on the caused hazard events to obtain more accurate safety targets (SG) of the system function safety concept stage as shown in the following six tables

TABLE VI safety goals

Wherein the maximum lateral error from the planned path is

Then X in the table above is 0.917.

Step two, determining a safety target attribute value: calculating a proper Fault Tolerance Time Interval (FTTI) value through simulation, selecting a steering angle reverse fault mode as an example, obtaining a simulation result as shown in fig. 7-12, and representing steering angle input and a transverse deviation result obtained through simulation under different vehicle speeds and different fault durations, wherein a solid line in the graph represents the simulation result under a normal working condition, namely under a fault-free working condition, a dotted line represents the simulation result under different fault duration working conditions, and a dotted line represents a safety metric value, and whether a hazard event occurs and when the hazard event occurs are judged according to whether the transverse deviation of a vehicle tracking reference path after the fault occurs is larger than the safety metric value.

Wherein, the Fault Tolerance Time Interval (FTTI) is a key indicator directly affecting the controllability of the vehicle, the FTTI is defined as the time span in which a fault occurs in the system before a hazard event occurs, and table seven represents the Fault Tolerance Time Interval (FTTI) and its associated fault duration obtained from the simulation results in the form of a fault with reversed steering angle.

TABLE VII FTTI time

Wherein, by injecting and simulating all faults in the fault list, the FTTI value of the most severe fault form is selected as the final fault tolerance time interval T value of the safety target SG1, while its associated fault duration describes the time to process the fault in an appropriate manner (transition to safe state).

Claims

1. A fault injection-based intelligent vehicle system early function safety assessment method is characterized by comprising the following steps: the method comprises the following steps: