Research On Safety Of The Intended Functionality Of Perception Module For Highway Pilot System

Highway Pilot（HWP）system is a typical L3-level autonomous driving system that integrates functions such as lane keeping,following,changing lanes,overtaking,merging,and diverting,which is beneficial to reduce traffic accidents and traffic congestion,and ensure the safety of drivers.HWP system is one of the current mainstream autonomous driving systems.Due to the high autonomy of HWP system,its ability to perceive complex environmental information and respond to sudden changes in the environment is an important basis for ensuring the safety of autonomous vehicles.China has a vast territory,complex road conditions.These will increase the inadequacy of the autonomous vehicle perception module to adapt to the scene,resulting in potential risks.Therefore,in-depth study of the performance limitations and triggering conditions of the perception module of the HWP system,considering the Safety of the Intended Functionality（SOTIF）,and designing the safety mechanism of the perception module in a targeted manner to prevent the harm caused by the lack of intended functions is an important research direction for SOTIF of autonomous vehicle.It is also the premise and foundation for the HWP system to land and realize large-scale applications.Supported on the National Key R＆D Program of China（2016YFB0100904）,this paper carried out the research on Safety of The Intended Functionality of perception module for HWP system.First,the function definition and scenario definition of the HWP system and its perception module were carried out;Next,the fusion perception algorithm was designed based on the federated Kalman filter;and based on the combination of HAZOP and STPA method and HWP system vehicle-level hazard events,the performance limitations and triggering conditions of each sensor were analyzed,and the intended functionality safety requirements of the perception module were obtained;And then the performance limitation detectors were designed by using dual-state chi-square detection,the fusion perception system was restructured,and the perception model of SOTIF was desigend;Finally,a Matlab/Simulinkand Prescan co-simulation test platform was built to verify the effectiveness,stability and accuracy of the system.The main research contents of this paper include the following four parts:（1）Function definition and algorithm design of HWP system perception moduleFirst,the function of the HWP system was defined,the function,composition and system architecture of the HWP system were clarified,and the operation scenario of the HWP system based on the Operational Design Condition（ODC）was defined.Then the function of the perception module of the HWP system was defined,and the function,composition and system architecture of the perception module was clarified.Finally,according to the system architecture of the perception model,a fusion perception model based on federated Kalman filtering was designed,and local filters and main filter were designed to perform data fusion of radar systems,lidar systems and camera systems.（2）Analysis of SOTIF of HWP system perception moduleBased on the function definition of the HWP system and its perception module,Hazard Analysis and Risk Assessment（HARA）were performed to obtain vehicle-level hazard events and safety goals.Combining HAZOP and STPA analysis method,the STPA control model of HWP system was established.And according to the HAZOP guide word,the unsafe control action of STPA was defined,and the mapping of each step of STPA to the SOTIF hazard generation process was established.And the performance limitations and triggering conditions of radar,lidar and camera were obtained through analysis.（3）Design of the mechanism of HWP system perception module based on SOTIFBased on the performance limitations and trigger conditions of each sensor,the SOTIF requirements of the perception module of the HWP system were obtained.According to the SOTIF requirements,the system architecture of the HWP system perception model was reconstructed.And the intended function safety policy of the perception module was designed,and a method of performance limitation detection and isolation was proposed.The intended function safety model of the perception module was established,and the performance limitation weight coefficient was designed to locate and isolate the sensors with performance limitations,the residual chi-square and state chi-square were analyzed and compared,and a two-state Chi-square detector with a two-state repeater was designed as a performance limitation detector to detect the performance limitation of the sensor.（4）Verification of HWP system perception module SOTIF model testThe Matlab/Simulink-Prescan co-simulation platform was built,and the perception system of radar,lidar and camera were built,and the front-vehicle ranging algorithm based on polynomial regression,the Deep SORT target based on Tracking and Kalman Filtering algorithm for leading vehicle speed detection were designed.The scheme using the Globalement Au Moins Aussi Bon（GAMAB）principle as a test evaluation scheme was proposed.And the characteristic matrix of the sensor in different environments was designed.Based on the characteristic matrix,the test conditions were established to verify the performance limitation of single sensor and multiple sensors.On this basis,the validity and stability of the SOTIF model of HWP system perception module were verified.