Avidan Efody, Mentor Graphics Corp. Whose fault is it? Advanced techniques for optimizing ISO 26262 fault analysis Avidan Efody, Mentor Graphics Corp. Todo : slide about power analogy? Slide with some real numbers (i.e. standard error and probability) Slide with “you are here”? FIT -> SPFM/PMHF? Concepts used – maybe at the beginning

Change "footer" to presenter's name and affiliation Motivation ISO 26262 requirements for fault analysis Similar requirements from other standards Requirements from mission-critical domains Data center Networking And many more No end-to-end how to available 2/16/2019 Change "footer" to presenter's name and affiliation

Agenda The problem Solution requirements Proposed solution

The problem : concept Safety concept is developed at high level Presentation Title The problem : concept Safety concept is developed at high level Failure In Time (FIT) budgets per part Technical assumptions on IP (SEooC) Safety mechanisms Clk & power RAM &ROM Shows graphic of complete E/E system from section-5 Actuato\Sensor ? FIT Inputs MCU ? FIT Bus Other logic ? FIT ? FIT ? FIT ? FIT Actuato\Sensor Outputs ? FIT ? FIT Your Initials, Presentation Title, Month Year

The problem : element requirements IP requirements derived from system analysis: Contribution of element to overall FIT<10% <10% of faults are single point/residual Debug logic not used in safety-critical operation Faults in debug logic are safe More…

The problem: typical flow Presentation Title The problem: typical flow Once implementation is in place its FIT must be accurately measured Bridging Transient Logical/ Sequential de-rating Timing de-rating Use case de-rating 45454545 whatisthisslide – elephant in the hole Explain what is required from a fault analysis engine at RTL/Gate – fault models, quick results, optimizations, who can do it (us or partners) Stuck-at D.C Your Initials, Presentation Title, Month Year

The problem: FIT doesn’t fit Presentation Title The problem: FIT doesn’t fit What if FIT doesn’t fit? Iterations are expensive Re-plan, re-design, re-verify Schedule delays Graphics : Poo stuck in the hole Your Initials, Presentation Title, Month Year

Solution requirements Accuracy/cost trade-off Statistical strength Integrated with overall verification Seamless abstraction switch Multi-platform

Proposed solution Statistical sampling of faults Population Sample size Fault points Analysis Traditional method Avoiding reruns Avoiding diff/duplication Multi platform Probabilistic metric

Population = test X cycle X signal? Good enough: But: Rigorous RBV Presentation Title Population = test X cycle X signal? Good enough: Rigorous RBV Interesting states covered Biased to corner cases But: Fault analysis leads to more stimuli requirements Assume fault in given state doesn’t produce any impact, does this mean anything? This is statistical analysis, we’re not covering many faults anyhow Your Initials, Presentation Title, Month Year

Sample size Variance ∝ 1/ 𝑁 Sanity check: ∝ De-rating factor Presentation Title Sample size Variance ∝ 1/ 𝑁 Brute force method Sanity check: ∝ De-rating factor Let some faults -> Failures Final analysis: ∝ required accuracy High level trade-off Analysis cost <> design cost ≈ ∞ Assume fault in given state doesn’t produce any impact, does this mean anything? This is statistical analysis, we’re not covering many faults anyhow Your Initials, Presentation Title, Month Year

Change "footer" to presenter's name and affiliation Fault points 52 48 2/16/2019 Change "footer" to presenter's name and affiliation

Change "footer" to presenter's name and affiliation Fault points Smaller variance -> cheaper analysis Segmentation of population helps 80 70 20 30 Jewish Asian-American 2/16/2019 Change "footer" to presenter's name and affiliation

Fault points Transient faults Makes sense to separate Presentation Title Fault points Transient faults SET – in logic SEU – in memory Makes sense to separate SET de-rating is lot higher Also, cell FIT ratio different FF/Mem FIT rate higher Separate statistics Smaller variance Smaller cost Signals fault probability varies Gate vs. FF vs. Memory Crude approximation: Gate 1, FF 4, Memory ∝ cells Refined approximation FIT per cell from fab Faults per type by weighted avg High level take-away Better correlation -> less analysis Your Initials, Presentation Title, Month Year

Analysis : Traditional flow Presentation Title Analysis : Traditional flow Run reference test Rerun test with fault Diff safety critical How can we optimize that? Slide with fault types from TVS - classification Your Initials, Presentation Title, Month Year

Analysis : Minimize scope Time scope: Fault time -> 0 Design Scope: ∩ between: Fault point fan-out Safety critical fan-in Stimuli Initialize FFs, Mems Scope inputs forced 2 1 2/16/2019 Change "footer" to presenter's name and affiliation

Analysis: Minimize compare RTL simulators already have a way to capture undefined state… Good tool support Attention to X optimism/pessimism (at RTL) 2/16/2019 Change "footer" to presenter's name and affiliation

Change "footer" to presenter's name and affiliation Analysis: decision T=0 T=10 => MPF 2 2 1 T=10 => SPF or RF T=End => USER 2 2 X 1 X 2/16/2019 Change "footer" to presenter's name and affiliation

Analysis : abstraction RTL or structural gate? SET Structural gate to 1st FF RTL from there SEU RTL all the way Requires RTL->GL flop mapping 2/16/2019 Change "footer" to presenter's name and affiliation

Analysis: multi platform Emulation/prototypes can fit in flow if: Results can be reproduced FFs/Memories can be dumped Signals into scope can be logged Combine platforms strengths Emulation/prototyping for long runs Simulation for X injection 2/16/2019 Change "footer" to presenter's name and affiliation

Change "footer" to presenter's name and affiliation PMHF Example, assume no SM Outputs of above: SEU SPF rate +/- SET SPF rate +/- PMHF: (SPF RATE) * (# of FF) * (FF FIT) + … Probability of PMHF < Target Target – PMHF >= 5σ => 0.9999997 Target – PMHF >= 7σ => 0.999999999998 2/16/2019 Change "footer" to presenter's name and affiliation

Change "footer" to presenter's name and affiliation Summary Fault simulation is an interesting challenge There’s more than just diff to it Requires upfront consideration/planning And an end-to-end flow Hopefully this paper will help… 2/16/2019 Change "footer" to presenter's name and affiliation

Change "footer" to presenter's name and affiliation Thanks 2/16/2019 Change "footer" to presenter's name and affiliation