EDA Tool Development to Support the Design and. Certification of Fail-Safe Products

Transcription

1 EDA Tool Development to Support the Design and Certification of Fail-Safe Products F.M. Gonçalves, M.B. Santos, I.C. Teixeira and J.P. Teixeira IST / INESC-ID, Rua Alves Redol, 9, Lisboa, Portugal {fernando.goncalves, marcelino.santos, jct}@inesc-id.pt Corresponding author: Fernando Gonçalves Address: INESC-ID Rua Alves Redol, Lisboa Portugal Phone: Fax: fernando.goncalves@inesc-id.pt

2 EDA Tool Development to Support the Design and Certification of Fail-Safe Products F.M. Gonçalves, M.B. Santos, I.C. Teixeira and J.P. Teixeira IST / INESC-ID, Rua Alves Redol, 9, Lisboa, Portugal {fernando.goncalves, marcelino.santos, jct}@inesc-id.pt Abstract New product development for safety-critical products is a challenging process, due to stringent quality and time-to-market requirements. In particular, such products undergo a certification process, prior to product market release. One of the bottlenecks of the design process for these products is the lack of commercially available EDA (Electronic Design Automation) tools, as this is a limited segment market. The purpose of this paper is to introduce a novel fault simulator tool, tfs, developed to support the design and certification process of Gas Burner Control Systems (GBCS), which must be EN298 standard compliant. The new tool performs fault simulation in the presence of single or double faults, either Stuck- At (SA) or bridging (BRI) faults, and performs timing analysis of critical output waveforms under faulty conditions. A new fault classification is introduced to automatically identify a reduced subset of potentially critical faults, which must be analyzed to verify if any unsafe device operation may occur. The new tool can be directly inserted in the design flow using Cadence EDA system. The usefulness and efficiency of the new tool are ascertained in the support of the certification process of a new ASIC implementing a novel fail-safe solution for a GBCS. Simulation results show that no unsafe operation occurs under the EN298 stated conditions. Keywords: Fail-safe, Fault simulation, Multiple faults 1

3 1 Introduction In modern societies, human life is priceless. Consequently, the safe operation of all equipments (electrical, mechanical, etc.) is a major concern. Each country or economic region impose their safety requirements. New products have thus to be evaluated by a recognized Certifying Institution, prior to market release. Such Institution must check whether a new product complies, or not, to the safety standard specific for that type of equipment. This may introduce a heavy burden in product costs and time-to-market. Redundancy is a well-known, and easiest to implement, solution to increase system safety. In microelectronics, this solution has been widely used, in part due to the lack of Electronic Design Automation (EDA) commercial tools oriented to safety-critical product development. However, redundancy increases costs, reducing product competitiveness. Therefore, new solutions have to be introduced, using innovative design techniques. Moreover, the demonstration of fail-safe properties in non fully redundant architectures requires the development of new EDA tools to validate those designs. If these two developments are not performed in parallel, the delay in timeto-market may compromise product profitability. Ideally, any safety technique should be validated analytically. For a self-checking technique [1,2,3,4,5,6,7] this statement applies solely to the validation of single faults. When the technique has to be validated for double faults, it is frequent to rely on the assumption that, after some clock cycles, an invalid state is reached and the checker will detect the corresponding non-codeword [2]. Unfortunately, this solution is not appropriate when the safety requirements specify a maximum delay for fault detection. Gas burner control systems have to comply the EN298 European safety standard [8]. The safety requirements imposed by this standard are really stringent. In particular, safe operation has to be guaranteed in the presence of two simultaneous faults. One of the most appropriate solutions to avoid redundancy is the self-checking technique. But, unfortunately, this technique cannot be validated analytically for double faults, neither there are commercially available software tools (fault simulators) for double faults. 2

4 The purpose of this paper is to present a new fault simulator tool, tfs, specially developed for the validation of a safety-critical Application Specific Integrated Circuit (ASIC) implementing a gas burner control system which complies the EN298 standard. The ASIC design has already been described in [9]. This paper is organized as follows. The next section summarizes the safety requirements imposed by the EN298 standard. The specifications of the fault simulator are presented in Section 3. Section 4 describes the architecture of the new fault simulator. The command line options are detailed in Section 5. The most relevant implementation details are presented in Section 6. Next section is devoted to the presentation of the computational requirements (operating system, time, memory and disk). Section 8 describes the main blocks of the ASIC used to ascertain the usefulness and efficiency of the new tool. The results obtained by the new fault simulator are presented in Section 9. Finally, Section 10 summarizes the main conclusions. 2 Safety Requirements Automatic Gas Burner Control Systems (GBCS) marketed in the European Union have to be EN298 [8] standard compliant. This standard defines that the system is fail-safe whenever the presence of a first fault leads to one of the following situations: 1. The system disables all critical outputs 1 in less than 3 s; 2. The system remains operational (Fault Tolerant). In this case, a second fault must be inserted. The system must remain operational or deassert the critical outputs in less than 3 s. The ASIC designed to implement the GBCS controls the main system functions. Hence, the safety requirements for the ASIC must also conform the above mentioned situations. The internal failure modes for complex devices (such as ASICs) are not clearly stated in EN298. Therefore, the classical single line Stuck-At (SA) fault model for digital circuits was used as a first approach. However, realistic faults, like Bridging (BRI) and open faults, may trigger unsafe operation. Hence, more accurate fault models 1 Critical outputs are defined as the system outputs whose logic values may cause harm caused by system operation. In the case of gas burner control systems, system outputs controlling the gas valve are considered as critical. 3

5 need to be used, and are one of the reasons for the new fault simulator development. At present, BRI fault models are implemented in tfs. 3 Specifications of the Fault Simulator The fault simulation specifications to validate EN298 compliance differ from the classical in the following two aspects: 1. Simulation in the presence of two simultaneous faults, either SAs or BRIs. 2. Only the critical outputs have to be monitored. Moreover, only dangerous situations (unintentionally critical output activation for more than 3 s) are relevant. As a consequence, the observation of the timing responses, in the presence of one or two faults is required. The classical fault simulation results (the Fault Coverage (FC), and a list of detected/undetected faults) are not suitable for the present validation purposes. Fault Coverage is relevant, in order to demonstrate that the selected test pattern is able to activate a different system behavior between the faulty and the fault-free device. However, FC serves as a test quality indicator, not a safe-operation indicator. In fact, for instance, a given fault can be detected (be in charge of observable output differences) due to the deassertion of a critical output (nondangerous behavior), but it can also be detected if it asserts a critical signal, which should be deasserted in normal operation (dangerous behavior). Hence, a new fault classification concept has to be introduced to distinguish between these two opposite situations. The following fault classification, composed by three fault classes, is proposed and has been used: Tolerant: the fault free circuit and the faulty circuit present identical simulation results. Safe: the critical output is enabled later than expected, and/or the critical output is shut off earlier than in the fault-free circuit. Potentially Critical: the critical output is enabled earlier than expected, and/or the critical output is shut off later than in the fault-free circuit. 4

6 The Tolerant and Safe fault classes do not require any further analysis. The presence of tolerant faults may trigger test pattern refinement, in the unlikely case in which not all the tolerant faults are redundant 2. On the contrary, the Potentially Critical faults should be carefully analyzed. 4 Architecture of the Fault Simulator A software tool, tfs, which copes the specifications stated in the previous section has been developed. At present, a serial fault simulation technique is being used [10]. The tool performs faults injection in a Verilog structural description, at logic level, and uses the Verilog TM logic simulator from Cadence as kernel simulator. The fault simulation results allow fault classification, accordingly to the above mentioned classes. The architecture of the developed fault simulator is presented in Figure 1. The Fault Activator process reads a gate-level structural description of the circuit in Verilog format, and a list of cells whose behavior should be modified in order to activate a fault. A modified Verilog file is generated after the activation of a fault. Following the generation of each modified Verilog file, the Verilog TM logic simulator from Cadence is invoked. This simulator reads 3 files: the modified Verilog description, a Verilog file containing the test patterns, and a cell library. The cell library file includes the behaviors of all cells instantiated in the Verilog description. For normal operation, these behaviors are fault-free ones. However, the simulation of SA faults is based on the modification of the instances, whose faulty behavior is also defined in this cell library. On the contrary, the BRI fault activation is not based on behavioral modifications of the cells. Hence, no particular data needs to be included in the cell library to simulate this kind of faults. The Fault Classifier process performs the classification task presented in the previous section by comparing the results of a fault-free simulation (previously saved in a file and loaded into memory at startup), with the results of the present fault simulation. Additionally to a comparison of the critical outputs status, a timing 2 In the case study, the use of self-checking techniques makes the majority of tolerant faults redundant in respect to the critical outputs under monitoring. 5

7 analysis is also performed. This analysis intends to identify the extent of the dangerous situations, violating the EN298 safety requirement of unintentional critical output activation for more than 3 s. 5 Fault Simulator Options The available options for the tfs fault simulator are: -b performs bridging (BRI) fault simulation, instead of the default Stuck-At (SA) fault simulation. -c counts the number of faults, without performing the fault simulation. This option is useful to determine the size of the fault list, eventually requiring a sampling process to drive the fault simulation to a manageable computer effort. -d performs double fault simulation, instead of the default single fault simulation. -l <save file> when the simulator is interrupted, by pressing Ctr-C, a file is automatically saved with the current simulation status. To later restart the simulation, this option must be used, and the <save file> name must be supplied. -n <fault file> this option is used for the validation of double faults, using item 2. of the safety requirements (see section 2). The <fault file> should be obtained by a previous single fault simulation. All faults classified as Tolerant will be resimulated by adding another fault. -r <sample> simulates a sample of the whole fault set. 6

8 Fault classification results Fault-free simulation Fault simulation results Cell library Test patterns Verilog file (structural) Faulty cells Fault Activator Modified Verilog File Verilog Simulator Fault Classifier Figure 1: Architecture of the tfs fault simulator. 6 Implementation Details The implementation of the Fault Activator process is far more complex than the implementation of the other processes. Hence, this section is mainly devoted to the implementation details of that process. In order, to achieve a better performance, the original Verilog file is read only at startup. The circuit description is loaded into appropriate data structures. The other input file required by the Fault Activator process, the Faulty cells file, is also read once at startup. 7

9 According to the command line options chosen by the user (see section 5), the Fault Activator process injects a new fault (or a pair of faults) each time it is invoked. For each cycle, a modified structural description (in Verilog format) is generated, the Verilog TM simulator is invoked and the Fault Classifier process is applied to obtain fault simulation results. A flowchart of the tfs fault simulator is presented in Figure 2. The blocks within the dashed area correspond to external functionalities, provided by the Cadence Verilog TM simulator. According to the fault classification presented in section 3, the identification of Safe and Potentially Critical faults requires a timing analysis. The Fault Classifier process performs this task. Therefore, the results of the fault-free and the faulty simulations have to include timing information. The major differences between the simulation of SA and BRI faults occur in the Fault Activator process. Thus, each type of fault model has a dedicated subsection for its specific implementation details. 6.1 Stuck-At Fault Model The SA faults activation is controlled by the contents of the Faulty cells file (see Figure 1). Each line of this file contains a cellname followed by a list of possible faulty cellnames. During the Fault Activator scanning through the instances list, when any cellname matches an instance in the Verilog file, that cellname is replaced by one of the faulty cellnames. Then, the fault simulation and fault classification are performed for this fault. In the next simulation cycle, the cellname is replaced by the next faulty cellname. This process is repeated until the list of faulty cellnames reaches the last entry in the line. The syntax for each line of the Faulty cells file is as follows: cellname: faultycellname1 faultycellname2 In theory, each cell can have an unlimited number of possible faulty behaviors. The major drawbacks of a large number of faults per cell is a huge computation time. Additionally, there is a prerequisite that all faultycellname behaviors have to be previously inserted in the cell library to be used by the Cadence simulator. Hence, using the proposed technique, the fault activation is restricted to cells included in the Faulty cells file and, for those cells, the type of faults are restricted to the built-in faulty behaviors. 8

10 Cadence Verilog Simulator Begin Read cell library Read Verilog file Read modified Verilog file Read faulty cells file Read test patterns file Read fault-free simulation file Simulate End No More faults to activate? Write simulation results Yes Read simulation results Activate new fault Perform fault classification Write modified Verilog file Write fault classification results Figure 2: Flowchart of the tfs fault simulator. This technique presents a major advantage over a hardcoded implementation of the SA fault model. In fact, it allows the activation of any fault that can be modeled locally by the replacement of a fault-free cell by a new defective cell. Moreover, this approach can be extended to handle the concept of macro cells, which enables the simulation of larger circuits. The concept of macro cell can be easily implemented without modifying the fault simulator source code. The macro cell behavior and the faulty behaviors of the macro cell have to be added to the cell library. A new line should also be included in the Faulty cells file, and the modifications are concluded. Macro cells may justify the mixed-level fault simulation, due to the drastic simulation effort reduction. 9

11 6.2 Bridging Fault Model When the BRI fault model is selected, the Faulty cells file is only used to identify the cells for which the fault activation will be performed. During the scan through the list of instances, whenever an instance cell matches any cellname of the Faulty cells file, the output node of this instance will be shorted to the output node of another instance. Hard bridgings (zero resistance) are assumed. The same procedure is used to choose this second instance, except that the list of instances is searched from the point where the first instance was found. This procedure reduces the number of faults, by avoiding the activation of redundant BRIs (a BRI between nodes A and B is activated only once, instead of a A-B BRI and a B-A BRI). The bridging fault model is a key point. An accurate modeling using, for instance, the voting, or the bias voting fault models [11,12], can be applied only when the transistors sizes are known. However, this information is not available in the majority of the cases. Hence, each BRI is modeled by the four possible situations: I. Node A dominates node B II. Node B dominates node A III. The resulting node is A wired-and B IV. The resulting node is A wired-or B Together, these situations model the impact of any possible bridging defect on the behavior of a digital circuit. The increased number of faults (four bridging faults per short between two nodes) is the disadvantage of this solution. To implement situations I. and II., every reference to the dominated node in the Verilog file is replaced by the dominator node. Situations, III. and IV. are applied to the Verilog file by inserting an AND gate or an OR gate, respectively. The inputs of the logical gate are the nodes A and B, and their output is connected to a new node. This node merges all branches earlier driven by nodes A and B. The application of this fault model to the simulation of mixed structural descriptions (macro cells and basic gates) is straightforward. The inclusion of the macro cells names in the Faulty cells file is the required modification. 10

12 7 Analysis of the Computational Resources for Fault Simulation Typically the major concern for fault simulation is the computational time. For the new fault simulator, tfs, this is no exception. The computational time value is highly dependent on the circuit complexity, on the fault model (SA or BRI) and on the type of fault simulation (single faults or double faults). Table 1 presents the computational effort as a function of the number of cells, n. Compared to the global computational time, the initialization of the data structures (read data from files) can be neglected. SA fault model BRI fault model Single faults 2n 2n(n-1) Double faults 2n(n-1) 2n 2 (n-1) 2-4n(n-1) Table 1: Time complexity dependence on the number of cells, n, for the simulation of SA and BRI faults (single and double fault simulations). The memory requirement is also a function of the circuit complexity. However, the figures are irrelevant for current memory sizes. For instance, the case study presented in this paper (Section 8) required approximately 1.5Mbytes of RAM in a SUN Ultra 10 machine. A summary of the simulation results is stored for each fault. Therefore, the disk space is linear with the number of simulated faults. The Cadence Verilog TM simulator is only available for UNIX platforms. Thus, at present, the tfs fault simulator is also restricted to these platforms, namely, for SUN Solaris operating systems. The tool has been successfully tested for Solaris versions ranging from 2.5 to Case Study: ASIC for Gas Burner Control System The ASIC functionally used in the gas burner control system only includes one critical output signal. However, in order to deal with two simultaneous BRI faults between output pins, triple redundancy of the critical signal has been inserted [9]. Additionally, a different activation type has been assigned to each of the critical outputs (see Table 2). The external circuitry enables the critical device (a transducer) solely when all output signals are enabled. 11

13 Signal CtrOut1 CtrOut2 CtrOut3 Enable Conditions Pulsed Pulsed (opposite phase) Active low Table 2: Conditions to enable the external critical device. Without safety concerns, the main blocks of the ASIC are a Finite State Machine (FSM) and several timers. The FSM implementation is based on a self-checking technique. It includes two main combinational blocks responsible for the generation of the next state and the outputs, named NS_block and O_block, respectively. As no self-checking timers are available, a triple redundancy solution was used for this functionality. Some extra blocks have been added to detect the internal faults (checker blocks) and to disable the critical output signals [9]. The ASIC has been described in behavioral VHDL language. A synthesized Verilog structural description has been used for fault simulation purposes. The structural description contains 1,513 gates. 9 Results The presented results comprise a large variety of fault analyses (single and double SA, and single and double BRI). The Certifying Institution suspicious on the fail-safe properties implemented in the ASIC has imposed this wide range of fault analysis. The presented results are based on the monitoring of the critical outputs only. Thus, a large number of Tolerant faults are identified because many faulty behaviors are not observable at the critical outputs. 9.1 Single Stuck-At Fault Analysis Applying the stuck-at fault model to the output nodes of all logic gates, 2,818 faults were obtained. Based on simulation results, the faults were distributed over the three classes ( Tolerant, Safe, or Potentially critical ). The obtained results are depicted in Table 3. 12

14 Class Number of faults Tolerant 1, % Safe 1, % Pot. critical % Total 2, % Table 3: Single SA fault simulation results The "Tolerant" and "Safe" faults do not need further analysis, because both behaviors are allowed by the EN298 standard. The number of "Potentially critical" faults is very limited (84 faults). Furthermore, only 11 different behaviors have been identified. After re-simulation and detailed analysis of the state transitions, none of those behaviors produces dangerous situations. Most of them (53 out of 84) are faults associated to the timers, usually triggering a premature time-out. Consequently, a state transition occurs too early. If the new state enables the critical output signal, then this is identified as a potentially critical situation. However, reduced time-out does not ever introduce any dangerous behavior. 9.2 Double Stuck-At Fault Analysis A large number of double faults have been identified: 3,967,065 faults combinations. The analysis of such a large set of faults is unpractical. Hence, several fault samples have been generated. Results for a sample size of 18,039 faults (0.45%) are presented in Table 4. Similar results are obtained with larger fault samples. Class Number of faults Tolerant 4, % Safe 12, % Pot. critical % Total 18, % Table 4: Double SA fault simulation results for a 0.45% sample size As it can be seen, Potentially Critical faults represent again a small percentage of the sampled faults (3.72%). In the presence of Potentially Critical faults, a large number of different behaviors (115) has been observed. 13

15 Fortunately, 5 of these behaviors represent 480 faults (the majority of Potentially Critical faults) (71.4%). Detailed analyses do not reveal a single unsafe behavior. The self-checking techniques have been applied to the most critical blocks, namely the NS_block and O_block. However, the detection of dangerous situations, induced by double-faults has to be ascertained by simulation. The results of a complete double-fault analysis for the NS_block and O_block are presented in Table 5 and 6. As expected, a large percentage of "Safe" faults was obtained. This is a direct effect of the self-checking technique applied to those blocks. All potentially critical situations are induced by a combination of a SA1 fault and a SA0 fault. The 222 potentially critical faults in the NS_block can be mapped into 24 different behaviors. None of these behaviors leads to unsafe operation. Class Number of faults Tolerant 18, % Safe 195, % Pot. critical % Total 214, % Table 5: Double SA fault simulation results for NS_block The O_block does not present any potentially critical behavior (see Table 6). Class Number of faults Tolerant 2, % Safe 31, % Pot. critical % Total 34, % Table 6: Double SA fault simulation results for O_block 9.3 Single Bridging Fault Analysis The occurrence of some critical shorts has been inquired by the Certifying Institution. In fact, the SA model is unable to uncover some likely physical defects [13]. Therefore, BRI fault simulation has also been performed. 14

16 The BRI faults were injected between all pairs of gate outputs. The circuit has 1,513 gates, leading to 1,143,828 faults. Using the above mentioned fault model, 4,575,312 fault simulations have to be performed. The validation was performed on a small size sample (see Table 7) and no unsafe operation was identified. Similar results are obtained with other fault samples. Class Number of faults Tolerant 1, % Safe 2, % Pot. critical % Total 4, % Table 7: Single BRI fault simulation results 9.4 Double Bridging Fault Analysis Assuming the BRI fault model described in section 6.2 (4 faults per BRI defect), the combination of two faults leads to 16 combinations for each pair of BRIs. The number of double BRI faults is approximately 1x Obviously, the simulation of the complete fault set is unfeasible. A reduced sample of BRI faults were simulated and the results are shown in Table 8. Again, no unsafe operation was detected. Class Number of faults Tolerant % Safe 1, % Pot. critical % Total 2, % Table 8: Double BRI fault simulation results 10 Conclusions Fail-safe products require the use of an adequate set of EDA tools in the design flow. For gas burner control systems, EN298 standard applies in the European Union. As adequate fault simulators for these products certification are not commercially available, a fault simulator, tfs, has been developed and presented in this 15

17 paper. A novel fault classification has been introduced to enable the identification of a limited subset of potentially critical faults. The simulation of single and double faults, either Stuck-at faults or Bridging faults can be performed with the new tfs tool, which can be used directly with Cadence EDA system. The fault insertion algorithm used for SA fault modeling allows the activation of all fault models that can be modeled locally by the replacement of a single fault-free cell by a new defective cell. These specifications turns it into an extremely effective tool for validation of any fail-safe or fault tolerant architecture whose safety requirements impose a safe behavior when two simultaneous faults may occur in the system. The primary intend for this development was the validation of the fail-safe solution that was being implemented in an ASIC for a gas burner control system. Consequently, the case study used to validate the usefulness and efficiency of the software tool was such ASIC. The results clearly highlight its effectiveness to solve this kind of validation problems. The use of the tfs simulator played a major role in persuading the Certifying Institution of the compliance of the product under development to the EN298 standard. The presented results include simulations of single and double SA faults, and single and double BRI faults. Typically the validation of safety critical systems cannot be based in the detection/no detection technique used in standard fault simulators. Hence, a fault classification has been proposed and the correspondent process has been implemented. This process identifies the compliance, or not, to the EN298 standard. The crucial point is solely the inappropriate activation of critical outputs. The fault simulation results have clearly shown that the ASIC is fail-safe. However, the circuit is too large for an exhaustive analysis of all fault combinations, namely BRI faults. Whenever the expected computational time is too large, the fault sampling option was used. References [1] Niraj K. Jha, Sying-Jyan Wang, Design and Synthesis of Self-Checking VLSI Circuits, IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, vol. 12, no. 6, pp , June

18 [2] Niraj K. Jha, Sandip Kundu, Testing and Reliable Design of CMOS Circuits, Kluwer Academic Publishers, [3] J.F. Wakerly, Error Detecting Codes, Self-Checking Circuits and Applications, North-Holland, [4] M. Nicolaidis, Fault Secure Property Versus Strongly Code Disjoint Checkers, IEEE Transactions on Computer-Aided Design (CAD), vol. 13, nº. 5, pp , May [5] C. Metra, M. Favalli, P. Olivo, B. Ricco, Design of CMOS Checkers with Improved Testability of Bridging and Transistor Stuck-on Faults, Journal of Electronic Testing: Theory and Applications (JETTA), vol. 6, pp. 7-22, Feb [6] Ch. Zeng, N. Saxena, E.J. McCluskey, Finite State Machine Synthesis with Concurrent Error Detection, Proc. Int. Test Conf. (ITC), pp , [7] S. Mitra, E.J. McCluskey, Which Concurrent Error Detection Scheme to Choose?, Proc. Int. Test Conf. (ITC), pp , [8] EN 298 Automatic Gas Burner Control Systems for Gas Burners and Gas Burning Appliances with or without Fans, European Committee for Standardization, October [9] F.M. Gonçalves, M.B. Santos, I.C. Teixeira, J.P. Teixeira, Design and Test of a Certifiable ASIC for Safety-critical Gas Burners Control System, accepted for publication in Journal of Electronic Testing, Theory and Application (JETTA), vol.18, Kluwer Academic Publishers, [10] Michael L. Bushnell, Vishwani D. Agrawal, Essentials of Electronic Testing for Digital, Memory and Mixed-Signal VLSI Circuits, Kluwer Academic Publishers, [11] P.C. Maxwell, R.C. Aitken, Biased Voting: A Method for Simulating CMOS Bridging Faults in the Presence of Variable Gate Logic Thresholds, Proc. Int. Test Conf. (ITC), pp , [12] J.M. Acken, S.D. Millman, Accurate Modeling and Simulation of Bridging Faults, Proc. Custom Integrated Circuits Conference (CICC), pp , [13] E.J. McCluskey, Ch.-W. Tseng, Stuck-Fault Tests vs. Actual Defects, Proc. Int. Test Conf. (ITC), pp ,