Method to Perform Hardware Safety Analysis without Fault Simulation

Abstract

A safety analysis method is based on a safety-specific design structural analysis and cone of influence (COI) that does not require fault simulation. The method for performing a safety analysis of an integrated circuit based on a safety-specific design structural analysis and cone of influence comprises generating with a processor a computed set of basic design elements by intersecting two transitive cones of influence, wherein a first cone of influence is a transitive fanin cone of influence starting from a TO element and a second cone of influence is a transitive fanout cone of influence starting from a FROM element.

Claims

1. A method for performing a safety analysis of an integrated circuit based on a safety-specific design structural analysis and cone of influence comprising: generating with a processor a computed first set of basic design elements by intersecting two transitive cones of influence, wherein a first cone of influence is a transitive fanin cone of influence starting from at least one TO element and a second cone of influence is a transitive fanout cone of influence starting from at least one FROM element.

2. A method for performing a safety analysis of an integrated circuit based on a safety-specific design structural analysis and cone of influence according to claim 1, further comprising: extracting, with the processor, from the computed first set of basic design elements a second set of basic design elements that are in a direct fanin of the computed set of basic design elements.

3. A method for performing a safety analysis of an integrated circuit based on a safety-specific design structural analysis and cone of influence according to claim 2, wherein said second set of basic design elements are not FROM elements of the first cone of influence.

4. A method for performing a safety analysis of an integrated circuit based on a safety-specific design structural analysis and cone of influence according to claim 1, further comprising: extracting, with said processor, from the computed first set of basic design elements a third set of basic design elements that are in a direct fanout of the computed first set of basic design elements.

5. A method for performing a safety analysis of an integrated circuit based on a safety-specific design structural analysis and cone of influence according to claim 4, wherein said third set of basic design elements are not TO elements of the first cone of influence or elements in the direct fanout of the TO elements of the first cone.

6. A method for performing a safety analysis of an integrated circuit based on a safety-specific design structural analysis and cone of influence according to claim 3, further comprising: generating with said processor a computed fourth set of basic design elements, wherein said fourth set of basic design elements comprises elements from said first computed set that are inside a transitive fanin cone of the third set of basic design elements.

7. A method for performing a safety analysis of an integrated circuit based on a safety-specific design structural analysis and cone of influence according to claim 6, further comprising: subtracting with said processor the fourth set of basic design elements from the computed first set of basic design elements to generate a fifth computed set of basic design elements.

8. A method for performing a safety analysis of an integrated circuit based on a safety-specific design structural analysis and cone of influence according to claim 3, further comprising: generating with said processor a computed a sixth set of basic design elements, wherein said sixth computed set of basic design elements comprises elements that are inside a transitive fanin cone of the second set of basic design elements

9. A method for performing a safety analysis of an integrated circuit based on a safety-specific design structural analysis and cone of influence according to claim 1, further comprising: calculating with said processor a size of logic represented by the computed first set of basic design elements.

10. A method for performing a safety analysis of an integrated circuit based on a safety-specific design structural analysis and cone of influence according to claim 1, further comprising: generating with said processor a fault list for the computed first set of basic design elements.

11. A method for performing a safety analysis of an integrated circuit based on a safety-specific design structural analysis and cone of influence according to claim 1, wherein at least one of said at least one TO element and said at least one FROM element is included in said computed first set of basic design elements.

12. A method for performing a safety analysis of an integrated circuit component having a plurality of parts comprising: deriving with a processor a subpart of one of said parts of said component from a transitive fanin logic cone associated with a first point and a transitive fanout logic cone associated with a second point, wherein said subpart comprises elements within both said transitive fanin logic cone of said TO element and said transitive fanout logic cone of said FROM element.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0017] For a more complete understanding of the present invention and the advantages thereof, reference is now made to the following description and the accompanying drawings, in which:

[0018] FIG. 1 is a diagram of cone of influence (COI).

[0019] FIG. 2A illustrates an ECC protected FIFO safety feature of an integrated circuit design.

[0020] FIG. 2B illustrates a fault detection analysis lock-step core safety feature of an integrated circuit design.

[0021] FIG. 2C illustrates extraction of unprotected logic for a lock-step core safety feature of an integrated circuit design.

[0022] FIGS. 3A-3G illustrate a method for extraction of a subpart of an integrated circuit design in accordance with a preferred embodiment of the present invention.

[0023] FIG. 4 illustrates a COI analysis starting from decoder inputs in accordance with a preferred embodiment of the present invention.

[0024] FIG. 5 illustrates COI analysis starting from decoder inputs and stopping at encoder and control logic outputs in accordance with a preferred embodiment of the present invention.

[0025] FIG. 6 illustrates that the intersection of FanoutCOI and FaninCOI in the present invention identifies the protected control logic without the need of defining stop points for the control logic.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0026] An integrated circuit design can be considered as a hardware component, having a plurality of parts and a plurality of subparts. Subparts maybe grouped into safety mechanism and intended functionality where two such groups may form a safety feature.

[0027] An example of a safety feature is error correction code (ECC) protected first-in-first-out (FIFO), which is illustrated in FIG. 2A. In the safety mechanism group, data inputs are encoded by encoder 210. The encoded data inputs are supplied to ECC memory 212 in the safety mechanism group and to data memory 222 in the intended function group. The outputs of the ECC memory 212 and the data memory 222 are combined and decoded with decoder 214 in the safety mechanism group to produce data outputs and diagnostic outputs.

[0028] A lockstep core safety mechanism is illustrated in FIG. 2B. Core inputs are provided to the core 240 in the intended function group. Shadow core inputs are provided to the shadow core 230 in the safety mechanism. The shadow core outputs and the core outputs are compared in the comparator 232 in the safety mechanism to produce diagnostic outputs. As shown in FIG. 2C, however, some logic may remain unprotected by such a safety mechanism.

[0029] Accurate extraction of a subpart, or set of basic design elements, is non-trivial. Basic design elements may include, for example, bits, states, ports, signals, wires, gates or cells. Extraction of a subpart and determination of where the safety mechanism or protected logic begins and/or ends in accordance with a preferred embodiment of the present invention is described with reference to FIGS. 3A-3G. Generally, in the method of the present invention a processor automatically generates a computed first set of basic design elements by intersecting two transitive cones of influence, wherein a first cone of influence is a transitive fanin cone of influence starting from a first point (TO elements) and a second cone of influence is a transitive fanout cone of influence starting from an second point (FROM elements). While the example shown in FIGS. 3A-3G have only a single TO element 310, more than one TO element 310 may be included. As shown in FIG. 3A, there is a first point or TO element 310 from which a transitive fanin cone of influence 320 is extracted. As shown in FIG. 3B, the subpart 322 initially is identified as design elements 311, 312, 313, 314, 315, 316 within the transitive fanin cone of influence 320. The cone of influence 320 stops at TO elements 330, 332 of other subparts and other primary design input(s) 334.

[0030] In the next step shown in FIG. 3C, the TO element 330 from a different subpart becomes a FROM element 330a for this subpart, and a second cone of influence 340 is a transitive fanout cone of influence of FROM element 330a. This second cone of influence 340, i.e., the transitive fanout, overlays the first cone of influence 320. The intersection of these two cones of influence provides a more precisely defined computed subpart or set 324 of basic design elements 311, 312, 313, 314 that includes, for example, a data path only. The processor may calculate a size of logic represented by the subpart 324 and may generate a fault list for the basic design elements in subpart 324.

[0031] The processor identifies or extracts elements (logic) in the computed subpart or set 324 (FIG. 3C) of basic design elements 313, 314 that are read by other subparts by extracting a transitive fanin-cone starting from the read element 319 (FIG. 3D) and intersecting it with the subpart 324 (FIG. 3C). These elements 313, 314 can be referred to collectively as subpart_read 326 (FIG. 3D). The TO element(s) of the first cone of influence and FROM element(s) of the second cone of influence may be included in the computed subpart 324. In one preferred embodiment, the TO element(s) are included in subpart 324 while the FROM elements are not include in subpart 324.

[0032] As shown in FIG. 3D, the processor also identifies all basic design elements 319, called read bits, which are in the direct fanout of subpart 324 (FIG. 3C) and are not TO element 310 or direct fanout of TO element 310. In other words, these read elements are elements that are not in the sub-part but read other elements in the sub-part. These read elements are for example not protected by a safety mechanism.

[0033] As shown in FIG. 3E, the subpart 322 (FIG. 3B) also contains potential residual logic, referred to collectively as subpart_write 328, that controls the subpart 324. The element 315 that writes to elements in the subpart 324 can be referred to as a write bit 315 (FIG. 3F). These write bits are in the direct fanin of any elements composing subpart 324 (FIG. 3C) and are extracted as such.

[0034] The subpart_write 328 (FIG. 3E) may be considered as the transitive fanin cone of write bit 315 that does not include TO or cone elements of other subparts. The processor identifies or extracts the subpart_write 328 for example as potential residual logic or elements.

[0035] The processor may subtract the subpart_read 326 from the subpart 324, i.e., the computed first set of basic design elements, to generate another subpart of set of basic design elements, so that, for example subpart_read is considered to contain potentially protected elements whereas this new subpart contains protected logic or elements.

[0036] Looking now at the invention in the context of a memory, an error code correction (ECC) protected first-in first-out (FIFO) design in accordance with the present invention is illustrated in FIG. 4. The design can be considered as a hardware part consisting of a number of subparts, including the hamming encoder and decoder, which enable double-bit memory error detection, and single-bit memory error correction, and the flip-flops (FFs) or memory, which store the encoded FIFO entries, including the ECC bits. The encoder and decoder subparts implement the safety mechanism (SM) protecting the memory. The control logic, which manages the FIFO read and write pointers, and the full and empty flags, is another subpart. This subpart is not protected by any SM.

[0037] To apply COI analysis and extraction on the ECC FIFO design, a set of first points (TO elements) must be defined for each subpart. The population of faults that are protected by the ECC SM can be extracted using the inputs of the decoder, marked as DI in FIG. 4, as TO elements. The transitive fan-in cone is extracted, and a fault list is generated. This step ensures that only faults that structurally propagate to at least one TO element are included in the faults list.

[0038] As shown in FIG. 4, the resulting list will include all faults in logic outside the decoder. This is an over approximation as, for example, faults in the control logic are not protected by the SM. Using this list, time and resources will be wasted simulating and debugging control logic faults that will always escape detection from the SM, regardless of the stimulus applied.

[0039] The basic COI analysis method can be significantly improved by introducing stop points, illustrated in FIG. 5 as EO (encoder outputs) and CO (control logic outputs). EO and CO are used as stop points during the COI analysis starting from the decoder inputs DI. This leads to a more precise list, which does not include faults in the control logic. It is worth noting that stop points can also be used as TO elements for the COI analysis and extraction of the fault lists for the encoder and control logic subparts. Using this observation, the need for specifying stop points can be eliminated. When doing COI analysis for a certain subpart, all TO elements of the other subparts can be used as stop points during the current analysis. This idea enhances basic COI analysis, enabling the extraction of more precise fault lists for each subpart. Assuming correct specification of the TO elements for all subparts, we can immediately deduce, without running any fault simulation, that all faults in the FFs subpart are detected, while all faults in the control logic subpart are undetected.

[0040] SAHP produces more precise results compared to basic COI analysis and extraction. However, it does rely on correct identification of TO elements for each subpart, which might be difficult in some cases. Identifying the TO elements of the control logic subpart (CO in FIG. 5), for example, is not trivial as this logic is not isolated in a separate module.

[0041] This challenge can be addressed by introducing the new concept of FROM elements. In addition to extracting the transitive fan-in cone from the TO elements, DI in the ECC FIFO example, we also consider the points where the protection by the SM starts, EO in the ECC FIFO example.

[0042] Unlike previously introduced stop points, FROM elements do not only act as stop points but are also used as TO elements for a transitive fan-out COI analysis and extraction. Intersecting the transitive fan-out of EO (FanoutCOI in FIG. 6) with the transitive fan-in of DI (FaninCOI in FIG. 4) provides the exact list of faults that are protected by the SM. Crucially, this result is achieved without the need for defining CO as stop points or relying or any hierarchical IC design information during the COI analysis of the FFs subpart. It is worth noting that the CO points in FIG. 5 are the write bits of the FFs subpart and sub sequentially the write subpart of the FF subpart contains the control logic. Read bits and read subparts would work in a similar way but are not demonstrated within this example.

[0043] Similar to the TO elements, FROM elements must be associated with the subpart under analysis. It is preferable to define FROM elements that are also TO elements for one or more other subparts. This reduces the total number of points that need to be defined and ensures that the analysis of all subparts covers the entire circuit. Moreover, TO elements can be used as stop points during the transitive fan-out cone extraction, although this is not required. During the analysis of a subpart, TO and FROM elements of all other subparts can be used to speed-up the extraction of the fault list.

[0044] The SAHP method provides more accurate fault lists compared to basic COI analysis and extraction. This eliminates the need to simulate numerous faults, resulting in significant effort and computational savings. SAHP can be applied using FROM elements or stop points. The two approaches can also be combined. Using FROM elements is preferred as results are more accurate, particularly in designs with complex control logic where only the data path logic is protected by a SM.

[0045] Any of the generated or extracted sets of basic design elements, calculations and lists may be stored in memory or other storage and may be displayed, for example, on a display.

[0046] The foregoing description of the preferred embodiment of the invention has been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise form disclosed, and modifications and variations are possible in light of the above teachings or may be acquired from practice of the invention. The embodiment was chosen and described explain the principles of the invention and its practical application to enable one skilled in the art to utilize the invention in various embodiments as are suited to the particular use contemplated. It is intended that the scope of the invention be defined by the claims appended hereto, and their equivalents. The entirety of each of the aforementioned documents is incorporated by reference herein.