Breakfast Bytes Blogs

At the end of last year, Cadence's Modus DFT Software Solution was ISO 26262 certified by TÜV-SÜD.

So what does that even mean?

The Modus DFT solution has two main functions. First, it takes a design, adds scan chains and compressor/decompressor logic, and constrains the layout so everything doesn't end up in a dense clump in the center of the chip. Second, it generates test vectors to exercise those scan chains through the compressors and decompressors. Eventually, the chip is manufactured with the scan logic, and the vectors are used for manufacturing test. For more details on Modus DFT, see my posts:

• Modus Test Solution—Tests Great, Less Filling
• CDNLive: Testing Times in Munich
• Cell-Aware Test: Research Cooperation Between Cadence, imec, and TU Eindhoven...Now Shipping in Modus DFT Software Solution
• What Next for Modus DFT?

The diagram above shows the basic structure of test compressor, decompressor, and scan chains.

TÜV-SÜD have also appeared before in Breakfast Bytes:

• What Is Automotive Tool Confidence Level 1?

As Isaid in that post:

The automotive semiconductor market has been memorably described as a pot of gold guarded by a dragon, and that dragon is ISO 26262. For obvious reasons, vehicles need to be safe. In fact, they need to fail less than the underlying semiconductors.

Note that Modus ATPG and Diagnostics has performed a “tool qualification”, which means the tool can be used for any ASIL (A-D) and any TCL (1-3). This is different from the toolchain certification TCL1 that I covered in the above post.

So what is ISO 26262? I've covered various aspects of that over the years here at Breakfast Bytes, too:

• "The Safest Train Is One that Never Leaves the Station"
• History of ISO 26262
• CDNDrive: ISO 26262...Chapter 11
• What to Do About IP Developed Before ISO 26262?

Certification

In case you didn't read all those blog posts referenced above, ISO 26262 is titled "Road Vehicles — Functional Safety" and that pretty much describes it. It is the standard to which vehicles are expected to adhere. For semiconductors, the most important is chapter 11, which is specifically about semiconductor-based electronics.

TÜV-SÜD is a company based in Germany (hence the umlauts). It was actually founded in 1866, so it pre-dates cars completely. As it happens, Breakfast Bytes has even covered that in my post The Mercedes Benz Museum and the Invention of the Automobile. SÜD is the German for South, and TÜV is short for Technischer Überwachungsverein which means technical inspection association. And that pretty much describes it, too. Although you may never have heard of them, they have over 25,000 employees in over 1,000 locations. They perform a wide range of inspections and certifications, but for today's post, the important one is that they do certification based on compliance with ISO 26262.

From a point of view of software associated with cars and with ISO 26262, there are really three different levels of sensitivity:

• Software that runs in the vehicle. For example, Green Hills Software's real-time operating system Integrity is used in many safety-critical electronic control units (ECUs)
• Software that creates or alters the design. For example, Modus DFT when it inserts scan chains is altering the design. If it does it wrong, it can cause failure
• Software that operates on the design without changing it. Modus DFT, when it generates the vectors, operates like this. Simulation is perhaps the canonical example: it might miss a problem that is there, but it can never insert a problem of its own

The motivation for this certification is that customers (semiconductor companies, tier-1s, automotive companies, etc) need assurance that products are built to a certain level of robustness in the context of safety. Documentation is obvious, but also the code development process, installation processes, product verification, checklists, requirements on the user ("the user will ensure sufficient disk space is available" for example). In the ideal case, and Modus DFT fall under this heading, users want to see the output from the tool verified with another tool. For test structure insertion and test generation, verification can be done by simulating with Xcelium. Every customer cannot certify Modus DFT on their own and so ISO 26262 certification is very important to them.

The certification process consists of providing a lot of documentation to TÜV-SÜD and then conducting an audit and interview. Due to the current situation, this was done online. It took place over four days with three hours per day of review. The documents provided, which took a year to prepare, covered the process (7 documents), checklists (12), manuals (3), templates (3), and quality management system (9).

The key competencies evaluated were:

• Documentation of processes
• Traceability from requirements
• Bug traceability
• Automated and repeatable
• Reports and analytics
• Competence of staff
• Onboarding of new staff
• Continuous improvement
• Safety impact

If you know anything about ISO 9000 certification, a lot of this might look familiar...except for the last bullet, safety impact. It is this that makes automotive different (and other safety-critical applications like aerospace, but that is not today's topic and they have their own similar standards such as DO 178B, instead of ISO 26262).

The above diagram shows the Modus DFT software development process from requirements to testing and bug fixing.

Bugs can be created at different levels. For example, if the data doesn't match the signal from the chip, it could be that die is bad. This is the normal operation of a test program, since its purpose is to screen out bad die. But if there is a data mismatch on all die, it could be any of:

• The customer used a different version of the design to run Modus DFT than to create the chip as manufactured
• The chip is faulty in some systemic way such as a metal short due to an unfixed DRC violation
• Modus DFT was run incorrectly
• Modus DFT has a bug

Feedback from the Audit Process

The feedback summary was "very positive!" with the strengths listed: good metrics, wide and deep process for continuous improvement, mature development culture, and a strong focus on customer needs and solution documentation.

You can download the certificate (above), and the full report from the Cadence support site (you need a Cadence support login). Also automotive functional safety kits.

Sigrity

In a completely separate process that also ended late last year, Cadence's Sigrity technology was ISO 26262 certified. There are two certified flows: a flow for analysis of a PCB signal integrity, and a flow for analysis of a PCB for power integrity.

Sign up for Sunday Brunch, the weekly Breakfast Bytes email.