Bridging the Pre-silicon Verification Gap for Vehicle Design

The business of building and selling vehicles is changing like never before in the history of the automobile. The quest for cars that drive themselves has completely upended what it means to design a car — and, indeed, what it means to own a car. Exactly how this will all settle out isn’t yet clear. What is clear is that automotive OEMs, and Tier 1 & Tier 2 suppliers are seeing challenges to their historical relationships as electronics pervade future vehicles.

Coupled with increased regulatory requirements for emissions, fuel efficiency, and safety, these electronics will need to be integrated more tightly with the volumes of software that will operate on them. That makes for changing alliances. Traditional and new participants will need to find ways to collaborate and innovate as their roles evolve. One common theme dominates for all players: the challenge of proving that all of these electronics and their software will run smoothly, correctly, efficiently, and safely.

Tier 2 increasingly means semiconductors
Semiconductor makers have long participated in the building of vehicles, quietly creating small chips included in electronic control units, or ECUs. The coming increase in automotive silicon content is bringing those chipmakers under the spotlight as their contributions become far more strategic. As a result, silicon providers are designing large automotive platform system on a chip (SoCs) in addition to the more traditional microcontrollers, memories, and other computing components.

Each of these SoCs is likely to contain numerous CPUs that must work together, and they will communicate with other components using a variety of advanced protocols. Vision systems and artificial intelligence (AI) engines will figure prominently among the technologies seeing rapid growth. And all of this must be done while keeping power levels down to an acceptable level.

Tier 1 suppliers will be overlaying huge volumes of software upon these silicon platforms, so the chips must be optimized for the types of software they will run. That requires much closer collaboration between tier 1 and tier 2 suppliers both for establishing requirements and for verification and validation. And the SoCs will communicate with other components via a wide variety of complex protocols and interfaces. That means a thorough verification effort for all of the implementations of those protocols.

Even at the Tier 2 level, verification and validation will be a challenge due to the size and complexity of the circuits and the broad use cases against which the circuits must be verified.

Challenges and opportunities for Tier 1 suppliers
Tier 1 companies are facing the biggest structural challenge of all. They have traditionally integrated tier 2 components into subsystems that were ultimately pulled together by the familiar automotive OEMs. While that model still has promise, it’s being challenged by a number of untraditional players.

• Companies like Google, traditionally nowhere near the automotive market, are looking to develop cars.
• Ride-sharing companies like Uber and Lyft have been developing driverless cars to supply their primary services — ride-hailing.
• Specialist newcomers like Tesla are integrating vertically, bypassing the entire traditional supply chain.
• Some larger Tier 2 companies like NXP and Nvidia are working directly with OEMs, cutting out the Tier 1 layer.

In this environment, Tier 1 suppliers need to form new and tighter bonds between themselves, traditional Tier 2 suppliers, and newcomers with interesting new ideas. Opportunities abound for tightening up integration across the entire supply chain. Establishing and tracking component requirements, verifying and validating components and modules, and sharing intellectual property (IP) more efficiently will help Tier 1 companies pull together the ecosystem so that it can operate as efficiently as the vertically integrated newcomers trying to do everything themselves.

The challenges of verification faced by Tier 2 suppliers will be multiplied for Tier 1. Those same silicon platforms must now be verified with the multiple layers of software, and the platforms must be verified as they interact with other components in the subsystem. The interfaces and protocols at the edges of the subsystems must also be thoroughly vetted to ensure that they’ll operate as desired when connected with other subsystems.

OEMs face a changing market
The market for vehicles is making a transition from one based on ownership to one in which individuals can choose from a among a flexible set of “mobility solutions” — individual ownership of vehicles is likely to wane.

In the traditional model, Tier 1 suppliers create subsystems, and OEMs integrate those subsystems. Responding to new market dynamics is going to challenge that model. It will mean rethinking higher-level operational details of the vehicles, and those new ideas require compelling new software on innovative new silicon platforms. Those implementations must be validated both before committing design resources and in parallel with the design of both hardware and software.

Once those ideas are validated and new solutions emerge, those solutions must be verified at all levels to ensure that they’re meeting expectations. The challenge is that there are far too many scenarios to test, and each of those scenarios means a combined electromechanical simulation that requires an enormous amount of computing. The very notion of verification stimulus is far different at this level than it is at the Tier 1 or Tier 2 levels. These scenarios are high level: full-vehicle interactions with the environment and with other players — vehicles, pedestrians, and other creatures and objects.

The notion of verification and validation is also being leveraged one step further: the creation of digital twin models that mirror individual cars as they operate on the roads. This brings the possibility of a verification continuum from the chip level to the full automobile while in operation. It also brings the challenge of executing the verification suites at all of these levels.

OEMs are also ultimately responsible for meeting the safety requirements laid out in ISO 26262. Every subsystem, every component in each subsystem, and all of the tools used to put the components, subsystems, and final system together must pass muster. That involves an enormous amount of planning, testing, documentation, and certification.

The pre-silicon verification gap
A complex SoC is an expensive investment. Countless person-hours go into the specification, implementation, and realization of the functions needed. The biggest single expense might be the cost of the mask set, which costs in the millions. Any design changes implemented before masks are committed can be fixed for the simple cost of the engineering time required to do so. Any changes needed after masks are made, however, will result in yet another mask-set purchase. That is an expense that Tier 2 suppliers spend countless hours trying to avoid. That means thoroughly checking out the design before those masks are created.

With enormous multicore SoCs, even running simulations limited to the booting of an operating system and the checkout of low-level drivers will take far longer than is practical, since simulation is simply too slow. So, with simulation alone, Tier 2 companies will find themselves unable to complete the verification.

In this environment, it’s not enough simply for the Tier 2 company to do silicon checkout at that low level. Tier 1 companies will need to exercise their higher-level software on these platforms and do so in advance of that mask set. OEMs themselves will need to exercise their scenarios on the planned implementations before the mask commitment.

If simulation is inadequate for the Tier 2 verification job, then it falls even further behind for Tier 1 suppliers and OEMs. There is a fundamental gap between what is required for full pre-silicon verification and what simulation will allow. Electronic-vehicle development will grind to a standstill without some way of bridging that verification gap.

The pre-silicon AV environment: PAVE360
Siemens’ PAVE360 program, for example, is a new verification environment intended to replace the older, inadequate traditional flows. Operating at many levels, from the individual chip to the subsystem to the full vehicle, it provides methodologies, stimulus, and verification horsepower for the entire ecosystem to use. It establishes a verification continuum that leverages the Tier 2 efforts within Tier 1, and the Tier 1 efforts at the OEM level.

The verification horsepower is provided using hardware emulation on the Veloce emulation platform. Simulation’s weakness is that it is limited to software models. By contrast, an emulator is a supercomputer that can run verification suites on hardware models of the silicon chips. It runs thousands of times faster than standard simulation, and it means that full verification is possible in the timeframe needed to bring competitive vehicles to a competitive market.

While new to the automotive market, emulation has long been proven in the networking, mobile, and storage markets, just to name a few. It has a flexible structure, with an operating system and applications that can be used to verify specific aspects of a design –– be it energy consumption, safety, interface protocols, or even internal testability circuits (design for test, or DFT).

The PAVE360 program leverages Veloce emulators in a manner specific to the needs of automotive developers. It lets the many underlying design tools and methodologies interact via standard, well-known protocols like transaction-level modeling (TLM) for inter-component verification and the functional mockup interface (FMI) for electro-mechanical verification. It performs the full range of pre-silicon verification tasks:

• Full functional verification
• Full visibility into internal circuits, along with robust debug capabilities
• Full interoperability with chip and software verification tools and with post-silicon hardware checkout
• Hardware/software co-verification and extraction of full-chip performance, bandwidth, and power metrics.

OEMs and Tier 1 and Tier 2 suppliers can work in parallel to explore new design ideas, establish and track design requirements, implement the ideas that will make a vehicle the most competitive, and verify the implementations along a continuum from low-level silicon to full vehicle. PAVE360 allows collaboration up and down the supply chain, pulling together what have previously been independent activities into a smooth, coordinated effort.

The result will be new, innovative vehicles with better performance that have been developed more efficiently and brought to market much faster. Creative designers can build vehicles that have new capabilities and a level of safety that we’ve never seen before.

— Jean-Marie Brunet is senior marketing director for the Emulation Division at Mentor.