Abstract:
A method for simulating faults in integrated circuits of electronic systems implementing applications under functional safety includes operating a simulation step of the system or electronic circuit on a processing system and executing the application under functional safety. The simulation step has a fault injection procedure including injecting a set of faults during simulation in determined locations, and verifying if observation points and diagnostic points connected to determined root failure modes are perturbed. The simulation step includes before the injecting step during simulation in determined locations of an electronic circuit performing a procedure to select a set of effective faults, pertaining only to effective root failure modes, which allow obtainment of the overall diagnostic coverage target, and supplying the set of effective faults for the execution of the injecting step during simulation in determined locations of the electronic circuit.

Description:
TECHNICAL FIELD 
       [0001]    The present description refers to techniques of simulating faults in integrated circuits of electronic systems or electronic circuits implementing applications under functional safety. The described techniques envisage operating a simulation step of said electronic system or circuit on a processing system that has the application under functional safety in execution, and during this simulation step a procedure of injecting faults is executed, comprising injecting faults during the simulation step in determined locations of the electronic system or circuit, verifying if observation points and diagnostic points connected to determined root failure modes are perturbed by the injected fault. 
         [0002]    Various embodiments can be applied to the functional safety. In particular, various embodiments are applied in electronic systems in the field of industrial robotics and industrial controls, and in the technical field of electronic systems for automotive applications for assisting the operator and partially or completely automatic driving. 
       TECHNOLOGICAL BACKGROUND 
       [0003]    The regulations for the functional safety, such as the regulation IEC 61508 and the regulation ISO 26262 require the adherence to certain metrics, or measure standards, analogous to the software metrics, such as the “diagnostic coverage”, suitable for quantifying the level of integrity of a certain electronic apparatus used in contexts that contemplate critical applications, such as the industrial field and the automotive field. 
         [0004]    The aforementioned regulations require verifying the adherence to said metrics by means of operations of so-called “injection of faults”, or rather, a form of verification that envisages the intentional injection of malfunctions in order to ascertain that these faults do not have effects on the application, or they are detected by suitable control systems. 
         [0005]    In the case of integrated circuits, for which it is impossible or impracticable to inject faults into the finished device—consider the difficulty of causing a short circuit within an integrated circuit composed of millions of transistors—operations of injecting faults are usually carried out during the step of developing the electronic apparatus, by means of simulations executed by suitable calculation tools. 
         [0006]    However, some disadvantages can render this procedure extremely expensive and sometimes—for very complex circuits—unfeasible. 
         [0007]    A concrete example of these disadvantages is the case of injecting transient faults, such as the so-called the “soft errors”, whose model consists in temporary changing the state of a register. This model allows emulation of the effect, for example, of radiation, such as alpha particles, which perturbs the state of a memory element which are the registers. These “soft” type of faults must be injected during any of the instants of execution (or better still, of the simulation of the execution) of one reference application. For complex electronic circuits, this reference application can be very long (for example, over a period of 10 ms). If, therefore, an electronic circuit composed of 100000 registers and with a clock frequency of 10 ns is considered, there are therefore 10 ms/10 ns*100000=100 billion faults. Since a modern calculation tool is typically able to inject a fault every 2 minutes, even if thousands of calculation tools were arranged in parallel, approximately 380 years would be required in order to complete the injection campaign. Therefore, a first disadvantage is represented by the long simulation times due to the interaction between the complexity of the circuits and multiplicity of potentially significant instants for the simulation. 
         [0008]    Another disadvantage is due to the frequent necessity by the producers of integrated circuits to implement the derivatives of an electronic data component, or rather, a new generation of the same architecture in which certain changes have been made. Therefore, the procedures described above would require repeating the operation of injecting faults, multiplying, in this way, the cost and time caused by the drawbacks discussed above for each new derivative. In the previous example, this would mean repeating a campaign 380 years for a number of times typically up to ten, this being the typical number of a sequence of derivatives. 
         [0009]      FIG. 1  schematically shows the failure modes, which are identified as part of the verification procedure of the functional safety of electronic systems for critical applications. These failure modes correspond to incorrect conducts of the device or electronic system regarding its specific conducts. These failure modes relative to the device or system, said final failure modes FFM, are represented, for example in the automotive field, by events such as the “non-application of the braking force when required by the driver”. As can be seen in  FIG. 1 , if the electronic system is broken down into its subsystems and components, these final failure modes FFM can be connected using simple logic operations represented by logic gates PL, such as AND or OR) by levels of other resulting failure modes, SFM, other “root” failure modes, RFM, or rather linked more directly to the system components. For example, in the case of an integrated circuit, a root failure mode RFMa can be “miscalculation by the processor” that in OR logic with another root failure mode RFMb “incorrect address by the processor in access to the memory” can constitute a higher failure mode (“resulting” failure mode RSM) which, for example, could be incorrect operation of the processor. Combining one or more failure mode levels results in reaching the final failure FFM in the end, which, as said, is therefore a logical combination of root failure modes RFM. 
         [0010]    In the systems for critical applications, required by the international regulations IEC 61508 and ISO 26262, the realization of safety mechanisms is carried out, able to prevent or to reveal these failure modes. For example, in the event of integrated circuits, a safety mechanism can be software executed periodically during the normal operation of the device in order to test all the instructions of a processor. 
         [0011]    The international regulations IEC 61508 and ISO 26262 require that these safety mechanisms reach certain values of “diagnostic coverage”, or rather, a certain ratio between the number of the dangerous failures (or rather those able to perturb the critical mission of the system) and the number of faults revealed by the diagnostic mechanism. 
         [0012]    In this case, the scope of the verification of the functional safety is that of verifying that—given the total of possible failures—the number of dangerous failures and the number of failures revealed from the diagnostic mechanism are those that are preventative in the planning step of the electronic system. 
         [0013]    In  FIG. 2 , elements and steps are schematically illustrated of a verification of the functional safety in an integrated circuit, indicated by the numerical reference  11 , subjected to verification. In  FIG. 2 , a fault G is represented, injected at a location LC, in the integrated circuit  11  under verification. Letters x, y, . . . , z indicate a plurality of outputs designed in the integrated circuit  11  under verification. One function f(x, y, . . . , z) of these outputs designated x, y, . . . , z represents an observation point O of the fault G. A second function G(x, y, . . . , z) of the outputs designated x, y, . . . , z represents a diagnostic point D. Of course, these magnitudes and the connected operations and functions are defined for a simulation step of the integrated circuit  11  under verification, for example through a computer  600  which can load into its memory and execute a computer program  610 , in particular on a computer support, or computer-readable non-transitory means, which comprises one or more of the operations of the method described here, even if, in general terms, these operations could be executed on the physical circuit, even with the difficulties discussed previously. 
         [0014]    This verification of the functional safety can be incorporated into a simulation step of the electronic system or electronic circuit  11  with injection of faults  100 , which, typically, as also represented in the flow diagram of  FIG. 6 , comprises: 
         [0015]    injecting  110  faults G during the simulation step (for example, “stuck-at” faults) of the circuit  11  at determined locations LC of this circuit  11 ; 
         [0016]    verifying  120  if a certain function f(x, y, . . . , z) of the outputs designated x, y, . . . , z, or observation point O is perturbed by the fault, or rather if the observation point O has a different measured value from an expected value. In this case, the fault G is defined as a potentially dangerous fault GP, in the opposite case it is a “safe” fault GS, or rather, it does not cause a failure of the critical mission. The designated outputs x, y, . . . , z are the outputs of the integrated circuit whose combination can exactly determine the root failure mode. For example, the root failure mode “miscalculation by the processor” has outputs designated as the outputs of the processor; 
         [0017]    in the event of a (potentially) dangerous fault GP, verifying  130  if a second function G(x, y . . . z) of the outputs corresponding to the safety mechanism (defined “diagnostic point”, D) is activated (or rather, for example, the value of G(x, y . . . z) differs from a pre-calculated value) from the dangerous fault GP, or rather if, when the observation point O assumes a different measured value from that expected at step  120 , the diagnostic point D is activated within a certain interval of time identified by the safety specifications of the electronic device  11 . If the diagnostic point D is activated, a dangerous fault condition DGP is revealed, otherwise step  130  gives a dangerous fault condition not revealed NGP. For example, in the case in which the safety mechanism is periodically executed software, the diagnostic point D is represented by the register of the processor or by the memory location in which the software deposits its measured value, to be compared with a pre-calculated value of the test (that is, the expected value without faults). 
         [0018]    Usually, the injection of faults occurs while a workload generator is executing commands, in particular, for example, an application under functional safety, to the electronic system. Monitoring modules are provided in order to trace the execution of the commands and to collect the data, for example, from the said points of observation, and analysis modules, which carry out, for example, evaluations of the dangerous faults, for example, according to FMEA analysis. All these modules can be software modules executed on a computer which, in general terms, carries out the simulation procedure. Similar procedures are described, for example, in the U.S. Pat. No. 7,937,679 by the Applicant. 
         [0019]    Therefore, based on what has been previously discussed, in the case of complex integrated circuits, the functional verification procedure by means of injection of faults presents at least the following disadvantages: in the absence of a selection strategy, the number of faults G to inject can be enormous (hundreds of millions); the complexity of the integrated circuit is such that it is not simple to identify the observation points O and the diagnostic points D; the length of the test within which to inject the faults is considerable and therefore, multiplied by the number of faults to inject, involves an unacceptable duration of simulation, even when running parallel simulations; every time that the producer changes something in the electronic component, it is necessary to repeat the entire “injection campaign”. 
       OBJECT AND SUMMARY 
       [0020]    The embodiments described here have the object of improving the potentialities of the methods according to the prior art as discussed previously, in particular to allow the injection of faults in simulation with a much lower time period. 
         [0021]    Various embodiments achieve this object thanks to a method having the characteristics referred to in the following claims. Various embodiments can also refer to an architecture as well as to a computer program product, loadable in the memory of at least one computer (for example, a network terminal) and comprising portions of software code suitable for executing the steps of the method during the moment in which the program is executed on at least one computer. As used here, this computer program product is intended to be equivalent to a computer-readable means containing instructions to control the computer system so as to coordinate the execution of the method according to the invention. The reference to “at least one computer” is designed to emphasize the possibility for the present invention to be implemented in a modular and/or distributed form. The claims form an integral part of the technical disclosure provided here in relation to the invention. 
         [0022]    Various embodiments can envisage that the method comprises operations that include: 
         [0023]    identifying which and how many faults to inject as a function of the objective of diagnostic coverage and according to the connection between the failure modes of the integrated circuit and its elementary parts; 
         [0024]    identifying a “window of opportunity” of the reference application within which to inject the faults; 
         [0025]    saving the intermediate states of the simulation and their use to reduce the interval of time effectively simulated for every injection concentrated it around the “window of opportunity”; 
         [0026]    identifying how many faults must be re-injected in one derivative of an integrated circuit already injected previously with the method described here; 
         [0027]    a calculation tool in the form of a simulator, or rather, a processing system configured to execute the simulation method indicated above. 
         [0028]    Combining these methods and their implementation by means of the calculation tool consequently allows the reduction of the number of faults to inject, and therefore reduction of the times of injection, by four or more orders of magnitude—with the result of a considerable cost reduction of the verification of the functional safety. 
     
    
     
       BRIEF DESCRIPTION OF THE FIGURES 
         [0029]    Various embodiments will be now described, purely by way of example, with reference to the attached figures, wherein: 
           [0030]      FIG. 1  and  FIG. 2  have already been previously described; 
           [0031]      FIG. 3  is a diagram illustrative of elements and operations of the principle of operations of the method described herein; 
           [0032]      FIG. 4  and  FIG. 5  show a temporal diagram of magnitudes relative to the method described here; 
           [0033]      FIGS. 6-10  show flow diagrams of procedures employed by the method described here; 
           [0034]      FIG. 11  shows a flow diagram of an embodiment of the method described here. 
       
    
    
     DETAILED DESCRIPTION 
       [0035]    In the following description, numerous specific details are provided with the aim gaining the maximum understanding of the exemplificative embodiments. The embodiments can be implemented with or without specific details, or with other methods, components, materials, etc. In other circumstances, material structures or well-known operations are not shown or described in detail in order to avoid obscuring aspects of the embodiments. The reference during this description to “an embodiment” means that a particular feature, structure or characteristic described in connection with the embodiment is comprised in at least one embodiment. Therefore, use of the phrase “in an embodiment” in several points in this description is not necessarily referring to the same embodiment. Moreover, the particular features, structures or characteristics can be combined in any convenient way in one or more embodiments. 
         [0036]    The headings and references are only provided here for convenience of the reader and they do not define the scope or the significance of the embodiments. 
         [0037]    As already previously discussed, in the case of complex integrated circuits, the simulation of an electronic circuit or system with functional verification by means of injection of faults presents the following disadvantages: in the absence of a selection strategy, the number of faults G to inject can be enormous (hundreds of millions); the complexity of the integrated circuit is such that it is not simple to identify the observation points O and the diagnostic points D; the length of the test within which to inject the faults is considerable and therefore, multiplied by the number of faults to inject, involves an unacceptable duration of simulation, even when running parallel simulations; every time that the producer changes something in the electronic component, it is necessary to repeat the entire “injection campaign”. 
         [0038]    It can be observed here that these disadvantages are closely linked to each other, i.e. the solution of only one of them does not result in significant advantages. The method described here is thus based on a complex strategy able to resolve the disadvantages as a whole. 
         [0039]    The simulation method described here overcomes these disadvantages by defining procedures comprising operations suitable for diminishing the number of injected faults concentrating the injection in points of the circuit and significant temporal intervals and by means of implementing a corresponding calculation tool. 
         [0040]    With reference to  FIG. 3 , a simulation procedure of faults is described, which allows selection and therefore reduction of the number of faults to inject during the injection step. 
         [0041]    In  FIG. 3 , an example of an electronic circuit  11  to simulate is shown. This electronic circuit  11  is comprised, per se, of subparts, in the example of  FIG. 3 , a logic arithmetical unit  11   a , a register block  11   b , a floating point unit  11   c , and a loading and memorization unit  11   d.    
         [0042]    The simulation procedure described here, also shown in the flow diagram of  FIG. 7 , which is indicated as a whole by reference  200 , envisages, in an operation  210 , the subdivision of this circuit  11  and subparts  11   a  . . .  11   d  by means of another partition into additional subparts, or elementary parts EP. Here, elementary part means the set of a register and the logic cone, or cone of logic, which generates its input state. For simplicity, an elementary part is also indicated below with the name of the register with which it is associated. The granularity of these elementary parts EP depends on the available information. A minimal level of granularity can envisage the selection as elements of the set that composes an elementary part EP, the registers R of the circuit  11  and the logic gates L. 
         [0043]    A subdivision operation  210  can, in particular, be carried out in a manner described in the U.S. Pat. No. 7,937,679, in particular in the description pertinent to  FIG. 3  of this document. In other words, it is possible to read the description of the circuit under simulation, at one of the various levels of abstraction to which this description is prepared. This reading can comprise an analysis or parsing of the description RTL, at the logic-gate and layout level by means of an EDA (Electronic Automation Design) tool, such as VHDL (VHSIC Hardware Description Language) or the description analyzers of VERILOG circuits. In the same way, the true and actual subdivision  210  into elementary parts EP, still at the RTL level, at the logic-gate and layout level can be carried out employing automatic procedures available in these tools. More specifically, for an integrated digital circuit such as the circuit  11 , represented at the gate-level abstraction level, it is envisaged to start from the “net-list”, which is automatically generated at the end of a software synthesis process of a digital circuit. This net-list is, for example, typically, in VERILOG language or in a specific format of the synthesis tool employed. This net-list contains the description of all the logic gates of the integrated circuit and their interconnections. Starting from this net-list, it is possible, through commands included in these synthesis tools, to extract a complete list of the registers from this net-list. This list is usually compacted by means of a PERL script that groups the registers according to their identification name or analogous computer program. Since the list originates from a description at the RTL level (register-transfer-level), the registers are the base elements of this description and are therefore employed in order to identify the elementary parts EP, which, as said comprise the receiving register and the logic cone that generates its state, as better described again with reference to  FIG. 3 , extended or rather, the set of circuital elements which pertains to a data register. In fact, once the registers to which the elementary parts EP pertain are identified, extraction of the information relative to the input logic cones and/or the output cones corresponding to each register is envisaged. This information relative to the logic cones comprises the composition of the logic cone, for example in terms of counting the gate number (which can serve for calculating the area of the cone), counting the PINs, the number of sources (inputs of the input logic cone) and the number of loadings (outputs of the output logic cone), interconnections and other values, known per se in the state of the art. In particular, by way of example, but not limiting, in the case of a gate-level description, this information is extracted from the netlist, employing commands available in the synthesis tool, in order to extract the gates that compose the “fan-in” and “fan-out” of each elementary part EP, intended as a register. The gate count values and other values can be calculated with specific script, based on these fans-in and fans-out. By way of example, a synthesis tool for Verilog, such as the Synopsis tool comprises, for this purpose, the commands “transitive_fanout” and “transitive_fanin”, which extract from the description of the circuit number and type of logic gates in the input logic cone in a data register, or which start from the register, in an output logic cone. According to this information, it is then straight-forward to calculate the number of gates (gate count), which, as said, can be employed as a measure of the area of the logic cone. 
         [0044]    The information on elementary parts EP and their composition can be inserted into informative structures, such as a database with a record for every elementary part EP, containing information on the gates that the input and/or output logic cone comprises and one or more of the extracted parameters discussed above, such as the gate count. 
         [0045]    In  FIG. 3 , three elementary parts EP 3 , EP 2 , and EP 1  are shown, in particular, which correspond to the input logic cones that pertain, respectively, to: 
         [0046]    an R 3  register, dislocated in the ALU  11   a , starting from the R 4  registers in the ALU and R 6  in the block registers  11   b , implementing, by way of example, a function corresponding to an observation point O 3 , of the sum of registers, or somma_reg, 
         [0047]    an R 2  register, in the LSU  11   d , from the R 5  registers in the ALU  11   b  and R 6  in the block registers  11   b , implementing, by way of example, a function corresponding to an observation point O 2 , of loaded data, or datocaricato_reg, 
         [0048]    an R 1  register, in the LSU  11   d , from the R 5  and R 7  registers in the FPU  11   c , implementing, by way of example, a function corresponding to an observation point O 1 , of memorized data, or datomemorizzato_reg. 
         [0049]    With the observation point O 3 , a root failure mode RFM 1  is associated, relative to an incorrect value produced by the sum operation. With the observation points O 2  and O 3 , a root failure mode RFM 2  is associated, relative to an incorrect value loaded from the memory or sent to the memory. 
         [0050]    Still with reference to the flow diagram of  FIG. 7 , the calculation of a failure rate for each elementary part λ EP  characterized at step  210  is then envisaged (step  220 ), for example using the method described in the U.S. Pat. No. 7,937,679 (note in particular the calculation of the cumulative failure rate for the responsive zones, corresponding to the elementary parts, described in column 10 line 31 to column 11, line 42 of U.S. Pat. No. 7,937,679, whose material is here considered incorporated for reference), or rather attributing a failure rate to each of the elementary functions, for example logic gates L and registers R or flip flop, which constitute the elementary part EP. 
         [0051]    Then (step  230 ), the elementary parts EP are grouped and connected according to respect root failure modes RFM. This grouping can be carried out using, also automatically, for example the “name” of the elementary part EP, or rather the register name to which it belongs (for example, /processore/ALU/somma_reg) in order to characterize the functionality (in this case “sum”) to which to connect the root failure mode RFM. This grouping is analogous to the cited grouping of the registers through a PERL script for compacting the list of the registers. Alternatively, this step  230  can be implemented completing a detailed analysis of the physical implementation of the circuit suitable for identifying the functionality to which every elementary part EP contributes. This can be manual or through a computer program, for example, a script configured for this analysis and detailed grouping or to a specific computer program not linked to off-the-shelf tool commands such as a script. 
         [0052]    Then (step  240 ), to each root failure mode RFM is assigned one a failure rate λ RFM  resulting from the sum of the failure rates λ EP  of the elementary parts EP that constitute it. 
         [0053]    The root failure modes RFM (step  250 ) are arranged in a list LF in which the root failure mode RFM that has the highest failure rate λ RFM  is placed at the top of the list, and so on in a decreasing order. Of course, an increasing order is also possible. 
         [0054]    In step  260 , an estimation is made—for each root failure mode RFM—of the fraction of dangerous failures of these totals, for example, evaluating the SFF (Safe Failure Fraction). This SFF value, which is also that indicated in the last column in Table 1 below, is calculated based on safeness S and diagnostic coverage DC, in particular SFF=S+DC (SFF=(safe failures+dangerous failures detected)/total failures=S+DC). 
         [0055]    In a step  270 , all the effective faults Ge are finally selected for the injection, or rather the faults G afferent to the elementary parts EP of effective root failure modes RFMe, or rather, the root failure modes that result in being capable, if the corresponding estimates SFF are confirmed, of reaching the overall objective of diagnostic coverage defined by the international standards. 
         [0056]    Table 1, below, corresponds to the list LF of the step  250 , or rather the portions of circuit from which to select the faults. 
         [0000]    
       
         
               
               
               
               
               
             
               
               
               
               
             
           
               
                   
                 TABLE 1 
               
               
                   
                   
               
               
                   
                   
                   
                   
                 Estimated 
               
               
                   
                 Failure 
                 Elementary 
                 Failure  
                 dangerous 
               
               
                   
                 mode 
                 parts 
                 rate  
                 failures/total 
               
               
                   
                 RFM 
                 EP 
                 λ RFM   
                 failures SFF 
               
               
                   
                   
               
             
             
               
                   
                 RFM2 
                 EP1, EP2 
                 64.4% 
                  100% 
               
               
                   
                 RFM1 
                 EP3 
                 30.6% 
                   0% 
               
               
                   
                 RFM3 
                 EP . . . .  
                  5.0% 
                   90% 
               
             
          
           
               
                   
                 TOT 
                  100% 
                  68.9% 
               
               
                   
                   
               
             
          
         
       
     
         [0057]    It should be noted that it is equally possible to have two tables like Table 1, one having the safeness S in the last column, and the other diagnostic coverage DC. 
         [0058]    In step  270 , in this case, RFM 2  is selected as the effective root failure mode RFMe, and consequently all the faults G afferent to the elementary parts EP that concur to this mode RFM 2  are selected for the injection. 
         [0059]    From the example of  FIG. 3 , it can be seen that this procedure significantly reduces the number of faults to inject, because only those relative to the elementary parts EP 1  and EP 2  are verified through injection of faults. 
         [0060]    Steps  210 - 270  therefore allow selection of how many and which are the “indispensable” faults to inject. 
         [0061]    The method envisages, moreover, to estimate when to inject these faults, in order to avoid that these faults must be injected throughout the entire time frame of the reference application used for the simulation. This is obtained through additional steps. 
         [0062]    With reference to the temporal diagram of  FIG. 4 , which reports the function of the time values assumed from observation points O 1 , O 2  and registers R 1 , R 2 , R 3 , and to the flow diagram of  FIG. 7 , where an additional method  300  is described, it is therefore also envisaged to:
       simulate  310  the reference application, indicated by A, generating the simulation values SV for all the registers of the elementary parts EP which have been selected at step  270  for all the observation points O relative to the effective root failure mode RFMe under examination;   select  320  one or more “windows of opportunity” W, or rather, in particular, temporal windows in the duration time of the simulation, within which to inject faults in an equidistributed manner, as portions of the simulation in which there is the maximum activity of the registers, for example R 1 , R 2 , R 3 , to which the elementary parts EP belong, for example, respectively EP 1 , EP 2 , EP 3 , and of the observation points O, for example, respectively O 3 , O 2 , O 1 . Activity signifies, in the digital circuits, the change of state of the signal from zero to one or vice versa. In order to calculate the maximum activity, in particular, for example, all the windows that have a value of activity greater than a threshold are selected, defined on the basis of the circuit and the level of required safety, for example greater of 50%       
 
         [0065]    The selection  320  of the windows of opportunity W allows reduction of the time valid for injection by several orders of magnitude. 
         [0066]    In order to improve the effectiveness of the method described here, it is envisaged that the simulation method can then quickly arrive at the instant during the simulation in which the window of opportunity W is opened, without having to wait for all the time that elapses, which, in certain cases, can be very high. Take, for example, a generic simulation of a microcontroller where one wide initial portion is formed by the initialization procedure of the processor in which a large part of the circuit is, in fact, inactive: this portion is not included in the windows of opportunity W, but occupies an important part of the simulation time. 
         [0067]    To this end, an additional method  400  is provided, which, with reference to the temporal diagram of  FIG. 5 , that traces the same magnitudes of the diagram of  FIG. 4 , comprises: 
         [0068]    executing  410  a simulation of the reference application A without faults, 
         [0069]    saving  420  the “snapshots” F 1 , F 2 , . . . Fn of the simulation at regular intervals of time, or rather saving the state of all signals of the electronic circuit  11 , 
         [0070]    identifying  430  which snapshot Fi immediately precedes the window of opportunity W. In  FIG. 5 , it is the snapshot F 3 . 
         [0071]    loading  440  this identified snapshot Fi, or rather loading in the simulation, the state of all the signals of the memorized electronic circuit  11  in this snapshot Fi, and 
         [0072]    starting  450  the simulation of the circuit  11  from the final instant t fin  of the selected snapshot Fi. 
         [0073]    In this way, step  440  allows further reduction of the simulation time avoiding the simulation of “useless” intervals, those in  FIG. 5  F 1  . . . F 3 , of the reference application A, or rather intervals in which there are no windows of opportunity W to inject. 
         [0074]    The method comprises, moreover, a method  500  for defining a strategy for identifying which faults are injected, in the case of a new circuit  21  obtained as a modification of a previously injected one, for example, circuit  11 . The circuit  21  is defined as derivative, or rather an electronic circuit derived from a preceding circuit. 
         [0075]    This method  500  comprises, with reference to the flow diagram, steps comprising, with reference to the diagram of  FIG. 10 :
       defining  510  the root failure modes RFM for the derivative circuit  21  and repeating the procedure of connection  220 - 230  with the elementary parts EP and selecting  270  the root failure modes RFM to inject, as previously described, or rather, the procedure  200 . Of course, step  510  can envisage that the procedure  300  is also executed in order to identify one or more windows of opportunity W, or the procedure  400  in order to start the simulation in proximity of the window of opportunity W;   counting  520 , in particular as a percentage value, how many elementary parts EP of the derivative circuit  21  do not find a correspondent in the elementary parts EP that have been previously determined, by means of the procedure  200 , for the circuit  11 , or rather, how many non-correspondent parts NEP there are;   calculating  530 , for a given root failure mode RFMi to be injected, a “distance” dλ %, in percentage value between one cumulative failure rate of the circuit  11 , or rather the sum of the failure rates λ RFM  of the elementary parts EP connected to the selected root failure mode RFM, and the correspondent cumulative failure rate of the derivative circuit  21 ;   selecting  540  the failure modes rRFMe to reinject into the derivative circuit  21  from the modes RFMe determined at step  510 , in particular those which have a number of different elementary parts NEP greater than a prefixed threshold TH or which have a greater distance dλ % than said prefixed threshold TH; in alternative to the re-injection, the expert in the field can analyze each identified different elementary part NEP at step  510  and evaluate the reason for this difference, and then decide if it is necessary to re-inject or if it is possible to deduce the result of the injection from those of the analogous elementary parts EP of the circuit  11 ;   selecting  550  the failure modes RFM and identifying, at step  510 , which of the results of the injection of the circuit  11  can be reused, such as those which have a different number of elementary parts EP lower than the said prefixed threshold and which have a smaller distance of the said prefixed threshold.       
 
         [0081]    The prefixed threshold percentage TH is set up, in particular by an expert technician, according to the provided safety mechanisms and according to the type of circuit: for example if a circuit envisages a total redundancy as a safety mechanism, the threshold TH can be raised (for example 40 or 50%) as it is, however, guaranteed that the faults will be revealed and therefore the new injection is superfluous. If instead the circuit envisages a safety mechanism such as, for example, a periodic test for which it is not possible to know, at first, if it will be able to cover the elementary part that differs, then the threshold TH is kept low (for example 20%). 
         [0082]    In the following Table 2, the decisions taken are summarized according to threshold TH by means of: 
         [0000]    
       
         
               
               
               
               
             
           
               
                   
                 TABLE 2 
               
               
                   
                   
               
               
                   
                 NEP 
                 dλ% 
                 Decision 
               
               
                   
                   
               
             
             
               
                   
                 &lt;TH 
                 &lt;TH 
                 Reuse the results 
               
               
                   
                   
                   
                 of injection of  
               
               
                   
                   
                   
                 the circuit 11 
               
               
                   
                 &gt;TH 
                 Any 
                 Repeat the 
               
               
                   
                 Any 
                 &gt;TH 
                 injection. 
               
               
                   
                   
               
             
          
         
       
     
         [0083]    The procedure  500  allows the drastic diminishing of the number of faults to inject for every new derivative circuit. 
         [0084]      FIG. 11  shows the method of simulating faults in integrated circuits of electronic systems implementing applications A under functional safety in its entirety. This method, indicated by reference  1000 , above all comprises applying the procedure  200  to the circuit  11  and obtaining the effective failures Ge to inject, as well as the effective root failure modes RFMe, that is, the root failure modes that result in being able to, if the correspondents estimations SFF are confirmed, to reach the overall objective of diagnostic coverage defined by the international standards. These effective failures Ge are passed to step  110  of injection of faults during the simulation step. Downstream of this step  110  it is envisaged to monitor the observation points and/or diagnostic points in order to identify dangerous failures GP. 
         [0085]    Additionally, with respect to the procedure  200 , it is possible, based on the effective failures Ge to inject, as well as effective root failure modes RFM selected from the procedure  200 , to apply a procedure  300  in order to identify a window of opportunity W in which to operate the simulation step  110  of the application with injection of faults. 
         [0086]    Additionally, with respect to the procedure  300 , it is possible, based on one or more identified windows of opportunity W, through the procedure  400 , to memorize snapshots F 1  . . . Fn of the simulation of the circuit  11  at various intervals and to identify an instant of time t fin , relative to the end of a snapshot Fi immediately preceding the beginning of the window of opportunity W with respect to which to start the simulation  110  with injection of effective faults Ge. 
         [0087]    Additionally, with respect to the procedures  200 ,  300 ,  400 , the method  1000  can comprise, when the electronic circuit is a derivative circuit  21 , or rather derived from an electronic circuit  11  for which the procedure  200  has been executed, or both the procedure  200  plus the procedure  300  or the procedure  200  plus the procedure  300  plus the procedure  400 , the execution of a procedure  500  which, through the comparison of elementary parts EP obtained at the procedure  200  on the circuit  11 , with the elementary parts EP obtained by applying the procedure  200  on the derivative circuit  21 , identifies effective root failure modes rRFMe to re-inject with respect to only those to execute the operation  110  as a re-injection process. In addition, the procedure  500  also identifies effective root failure modes uRFMe for which they can be reused, as results of the simulation, the results previously obtained by injecting faults for the circuit  11 , without repeating the injection step  110 . 
         [0088]    Therefore, from the description, the advantages of the invention are clear. 
         [0089]    The method and system described advantageously allow identifying which and how many faults to inject as a function of the objective of diagnostic coverage and according to the connection between the failure modes of the integrated circuit and its elementary parts. 
         [0090]    The method and system described advantageously allow identifying a “window of opportunity” of the reference application within which to inject the faults. 
         [0091]    The method and system described advantageously allow saving the intermediate states of the simulation and their use to reduce the interval of time effectively simulated for every injection concentrating it around the “window of opportunity”. 
         [0092]    The method and system described advantageously allow identifying how many faults must be re-injected in one derivative of an integrated circuit already injected previously with the procedures according to the method described here; 
         [0093]    Various combinations of the procedures described and their implementation by means of a calculation tool consequently allows the reduction of the number of faults to inject, and therefore reduction of the injection times, by four or more orders of magnitude—with the result of a considerable cost reduction of the verification of the functional safety. 
         [0094]    Of course, without prejudice to the principle of the invention, the details and the embodiments can vary, even significantly, with respect to what is described here purely by way of example, without deviating from the field of protection. This field of protection is defined by the attached claims. 
         [0095]    The method described here refers to the implementation for the simulation on at least one processor or computer, which, as said, can be an implementation in a modular and/or distributed form, for example on an architecture of server processors. 
         [0096]    The method of simulating faults into integrated circuits of electronic systems implementing applications in functional safety with injection of faults described here, as indicated previously, can be integrated as a step, also recursive, of design procedures of electronic systems or circuits (EDA, Electronic Design Automation). 
         [0097]    These design procedures are usually associated, in a production process of the electronic system, with a physical production step, at the silicon foundry level, of the electronic system and also with a production step of a program that is executed on this electronic system, based on the results of the design procedures, in turn including one or more applications of the described simulation method. For example, the design procedure described here is part of the production process of highly reliable microcontrollers such as those described in the U.S. Pat. No. 7,472,051 by the same Applicant.