NXP嵌入式软件质量保证

1、SW Quality: essential for NXPpresentation for Bits&Chips 2008, Eindhoven, 9 October 2008Kees Lepoeter, NXP product manager IP & SW QualityV3, 15 September 2008August 2008 CONFIDENTIALSWTC, june 2008 2 2 2Outline Introducing NXP SemiconductorsTrendsSW Quality: do we have an issue?Current init

2、iatives in NXPSW Quality landscapeSW CertificationConclusionsAugust 2008 CONFIDENTIALSWTC, june 2008 3NXP SemiconductorsSpin-out of Royal Philips Electronics Semiconductor DivisionTop-10 global supplier with Sales of $ 6.32 Bln (2007*)31,000 employees / 6,000 engineersInvesting $1.4 Bln in R&D a

3、nnually (2007*)5,700+ patent families More than 26 R&D centers in 12 countriesParticipation in over 100 standardization bodies and consortia*) These figures include the Mobile & Personal Business which is largely part of the ST NXP Wireless JV since August 2, 2008August 2008 CONFIDENTIALSWTC

4、, june 2008 4TrendsInnovation and time-to-market determine margins Winner takes it allGrowing software complexity in silicon industry Including increasing amount of 3rd party SWGrowing % of IC returns due to software failures Can lead to project delay, cost of non-quality or unsatisfied customersHig

5、h quality drive from customers High quality requirements especially from the Automotive industry Requesting TS16949, Zero Defect, MISRA, Automotive Spice, Use of advanced tooling at customer site to check incoming software E.g. QAC, Coverity, Klocwork, August 2008 CONFIDENTIALSWTC, june 2008 5Exampl

6、es from Automotive industryPrevention of SW problem (un-initialized memory) in Car Radio chip Estimated cost in case of recall: 5 million Cars x 100$ / car Fortunately this could be solved by SW workaroundAutomotive customers require Quality Agreement signed SW quality agreement needed as prerequisi

7、te for new businessVery high quality requirementsAutomotive Spice level 3 (CMMi like, but more strict)MISRA, metrics, review suppliers, PR support guarantees, etc.If these requirements are not met, product is not acceptedAugust 2008 CONFIDENTIALSWTC, june 2008 6What is this ?/* Woooops. */#define RL

8、C_MOD_N_COMPARE(_n1, _n2, _b1, _b2, _N) ( (_n1) = (_n2) ? 0 : (_b1) = (_b2) ? (_n1)-(_n2) : (_b1) = (_n1) & (_b1) (_n2) | (_b1) = (_n2) & (_b1) (_n2) & (_b1) (_n1) ? (_n1) -(_n2) : (_n1) (_n2) ? -(_n2) + (_N) - (_n1) : (_n1) + (_N) - (_n2) )August 2008 CONFIDENTIALSWTC, june 2008 7Explan

9、ationThis is a C macroThis macro belongs to one of the key NXP products This macro contained (at least) one bugThe effect of this bug has troubled a large NXP customer recentlyAfter a waste of time of several people in integration and development teams, two full days of analysis from an architect ha

10、ve been necessary to discover the root cause of the issue (signedness issue) and then the bugIt appeared that this bug was related to a MISRA violation, and could have been prevented if Static Code Analysis would have been applied: NXP Rule QL3:MISRA.12.9 The unary minus operator shall not be applie

11、d to an expression whose underlying type is unsigned.August 2008 CONFIDENTIALSWTC, june 2008 8 8 8Outline Introducing NXP SemiconductorsTrendsSW Quality: do we have an issue?Current initiatives in NXPSW Quality landscapeSW CertificationConclusionsAugust 2008 CONFIDENTIALSWTC, june 2008 9HumanResourc

12、esMethods& ToolsArchitectureProcess Enabling dimensionReference Model to address SW topicsTimeToMarketBudget &BusinessModelsProductSpecification & QualityProject dimensionHumanResourcesMethods& ToolsArchitectureProcess Enabling dimensionReference ModelHow do enabling technologies inf

13、luence SW quality?Process Mature process condition for (SW) quality CMMi / DisciplineArchitecture Excellent, but simple design is key to high quality (SW) productMethods & Tools Landscape of methods & tools to verify specification, design and implementation quality Focus of this presentation

14、August 2008 CONFIDENTIALSWTC, june 2008 10Currently running initiatives1.NXP-wide deployment & management attentionMISRA-C Coding guidelinesNXP dashboard with SW Quality metricsExpert reviews e.g. w.r.t. SW architecture and Project managementRequirements coverage and traceabilityTest/decision co

15、veragePost-release Defect Density2.Enablers and pilotsSW Design Environment based on EclipseStandardized configuration mgt approachDiversity Management ready for roll-outRoot cause analysis of problem reportsFormal methods3.Research topicsModel driven engineeringAugust 2008 CONFIDENTIALSWTC, june 20

16、08 11Static Code analysis in NXP Deployed at all SW development teams in NXP that develop software in C The following standards and tools are being introduced: MISRA coding standardsindustry standard, widely used and accepted in the embedded system domain QAC static code analysis toolthis will check

17、 the SW for MoReUse/MISRA compliance TICS quality database and reporting infrastructureAugust 2008 CONFIDENTIALSWTC, june 2008 12MISRA Code Quality Levelsas defined within NXP1: Undefined Behaviour2: Dangerous Constructs3: Hard to Debug4: Maintainability Issues5: Good Practices6: Advisory MISRA Rule

18、sFocus on elimination ofLevel-1 and 2violationsLevel-5 is equivalent tofull MISRAcomplianceAugust 2008 CONFIDENTIALSWTC, june 2008 13Next step: Introduce Advanced Static Code CheckerRationale New generation of Static Code Analysis tools has emerged in the past years These tools are known to be very

19、effective in finding actual bugs in the SW such as memory corruption and locking errors. Some can also detect security vulnerabilities Customers such as Samsung use these tools as incoming inspectionApproach Select preferred tool for NXP (evaluation currently ongoing) Assess applicability for bug hu

20、nting, data & control flow analysis, security rules checking, MISRA compliance checking Deploy in 2009August 2008 CONFIDENTIALSWTC, june 2008 14Metrics related to SW QualityCentrally collected Source Lines of Code MISRA compliance McCabes Cyclomatic complexityCentrally collected (being introduce

21、d ) Test coverage / Decision coverage Requirements coverage Post-release Defect DensityLocal NXP initiatives Compiler warnings Dead code and Code duplication Code reviews PR/CR statusAugust 2008 CONFIDENTIALSWTC, june 2008 151515Outline Introducing NXP SemiconductorsTrendsSW Quality: do we have an i

22、ssue?Current initiatives in NXPSW Quality landscapeSW CertificationConclusionsAugust 2008 CONFIDENTIALSWTC, june 2008 16Zero-Defect SW Methods Landscapeversion 1.6, 26 August 2008Already addressedProposed extensionSoftwareDevelopmentLifecycleRequirementsDesign & Verification MethodsFormal Analys

23、isduring run-timeCodingTestingDesignResourceUsage & LeakanalysisCodeGenerationModelCheckingRequirementManagement,Engineering&TraceabilityModeling: UML Model Driven Engineering Domain Spec Languages Formal MethodsArchitectureGuidelinesCompilationWarningsanalysisCoding Rulesanalysis(MISRA)Data

24、 & ControlFlow analysisRun-Time /Security RulesanalysisSystem Testing:Requirements,Load & StressUnit Testing:Code Coverage& SpecsIntegration Testing:Interoperability & InterfacesEnablers: Diversity, Build & Config. Mgt, SWDE, Debugging, Automation, CMMi & TMMi, DfX/SW reviews

25、, Numetrics, .Reverse Engineering / Model Extraction /SW DocumentationTimingAnalysis(on SoC)Not done(centrally)Legend:Human factorCode reviewsAugust 2008 CONFIDENTIALSWTC, june 2008 17SW certificationPlan is to certify SW before it is used in NXP products, as part of the Design-for-Excellence program in NXPCertification based on expert review including data collection for: SW code quality (e.g. code reviews, static code analysis) Test Quality (e.g. test coverage, test effort) Test results (e.g. # of new PRs (almost) 0, customer test results) Release quality