Design for test (DFT): scan chains and BIST

The big idea

A chip factory is amazingly precise, but not perfect. A speck of dust can join two wires that should stay apart, or a wire can come out broken. These flaws are called . Some chips in every batch have them. So every single chip has to be tested before it ships.

This is a different job from verification. Verification asks “is the design right?” It happens once, before anything is built. Manufacturing test asks “did this copy come out right?” It happens to every chip.¹

Catching a bad chip early is cheap. Once it is soldered onto a circuit board, finding and replacing it costs about ten times more. The cost keeps growing at every later step.¹²³

Chips are made many at a time on a thin silicon disc, the , and the process is never perfect. A few copies come out with : two wires shorted together, a wire broken, a transistor badly formed. The share of copies that come out working is the . Since nobody can see which copies are bad, every chip has to be tested electrically before it ships.¹

That test is not the same as verification. Verification checks the design for mistakes, once, before anything is built. Manufacturing test checks each physical copy for defects, and runs on every chip.¹ No real test is perfect. A bad chip that passes is a ; a good chip that fails is yield loss.¹

Testing a chip from the outside is hard because almost everything that matters is buried. A chip stores its working data in millions of , tiny one-bit memories that update on each tick of the chip’s clock, but it may have only a few hundred pins. is the set of design techniques that make testing cheap to create, run and judge.¹ Most of it is added right after synthesis, to the (the list of every logic gate and flip-flop in the design and the wires between them). Flip-flops are linked into test chains, memories get small built-in testers, a standard test port is added, and software works out the the factory tester will run.

How good does the test need to be? Test software counts imaginary faults, and the share its patterns would catch is the . A classic formula from Williams links yield $Y$ and coverage $T$ to the share of shipped chips that are bad, the defect level:

\mathrm{DL} = 1 - Y^{\,1-T}

With 90% yield, 90% coverage ships about 10,000 bad chips per million (written , defective parts per million), 99% coverage about 1,000, and 99.9% about 100.¹⁰ Each extra “nine” of coverage cuts the bad chips tenfold, which is why test teams fight over fractions of a percent.

DFT is the set of structures that make a netlist testable at acceptable cost. Each covers a different part of the chip:

Scan and compression for random logic: flip-flops become shift registers the tester can load and unload, and on-chip compression cuts the data that has to move.
(memory built-in self-test) for embedded memories, which scan reaches poorly.
(logic built-in self-test) where the chip must test itself, in the field or with little tester help.
and , the standard test port and the network behind it that reaches all of the above.

The results are judged on under several fault models, on pattern count and test time, and on what the structures cost in area, timing and power.¹⁷

The economics come from the Williams relation between yield $Y$ , coverage $T$ and shipped defect level:

\mathrm{DL} = 1 - Y^{\,1-T}

Plug in $Y = 0.9$ . At $T = 0.99$ the exponent is 0.01 and $\mathrm{DL} \approx 0.001$ , about 1,000 defective parts per million (DPPM). At $T = 0.999$ , $\mathrm{DL} \approx 0.0001$ , about 100 DPPM.¹⁰ Stuck-at coverage alone doesn’t reach low-DPPM targets, because timing-related defects and defects nobody modeled escape it; even a 100% stuck-at test run at speed is not enough on its own.¹⁶ Defects inside library cells also escape pin-level models, and cell-aware patterns catch parts that passed stuck-at and transition sets. So production programs stack several fault models.²⁰

Shipped DPPM at 90% yield and 99% coverage (Williams model): ≈1,000
Same yield, 99.9% coverage: ≈100
Full-scan gate overhead, textbook example (100k gates, 2k flops): 6.7%

The first two numbers come from the Williams curve as tabulated in NYCU’s course notes; the third from the TU Delft scan-design lecture’s overhead formula, worked through under “How it works.”¹⁰⁷

Fault coverage99.0%

Yield90%

Yield 90%, fault coverage 99.0%: defect level ≈ 1,050 DPPM (defective parts per million shipped).

The Williams model: shipped defect level against fault coverage, on log scales. Each extra nine of coverage cuts the bad chips shipped about tenfold. Lower yield shifts the whole curve up.

In and out

DFT starts with the chip’s parts list from synthesis. It adds the test hardware and writes the tests for the factory’s test machine. It also reports what share of possible flaws those tests would catch.

DFT takes in the design as synthesis left it and hands out the same design with test hardware added, plus everything the factory needs to run the test. The files have standard formats, named in the table:

Verilog is a text language for describing hardware; here it holds the netlist.
Liberty (.lib) and LEF describe the , the library of pre-built gates and flip-flops: Liberty gives their timing and power, LEF their shape for layout.
holds the timing rules, such as how fast the clock runs.
Tcl is the scripting language most chip tools are driven with.
is a layout file; its SCANCHAINS section lists which flip-flops make up each test chain.
BSDL describes the chip’s standard test port and pins for board testers.

Direction	What	Format
In	Synthesized gate-level netlist	Verilog
In	Cell library with scan flop variants (SDFF_X1 next to DFF_X1)	Liberty (.lib), cell LEF
In	Functional timing constraints	SDC
In	DFT configuration: chain count or length, scan ports, compression ratio, clock mixing, memory list for MBIST	Tool script (Tcl)
Out	Scan-inserted netlist with compression, BIST controllers and TAP	Verilog
Out	Scan chain description for placement-aware reordering	DEF SCANCHAINS section
Out	Test-mode constraints (shift, capture, BIST modes)	SDC
Out	Boundary-scan description of the chip’s pins	BSDL
Out	Test patterns and expected responses; fault lists and coverage reports	Tester pattern files; text reports

The library has to offer a scan version of every flip-flop (SDFF_X1 beside DFF_X1): the same cell plus a test input and a mode switch. Inserting scan works by swapping each flip-flop for its scan twin.²² The patterns end up in the test program, the software that controls the factory tester.²

Two outputs matter later than people expect. The scan chain description tells placement which chain segments it may reorder, and the chain order that comes out of layout is what pattern generation and the test program are built from, so a reorder means regenerated patterns.⁷ ATPG also reads its own cell models, the test-mode constraints and the clock definitions, and those must match how the tester will actually drive the chip. BSDL records the length and order of the boundary-scan register, the instruction codes and where the test-port pins are, which is what board-test tools need.⁹

Tap an input or an output to see what it holds.

DFT’s inputs (left) and outputs (right), as in the table above. Tap any of them.

How it works

Pretend flaws

Real flaws come in endless shapes, so software uses a simple stand-in. It pretends one wire is stuck at 0 (always off) or stuck at 1 (always on). A good test is one where the stuck wire would change the chip’s answer. The share of these pretend flaws that the tests would catch is called the .³

Scan chains

A chip is full of tiny memory cells, each holding a single 1 or 0. Most are buried deep inside, out of reach. DFT gives each one an extra side door. In test mode, the cells link up into long lines called . Values pass along them like buckets in a bucket brigade.⁷

A test then has three steps:

Shift in. The tester feeds 0s and 1s into the chain, one at a time, until every cell holds a chosen value.
Capture. The chip takes one normal step. The logic between the cells works on those values, and each cell catches a result.
Shift out. The results slide out to the tester, which compares them with a good chip’s answers. Any difference means the chip is bad.

Software picks the test patterns. It aims to catch as many pretend flaws as possible with as few tests as possible.¹⁰

Testing at full speed

Some flaws don’t break a wire. They just make a signal a little late. To catch these, the capture step runs at the chip’s real speed.⁶

Fault models: a countable list of things that can go wrong

There are endless possible physical defects, so test software works with a : a simple, logical description of what a defect does. The classic one is the single : assume exactly one wire is permanently 0 (stuck-at-0) or permanently 1 (stuck-at-1). Every input and output of every gets both faults.³

A test for a fault has to do two things: make the faulty wire carry the opposite of its stuck value, so good and faulty circuits differ there, and pass that difference along to a point the tester can see. Take a two-input AND gate whose output is stuck at 0. Only inputs 1, 1 make a good AND output 1, so that is the only pattern that tells the two circuits apart.¹² Some faults behave identically under every possible test; they are called equivalent, and keeps just one from each group.³

Stuck-at misses some kinds of defect, so other models cover them:³

: a wire is too slow to rise or too slow to fall. The test first sets the wire to its old value, then flips it and checks the result at full speed.⁶
: a whole chain of gates is a little slow, adding up to too slow. The number of such paths grows explosively with circuit size, so only the slowest (critical) paths are tested.⁶
: two wires shorted together.³
: defects inside a library cell, simulated in detail and turned into conditions on the cell’s pins.²⁰

is the number of detected faults divided by the total. Fault efficiency divides by the faults that can be tested at all, so (in redundant logic, for example) don’t count against the patterns.¹³

Scan: reaching the buried flip-flops

A circuit has two kinds of parts. (the gates) computes outputs from its current inputs. Flip-flops hold the results between clock ticks, and their contents feed the next round of logic. Testing a gate deep inside means setting the flip-flops in front of it and reading the flip-flops after it, which the pins can’t do directly. The test needs : the power to set any point and to see any point.⁷

Scan provides both. Each flip-flop is replaced by a , which has a two-way switch, a multiplexer, in front of its input. A control signal called (SE) sets every switch at once. With SE = 0 each flip-flop takes its normal input from the logic. With SE = 1 it takes its scan input instead, which is wired to the output of the previous flip-flop. The first scan input comes from a scan-in pin and the last output goes to a scan-out pin, so in test mode the flip-flops form a , a long shift register.⁷

Scan only works if the design keeps a few rules: state is held only in clocked flip-flops, every flip-flop’s clock can be controlled from a pin, and no clock signal feeds a flip-flop’s data input.⁷ With every flip-flop in a chain, test software can treat each flip-flop output as an extra input it can set and each flip-flop input as an extra output it can read. The hard problem of testing a circuit that remembers things over time becomes the much easier problem of testing plain logic.⁷

Shift and capture

Every pattern follows the same cycle. With SE = 1, the tester clocks the chain once per flip-flop to load the pattern. With SE = 0, it gives one normal clock tick, and every flip-flop captures what the logic computed. Then it shifts again, which unloads that result while loading the next pattern.⁷

Shifting is where the time goes. One chain of 2,000 flip-flops tested with 500 patterns needs about a million clock ticks.⁷ Chains shift side by side, so splitting the flip-flops into many short chains divides that time. The time to load one pattern equals the length of the longest chain, so chains are made equal in length.⁷⁸

Large chips have several clocks, and the flip-flops driven by one clock form a . Tools can keep each chain inside one domain.²² Where a chain has to cross from one domain to another, the two clocks may arrive at slightly different times, and a fast-arriving bit could skip a place. A between them holds the bit back so it can’t.²¹

Generating the patterns

(automatic test pattern generation) usually starts with random patterns, which catch the easy faults cheaply, then searches methodically for a test for each fault that is left.¹⁰ Random patterns easily reach 60–80% coverage, but the last few percent need the methodical search.¹² After each new pattern, checks which other faults it happens to catch, and those are crossed off. Finally, compaction merges and removes patterns to shrink the set.¹³

Testing at full speed

A slow defect gives the right answer if the tester waits long enough. To catch it, an uses two patterns. The first, V1, sets up starting values. The second, V2, makes some signals change, and the result is caught exactly one normal clock period later. Shifting can stay slow.¹⁵ There are two common ways to launch V2:

(LOC): shift V1 in, turn SE off, then give two fast clock ticks. The first tick loads V2, which is simply what the logic computed from V1; the second catches the result.¹⁵
(LOS): the last shift tick itself creates V2, then SE turns off and one fast tick catches the result. It catches more faults, but SE has to switch within one fast clock period everywhere on the chip.¹⁵

Compression

Test time and tester memory grow with chain length and pattern count. In any one pattern, only a small share of the bits matter to the faults it targets; the rest are “don’t care.” exploits that. A decompressor on the chip expands data from a few scan-in pins into hundreds of short internal chains, and a compactor squeezes the chain outputs back into a few scan-out pins.¹⁹¹⁸

Fault universe and accounting

Start with how big the fault list is. A fault site is any place a stuck-at fault can sit: each primary input, each gate output, and each fanout branch (each separate leg of a wire that splits to drive several gates). The single stuck-at list is twice the number of sites, two faults per site.³ Many of those faults are equivalent, meaning every test that catches one catches the other, so tools collapse each group to one representative. In the Delft course’s small example, 16 sites give 32 faults, which collapse to 20.³

Real programs run several models, each with its own fault list and report: faults (slow-to-rise and slow-to-fall at each pin); faults on the critical paths that timing analysis reports, preferring robust tests, which detect the fault whatever happens on other paths, where they exist;⁶ between wires that run close together; and faults. Cell-aware test SPICE-simulates each likely defect in each cell layout and records the input conditions that expose it, either within one clock cycle (static) or across two (delay). It exists because defects inside cells escape pin-level models and end up as shipped bad parts.²⁰

Always check a coverage number’s denominator. Detected over total is fault coverage. Detected over total minus the proven-untestable faults is fault efficiency, and different sources and tools use different names for the two.¹³¹² In a typical report, faults ATPG proved can never be tested (tied to a constant, blocked, or redundant) are a fair exclusion. Faults that are untestable only because of your own test setup, and “aborted” faults where the search gave up, are not: they are coverage you might still win back.

Scan architecture and its cost

A mux-D costs speed in two places. The multiplexer adds roughly two gate delays to the flip-flop’s normal data input, and the wire to the next flop in the chain adds one extra load on its output, about a 5–6% delay hit in the textbook estimate.⁷ The gate-count overhead is estimated as $4\, n_{\mathrm{sff}} / (n_{\mathrm{g}} + 10\, n_{\mathrm{ff}})$ : four extra gate-equivalents per scan flop, divided by the design’s gates plus flip-flops counted at ten gates each. For 100,000 gates and 2,000 flip-flops that is $8{,}000 / 120{,}000 \approx 6.7\%$ .⁷

The payoff is large. s5378 is a classic academic benchmark circuit with about 2,800 gates and 179 flip-flops. Making every flip-flop scannable raised its stuck-at coverage from 70.0% to 99.1% and cut test-generation CPU time from 5,533 s to 5 s, at a 15.66% gate overhead on that small circuit.⁷ Partial scan, which leaves some flip-flops out, gives back some area and timing, but then test generation has to reason across clock cycles again (sequential ATPG).⁷

Chain architecture is a set of constraints. Chains can be kept to one clock and clock edge each (OpenROAD’s -clock_mixing no_mix does this, and warns it may leave chains unbalanced). Lengths should be balanced, because the longest chain sets the shift cycles per pattern. go wherever a chain crosses clock domains or links flip-flops placed far apart, both cases where the two clocks can arrive at quite different times.²²⁸²¹ Gated clocks, and signals the tester can’t otherwise control, need test-mode control so every flip-flop shifts predictably. These are the scan rules, checked by design-rule audits before test generation.⁷

At-speed launch and capture, step by step

Both methods load V1 by slow shifting and catch the result one functional clock period after launch; they differ in where V2 comes from.¹⁵

(skewed-load): scan enable stays on for the final shift edge, so V2 is V1 shifted along by one bit. Scan enable then has to fall before the capture edge one fast period later, which makes it an at-speed signal spread across the whole chip. Because V2 is a shifted copy rather than the logic’s own output, V2 can be chosen more freely, and coverage is higher. The cost is that V2 may be a state the chip never reaches in normal use, so a good part can fail on a path that never needs to be fast.¹⁵
(broadside): scan enable falls after V1 is loaded and has plenty of time to settle. Two fast clock pulses follow: the first captures the logic’s response to V1, which becomes V2, and the second captures the response to V2. It is easier to build and closer to normal operation, but V2 is fixed by V1, so some transitions can’t be launched and coverage is lower.¹⁵

A third option, enhanced scan, adds a hold latch or second flop per scan cell so any V1, V2 pair can be applied. It costs area and puts extra delay on the functional path.⁶¹⁵

Compression

Compression rests on sparse “care bits.” A test for one fault, or a few, needs specific values in only a small percentage of scan cells; the rest can be anything.¹⁹ That lets a small decompressor, fed from a few tester channels, fill hundreds of short internal chains: it only has to get the care bits right. On the way out, an XOR-based compactor folds many chain outputs into a few channels.¹⁹¹⁸ The weak spot is unknown values. Simulation can’t predict some captured bits, for example from false or multicycle paths, and the compactor must cope with those values; blocking or masking them keeps them out, at some cost in coverage.¹⁹¹⁸ The achievable ratio is limited by how many care bits the hardest patterns need and by how many X’s reach the outputs. “Under the hood” shows the linear algebra.

Scan enable

SE = 0: each flip-flop takes its input from the logic, exactly as the design intends. The chain wires are idle.

Three scan flip-flops. Scan enable picks, for every flip-flop at once, between its normal input and its neighbor’s output. Tap a part.

Chip

Capture

Defective chip, slow capture: the delay defect makes the transition late, but the slow test waits long enough. A test escape.

A transition test: launch a change, then capture the result one clock period later. A slow capture hides delay defects. Delays are illustrative.

Chains1

Compression

1 chain of 2,000 flip-flops: 2,000 shift ticks per pattern, about 1,000,000 for 500 patterns. Each chain needs its own pins: 2 in all.

The chapter’s example: 2,000 flip-flops, 500 patterns. Shift time falls with the number of chains; compression lets many chains share a few pins. Pin counts are illustrative.

Memories, self-test and JTAG

Scan chains test the chip’s logic. Other parts need their own tricks.

Memories. Each memory block gets a tiny built-in tester. It writes values into every spot and reads them back.⁸ Many memories also carry spare rows and columns, so a chip with a few bad spots can be repaired instead of thrown away.⁵
Self-test. Some chips can make their own tests and check their own answers. That lets a chip retest itself later, for example each time a car starts.⁸
The test port. A small standard plug called JTAG, with four or five pins, lets engineers reach the test hardware inside. It also checks that every pin is soldered properly to the board.⁹⁸

Memory self-test

On-chip memories are dense grids of millions of tiny storage cells, and testing them through scan chains would take far too long. Instead, each memory gets (built-in self-test): a small controller beside it that generates addresses and data, writes and reads the memory, and compares what comes back. It runs at full speed, needs no expensive tester time, and can report which addresses failed.⁸

The tests it runs are . Each step walks through every address, going up (⇑) or down (⇓), and does the same short list of operations at each one: “w0” means write 0, “r1” means read and expect 1. One standard test, March C−, is {⇕(w0); ⇑(r0,w1); ⇑(r1,w0); ⇓(r0,w1); ⇓(r1,w0); ⇕(r0)}, where ⇕ means either order. That is ten operations per memory cell.⁵ Many memories include spare rows and columns of cells. When MBIST finds bad cells, spares can be swapped in, which raises memory yield dramatically.⁵

Logic self-test

lets the chip test its own logic. The most common scheme, called STUMPS, uses the scan chains. A small on-chip pattern generator, an , produces a long stream of random-looking bits to fill the chains. The results coming out of the chains are folded into one short “fingerprint” by a , and one comparison at the end says pass or fail.⁸

Random patterns have a blind spot: faults. Consider an AND gate with eight inputs whose output is stuck at 0. Only one input combination, all eight 1s, reveals it. With each random bit equally likely to be 0 or 1, that happens once in $2^8 = 256$ patterns on average, so logic BIST adds biased (weighted) random patterns or extra test hardware for such spots.⁸

JTAG and IJTAG

Circuit boards used to be tested with a “bed of nails,” a fixture of probes pressed against the board’s wiring. Dense, double-sided boards made that impractical, so the industry agreed a standard, , known as JTAG after the group that wrote it and standardized in 1990. It puts a small test cell behind each chip pin and adds a test port of four pins (TDI data in, TDO data out, TCK test clock, TMS mode select) plus an optional reset, TRST. A small controller behind the port steps through 16 states to load instructions and move test data. A board tester can then set and read every pin of every chip, one bit at a time, and check the wiring between them.⁹

The same port became the way into the chip’s other built-in test circuits. (internal JTAG, or IJTAG) defines a reconfigurable network of test chains behind it that reaches embedded “instruments” such as BIST controllers and temperature sensors.¹⁶

MBIST in practice

MBIST is generated per memory instance, and the March algorithm is chosen for the fault classes that memory needs covered: stuck cells, coupling between neighboring cells, address decoder faults and so on. Memories are why test time must stay linear in size. At a 10 ns cycle, a $10n$ test (ten operations per cell) takes 6.56 ms on a 64 Kbit array; a quadratic $10n^2$ test takes about 7 minutes on the same array, which rules quadratic tests out in production.⁵ Failing addresses from MBIST decide which spare rows and columns replace bad ones, and that redundancy raises memory yield dramatically.⁵

LBIST constraints

STUMPS (self-test using a MISR and parallel shift-register sequence generator) adds three blocks: a pseudo-random pattern generator, an optional phase shifter that makes adjacent chains receive less correlated bits, and a MISR on the outputs. Scan-based BIST is the form most used in industry, and one test takes as many shift cycles as the longest chain, plus one for capture.⁸

The hard requirement is X-free capture. A MISR is linear: each new state is the XOR of its old state and its inputs. So if any captured bit is unknown, every later state, and the final signature, is unknown too. Memories, non-scan flip-flops and analog boundaries therefore have to be blocked off from the chains during LBIST. Coverage is also capped by faults unless weighted patterns or extra testability hardware are added.⁸ In-field LBIST must also fit a power and time budget and restore normal state afterwards; the automotive page covers that case.

Access: 1149.1 and 1687

1149.1 requires an instruction register of at least 2 bits, a 1-bit bypass register that lets data skip a chip that isn’t being tested, and four mandatory instructions: EXTEST (drive and read the pins to test board wiring), SAMPLE and PRELOAD (snapshot or preset the pin cells while the chip runs normally), and BYPASS. IDCODE, INTEST and RUNBIST are among the optional ones.⁹

IJTAG builds on that port. Segment insertion bits (SIBs) splice sections of the internal test network into or out of the active path, so only the instruments in use add length.¹⁶ A description language, ICL, describes the network, and a procedure language, PDL, describes how to operate each instrument in terms of its own pins. Tools “retarget” PDL through the network up to the chip’s pins. This is how BIST engines, sensors and other instruments across a large chip share one port.¹⁷

Memory

1 / 7

An 8-cell memory, contents unknown. MBIST will run March C−: six passes, ten operations per cell. Press Next element.

MBIST running March C− on eight cells. Each element visits every address in the order shown. Plant a stuck-at cell at address 5 and see which element catches it.

Instruction

Boundary scan (EXTEST): the bits shift through a cell behind every pin, so a board tester can drive and read every pin.

The JTAG port and what sits behind it. The loaded instruction picks the path from TDI to TDO. Tap a part to name it. Layout illustrative.

DFT and the rest of the flow

Scan is normally added to the netlist right after synthesis. Tools check the scan rules, swap in scan flip-flops, wire up the chains, and run ATPG on the result. Layout then reworks the chain order, and timing is checked in the test modes too.⁷ OpenROAD, an open-source chip layout tool, splits the work the same way. scan_replace swaps the flip-flops before placement (deciding where every cell sits on the chip), because scan flip-flops are bigger. execute_dft_plan wires up the chains after placement, choosing an order that keeps the wires short.²² Later, can shorten them further, using the chain list in the DEF file. Lockup latches act as fixed break points it can’t reorder across.²¹

DFT costs some speed and area. Every flip-flop’s normal input now passes through the scan multiplexer, every flip-flop output drives one extra wire, and the scan wiring takes room.⁷ It also adds new timing to check. In shift mode, each flip-flop feeds the next directly, with almost no logic in between. If the next flip-flop’s clock arrives a little late, the new bit can race through before the old one is safely stored, a violation (the clock tree chapter explains hold).⁷²¹ Each test mode gets its own constraints file. In it, set_case_analysis fixes test control pins at constant values, so the timing tool only checks the paths that are active in that mode.²⁴

Testing also burns more power than normal use. During shifting, all the flip-flops change at once and the logic behind them flickers too, so switching can be double what the chip sees in normal operation, or more.²⁵

Test modes are timing scenarios in their own right, signed off alongside the functional ones. Shift mode usually runs slowly, so setup (data arriving too late) is easy, but hold on the direct flop-to-flop scan hops is critical. Lockup latches fix the cases where the two flops’ clocks come from very different branches of the clock tree, but each one is a break point that stops reordering across it, and too many of them lengthen scan routes and cause congestion.²¹ Capture mode at speed inherits the functional constraints. False and multicycle paths (paths the design deliberately doesn’t require to finish in one cycle) can capture unpredictable values at speed, so ATPG must treat their endpoints as unknowns and keep them out of the compared response.¹⁹¹⁸ set_case_analysis is the timing tool’s lever here. It sets constants on pins such as test_mode and scan_en; the constants propagate through scan muxes and clock muxes, and no paths are timed from constant pins.²⁴

Test power is its own budget. Test power is significantly higher than functional power, switching activity in shift can be double the functional level or more, and the resulting supply droop () can corrupt test results and fail good parts.²⁵ Shift dominates test time, and the quickest way to shorten it is to shift faster, but shift power caps the shift frequency. Mitigations include filling don’t-care bits to minimize toggling, scan cells that block their functional output while shifting, splitting chains into segments clocked one after another (staggered), and reordering cells or patterns to cut transitions.²⁵

Physical design inherits DFT decisions. Compression logic and MBIST controllers need floorplan space near their chains and memories. Scan reordering must respect chain partitions and lockups, and any change to chain order means new patterns.⁷ Late netlist edits (ECOs) that touch flip-flops must keep the scan stitching intact, or the chain breaks.

Chain order

Netlist order: 3184 units of scan wire and 10 crossings between clock domains, each needing a lockup latch.

Stitching one scan chain after placement (what execute_dft_plan does). Wire lengths in drawing units; placement illustrative. Tap a part.

On the tester

The tests run on a big, expensive machine that plugs into each chip, feeds in the patterns and checks the answers.² Each chip is tested at least twice.

Before the chips are cut apart. Chips are made hundreds at a time on a thin, round slice of silicon called a wafer. Tiny needles touch each chip to test it. Bad chips are marked and never packaged.
After packaging. Each good chip is sealed in a protective case and tested again, in case packing damaged it.

Some chips also run hot for hours before they ship, so weak ones fail in the factory instead of in a customer’s hands.² Results from failed chips point to where the flaw probably is. That helps the factory fix the cause.²⁶

The patterns run on (ATE), a computer-controlled tester that applies each pattern to the chip’s pins, compares the responses with the expected ones, and marks the chip good or bad.² Each chip is tested at two points. (or probe test) runs before the wafer is cut into individual chips (dies), using a probe card whose fine needles touch each chip’s pads. runs after each chip is sealed in its package. These production tests give a simple pass or fail: they must catch a high share of modeled faults while keeping test time short, because tester time is expensive.²

Alongside the scan patterns, the tester makes electrical (parametric) measurements: whether each pin makes contact, how much current leaks, input and output voltage levels, and timing at the pins. Some products also get , hours at high temperature and voltage that make weak chips fail in the factory rather than early in a customer’s hands.²

Test time is money. A worked example from around 2000 priced a 1,024-pin tester at about $4.3 million. Spread over five years of round-the-clock use, with upkeep, that came to 4.5 cents per second, so a 6-second test cost 27 cents per chip. Only 65% of chips passed, so each good chip carried $27 / 0.65 \approx 41.5$ cents of test cost.¹

Failing chips are also a source of information. software traces a chip’s wrong outputs back through the circuit and simulates likely faults to list where the defect probably is. Comparing results across many failing chips reveals problems that repeat, and picks chips worth opening up for physical inspection, which helps the factory raise yield.²⁶ The After tapeout page follows chips from here.

Wafer sort runs before dicing and keeps bad dies out of packages; packaged-part test follows assembly.² Probing has its own limits (contact, pin inductance and the frequencies probe cards can carry), so sort may run a reduced or slower set. For multi-die packages, sort is what defines a . Production tests make a go/no-go decision with no diagnosis, at the speed the supplier guarantees, alongside parametric tests.² Diagnosis runs separately, on logged failures, and the fault simulation behind it runs with fault dropping turned off, because it needs every fault each failing pattern could explain, not just the first.⁴

works in steps. For each failing pattern, it traces back from each wrong output bit through the logic to find signals that could explain it. Layout analysis turns those logical locations into likely physical opens and bridges. Each candidate is fault-simulated, and candidates are ranked by how well they reproduce the tester’s observations. Quality is measured as resolution (how many candidates are reported) and accuracy (whether the true defect is among them). Volume diagnosis then correlates results across many failing chips to find yield problems with a common root cause, and steers physical failure analysis, the visual inspection that confirms a defect, toward the right chips.²⁶ Compression and MISRs complicate this, because they mix many cells’ responses before the tester sees them; a compactor should support diagnosis, not just a yes/no answer.¹⁹

1 / 7

Wafer sort (probe test): a probe card’s needles touch each die’s pads, and the tester runs the patterns. Failing dies are marked: 4 of 32 here.

Test insertions from wafer to customer, and diagnosis feeding back to the fab. Die counts are illustrative.

Test time6 s

Yield65%

6 s × 4.5¢/s = 27.0¢ per chip tested. With 65% passing, each good chip carries 27.0¢ / 0.65 = 41.5¢ of test cost.

The chapter’s worked example (around 2000): a $4.3 million tester at about 4.5¢ per second. Bad chips use tester time too, so cost per good chip is cost per chip divided by yield.

Try it

Below is a tiny chip with four memory cells in one scan chain and a little logic between them. Pick a flaw to plant, such as one wire stuck at 0. Click the four bits to set a test pattern. Then press Shift in, Capture and Shift out, and watch the bits move.

The sim tells you whether your pattern found the flaw. Try a few: one pattern catches some flaws and misses others. Then press Run ATPG to let the computer pick a small set of patterns that catches every flaw it can.

The circuit has four scan flip-flops, q0–q3, in one chain, and four gates: n0 = q0 AND q1 (1 only if both are 1), n1 = q1 OR q2 (1 if either is 1), n2 = n0 XOR q3 (1 if exactly one is 1) and n3 = NOT(q2 AND q3). On capture, flip-flop q0 stores n2, q1 stores n1, q2 stores n0 and q3 stores n3. The fault list has 16 faults: stuck-at-0 and stuck-at-1 on each of n0–n3 and q0–q3.

Work one through first. Load q0–q3 = 1, 1, 0, 0. Then n0 = 1, n1 = 1, n2 = 1 XOR 0 = 1 and n3 = NOT(0) = 1, so a good chip captures 1, 1, 1, 1. Now plant “n0 stuck-at-0”: n0 becomes 0, so n2 becomes 0 too, and two of the captured bits flip. The outputs differ, so this pattern detects the fault. Choose a fault, click the bits to set a pattern, then press Shift in (4 shift clocks), Capture (one normal clock) and Shift out (4 shift clocks). Then press Run ATPG. It simulates all 16 possible patterns against every fault and keeps picking the pattern that catches the most faults not yet caught, until every catchable fault is covered, and reports the pattern count and coverage.

Same circuit: q0–q3 in one chain, n0 = q0 AND q1, n1 = q1 OR q2, n2 = n0 XOR q3, n3 = NOT(q2 AND q3), capturing D0 = n2, D1 = n1, D2 = n0, D3 = n3, with 16 stuck-at faults on n0–n3 and q0–q3. Inject a fault and apply patterns by hand, then press Run ATPG. The Expert view shows the fault-detection table that a fault simulator builds: all 16 patterns down the side, all 16 faults across the top, and a tick wherever a pattern detects a fault.⁴

ATPG here is a greedy set cover over that table: take the pattern that detects the most remaining faults, cross those faults off, repeat. That mirrors fault dropping, and it is how the open-source Fault toolchain compacts its pattern sets.²³ Look for faults whose columns are identical: every pattern treats them the same, so they are equivalent, and a real tool would collapse them to one.³ Notice too that n0 stuck-at-0 reaches two outputs at once, D2 directly and D0 through the XOR, so either one is enough to see it.

Loading simulation…

In practice

When a DFT engineer checks the results, they ask four questions.

Do the chains work? The first test just slides a known pattern, such as 00110011, through each chain and checks it comes out unchanged.⁷ If a chain is broken, nothing else matters.
What’s the coverage? Even a small gap matters. Missing a few flaws in every thousand can mean hundreds more bad chips in every million shipped.
How long does the test take? Every second on the test machine costs money, and it adds up over millions of chips.
Does test mode work at full speed? A test that fails good chips is as bad as one that passes bad ones.

Below are three files of the kind a DFT engineer works with, each annotated line by line. All three are illustrative. The first is a script in Tcl, the language chip tools are driven with. Its first half uses OpenROAD’s documented commands for inserting scan chains. OpenROAD’s DFT module has no pattern-generation command, so the second half uses made-up generic commands that stand in for a commercial DFT and ATPG tool.²² (The open-source Fault toolchain does generate patterns: random patterns checked by fault simulation, then compaction and scan chain stitching, built around the Yosys synthesis tool.²³)

In outline, the script reads in the library and the netlist, sets chain rules, swaps in scan flip-flops, wires the chains, then describes the test setup to the ATPG tool and generates patterns for two fault models.

Below are an illustrative scan-insertion and ATPG script, an illustrative ATPG summary, and shift- and capture-mode SDC. The script’s first half is real OpenROAD syntax; the ATPG half and the report format are generic, and the numbers are made up but internally consistent. In the summary, compare the two coverage numbers and look at what sits in the AU (ATPG-untestable) and aborted buckets, since those are the faults you can still win back.

dft.tcl (illustrative)tcl

# Part 1: scan insertion, OpenROAD dft syntax
read_lef    tech.lef
read_lef    stdcells.lef
read_liberty stdcells_typ.lib
read_verilog results/top_synth.v
link_design top
read_sdc    constraints/top_func.sdc

set_dft_config -max_length 200 -clock_mixing no_mix \
    -scan_enable_name_pattern "scan_en" \
    -scan_in_name_pattern  "scan_in_{}" \
    -scan_out_name_pattern "scan_out_{}"
report_dft_config
scan_replace                      ;# DFF_X1 -> SDFF_X1, same function plus SI/SE
# ... floorplan and global placement run here ...
report_dft_plan -verbose          ;# preview chains, no changes yet
execute_dft_plan                  ;# stitch chains, placement-aware
write_verilog results/top_scan.v

# Part 2: ATPG, generic commands (every commercial tool spells these differently)
read_netlist        results/top_scan.v
read_cell_models    lib/stdcells_atpg.v
define_clock        clk      -off_state 0
define_scan_enable  scan_en  -active 1
define_constraint   test_mode 1
run_scan_drc                      ;# chains shift? clocks and resets controllable?
set_fault_model     stuck_at
add_faults          -all
run_atpg            -random_first 128 -abort_limit 100
report_summary
set_fault_model     transition -launch capture
add_faults          -all
run_atpg
write_patterns      out/top_stuck_and_transition.pat

1L2Lines 2–7 read the cell shapes (LEF), cell timing (Liberty), the synthesized netlist and the timing constraints.
2L9Chains of at most 200 flip-flops, never mixing clocks or clock edges in one chain. no_mix can leave chains unequal in length, so check the plan.
3L11{} becomes the chain number: scan_in_0, scan_in_1, …
4L14Swaps every flip-flop for its scan version. Done before placement because the scan cells are larger.
5L16Shows which flip-flops go in which chain without changing anything. Try different settings here.
6L17Wires up the chains, using cell positions to keep scan wires short. Any later change of order means new patterns.
7L25Holds the chip in test mode for every pattern. If these settings don’t match how the tester drives the chip, patterns fail on the tester.
8L26Scan design-rule checks: do the chains shift, and can every clock and reset be controlled? Fix every violation before trusting a coverage number.
9L29128 random patterns first for the easy faults, then a methodical search. A fault whose search exceeds 100 backtracks (undone guesses) is reported as aborted.
10L31Second fault model: slow-to-rise and slow-to-fall faults, launched on capture (LOC). Reported separately, and normally lower than stuck-at.

The summary below has one row per class of fault. DT (detected) faults count for you. UD (undetectable) faults are proven impossible to test and are left out of the second coverage number. AU (untestable with the current test setup) and ND (not detected) are work left to do.

atpg_summary.rpt (illustrative, generic format)log

Fault model: stuck-at        Fault list: uncollapsed
-------------------------------------------------------
Fault class                              Faults
-------------------------------------------------------
DT  detected                          1,221,447
UD  undetectable                         18,615
      tied                                6,204
      blocked                             3,980
      redundant                           8,431
AU  ATPG untestable                       6,032
ND  not detected                          2,808
      aborted                             1,113
      no test found                       1,695
-------------------------------------------------------
Total faults                          1,248,902
Fault coverage   DT / total                97.80%
Test coverage    DT / (total - UD)         99.28%
Patterns (compressed)                     3,412
-------------------------------------------------------
Transition (LOC) test coverage             93.4%   patterns 7,980

1L1Always state the fault model and whether equivalent faults were merged (collapsed). Coverage on the two lists differs.
2L7Tied: a constant (a tie cell, or a pin fixed in test mode) holds the wire at the stuck value, so no test can exist.
3L9Redundant: logic that can’t change any output. Worth a look, since it may be logic that could be removed.
4L10Untestable under the current test setup: flip-flops left out of scan, blocks the tool can’t see into, pins fixed in test mode. Often recoverable with a test point or a scan fix.
5L12Aborted: the search hit its backtrack limit. Raising the limit or rerunning on just these faults often recovers some.
6L16Fault coverage counts every fault against you.
7L17This number leaves out proven-undetectable faults. Names vary between tools, so check the report’s definition.
8L18Pattern count, chain length and compression ratio together set tester time and memory.
9L20Transition coverage is usually lower because each fault needs a two-pattern test launched at speed.

Each test mode gets its own timing constraints. The shift file sets scan enable to 1, so the timing tool checks only the chain connections; the capture file sets it to 0 and checks the normal logic at full speed. set_case_analysis fixes a pin at a constant, and the tool carries that constant through the scan multiplexers, so paths that can’t be active aren’t checked.²⁴

top_test.sdc (illustrative: two modes, one file per mode in real flows)sdc

## ---- Shift mode (top_shift.sdc) ----
create_clock -name scan_clk -period 20.0 [get_ports clk]   ;# 50 MHz shift
set_case_analysis 1 [get_ports test_mode]
set_case_analysis 1 [get_ports scan_en]
set_input_delay   4.0 -clock scan_clk [get_ports scan_in_*]
set_output_delay  4.0 -clock scan_clk [get_ports scan_out_*]

## ---- Capture mode, launch-on-capture (top_capture.sdc) ----
create_clock -name clk -period 1.25 [get_ports clk]        ;# 800 MHz, same as mission
set_case_analysis 1 [get_ports test_mode]
set_case_analysis 0 [get_ports scan_en]
set_false_path -from [get_ports scan_in_*]
set_false_path -to   [get_ports scan_out_*]
set_multicycle_path 2 -setup -from [get_cells u_cfg/*] -to [get_cells u_dp/*]

1L2Shifting runs slowly (a 20 ns period). Arriving in time is easy here; the real check is hold on the direct flip-flop-to-flip-flop scan hops.
2L3In this design, test_mode = 1 selects the test clocks and turns on every clock gate, so every flip-flop gets a clock.
3L4scan_en = 1: the constant passes through every scan multiplexer, so only the chain connections are timed.
4L5Scan pin timing comes from how the tester drives and samples its pins, not from the chip’s normal interface.
5L9LOC capture uses the normal clock period (1.25 ns), because launch and capture run at full speed.
6L11scan_en = 0 throughout launch and capture in LOC, so it is a constant here. LOS would need scan_en itself timed at full speed.
7L12The scan pins carry no full-speed data during capture, so exclude them (set_false_path).
8L14Carry the design’s normal timing exceptions into test mode. ATPG must also ignore values on these paths, or good chips fail at speed.

Coverage

Fault coverage = DT / total = 1,221,447 / 1,248,902 = 97.80%.

The illustrative ATPG summary above, one segment per fault class (DT drawn shortened, the rest to scale). Tap a segment; switch the denominator.

What goes wrong

A broken chain. If one link in a scan chain is wired wrong, every test through it fails. That is why chain tests run first.
Too much power during tests. Tests make far more of the chip switch at once than normal use does. That extra load can make good chips fail.²⁵
Tests that are too slow. A chip can pass every slow test and still fail at full speed in a customer’s phone.⁶

Breaking the scan rules. Clocks that are switched on and off by logic (gated clocks), loops of logic with no flip-flop in them, and signals the tester can’t control all stop chains from shifting predictably. Rule checks in the DFT tool find them; extra test-control logic or design changes fix them.⁷
Bits racing through while shifting. Scan connections are direct, with almost no logic, so a small difference in clock arrival between neighboring flip-flops can let a bit skip a place (a hold violation). It is worst where a chain crosses between clock domains. Lockup latches fix it.⁷²¹
Logic random patterns can’t reach. A gate with many inputs that needs one exact combination is almost never exercised by random patterns, which limits logic BIST coverage.⁸
Unknown values. Some captured bits can’t be predicted, for example on paths designed to take more than one clock cycle. They have to be masked, which costs coverage, or they corrupt the compressed results.¹⁹¹⁸
Too much power. So much switching during test causes the supply voltage to sag (), which can make good chips fail.²⁵
Out-of-date patterns. Patterns are built from the final chain order. If the chain order changes after placement, or a late fix touches flip-flops, patterns made for the old netlist will fail.⁷

Overkill at speed. Failing good parts happens two ways. LOS launch states may be unreachable in normal operation, so the test exercises paths that never need to be fast.¹⁵ And false or multicycle paths, captured at speed, give unpredictable values. The fix is to mask those endpoints in ATPG and keep the test-mode SDC consistent with the functional exceptions.¹⁹
Test-mode IR drop. Shift and capture toggle far more cells than normal operation, and the supply droop slows gates and can fail parts that are actually good. Fill don’t-care bits to minimize toggling, block scan cells’ functional outputs during shift, stagger the clocks of chain segments, and reorder to cut transitions.²⁵
Coverage that hides escapes. High stuck-at coverage with weak transition coverage still ships timing defects, and pin-level models miss defects inside cells. Track several models and add cell-aware patterns for low-DPPM products.⁶²⁰
Compression limits. The decompressor reproduces care bits by solving linear equations, so a pattern with more care bits than the decompressor has free input bits for that load can’t be encoded. Unknown values force masking, which costs observability. Both show up as extra top-up patterns or lost coverage.¹⁸¹⁹
Lockup sprawl. Chains stitched carelessly across domains, or between flip-flops far apart, pile up lockup latches. Each one blocks reordering, and the result is long, criss-crossing scan routes and congestion. Physically aware stitching and sensible chain-length limits avoid it.²¹
Diagnosis blind spots. Diagnosis works from failing scan cells. High compression and MISR compaction mix many cells together before the tester sees them, which makes failing cells ambiguous and slows yield learning. Plan a diagnosis-friendly mode up front.²⁶¹⁹

Chain

Shift clocks15

Hold race: flop 4’s clock arrives late, so it captures flop 3’s new bit. The chain acts one flip-flop short and 4 of 8 bits are wrong.

A chain integrity test on an eight-flop chain. Plant a broken link or a hold race between flip-flops 3 and 4, then shift.

Under the hood

This part goes deeper, into the math, models and algorithms behind the chapter. It’s written for the Expert level.

The ATPG problem

For one target fault, ATPG must find input values that do three things.¹²

Activate the fault: drive the faulty line to the opposite of its stuck value, so the good and faulty circuits differ there.
Propagate the difference along a sensitized path to an output: every gate on the path must have its other inputs at values that let the difference through (1 on an AND, 0 on an OR).
Justify every internal value the first two steps required, working back to the inputs.

With full scan, flip-flop outputs act as extra inputs (pseudo-primary inputs) and flip-flop data pins as extra outputs, so the problem is purely combinational.⁷ Proving a fault untestable means exhausting the search, so tools cap the number of backtracks (undone decisions) per fault and report the rest as aborted.¹³

The D-algorithm (Roth, 1966)

Roth’s idea was to track the good and the faulty circuit in one signal. $D$ means “1 in the good circuit, 0 in the faulty one” and $\overline{D}$ the reverse, giving five values: 0, 1, $X$ (unknown), $D$ and $\overline{D}$ .¹¹ A primitive D-cube activates the fault at its gate: inputs 1, 1 on an AND gate whose output is stuck-at-0 give $D$ at the output. Propagation D-cubes push a $D$ through a gate by setting the gate’s other inputs to non-controlling values.¹²

The keeps two lists: the D-frontier (gates with a $D$ on an input whose output is still unknown, which is where the fault effect can advance) and the values still to justify. It makes choices on internal lines, works out every value those choices imply, and backtracks when it hits a conflict, when the D-frontier empties, or when the fault is no longer activated.¹¹ Its weakness is that deciding values on internal lines can commit to combinations that no input assignment produces, where signals split and later rejoin, and discover that only much later. IBM’s error-correction and translation circuits were a well-known case where it struggled.¹³

Target fault

1 / 5

Target: g1 stuck-at-0. Every line starts at X.

Activate, propagate, justify on out = (a·b + c)·d, in five-valued logic: D is 1 in the good circuit and 0 in the faulty one. The highlighted gate is the D-frontier.

PODEM (Goel, 1981)

decides only at primary inputs. Each round it picks an objective (activate the fault, or advance the D-frontier), traces that objective backward through the gates to an unassigned primary input, assigns that input, and simulates forward to see what follows. The decision tree now has at most $2^{\text{number of inputs}}$ leaves instead of $2^{\text{number of lines}}$ .¹³ After each step it checks whether a test is still possible, for example whether the D-frontier still exists. If not, it flips the most recent untried input assignment.¹³ Backtrace uses controllability heuristics. To set a gate’s output to the value one input alone can force (a 0 on an AND), it follows the easiest input. To set the value that needs every input (a 1 on an AND), it follows the hardest input first, so any failure shows up early.¹²

FAN (Fujiwara and Shimono, 1983)

improves on PODEM and cuts the search further. Immediate implication assigns every value that is uniquely forced, which PODEM misses and later has to backtrack over.¹³ Backtrace stops at headlines, the outputs of fanout-free cones, because such a cone can always be justified later without conflict. Propagation uses all branches of a fanout at once.¹² Later engines added learning (SOCRATES), implication graphs and BDD-based search on the same foundations.¹³

A production ATPG loop

A classic system such as SOCRATES runs in phases. First, random patterns (32 at a time) with fault simulation and fault dropping, stopping once 64 random patterns in a row detect nothing new. Then deterministic passes over the remaining faults with rising backtrack limits: 10 per fault, then 50, 100 and finally 10,000, fault-simulating each new pattern against everything left.¹³ Compaction comes in two forms. Reverse-order fault simulation re-simulates the final set backward and drops patterns whose faults later patterns already catch. Static compaction merges patterns whose specified bits don’t conflict, which works because deterministic patterns leave most inputs at X.¹³

Fault simulation

Serial. Inject one fault, simulate all patterns, compare with the good circuit, repeat. Simple and works for any fault type, but costs about one full simulation per fault.⁴
Parallel. Use the bits of a computer word as separate circuits. With $w$ -bit words, one pass simulates the good circuit and $w - 1$ faulty ones with bitwise operations, for about a $(w - 1)\times$ speedup. It suits two-valued logic with zero or unit gate delays.⁴ The pattern-parallel version, PPSFP, instead packs many patterns into the word and propagates one fault at a time, event by event, stopping where the difference dies out. For full-scan combinational logic it beats concurrent simulation, and critical path tracing inside fanout-free regions means only faults at fanout stems need explicit propagation.¹⁴
Deductive. Simulate only the good circuit, and for each line deduce the set of faults that would flip it, using set operations on the gate inputs’ lists. The lists at the outputs are the detected faults. One pass, but list sizes are unpredictable and only simple delay models work.⁴
Concurrent. Event-driven simulation of the good circuit plus, at each gate, copies only for the faulty circuits whose values differ there. The most general method, handling timing, multi-valued logic and functional models, at the cost of memory.⁴ It and PPSFP are the two most common methods.¹⁴

Fault dropping removes detected faults as simulation proceeds and is turned off for diagnosis. For very large designs, simulating a random sample of 1,000–2,000 faults estimates coverage with an accuracy that depends on the sample size, not the circuit size.⁴

LFSRs, MISRs and aliasing

An is a shift register whose input is the XOR of selected stages. Write its state as a column of bits $X(t)$ . Each clock, $X(t+1) = T\,X(t)$ , where $T$ is a fixed 0/1 matrix (the companion matrix) and arithmetic is mod 2. $T$ ’s characteristic polynomial $f(x) = 1 + h_1 x + \dots + x^n$ records which stages feed back. When that polynomial is primitive, the sequence repeats only after $2^n - 1$ steps, visiting every nonzero state. The all-zero state maps to itself, so it must never be loaded.⁸ The external-XOR (standard) and internal-XOR (modular) forms are equivalent up to a relabeling of states; the modular form is faster.⁸

For response compaction, read a stream of output bits as the coefficients of a polynomial. A single-input signature register divides that polynomial by $f(x)$ and keeps the remainder as the signature. A XORs many outputs into one register. Because the circuit is linear, the final signature equals the XOR of the remainders each output would have produced alone, so one register serves all outputs.⁸ , a faulty stream producing the good signature, has probability about $2^{-k}$ for a degree- $k$ MISR, while simple parity aliases frequently.⁸

Compression as linear algebra

A common decompressor is a linear finite-state machine fed continuously by the tester channels. Every bit it delivers to a scan cell is therefore an XOR of some of the bits the tester injected. ATPG produces a test cube with only the care bits specified. Each care bit gives one linear equation over $\mathrm{GF}(2)$ (arithmetic mod 2) in the unknown tester bits, and the tool solves the system to find channel data that reproduces every care bit; the don’t-care cells get whatever falls out.¹⁹¹⁸ If a cube has more care bits than the tester supplies free variables for that load, the equations may have no solution, which is why pattern counts rise as compression ratios climb. On the response side, a compactor between the internal chains and the output channels must stay in step with the decompressor and must handle X values.¹⁹ A MISR used as a time compactor is linear, so a single X makes its signature unknown, and X’s are blocked or masked before they reach it.⁸¹⁸

Check yourself

Novice · 0 of 5 correct

Q1Why can’t a tester simply check a chip through its normal pins?
Q2A design has 40,000 scan flip-flops. Why split them into 400 chains of 100 rather than one chain of 40,000?
Q3Yield is 90% and stuck-at fault coverage is 99%. Using the Williams formula $\mathrm{DL} = 1 - Y^{1-T}$ , roughly how many defective chips per million ship?
Q4What does scan enable do?
Q5Why does a timing test need two patterns rather than one?

Sources

Show Hide 26 sources

VLSI Test Technology and Reliability, Module 1: IntroductionSaid Hamdioui · TU Delft OpenCourseWare · 2010Verification vs. manufacturing test, escapes and yield loss, DPM, causes of escapes, rule of ten, DFT definition, the 2000-era ATE cost example.
VLSI Test Technology and Reliability, Module 2: VLSI Test Process and ATESaid Hamdioui · TU Delft OpenCourseWare · 2010Production test is go/no-go with no diagnosis; burn-in; wafer sort before dicing vs. packaged test; parametric tests; ATE run by a test program; probe cards and pin electronics.
VLSI Test Technology and Reliability, Module 3: Fault ModelingSaid Hamdioui · TU Delft OpenCourseWare · 2010Common fault models, the single stuck-at fault, counting fault sites, fault equivalence and collapsing with a worked example.
VLSI Test Technology and Reliability, Module 4: Logic and Fault SimulationSaid Hamdioui · TU Delft OpenCourseWare · 2010Serial, parallel, deductive and concurrent fault simulation; fault dropping, suppressed for diagnosis; fault sampling of 1,000–2,000 faults.
VLSI Test Technology and Reliability, Module 8: Memory TestingSaid Hamdioui · TU Delft OpenCourseWare · 2010March test notation, MATS+, March C− (10n), test time of O(n) vs. O(n²) tests on a 64 Kbit array, redundancy and memory yield.
VLSI Test Technology and Reliability, Module 9: Delay TestingSaid Hamdioui · TU Delft OpenCourseWare · 2010Two-pattern delay tests, path delay faults, robust and non-robust tests, transition faults, enhanced vs. normal scan; a full stuck-at test alone cannot give high quality.
VLSI Test Technology and Reliability, Module 11: Digital DFT and Scan DesignSaid Hamdioui · TU Delft OpenCourseWare · 2010Mux-D scan flop, scan rules, test length formula, area and delay overhead, s5378 full-scan example, partial scan, scan flow from rule audits to test program, scan power.
VLSI Test Technology and Reliability, Module 12: Built-In Self-TestSaid Hamdioui · TU Delft OpenCourseWare · 2010LFSR theory, random-pattern-resistant faults, SISR/MISR, aliasing ≈ 2^−k, STUMPS, scan-based BIST test length, memory BIST.
VLSI Test Technology and Reliability, Module 13: Boundary Scan StandardSaid Hamdioui · TU Delft OpenCourseWare · 2010IEEE 1149.1 motivation, TAP pins, 16-state TAP controller, registers, mandatory and optional instructions, BSDL.
Unit 11: Testing (Introduction to EDA lecture 9)Chang, Huang, Li, Lin, Liu · National Yang Ming Chiao Tung University course pageDefect level DL = 1 − Y^(1−T) (Williams), DPM vs. yield and coverage table, ATPG flow with random patterns first, milestone ATPG algorithms.
ECE 1767: ATPG for Stuck-At Faults (D-Algorithm)University of Toronto course notesRoth’s 1966 D-algebra, five-valued logic, justify and propagate, backtracking on conflicts.
Chapter 5: ATPGArnaud Virazel · LIRMM / University of Montpellier course notesRandom test reaches 60–80% easily; coverage vs. efficiency; D-algorithm D-cubes; PODEM objective and backtrace heuristics; FAN improvements.
CMPE 418 Design Verification & Testing: ATPG (PODEM, FAN, test generation systems)University of Maryland, Baltimore County course notes · 2004PODEM decides only at primary inputs; FAN immediate implications; fault coverage vs. efficiency; SOCRATES flow and backtrack limits; compaction.
Efficient Fault Simulation on Many-Core ProcessorsMichael A. Kochte, Marcel Schaal, Hans-Joachim Wunderlich, Christian G. Zoellin · DAC 2010 (author-hosted, University of Stuttgart) · 2010PPSFP and concurrent simulation as the two most common methods; PPSFP packs patterns into machine words; critical path tracing inside fanout-free regions.
An Efficient Pulse Flip-Flop Based Launch-on-Shift Scan CellRajesh Kumar, Sunil P. Khatri · IEEE (author-hosted, Texas A&M University) · 2010Two-vector at-speed test; LOS gives better coverage but needs an at-speed scan enable and risks yield loss; LOC uses two fast clock pulses; enhanced scan costs area.
Design Automation for IEEE P1687Farrokh Ghani Zadegan, Urban Ingelsson, Gunnar Carlsson, Erik Larsson · DATE 2011 (author-hosted, Linköping University) · 2011P1687 (IJTAG) standardizes access to embedded instruments (memory and logic BIST, scan chains, temperature sensors) through the JTAG TAP; Segment Insertion Bits include or exclude network segments from the scan path.
What’s the Difference Between JTAG (IEEE 1149.1) and IJTAG (IEEE P1687)?Martin Keim · Electronic Design · 2012Kept as a fallback for ICL, PDL and retargeting (the standard itself is paywalled): IJTAG accesses embedded instruments through the JTAG port; SIBs reconfigure the network; ICL and PDL; retargeting.
Chapter 8: Test Compression (VLSI testing course slides)Shi-Yu Huang · National Tsing Hua University course pageTest vectors have many don’t-care bits, which is why they compress; linear-decompression schemes solve linear equations over the care bits; X-blocking and X-masking keep unknowns out of the compactor at some coverage cost; MISR time compaction.
Test compressionWikipedia contributors · WikipediaOnly a small percentage of scan cells need specific values; many short internal chains fed by a continuous-flow decompressor; linear-FSM decompressors solved from linear equations; compactors must handle X states from false and multicycle paths.
Improving Cell-Aware Test for Intra-Cell Short DefectsDong-Zhen Lee, Ying-Yen Chen, Kai-Chiang Wu, Mango C.-T. Chao · DATE 2022 (open proceedings archive) · 2022Conventional faults sit at cell ports; intra-cell defects cause DPPM; cell-aware test SPICE-simulates defects; 1- and 2-time-frame CA faults catch parts that escaped stuck-at and transition tests.
Scan Lockup Latches: Significant Role in CongestionNalin Gupta, Mayank Verma, Nitin Bhardwaj · Design & Reuse · 2015Kept as a fallback (no open primary source found). Lockup latches fix shift-mode hold across clock domains and between distant flops; they act as break points for reordering and cause congestion; reordering reads the scan DEF.
DFT: Design for TestingThe OpenROAD Project · OpenROAD documentationset_dft_config (no_mix may unbalance chains), scan_replace before placement, placement-aware execute_dft_plan; the module’s commands cover scan insertion only; single-bit cells only.
Fault, an Open Source DFT ToolchainMohamed Gaber, Manar Abdelatty, Mohamed Shalan · Workshop on Open-Source EDA Technology (WOSET) · 2019Yosys-based synth, cut, pseudo-random ATPG with fault simulation, greedy static compaction, scan chain insertion; the cost of a fault multiplies by ten at each later stage.
OpenSTA Command ReferenceParallax Software · OpenSTA (GitHub)set_case_analysis sets a pin to a constant; constants propagate and no paths are timed from constant pins.
Developments in Scan Shift Power Reduction: A SurveyVijay Sontakke, John Dickhoff · Bulletin of Electrical Engineering and Informatics (open access) · 2023Test power exceeds functional power; switching activity can double or more; IR-drop yield loss; shift dominates test time; X-fill, gated scan cells, segmentation with staggered clocks, reordering.
LearnX: A Hybrid Deterministic-Statistical Defect Diagnosis MethodologySoumya Mittal, R. D. (Shawn) Blanton · IEEE European Test Symposium 2019 (NSF Public Access Repository) · 2019Diagnosis turns failing responses into defect candidates by path tracing and fault simulation; resolution and accuracy; volume diagnosis and physical failure analysis drive yield learning.