A TESTBENCH 327 In this chapter, fault simulation and ATPG will be examined from the user’s per- spective. What kind of reports should be generated, and how do test programs get translated into tester format? Users have, in the past, been quite critical of fault sim- ulators, complaining that they simply produced a fault coverage number based on the test vectors and the fault list, without producing any meaningful suggestions, help, or insight into how to improve on that number. We will examine ways in which fault simulation results can be made more meaningful to the end user. The workflow depicted in Figure 7.2 is quite general; it could describe almost any design project. The circuit being designed may be constrained by rigid design rules or it may be free form, with the logic designers permitted complete freedom in how they go about implementing their design. However, as details get more specific (e.g., is the design synchronous or asynchronous?), choices start becoming bounded. Many of the vexing problems related to testing complex sequential circuits will be post- poned to subsequent chapters where we address the issue of design-for-testability (DFT). For now, the focus will be on the fault simulator and the ATPG and how their interactions can be leveraged to produce a test program that is thorough while at the same time brief. 7.4 A TESTBENCH A testbench will be created for the circuit in Figure 7.3 using Verilog. A VHDL description at the structural level would be quite similar, and the reader who under- stands the following discussion should have no difficulty understanding an equiva- lent VHDL description of this circuit. The testbench instantiates two modules; the first is the circuit description, while the second contains the test stimuli, including timing data. The circuit description is hierarchical, containing modules for a mux and a flip-flop. The test stimulus module follows the hierarchical netlist testbench. 7.4.1 The Circuit Description The Verilog circuit description that follows is rather brief. The reader who wishes to acquire a more thorough understanding of the Verilog HDL is encouraged to consult Figure 7.3 Gate-level interconnection. SEL CLR E CK TSE C D Y Clr F G B A 328 DEVELOPING A TEST STRATEGY one of the many textbooks dedicated to that subject. Because the language is quite robust, the following code represents but one of several ways to describe a particular behavior. Also note that the first line of each module is set in boldface for conve- nience in locating the start of each new module. 'timescale 1 ns / 100 ps module testbench; ckt7p3 X1 (tse, sel, ck, clr, y); stimuli X2 (tse, sel, ck, clr, y); endmodule module ckt7p3 (tse, sel, ck, clr, y); input tse, sel, ck, clr; inout y; wire hold; wire load, choose; mux2 x1 (.A(hold), .B(load), .Sel(sel), .C(choose)); dff x2 (.Q(hold),.QN(),.data(choose),.clock(ck), .preset(1'b1),.clear(clr)); bufif1 #(7,7) x3 (y, hold, tse); buf #(4,4) (load, y); endmodule module mux2(A, B, Sel, C); input A, B, Sel; output C; not #(5,5) n1 (Sel_, Sel); and #(5,5) n2 (L1, Sel_, A); and #(5,5) n3 (L2, Sel, B); or #(6,6) n4 (C, L1, L2); endmodule module dff(Q,QN,data,clock,preset,clear); input data; input clock; input preset; input clear; output Q; output QN; nand #(5,5)N1 (L1, preset,L4, L2), N2 (L2, L1, clear, clock), N3 (L3, L2, clock, L4), N4 (L4, L3, data, clear), N5 (Q, preset, L2, QN), N6 (QN, Q, L3, clear); endmodule module stimuli(tse, sel, ck, clr, y); output tse, sel, ck, clr; inout y; A TESTBENCH 329 reg [3:0] inputs; reg ck; parameter clock_high = 50; // 100ns period, clock high 50ns 'define cycle #1000 inputs = 4'b assign {tse, sel, clr, y} = inputs; initial begin ck = 0; $dumpfile("ckt7p3.dump"); $dumpvars(3, X1); $monitor($time,," tse = %b sel = %b ck = %b clr = %b y = %b", tse, sel, ck, clr, y); 'include "ckt7p3.fvc" // include vector file $finish; // end simulation end always #clock_high ck = ~ck; endmodule // ckt7p3.fvc tse, sel, clr, y #0 inputs = 4'b110Z; // Reset 'cycle 0111; 'cycle 0111; 'cycle 101Z; 'cycle 101Z; 'cycle 110Z; 'cycle 111Z; 'cycle 0111; 'cycle 101Z; 'cycle 101Z; 'cycle 0110; The first module in the listing is the top-level testbench, aptly named testbench . It begins with a timescale compiler directive that allows modules with different time units to be simulated together. The first number specifies the unit of measurement for delays in the module, and the second number specifies the accuracy with which delay values are rounded before being used in simulation. In the modules that fol- low, delays are multiples of 1 ns, and they are rounded to 100 ps during simulation. So, if a delay value of 2.75 is specified, it represents 2.75 ns and is rounded to 2.8 ns. The next entry is the name of the module, which ends with a semicolon, as do most lines in Verilog. The modules ckt7p3 and stimuli are then instantiated. Ckt7p3 con- tains the circuit description while the module stimuli contains the test program. End- module is a keyword denoting the end of the module. The circuit ckt7p3 again begins by listing the module name, followed by a declara- tion of the I/O ports in the circuit. The second line of ckt7p3 defines the ports tse , sel , ck , and clr as inputs. The third line defines the port y as an inout—that is, a bidirec- tional signal. The signals hold , load , and choose are internal signals. As wires, they can carry signals but have no persistence; that is, there is no assurance that values on those signals will be valid the next time the module is entered during simulation. 330 DEVELOPING A TEST STRATEGY The next line instantiates mux2 . It is a two-input multiplexer whose definition fol- lows the definition for ckt7p3 . Note that the signals in mux2 are associated with wires in ckt7p3 by using a period (.) followed by the signal name from mux2 and then the wire called hold in ckt7p3 is enclosed in parentheses. The signal named Q in dff is also associated with the wire hold . It is not necessary to associate names in this fashion, but it is less error-prone. If this method is not employed, then signals become position-dependent; in large circuits, errors caused by signals inadvertently juxtaposed can be extremely difficult to identify. The dff instantiated in ckt7p3 is the next module listed. It corresponds to the cir- cuit in Figure 2.8. The signal 1’b1 connected to the preset in the dff denotes a logic 1. Similarly, 1’b0 denotes a logic 0. The next element in ckt7p3 is called bufif1 . The bufif1 is a tri-state buffer and is a Verilog primitive. There is a corresponding ele- ment called bufif0 . Bufif1 is active when a logic 1 is present on its enable pin. Bufif0 is active when the enable signal is a logic 0. Other Verilog primitives in the above listing include buf, and, or, and nand. Any Verilog simulator must provide simula- tion capability for the standard primitives. Verilog does not support built-in sequential primitives for the latches and flip- flops; however, it does support user-defined primitives (UDPs). The UDP is defined by means of a truth table, and the facility for defining UDPs allows the user to extend the set of basic primitives supported by Verilog. Through the use of UDPs it is possible for the user to define any combination of gates as a primitive, so long as the model only contains a single output pin. Sequential elements can also be defined. The requirement is that the sequential element must directly drive the output. 7.4.2 The Test Stimulus Description The module called stimuli has the same I/O ports as ckt7p3. However, in this module the signals that were inputs in ckt7p3 have become outputs. The inout signal y remains an inout. A 4-bit register named inputs is defined. The “reg” denotes an abstract storage element that is used to propagate values to a part. The signal called ck is defined as a register. Then a parameter called clock_high is defined and set equal to 500. That is followed by the definition of the ASCII string #1000 inputs = 4’b. These two statements are used to define a clock period of 1000 ns, with a 50% duty cycle. The values in the register inputs are assigned to the input and inout signals by means of the assign statement that follows. An initial statement appears after the assign statement. The first initialization statement causes a 0 to be assigned to ck prior to the start of simulation. Then a dump-file statement appears; it causes internal signal values to be written to a dump file during simulation. The dumpvars statement requests that the dump be per- formed through three levels of hierarchy. The dump file holds values generated by internal signals during simulation so that they can later be retrieved for visual wave- form display. In the ckt7p3 circuit, there are three levels of hierarchy; the top level contains mux2 and dff, and these in turn contain lower-level primitive elements. The monitor statement requests that the simulator print out specified values during simulation so FAULT MODELING 331 that the user can determine whether the simulation was successful. It instructs the simulator on how to format the signal values. The text enclosed in quotes is the for- mat statement; it is followed by a list of variables to be printed. The include state- ment requests that a file named ckt7p3.fvc be included; this file contains the stimuli to be simulated. The $finish indicates the end of simulation. The ck signal is assigned an initial value of 0. Then, every 500 ns it switches to the opposite state. The next file contains the stimuli used during simulation. Although the stimuli in this example are vectors listed in matrix form, they could just as easily be generated by a Verilog model whose sole purpose is to emit stimuli at random times, thus imi- tating the behavior of a backplane. In this vector file, the word cycle is replaced by the ASCII text string defined in stimuli.v. That text contains a time stamp, set to the value 1000. The simulator applies each vector 1000 time units after the previous vector. The time stamp is followed by the variable inputs; it causes the following four values to be assigned to the variable inputs from which they will subsequently be assigned to the four I/O ports by the assign statement. The values begin with the number 4, indicating the number of signal values in the string; the apostrophe and the letter b indicate that the string is to be interpreted as a set of binary signals. The four values follow, ended by a semicolon. The values are from the set {0, 1, X, Z}. The fourth value is applied to the inout signal y. Recall the y is an inout; sometimes it acts as an input, and other times it acts as an output. When y acts as an input, a logic 0 or 1 can be applied to that pin. When y acts as an output, then the I/O pad is being driven by the tri-state buffer, so the external signal must be a floating value; in effect the external driving signal is disconnected from the I/O pad. 7.5 FAULT MODELING In Chapter 3 we introduced the basic concept of a stuck fault. That was followed by a discussion of equivalence and dominance. The purpose of equivalence and domi- nance was to identify stuck-at faults that could be eliminated from the fault list, in order to speed up fault simulation and test pattern generation, without jeopardizing the validity of the fault coverage estimate computed from the representative faults. Other factors that must be considered were postponed so that we could concentrate on the algorithms. The fault list is determined, at least in part, by the primitives appearing in the netlist. But, even within primitives, defects in different technologies do not always produce similar behavior, and there are several MOS and bipolar tech- nologies in use. 7.5.1 Checkpoint Faults Theorem 3.3 asserted that in a fanout-free circuit realized by symmetric, unate gates, it was sufficient to put SA1 and SA0 faults on each primary input. All of the interior faults are either equivalent to or dominate the faults on the primary inputs. All faults interior to the circuit will be detected if all the faults on the inputs are detected. This 332 DEVELOPING A TEST STRATEGY suggests the following approach: identify all fanout-free regions. Start by identify- ing logic elements that drive two or more destination gates. That part of the wire common to all of the destination gate inputs is called a stem. The signal path that originates at a primary input or at one of the fanout paths from a stem is called a checkpoint arc. 2 Faults on the gate inputs connected to checkpoint arcs are called checkpoint faults. It is possible to start out with a fault set consisting of SA0 and SA1 faults at all checkpoint arcs and stems. This set can be further reduced by observing that if two or more checkpoint arcs terminate at the same AND (OR) gate, then the SA0 (SA1) faults on those arcs are equivalent and all but one of them can be deleted from the fault list. The remaining SA0 (SA1) fault can be transferred to the output of the gate. Example The circuit in Figure 7.4 has eight checkpoint arcs: four primary inputs and two fanout paths from each of P and R. Therefore, there are initially 16 faults. Faults on the inputs of the inverters can be transferred to their outputs; then the faults on the output of Q can be transferred to the input to S. The 16 faults now appear as SA0 and SA1 faults on the outputs of P and R and on each of the three inputs to S and T. The SA0 faults at the inputs of AND gates S and T are equivalent to a single SA0 fault on their outputs; hence they can be represented by equivalent SA0 faults, result- ing in a total of 12 faults.  Using checkpoint arcs made it somewhat simpler to algorithmically create a min- imum or near minimum set of faults, in contrast to assigning stuck-at faults on all inputs and outputs of every gate and then attempting to identify and eliminate equiv- alent or dominant faults. In general, it is a nontrivial task to identify the absolute minimum fault set. Recall that fault b dominates fault a if T a ⊆ T b , where T e is the set of all tests that detect fault e. If b is a stem fault and a is a fault on a checkpoint arc and is T a = T b , then fault b can be omitted from the fault list. But, consider the circuit of Figure 4.1. If the test vector (I 1 , I 2 , I 3 , I 4 , I 5 ) = (0, 0, 1, 0, 0) is applied to the circuit, an SA0 on the output of gate D will not be detected, but an SA0 on the input to gate I driven by gate D will be detected, as will an SA0 on the input to inverter J (verify this). Figure 7.4 Propagating a signal. D 1 D 0 S E 1 1 0 e e e V U S T P Q R FAULT MODELING 333 Checkpoint faults can be associated with unique signal path fragments. This is illustrated in Figure 7.4. The bold lines identify a signal path from input D 0 to the output. During design verification it would be desirable to verify that the indicated path behaves as intended. Verification involves propagating a signal e ∈ {0,1} from input D 0 to the output while all other signals are in an enabling state. But, there are many such signal path fragments. How can we be sure that all such paths have been verified? Note that sensitization of the path is no more and no less than a sensitization of the SA1 on the input to gate T and an SA0 on the output of gate T. An SA1 on the input to T can only be detected if a logic 0 can be propagated from D 0 to the output V in such a way that the output value functionally depends on the presence or absence of the stated fault. Meanwhile, an SA0 on the output of T can only be detected if a 1 can be successfully propagated from D 0 to V. Hence, if tests can be created that detect both of those faults, then a test has been created that can serve as part of a design verification suite. The point of this discussion is that if a test detects all stuck-at faults, then the test is also useful for verifying correctness of the design (note that it is necessary, of course, to verify circuit response to the stimuli). Conversely, if a design verification suite detects all checkpoint faults, then that suite is exercising all signal path frag- ments during times when they act as controlling entities—that is, when the circuit is conditioned such that an output is functionally dependent on the values being propa- gated. If the test does not detect all of the faults, then it is missing (i.e., not exercis- ing), some signal path fragments. Hence, the fault coverage number is also a useful metric for computing thoroughness of a design verification suite. 7.5.2 Delay Faults A circuit may be free of structural defects such as opens and shorts and yet produce incorrect response because propagation delay along one or more signal paths is excessive. Simply propagating 1 and 0 along these paths, while sufficient to detect stuck-at faults, is not sufficient to detect delay faults since the signal propagating to a flip-flop or primary output may have the same value as the previous signal. It can- not then be determined whether the signal clocked into the flip-flop or observed at a primary output is the new signal or the old signal. Detecting delay faults requires propagating rising and falling edges along signal paths (cf. Section 3.8). The existence of checkpoint faults as identifiers of unique signal paths for propagation of 1 and 0 suggests the following strategy to detect both stuck-at faults and delay faults: 1. Identify all unique signal paths. 2. Select a path, apply a 0 to the input, then propagate through the entire path. 3. Repeat the signal propagation with a 1, and then again with a 0, on the input. 4. Continue until all signal paths have been exercised. 334 DEVELOPING A TEST STRATEGY The test strategy just described will check delay relative to clock pulse duration along paths where source and destination may be flip-flops and/or I/O pins. The strategy is also effective for detecting stuck-open faults in CMOS circuits (see Section 7.6.3). The number of unique signal paths will usually be considerably less than the number of checkpoint faults since several faults will usually lie along a given signal path. Since the task of identifying signal paths and creating rising and falling edges can be compute-intensive, it may be advisable to identify signal paths most likely to have excessive delay and limit the propagation of edges to those paths. Note that a complete signal path can include several flip-flops. It is not an easy task to set up and propagate rising and falling edges along all segments of such paths. For example, an ALU operation may be needed in a CPU to set up a 0 or 1. By the time the complementary value has been set up several state transitions later, the original value may have changed unintentionally. A concurrent fault simulator can be instrumented to identify and track edge faults, just as easily as it tracks stuck-at faults, and it can identify paths or path segments that have been exercised by rising or falling edges. 7.5.3 Redundant Faults Redundant connections can cause a fault to be undetectable. A connection is defined as redundant if it can be cut without altering the output functions of a circuit. 3 If a circuit has no redundant connections, then it is irredundant. The following theorem follows directly from the definition of redundancy. Theorem 7.1 All SA1 and SA0 faults in a combinational circuit are detectable iff the circuit is irredundant. The simplest kind of redundancy, when discrete components are used, is to tie two or more signal pins together at the input of an AND gate or and OR gate. This is done when an n-input gate is available in an IC package and a particular application does not require all the inputs. For example, if an AND gate has inputs A, B, and C and if inputs A and B are tied together, then input combinations A, B, C = (0,1,1) or (1,0,1) are not possible. So SA1 faults on inputs A and B are undetectable. Consider what happens when an open occurs on a net where two inputs are tied together (Figure 7.5). There are two possibilities: 1. An open occurs somewhere between the common connection point and one of the inputs. 2. An open occurs prior to the common connection point. Figure 7.5 AND gate with redundant input. B A C FAULT MODELING 335 If an open exists between the common connection and the gate input, then the fault cannot be detected. If an open occurs prior to the common connection of the inputs, then the open affects both inputs and circuit behavior is the same as if there were a single input with a SA1 on the input. The redundancy just described is easily spotted simply by checking for identical names in the gate input list. If matching signal names are found, then all but one sig- nal can be deleted. Other kinds of redundancy can be more difficult to detect. Redundancy incorporated into logic to prevent a hazard will create an undetectable fault. If the fault occurs, it may or it may not produce an error symptom since a haz- ard represents only the possibility of a spurious signal. No general method exists for spotting redundancies in logic circuits. 7.5.4 Bridging Faults Faults can be caused by shorts or opens. In TTL logic, an open at an input to an AND gate prevents that input from pulling the gate down to 0; hence the input is SA1. Shorts can be more difficult to characterize. If a signal line is shorted to ground or to a voltage source, it can be modeled as SA0 or SA1, but signal lines can also be shorted to each other. In any reasonably sized circuit, it is impractical to model all pairs of shorted nets. However, it is possible to identify and model shorts that have a high probability of occurrence. Adjacent Pin Shorts A function F is elementary in variable x if it can be expressed in the form F = x* ⋅F 1 or F = x* + F 2 where x* represents x or x and F 1 , F 2 are independent of x. An elementary gate is a logic gate whose function is elementary. An input-bridging fault of an elementary gate is a bridging fault between two gates, neither of which fans out to another cir- cuit. With these definitions, we have: 4 Theorem 7.2 A test set that detects all single input stuck-at faults on an elementary gate also detects all input-bridging faults at the gate. The theorem states that tests for stuck-at faults on inputs to elementary gates, such as AND gates and OR gates, will detect many of the adjacent pin shorts that can occur. However, because of the unpredictable nature of pin assignment in IC pack- ages (relative to test strategies), the theorem rarely applies to IC packages. It is com- mon in industry to model shorts between adjacent pins on these packages because shorts have a high probability of occurrence, due to the manufacturing methods used to solder ICs to printed circuit boards. 336 DEVELOPING A TEST STRATEGY Adjacent pin shorts may cause a signal on a pin to alter the value present on the other pin. To test for the presence of such faults, it is necessary to establish a sensi- tized signal on one pin and establish a signal on the other pin that will pull the sensi- tized pin to the failing value. If the sensitized value D (D) is established on one of the pins, then a 0 (1) is required on the adjacent pin. Given a pair of pins P 1 and P 2 , the following signal combinations will completely test for all possibilities wherein one pin may pull another to a 1 or 0. P 1 :DD01 P 2 :01DD It is possible to take advantage of an existing test to create, at the same time, a test for adjacent pin shorts. If a path is sensitized from an input pin to an output pin during test pattern generation and if a pin adjacent to the input pin has an x value assigned, then that x value can be converted to a 1 or 0 to test for an adjacent pin short. The value chosen will depend on whether the pin on the sensitized path has a D or D. Programmable Logic Arrays Shorts created by commercial soldering tech- niques are easily modeled because the necessary physical information is available. Recall that IC models are stored in a library and are described as an interconnection of primitives. That same library entry can identify the I/O pins most susceptible to solder shorts, namely, the pins that are adjacent. Structural information is also available for programmable logic arrays (PLAs) and can be used to derive tests for faults with a high probability of occurrence. Logically, the PLA is a pair of arrays, the AND array and the OR array. The upper array in Figure 7.6 is the AND array. Each vertical line selects a subset of the input variables, as indicated by dots at the intersections or crosspoints, to create a prod- uct term. The lower array is the OR array. Each horizontal line selects a subset of the product terms, again indicated by dots, to create a sum-of-products term at the outputs. Figure 7.6 Programmable logic array. x 1 x 4 x 3 x 2 y 1 y 2 [...]... 7.8.3 Behavioral Fault Simulation The advent of RTL logic design and the resulting reliance on logic synthesis has had a major impact on design styles and productivity By expressing a design at a 362 DEVELOPING A TEST STRATEGY higher level of abstraction, the designer can focus on circuit behavior until the model responds correctly However, from the standpoint of developing and evaluating test programs,... specific faults When random patterns are employed, their use is normally followed by deterministic calculation of test patterns for specific faults 7.7.2 Seed Vectors Random vectors are quite useful in combinational circuits However, sequential circuits with tens or hundreds of thousands of logic gates and numerous complex state machines engaged in extremely detailed and sometimes lengthy “hand-shaking” sequences... FAULTS 337 The PLA is susceptible to bridging faults and crosspoint faults.5 The crosspoint fault is a physical defect caused by a diode at a crosspoint that is connected (unconnected) when it should not (should) have been connected In the AND array, the product term logically shrinks if a device is disconnected and the product term logically expands if an additional input variable is connected to... can be sorted in ascending or descending order and stored for fast retrieval during testing During testing, if errors are detected, a pass–fail vector can be created in which position i contains a 1 if an error is detected on that pattern and a 0 if no error is detected This vector is compared to the pass–fail vectors created from simulation output If one, and only one, vector is found to match the pass–fail... fault simulation can be a very CPU-intensive activity Therefore, when testing PCBs it has been the practice to direct test pattern generation and fault simulation at fault classes that have the highest probability of occurrence In the PCB environment, two major fault classes include manufacturing faults and field faults Manufacturing faults are those that occur during the manufacturing process, and include... will discuss some features and 342 DEVELOPING A TEST STRATEGY attributes of fault simulation that will enable a user to design strategies that are more productive, irrespective of whether or not an ATPG is employed 7.7.1 Random Patterns The use of random patterns is motivated by the efficiency curve shown in Figure 7.10 The first dozen or so patterns applied to a combinational logic circuit typically detect... number of unique input patterns applied and makes no distinction concerning the values assigned to the inputs It is a measure of test effectiveness for all kinds of faults, single and multiple, and suggests why there is a high initial percentage of faults detected However, the formula does not provide any information about particular classes of faults, and, in fact, simulation of single stuck-at faults... any logic, is complicated by the fact that a signal is affected by a logically unrelated signal However, the regular structure of the PLA makes it possible to identify potential sources of bridging faults and to perform fault simulation, if necessary, to determine which of the possible bridging faults are detected by a given set of test patterns 7.5.5 Manufacturing Faults Creation of test stimuli and. .. generating stimuli randomly, pseudo-randomly or algorithmically during each clock period Furthermore, many of the sequences created by the testbench may be repetitive and may not be contributing to overall fault coverage By contrast, within the confines of the limited amount of tester memory it is desirable to store, and apply to the design, a test program that is both efficient and effective The tester... known and, with experience, a reasonably accurate estimate can be made of the number of fault effects that exist, on average, for each fault origin With this information, it is possible to estimate how many faults can be processed in each fault simulation pass If the estimate is too optimistic, and not enough memory exists to process all of the faults, then some of the faults can be deleted and fault simulation . input to S. The 16 faults now appear as SA0 and SA1 faults on the outputs of P and R and on each of the three inputs to S and T. The SA0 faults at the inputs of AND gates S and T are equivalent. represents the fault- free circuit. F 1 and F 2 represent the output SA0 and SA1, respectively. F 3 and F 4 represent open inputs at A and B. F 5 and F 6 correspond to opens in the pulldown transistors. or hundreds of thousands of logic gates and numerous complex state machines engaged in extremely detailed and sometimes lengthy “hand-shaking” sequences tend to be quite random-resistant, meaning