Design for testability: scan, ATPG and BIST

In short

Design for testability (DFT) is the deliberate addition of hardware to a chip so that manufacturing defects can be detected cheaply on an automatic test equipment (ATE) after fabrication. Without it, a block buried behind millions of gates is neither controllable nor observable from the pins; scan design converts every flip-flop into a shift-register element so the ATPG tool can load any state and read any state back. The topic is examined in VLSI testing / VLSI design papers of most Indian university syllabi; it is not part of the GATE EC syllabus, which covers digital and sequential circuits but not fault models or testability measures. It is one of the highest-volume hiring areas in Indian VLSI - DFT engineers at Intel, Qualcomm, Samsung SRI-B, Texas Instruments, NXP, Nvidia, AMD, Microchip, Bosch, Synopsys, Cadence, Siemens EDA and the service houses - and it is the bridge to India's new test and packaging plants.

Explained

Why DFT exists: controllability, observability and fault models

• Controllability - the effort needed to force a chosen value on an internal node from the primary inputs. Observability - the effort needed to propagate that node's value to a primary output. DFT buys both.
• A defect (open, short, particle, resistive via, missing contact) is modelled as a logical fault so that it can be targeted by an algorithm.
• Stuck-at fault (SA0/SA1): a net permanently 0 or 1. Single-stuck-at is the industry baseline model; it catches most gross defects and is the basis of almost all exam problems.
• Transition / delay faults: slow-to-rise and slow-to-fall at a node - needs two patterns (launch and capture) applied at rated speed; catches resistive opens that stuck-at misses.
• Path-delay fault: cumulative delay of a whole path exceeds the clock period; used on critical paths only (path count explodes).
• Bridging fault: two nets shorted (AND-bridge, OR-bridge, dominant bridge); physically-aware / DFM ATPG extracts realistic bridge pairs from layout.
• IDDQ fault: a quiescent-current measurement detects leakage/shorts that are logically invisible; less effective in deep sub-micron because normal leakage is large.
• Cell-aware test: defects modelled *inside* the standard cell from its transistor-level layout; standard at advanced nodes and adds 1-3 % coverage over stuck-at + transition.
• Fault collapsing: equivalent and dominant faults are merged (an n-input AND gate has 2n+2 faults, collapsed to n+2), cutting ATPG effort roughly 2×.
• Redundant / ATPG-untestable faults cannot be detected by any pattern - they lower fault coverage but are excluded from *test* coverage.

Testability measures and ad-hoc DFT

• SCOAP (Sandia Controllability/Observability Analysis Program) gives combinational CC0, CC1 and CO as integers, computed by one forward pass and one backward pass over the netlist - purely topological, no simulation.
• Primary inputs: CC0 = CC1 = 1. Primary outputs: CO = 0. Sequential versions SC0, SC1, SO count clock cycles instead of gates.
• High numbers flag hard-to-test logic; the designer then adds test points - a control point (MUX or AND/OR gate forced in test mode) or an observe point (extra flop/XOR into a chain).
• Ad-hoc DFT: break long counters, bring internal nodes to spare pins, insert test MUXes, avoid combinational feedback, avoid asynchronous logic, partition large blocks. Cheap but not systematic and gives no coverage guarantee - hence structured DFT.

Scan design

• Mux-D scan flip-flop: a 2:1 MUX in front of a normal D flop. SE (scan enable) = 0 → functional D; SE = 1 → SI from the previous cell. Area cost ≈ 5-15 % of flop area, plus one extra gate delay in the functional path - the classic area/timing versus testability trade-off.
• Cells are stitched into scan chains: scan-in pin → cell → cell → ... → scan-out pin. Many chains run in parallel to cut test time.
• Three modes: *shift* (SE = 1, load stimulus / unload response), *capture* (SE = 0, one functional clock pulse captures the combinational response), *functional*.
• Pattern application: shift in L bits → de-assert SE → one capture pulse → shift out the response while shifting in the next pattern (overlapped shift saves nearly half the cycles).
• Other styles: clocked-scan (separate test clock instead of a MUX), LSSD (level-sensitive scan design - master/slave latches with non-overlapping clocks A, B, C; race-free, used in IBM-style flows), enhanced scan (hold latch per cell, stores two independent vectors for delay test), partial scan (only some flops scanned - saves area, loses coverage and needs sequential ATPG).
• Scan DRC rules (checked before stitching, in Tessent/TestMAX):
  1. All clocks controllable from a pin during shift; internally generated and gated clocks bypassed in test mode.
  2. Asynchronous sets/resets held inactive during shift (test-mode OR/AND gating).
  3. No combinational feedback loops; latches made transparent or clamped.
  4. Clock must not be used as data, and data must not reach a clock pin.
  5. X-sources - memories, analog blocks, black boxes - bounded by masking or wrappers.
  6. Bidirectional pins forced to a known direction; tristate buses given a single enabled driver.
• Shift power is a real limit: every cell toggles every cycle. Remedies - low shift frequency (10-50 MHz against GHz functional speed), chain splitting with staggered scan-enable, clock gating during shift, adjacent/repeat X-fill of don't-care bits.

ATPG: algorithms, metrics and compression

• Steps for one fault: (1) activation/excitation - force the opposite value at the fault site (D or D̄); (2) propagation - sensitise a path to an output through the D-frontier; (3) justification - back-trace the required values to primary inputs/scan cells; (4) backtrack on conflict.
• D-algorithm - works on internal signals using D-cubes; complete but slow. PODEM - path-oriented decision making, assigns only primary inputs with objectives and backtracing, no conflicts in the implication stack. FAN - adds multiple backtrace, headlines and unique sensitisation; the basis of commercial engines. SAT-based ATPG is now common for hard faults.
• Fault simulation grades patterns and finds collateral detections: parallel, deductive, concurrent algorithms; random pattern fill + fault simulation is used first, then deterministic ATPG for the residue.
• Coverage targets in practice: stuck-at ≥ 99 %, transition ≥ 90-95 %; automotive parts to ISO 26262 ASIL-D demand higher coverage plus in-field self-test.
• At-speed test: LOC/broadside (launch from the last shift-captured state - two at-speed capture pulses, easier timing, more untestable faults) versus LOS/skewed-load (launch by the last shift pulse - higher coverage but scan-enable must meet at-speed timing). Faster-than-at-speed test squeezes small-delay defects.
• Test compression (EDT / TestKompress / DFTMAX / Modus): a few ATE channels feed an on-chip decompressor (ring generator + phase shifter) driving hundreds of short internal chains; responses go through an X-tolerant XOR compactor back to a few pins. 10×-400× reduction in both test data volume and test time.
• Hierarchical DFT: ATPG once per core, patterns retargeted to the top level through IEEE 1500 wrappers - essential for SoCs with repeated cores and for parallel test of identical blocks.
• Diagnosis: failing cycles and channels are mapped back to candidate nets/cells; volume diagnosis across many failing dies drives yield learning in the fab.

BIST: logic and memory

• Logic BIST (LBIST) puts the pattern source and response evaluator on chip - an LFSR/PRPG generating pseudo-random vectors and a MISR compacting responses into a signature compared with a golden value.
• STUMPS (self-test using MISR and parallel shift-register sequence generator) is the standard architecture: PRPG → phase shifter → scan chains → compactor → MISR.
• LFSR: n flip-flops with XOR taps given by a characteristic polynomial; a primitive polynomial gives a maximal sequence of 2ⁿ − 1 states (all-zero excluded for XOR type).
• Aliasing: a faulty response can compact to the good signature; probability ≈ 2⁻ᵏ for a k-bit MISR (2⁻³² ≈ 2.3 × 10⁻¹⁰) - negligible.
• Random-pattern-resistant faults (deep AND trees, wide comparators) have tiny detection probability; fixed by test points or by top-up deterministic ATPG patterns on top of LBIST.
• X-sources must be blocked before the MISR - any X corrupts the signature, unlike an ATE comparison which can be masked per cycle.
• Advantages: at-speed, no ATE pattern memory, reusable in the field (key-on self-test in automotive), good for burn-in and for in-system periodic test. Limits: area and timing overhead, lower coverage per pattern, no direct diagnosis.
• Memory BIST (MBIST): an on-chip FSM applies march algorithms to RAM; memories cannot be scanned.
  • Fault models: stuck-at cell, transition, coupling (CFin, CFid, CFst), address decoder faults (AF), data retention, neighbourhood pattern-sensitive faults.
  • March tests: MATS+ (5N), March C− (10N - AF, SAF, TF, CF), March SS, March B; checkerboard and retention (pause) tests; word-oriented memories use several data backgrounds (solid, checkerboard, row/column stripe).
  • MBIST adds repair (BIRA/BISR with spare rows/columns and fuses) and bitmap collection for diagnosis.

Board and system test standards

• IEEE 1149.1 (boundary scan / JTAG, current edition 1149.1-2013): a boundary-scan cell at each I/O plus a TAP controlled by TCK, TMS, TDI, TDO and optional TRST, driven by a 16-state controller. Tests board interconnect (opens/shorts) without a bed-of-nails, and gives access for in-system programming and debug.
  • Mandatory instructions in the classic standard: BYPASS, SAMPLE/PRELOAD, EXTEST; the 2013 edition also made IDCODE, CLAMP and HIGHZ mandatory (IDCODE register is 32-bit: 1 + 11-bit JEDEC manufacturer ID + 16-bit part + 4-bit version). Optional: USERCODE, INTEST, RUNBIST. The 2013 edition made a BSDL description mandatory, introduced PDL for describing instruments, and added optional reset/power-domain features.
• IEEE 1149.6 extends boundary scan to AC-coupled and differential nets; IEEE 1149.4 covered mixed-signal test buses; IEEE 1149.7 adds a 2-pin compact TAP.
• IEEE 1500-2005: standard core test wrapper (WIR, WBY, WBR, WPC) so third-party IP cores can be isolated and tested; IEEE 1687 (IJTAG) standardises access to embedded instruments through reconfigurable scan networks using ICL and PDL; IEEE 1838 extends access to 3D stacked dies; IEEE 1687.1 defines access to 1687 networks from interfaces other than JTAG.
• Indian context: there is no separate Indian Standard for DFT - these IEEE standards and the customer's quality flow govern. Automotive silicon follows ISO 26262 (functional safety, ASIL A-D) and AEC-Q100 qualification; quality systems commonly certified to IATF 16949 / ISO 9001:2026. Post-fab test happens at ATMP/OSAT plants - Micron's Sanand facility, the Tata-PSMC Dholera fab with its Assam (Jagiroad) ATMP, CG Power-Renesas-Stars, Kaynes Semicon - plus SCL Mohali and ISRO/SITAR for strategic devices, all under the India Semiconductor Mission.

Key points

• DFT - extra hardware that buys controllability and observability, trading area, pins, power and a little timing for testability.
• Stuck-at - baseline fault model, one pattern per fault; transition - needs a launch-capture pair at speed.
• Fault collapsing - merging equivalent/dominant faults; roughly halves the fault list.
• SCOAP - integer controllability/observability from topology; PI CC0 = CC1 = 1, PO CO = 0.
• Mux-D scan cell - MUX + flop; SE selects functional D or scan SI.
• Three scan modes - shift, capture, functional; overlapping unload with the next load saves nearly half the cycles.
• LSSD - latch-based, race-free scan with non-overlapping A/B/C clocks; enhanced scan holds two vectors for delay test.
• Scan DRC - controllable clocks, inactive async resets during shift, no comb loops, X-sources bounded.
• ATPG steps - activate, propagate (D-frontier), justify, backtrack; D-algorithm → PODEM → FAN → SAT.
• Fault coverage vs test coverage - the second excludes undetectable and untestable faults, so it is always the higher number.
• LOC vs LOS - broadside is timing-friendly, skewed-load gives higher coverage but needs an at-speed scan enable.
• Test compression (EDT) - on-chip decompressor + compactor; 10×-400× less data and time for a few percent area.
• LFSR - primitive polynomial gives 2ⁿ − 1 patterns; MISR compacts responses, aliasing ≈ 2⁻ᵏ.
• STUMPS - the standard LBIST architecture; needs X-bounding and test points for random-resistant faults.
• MBIST - march algorithms (March C− = 10N) on chip, with BISR repair; memories are never scanned.
• IEEE 1149.1 - TAP (TCK, TMS, TDI, TDO, TRST) with mandatory BYPASS, SAMPLE/PRELOAD and EXTEST, for board-level interconnect test.
• IEEE 1500 / 1687 - core wrappers and instrument access; the backbone of hierarchical DFT and in-system test.
• Defect level falls steeply with coverage - the business case for pushing stuck-at coverage past 99 %.

Formulas and examples

Example 1 - scan test time and the value of more chains. A design has 1,000,000 scan flops, 8,000 patterns, shift clock 50 MHz (20 ns).

• One chain: L = 1,000,000. Cycles = 8,001 × 1,000,000 + 8,000 ≈ 8.001 × 10⁹ → t ≈ 8.001 × 10⁹ × 20 ns ≈ 160 s per die - commercially impossible.
• 200 chains: L = 5,000. Cycles = 8,001 × 5,000 + 8,000 = 40,013,000 → t ≈ 0.80 s.
• Only 20 ATE channels are available. Without compression, 20 chains of 50,000 give 8,001 × 50,000 ≈ 4.0 × 10⁸ cycles ≈ 8.0 s. With EDT feeding 200 internal chains from the same 20 channels, back to 0.80 s - a 10× gain.
• Tester cost at an assumed ₹2 per second of ATE time: 0.80 s → ₹1.60 per die, against ₹16 per die uncompressed.

Example 2 - coverage arithmetic. Total collapsed faults 1,200,000; detected 1,140,000; ATPG-untestable 24,000.

• FC = 1,140,000 / 1,200,000 = 95.00 %.
• TC = 1,140,000 / (1,200,000 − 24,000) = 1,140,000 / 1,176,000 = 96.94 %.
• Quoting the second number as "fault coverage" is the commonest reporting error in interviews.

Example 3 - defect level in DPM. True yield Y = 0.90.

• T = 0.95: DL = 1 − 0.90^0.05 = 1 − e^{0.05 × ln 0.9} = 1 − e^−0.005268 = 0.005254 → 5,254 DPM.
• T = 0.99: DL = 1 − 0.90^0.01 = 1 − e^−0.0010536 = 0.0010530 → 1,053 DPM.
• T = 0.999: DL = 1 − e^{−0.00010536} = 0.00010535 → 105 DPM. Four extra points of coverage cut escapes 50×.

Example 4 - LBIST, aliasing and random resistance. A 16-bit maximal LFSR runs at 100 MHz.

• Patterns = 2¹⁶ − 1 = 65,535; raw generation time = 65,535 × 10 ns = 655.4 µs (the real BIST time is this × chain length, since each pattern must be shifted).
• 32-bit MISR: aliasing ≈ 2⁻³² = 2.3 × 10⁻¹⁰ - about one escape in 4 billion faulty responses.
• A fault with detection probability p = 1 × 10⁻⁶: P_det = 1 − (1 − 10⁻⁶)⁶⁵,535 ≈ 1 − e^−0.0655 = 6.3 %. For 99 % confidence, N = ln(0.01)/ln(1 − 10⁻⁶) ≈ 4.605 × 10⁶ patterns - impractical, so a test point is inserted instead.

Example 5 - MBIST time. A 4,096-word × 32-bit SRAM, March C−, 4 data backgrounds, BIST clock 200 MHz (5 ns).

• Operations = 10 × 4,096 × 4 = 163,840 → time = 163,840 × 5 ns = 819.2 µs.
• The same memory with MATS+ (5N, 1 background) takes 5 × 4,096 × 5 ns = 102.4 µs but misses coupling faults - the classic test-time versus coverage trade.

Example 6 - SCOAP on a small circuit. Inputs a, b, c; z = AND(a, b); y = OR(z, c), y a primary output.

• CC0(a) = CC1(a) = 1 for all inputs. z: CC0 = min(1,1) + 1 = 2, CC1 = 1 + 1 + 1 = 3.
• y: CC1 = min[CC1(z), CC1(c)] + 1 = min(3,1) + 1 = 2; CC0 = CC0(z) + CC0(c) + 1 = 2 + 1 + 1 = 4.
• CO(y) = 0 (primary output). For the OR gate, CO(z) = CO(y) + CC0(c) + 1 = 0 + 1 + 1 = 2; then CO(a) = CO(z) + CC1(b) + 1 = 2 + 1 + 1 = 4. To test a SA0 on a: set a = 1, b = 1, c = 0 → y = 1 good, 0 faulty.

Where it is used

• DFT engineer roles in Indian design centres (Intel Bengaluru, Qualcomm, Samsung SRI-B, TI, NXP, Nvidia, AMD, Micron, Microchip, Renesas, Bosch, Western Digital) - scan insertion, ATPG, pattern bring-up, silicon debug and diagnosis; strong demand for Tessent, TestMAX and Modus skills.
• ATE and post-silicon validation: writing and debugging STIL/WGL patterns on Advantest V93000 or Teradyne UltraFLEX/J750 platforms at OSAT/ATMP sites - Micron Sanand, Tata Assam, CG Power-Renesas, Kaynes Semicon - and at captive test floors.
• Automotive and industrial silicon: LBIST and MBIST fired at key-on and periodically in the field for ISO 26262 ASIL-C/D diagnostic coverage in airbag, braking, motor-control and BMS chips.
• Board and system manufacture: JTAG boundary-scan interconnect test and in-system flash programming on telecom, defence and railway boards (BEL, HAL, C-DOT, Tejas, L&T, ISRO payload electronics).
• Memory-heavy SoCs: MBIST with BISR repair recovers yield on large on-chip SRAM arrays; bitmaps feed fab yield learning.
• EDA product and AE roles: Synopsys, Cadence and Siemens EDA India teams build and support the scan/ATPG/compression tools and the 1687-based instrument access flows.

Interview questions

• Q: Why is scan needed when the design is already functionally verified? A: Verification checks the design intent; test checks each fabricated die for physical defects, and only scan makes a buried flop controllable and observable from the pins at acceptable cost.
• Q: What is the difference between fault coverage and test coverage? A: Fault coverage divides detected faults by all faults; test coverage divides by testable faults only, excluding ATPG-untestable and unused logic - so test coverage is always higher and is what customers are quoted.
• Q: Why is the shift clock much slower than the functional clock? A: Every scan cell toggles on every shift cycle, so switching current and IR drop are far above functional levels; shifting slowly keeps the chip within its power and droop limits.
• Q: LOC or LOS - which would you choose and why? A: LOC (broadside) by default, because scan-enable need not be at-speed; LOS gives higher transition coverage with fewer patterns but requires an at-speed, timing-closed scan-enable, so it is used only when coverage demands it.
• Q: How does test compression reduce both data volume and test time? A: A decompressor expands a few ATE channels into many short internal chains, so the shift depth per pattern falls by the chain-count ratio and only the compressed seeds need to be stored.
• Q: What does an X on a scan path do in LBIST versus in ATE-based scan test? A: In LBIST it corrupts the MISR signature and must be blocked at source; on ATE it can simply be masked for that cycle/channel, so ATE flows tolerate X far better.
• Q: Why are 99 % stuck-at patterns not enough for a 2 GHz part? A: Stuck-at patterns are applied slowly and detect only hard logic faults; resistive opens and slow paths need transition/path-delay patterns applied at rated speed.
• Q: Which IEEE 1149.1 instructions are mandatory, and what does EXTEST do? A: BYPASS, SAMPLE/PRELOAD and EXTEST are mandatory; EXTEST drives preloaded values out of the output boundary cells and captures the neighbours' input cells, testing board interconnect for opens and shorts.
• Q: Why can't memories be put into scan chains? A: Their internal arrays are not flip-flops and their fault models (coupling, decoder, retention) need sequential march sequences, so an on-chip BIST FSM is used and the memory is treated as an X-source for scan.
• Q: What is a random-pattern-resistant fault and how is it handled? A: One with very low detection probability under pseudo-random vectors, typically behind a wide AND/comparator; handled by inserting control/observe test points or by topping up LBIST with deterministic ATPG patterns.
• Q: What breaks if an asynchronous reset is left active during shift? A: Cells get cleared instead of shifting, so the chain integrity (flush) test fails and no pattern can be loaded; the reset must be gated inactive in test mode.
• Q: How much area does scan cost, and what else does it cost? A: Typically 5-15 % on the flops plus routing and a small percentage for compression logic; it also adds a MUX delay in every data path and consumes pins, so it must be planned before synthesis and floorplanning.

Common mistakes

• Quoting test coverage as fault coverage, or reporting coverage without saying which fault model it is for.
• Forgetting the capture cycles and the pattern-overlap saving in test-time calculations, or using the functional clock instead of the shift clock.
• Assuming stuck-at coverage implies delay-fault coverage - they are different models with different pattern counts.
• Treating DFT as a back-end afterthought: ungated internal clocks, async resets and combinational loops are all cheap to fix in RTL and expensive to fix after synthesis.
• Leaving X-sources (memory outputs, black boxes, uninitialised flops) unbounded, then blaming ATPG for low coverage or a mismatching BIST signature.
• Mixing up controllability and observability in SCOAP, or using the OR-gate rule for an AND gate (CC0 of AND is a *min* + 1, CC1 is a *sum* + 1).
• Believing MISR aliasing is a practical risk - at 32 bits it is about 2 × 10⁻¹⁰, far below the defect escape rate that actually matters.

Related topics

Physical design: floorplanning, placement, clock tree synthesis and routing · Physical verification and signoff: DRC, LVS and IR drop · Sequential circuit design and timing (setup, hold, CDC) · Fault-tolerant and functional-safety design (ISO 26262) · Semiconductor fabrication, yield and reliability · Verilog/SystemVerilog RTL design and synthesis