MODEL FOR DELAY FAULTS BASED UPON PATHS

Transcription

1 MODEL FOR DELAY FAULTS BASED UPON PATHS Gordon L. Smith International Business Machines Corporation Dept. F60, Bldg , P. 0. Box 39 Poughkeepsie, NY (914) Abstract Delay testing of combinational logic in a clocked environment is analyzed. A model based upon paths is introduced for delay faults. Any path with a total delay exceeding the clock interval is called a "path fault." This is a global delay fault model because it is associated with an entire path. The more familiar slow- to-rise or slow- to-fall gate delay fault, on the other hand, is a local fault model. A procedure is described which identifies paths which are tested for path faults by a set of patterns. It does not involve delay simulation. The paths so identified are tested for path faults independent of the delays of any individual gate of the network. Introduction Testing of a clocked machine for delay failures requires tests that are conducted at essentially normal clocking rates. These tests, which are called delay tests, are distinct from tests for DC logic faults, which are generally conducted at slower clock rates. Of the delay test protocols possible, one is of considerable interest because of its relative simplicity and its similarities to the protocols generally used for nonfunctional testing for DC faults. This protocol, which is the subject of this paper, differs from the DC test protocols only in the following: 1) After initial loading of the latches feeding the combinational network, a clock is issued that causes many of these latches to take on new values; 2) The clock that samples the output of the combinational network into another set of latches is timed to occur at the same time interval (approximately) after the previous clock as occurs during normal machine operation. If unexpected values are latched at the output, a delay failure of the combinational network is assumed. This protocol is intended to detect delay faults within the combinational network which cause the propagation time of the network to exceed the clock interval. It is assumed, for purposes of this paper, that there are no other types of faults. The protocol does not verify that the delay value of each gate of the combinational network falls within specified values. Patterns for the tests may be loaded by any method, including, for example, scan-in and/or sequencing of machine clocks. The patterns may be derived from any source, including generated test patterns, though the most useful applications appear to be those in which patterns are provided by a pseudorandom pattern generator. A fault model often used for delay testing is the slow-to-rise or slow-to-fall delay fault at a gate input or output [1-4]. As will be shown later, this model has a number of deficiencies. These include the dependency of testability upon the fault size and upon the delay values of other parts of the network, and the inability to model delay failures in which the delay value of every gate is within specifications yet at least one delay through the entire combinational network exceeds the clock interval. This latter case arises when statistically timing rather than worst case timing is the basis for a design. A fault model is proposed that covers all possible delay faults of the combinational network. The delay fault model is based on a path of the combinational network. A path has a delay fault if signal propagation time through the path is greater than the interval between the two test clocks. The amount by which the clock interval is exceeded is not relevant. From an operational point of view, the combinational network is free of delay faults if and only if every path propagates signals in less time than the clock interval [5]. A procedure is proposed that identifies those paths that are unconditionally delay tested by a set of patterns. An important element of the protocol is the constancy of the clock interval. Clocks are not altered depending upon the path under test. Approaches such as those described by references [1-3] set the clock times to values appropriate for each path under test. Those approaches are designed to measure the propagation time of individual paths independent of the operating clock, generally with the intent of locating slow components whether or not operation under normal clocking conditions is affected. Reference [4] proposes an alternative model based on a delay fault at a gate. This model is applicable to the protocol of this paper. That model leads to a procedure for measurement of test quality that is fast but requires the assumption that gate delay faults are large. The path based delay fault model of this paper, on the other hand,

2 is effective for delay faults of any size, whether large or small. Reference [5] contains a discussion of delay testing against clocks, including aspects such as latches and clock distributions not touched on herein. In the following, the assumed hardware model is described. Sections on path faults and on a procedure for identifying paths tested for faults follow. A number of important properties of path faults are then given followed by a section on selection of paths. HARDWARE MODEL Figure 1 shows the assumed model. Input latches, which may be internal or external to the hardware under test, are first loaded with a set of initial values and, after all logic has quiesced, an input clock is issued which results in the loading of a set of final values into the input latches. These two sets of values constitute one pattern. Any input latch which thereby changes from 0 to 1 or from 1 to 0 generates a transition at the latch output. It is assumed that input latches are glitchless, that is, there is no momentary change in the latch output if the initial and final values are identical for that latch. Transitions from the input latch outputs propagate into the combinational network. It is assumed that the network is represented by gates with a single output and two delay values, one for a rising output transition and one for a falling output transition. Transitions may or may not propagate to the output of the network, depending upon all of the input values and upon the relative delays of the various gates of the network. It is quite possible that opposite transitions arriving at different inputs of a gate may cancel each other and propagate no further. The time it takes a transition to propagate through the combinational logic is the sum of the gate delays along the path traversed by the transition. It is assumed that the delay through each gate is a function of whether a transition rises or falls but is otherwise independent of the logical state of the network. It is assumed that the delay of a gate may vary from machine to machine because of process, temperature, and voltage variation. The outputs of the combinational network feed into a second set of latches called the output latches. These latches are clocked by an output clock which occurs at a specified clocking interval after the input clock. The value set into the output latch is the value leaving the combinational network at the time of clocking. The polarity hold latch is an example of a latch that has the characteristics required for output latches. DELAY FAULTS A delay test of a combinational network in a clocked environment is defined to be a test of the ability of the combinational network to propagate data in time for clocking into the next stage of latches. If such a test is failed and there are no DC faults, the network is said to have a delay fault. The time of the latch clocks is fixed. The timing of the clocks is not varied according to the Particular path through the network under test. Loosely speaking, this is a test against the "cycle time". In any design, a delay fault may occur because the delay values of one or more gates of the combinational network exceed specifications. However, a design may be free of delay faults yet have many gates with delay values that exceed specifications. In some designs (generally called statistical timing designs) there is a nonzero probability that a network may have delay faults yet have no gates with delay values exceeding specifications. If a path happens to have all gates with high but valid delay values, the aggregate delay of the path may cause it to exceed the clocking interval. Because the clocking is not designed to meet a worst case criterion but only a statistical worst case criterion, the network has a delay fault yet no gate has a delay value exceeding specifications. In a worst case design, however, a delay fault can occur in the combinational network only if at least one gate has a delay value exceeding specifications. Two types of delay faults are considered herein: 1) A path fault is a path of the combinational network between input and output latches for which a transition in the specified direction as initiated by the setting of an input

3 latch does not arrive at the path output in time for proper setting into an output latch; 2) A gate delay fault is defined as a gate defect that results in at least one path fault. It is emphasized that, whereas a gate delay fault is similar to a DC stuck fault in that it is associated with a single gate, a path fault is associated with an entire path. Path faults are global faults. Because of the high cost of delay simulation, it is advantageous to construct a criterion for delay testing for a path fault that is independent of the delay values of the gates. Therefore, a path is tested independent of gate delays by a pattern if any path fault on that path necessarily results in setting of an improper value into an output latch independent of the delay values of all gates of the combinational network. Of course, the sum of the delays of the gates along the path must exceed the clock interval if the path is to be a path fault. This definition assures that a path is tested for a path fault no matter how large or small the delays of individual gates are. Whether the path fault is caused by a single gate or multiple gates is also irrelevant. An improper value set into the latch at the output of a tested path does not assure that that path is a path fault because numerous simultaneously tested paths may end at the same latch. The advantage of this definition is that testability can be determined without the use of delay simulation because the delay values of individual gates has no effect on the testability criterion. The method for determining which paths are tested independent of gate delays by a given pattern is now given. Figure 2 provides a combinational network with delay faults which will serve as an example. The initial values and final values are shown as ordered pairs at the inputs. The delay value of each gate (assumed independent of transition direction for this example) and the function of each gate are also given. element of each ordered pair is a Boolean 0 or 1. The second value is 's' (steady), 'p' (path), or '-' (neither s nor p). The behavior as a function of time represented by each value is shown in Figure 3. The propagation tables for the inverter and the AND gate are shown in Figure 4 and examples of value propagation for an AND gate are shown in Figure 5. Propagation tables for other gates such as OR or exclusive-or can be constructed by using appropriate models built from the inverter and AND gate. The table resulting for the OR gate, for example, is identical to that of the AND gate, except that all occurrences of the values 0 and 1 are replaced by the values 1 and 0 respectively. The value assigned to the first element of each ordered pair for any gate is the Boolean value calculated by propagating the final values through the network in the conventional manner. A value s indicates that a gate necessarily holds a steady value during the propagation of transitions through the network. This must be true no matter what delays are assumed for each gate of the network. Inputs to the network take the value s if the initial and final value for the input latch are identical. An inverter takes the value s if the input takes the value s. An AND gate takes the value s if all inputs are value Is, or if at least one input is value Os. In either of these cases, it is clear that the AND gate output is steady. It is assumed that the circuit design assures that there are no glitches on the output of an AND gate provided that either of the stated input conditions is met. A value p indicates that there is at least one path of gates with a value p from the network input to this gate and that Figure 2: Example: Combinational Network with Delay Faults and Patterns Six propagation values are used. Each value consists of one of the ordered pairs Os, Is, Op, 1p, 0-, or 1-. The first Figure 3: Values

4 Figure 5: Propagation Examples. the gate does not change value before transitions have propagated through each pathof gates with a value p from the network input to this gate. Inputs to the network take the value pif the initial and final values for the input latch are opposite. An inverter takes the value p if theinput takes the value p. If an AND gate has 1) all inputs with the values Is, lp or 1- and at least one with the value 1p, or 2) exactly one input with the value Op and all other inputs with the value Is, then the gate necessarily has a transition. Furthermore,the gate can not leave its initial state before allnputs with value p have left their initial states(as delayed by the gate). Therefore, it follows in either of these cases that the output of the AND gate meets the requirements for the value p. For example, an AND gate with two inputs with value lp (see Figure 5) can not have a transition until both inputs have had transitions. The last input to changes the controlling input. Therefore, the output is assigned the value lp. A value - indicates that a gate does not meet the criteria for values s or p. A gate with the value - may have none, one or many transitions. Its final value may or may not be the same as its initial value. As can be seen in Figure 3, only the final value of a net with the value 1- or 0- can be stated with certitude. In all cases not described as resulting in the values s and p, the value - is assigned to the output of a gate. The following two cases deserve special mention (see Figure 5): An AND gate with two inputs with value Op has a transition when the first input has a transition. Therefore, the gate takes the value 0- because there is a change in value before transitions have propagated through both inputs. The change in output value is controlled by the first input to have a transition. An AND gate with one input with a value Op and one with value lp takes the value 0- because there is no assurance that the gate has a transition. A value p assures that a net changes value, but it does not assure that the net goes through a single transition. Figure 5 includes an AND gate with input values lp and 1-. As can be seen, the output, which has value lp, has multiple transitions because the input with value 1- has multiple transitions. However, the output does not leave its initial state before the input with value lp leaves its initial state. It follows that the output of a path of gates with value p can not leave its initial state until thetransition has propagated through the entire path.if the delay of the path exceeds the clock interval, then the output latch is necessarily set to an improper value without regard to how the delay is distributed along the path. The delay values of any other gates of the network are also irrelevant. The path is tested for path faults independent of gate delays. Figure 6 shows the example of Figure 2 after propagation of values in accordance with the tables. Three paths BJM, BGKM, and CGKM have the value p at every net and are, therefore, tested for path faults independent of gates delays. These paths are shown with heavy lines.

5 Figure 6. Example: Value Propagation and Paths Tested Independent of Gate Delays. PROCEDURE FOR IDENTIFYING TESTED PATHS The following describes a procedure that uses the propagation tables previously given to identify the paths of a set of paths that are tested for path faults independent of gate delays by a set of patterns. A connected gate model of the combinational network is built. A list of paths is provided. For purposes of the algorithm, each path is described as a transition direction and a list of gates from the output backwards to the input. The following set of operations is executed repetitively until all paths are tested or until some other termination criterion is met: 1. Generate the next set of initial and final values. Assign corresponding values of 0s, Is, 0p, or lp to each input of the network. The procedure for generating initial and final values functionally duplicates the loading mechanisms of the hardware. 2. Propagate values as per the propagation Tables. 3. Trace each path in the list of untested paths. Any path with the correct transition direction and with the value p on every gate of the path is flagged as tested. It is then removed from the path list. Because values are propagated only once for each pattern, the execution time for each pattern of the procedure is roughly proportional to only a linear function of the number of gates and the number of paths in the path list--not the product as is typical for DC stuck fault simulation. If paths are selected for the path list using considerations described later in this paper, it is usually reasonable to assume that the number of paths in the path list is a small multiple of the number of gates. Therefore, the execution time for each pattern of the procedure is roughly proportional to the number of gates. The execution time per pattern improves only modestly as paths are marked as tested and eliminated from the path list because of the constant costs of value propagation. The performance of path tracing is enhanced by path compression techniques and by the tendency of tracing to abort early for many paths during each pattern. PROPERTIES The following describes a number of properties related to path faults. 1. The presence of other path faults has no effect on the ability to test for a given path fault independent of gate delays. This is because a path of gates with the value p is tested by a pattern independent of the size of delay values of other gates of the network. Thus, multiple path faults are handled with the same facilty as single path faults. 2. If an output latch is improperly set by a pattern, it is impossible to diagnose the specific path fault that caused the failure. Any path of gates with the value p that terminates at that latch may be the cause. These paths may diverge, converge, or reconverge (see Figure 6). Furthermore, the failure may be due to a path fault on a path that contains gates with the value -. There may or may not also be gates with the value p. It is not possible to exclude such a path as a cause of a failure; however, detection of a path fault on such a path may be dependent upon the delay values of various individual gates of the network. 3. If a pattern tests a path independent of gate delays, then the pattern obtained with the following transformation also tests the path: all input values to the network remain the same except that any with the value p (other than the input to the tested path) is changed to s. The tested path input and each gate of the tested path necessarily have the value p before the transformation. Because the final values at the inputs are unchanged, it follows that the final values of all gates of the network are unchanged by the transformation. It is now shown that gates that formerly had the value s continue to have the value s after the transformation. Examination of the propagation tables shows that the only way to change a gate with the value s while retaining the same final value is to change at least one gate input that previously had the value s to some other value. Because inputs of the network are never changed from the value s, it follows by induction that no gate of the network is changed from the value s. Examination of the propagation tables for the gates along the tested path also shows that the only way to eliminate a value p from the path while retaining the same final values is to change an input value of an AND gate with the output value Op from the value is to the value 1- or lp. But it has just been

6 shown that no gate is changed from the value s and the path remains testable after the transformation. Therefore, if a specific pattern is sought that tests a path independent of gate delays, it is sufficient to find an appropriate set of final values because the initial values may be set identically equal to the final values for all inputs except the input of the path. The initial value of that input is set opposite to its final value. This assumes, of course, that the hardware can generate such a pattern. 4. The function representing propagation of the six values through an AND gate (or an OR gate) is symmetric and associative. The distributive property is not satisfied because, for example, if a=lp and b=c=ls, then ab+ac=1while a(b+c)=lp. 5. Because any path tested independent of gate delays is necessarily tested for path faults, it follows that the procedure establishes a valid lower bound on the paths tested for path faults by a set of patterns. 6. The paper by Barzilai and Rosen [4] describes a procedure for determining if a large gate delay fault is tested by a pattern. "Large" is defined to mean that the gate delay fault is large enough to turn every path through the fault into a path fault. Any such fault (with the appropriate polarity) lying on a path that is tested independent of gate delays is necessarily detected. 7. Any DC stuck fault lying on a path that is tested independent of gate delays is tested if the value of the stuck fault is opposite to the final value propagated to that point because the output of the path never changes value. 8. A path that is tested independent of gate delays might not be tested in the presence of stuck faults. For example, if the output of gate H in Figure 6 is stuck at the value 0, then the two paths BGKM and CGKM are no longer tested for path faults. 9. The formalism for delay faults due to paths that have delay values that are below specified values (race conditions) is virtually identical to the formalism for path faults as described in this paper. The differences arise because the last input to change at a gate is of interest for path faults, while the first input to change at a gate is of interest for race conditions. A propagation table for testing paths for race conditions independent of gate delays can be derived by changing the function at the top of the propagation table in Figure 4 from "AND" to "OR" and using the inverter and the OR gate as primitives. SELECTION OF PATHS FOR PATH LIST Because the number of paths in a network can be excessively large, reduction of the number of paths in the path list is important. The following discusses some of the considerations involved in path selection for the path list. The difficulties associated with directly modelling of gate delay faults is also discussed. A combinational network is free of delay faults of any size if and only if there are no path faults. However, analysis of actual gate delays and delay fault sizes usually demonstrates that testing of a small subset of all paths is sufficient to assure with adequate confidence that all paths are free of path faults. While it usually is not economical to explicitly include delays in a procedure that determines the piths that are delay testes, it is appropriate to consider delays during generation of the path list. Tendolkar [6] shows how the amount by which a gate with a delay defect exceeds its specified delay values affects the probability that a gate delay fault results. However, if a gate delay fault is caused by a gate delay defect, then the amount by which the resulting gate delay exceeds its specified delay also affects the effectiveness of delay testing, as is now explained. Let the slack of a path of a given machine after manufacture be defined as the arrival time of the clock at the output latch minus the arrival time at the same latch of a transition arriving through the path (minus the latch set up time). This definition is similar to the definition of slack used in timing analysis [7], yet differs because it applies to a specific machine built on the manufacturing line rather than to the design. Thus a path may have a positive slack in a design, yet have a negative slack in a particular machine because of a delay defect. The slack of a given pate of the network is defined as the least positive slack of any path passing through the gate. Any reference to slack for a design refers to the timing analysis sense. Consider the combinational network of Figure 7. There are four paths through gate C. In the absence of any delay defect at gate C, the slack of gate C is the slack of path BCE, the path with the least positive slack (12 - ( ) _ +1). An isolated delay defect at gate C does not result in a gate delay fault unless the defect size exceeds 1 (the gate delay exceeds 3). If, for example, there is a delay defect of 2 at gate C, a gate delay fault results and the slack of gate C is -1. Because BCE is the only path with negative slack, it follows that the delay fault can be detected only by patterns that delay test path BCE. On the other hand, if there is a delay defect of 7 at gate C, the gate has a slack of -6 and the delay fault can be detected by patterns that delay test any path.

7 Clock Interval = 12 Path Propagation Defect Time Detectable Good Machine ACD 6 -- ACE 8 -- BCD 9 -- BCE Defect at C: 2 ACD 8 N ACE 10 N BCD 11 N BCE 13 Y Defect at C: 7 ACD 13 Y ACE 15 Y BCD 16 Y BCE 18 Y Figure 7. Gate Delay Defect Size Affects Detectability. As can be seen, the number of paths with negative slacks increases as the size of a pate delay defect increases. Therefore, it is generally easier to detect a gate fault produced by a large delay defect than one produced by a small delay defect. The word "generally" is included because a larger gate delay defect may be more difficult to detect than a smaller one in a few cases involving reconvergent paths. The necessity for considering the size of a gate delay defect and the size of all gate delays makes the gate delay fault model unattractive for direct modelling. If, for each gate, the path in the design with the worst (least positive) slack for that gate is tested independent of gate delays, then the network is entirely tested for path faults under the assumption that there is no variation of delay values from machine to machine except for the occurence of at most a single gate delay defect. However, if all paths with worst slacks are not tested by the set of test patterns provided, it may then be desirable to include some "almost worst" paths for each gate in the path list. Establishing that a gate is free of larger gate delay faults is of value even it is not established that the gate is free of all gate delay faults.."almost worst" paths refers to those paths of the design that have slacks close to the slack of the path with the least positive slack value. Because of delay variation, it can not be said that a gate delay defect of a certain size will produce a delay fault without knowledge of the delay values of all gates in each path through that gate for the particular machine. Therefore, it can happen that the path with the least positive slack through a given gate in one machine-is not the path with the least positive slack through the same gate of another machine. Again, it is appropriate to select paths through each gate that have the worst or almost worst slacks in the design. In a statistical based timing design, the paths that are most likely to fail are those with the worst or almost worst slacks in the design. It is, therefore, advisable to select those paths for the path list. In all cases the slack of paths in the design provides a tool for selection of a subset of the set of all paths for entry into the path list of the procedure for identifying tested paths. CONCLUSION Delay testing in a clocked environment is discussed. The criterion for a machine being free of delay faults is defined in terms of the ability of paths to propagate transitions through the combinational network in less time than the clock interval. Whether the delay values of individual gates exceeds specifications or not is irrelevant to this criterion. The path fault is defined as any path that does not meet the clock interval. This fault model is capable of modelling all delay faults of any size. A path is tested for path faults independent of gate delays if the size of any individual gate delay has no affect on the delay testing of the path. A procedure for establishing which paths of a set of paths are tested for path faults independent of gate delays is described. The procedure, which does not use delay simulation, propagates a set of six values only once for each pattern. Those paths of a path list which are tested by the pattern are then determined directly from the resulting graph. The execution time is roughly proportional to a linear function of the number of gates and the number of paths. The use of timing analysis slacks provides a means for selecting a reasonable number of paths for the procedure for identifying tested paths. Gate delay faults require the use of delay simulation unless only "large" gate delay faults are modelled. For this reason, the path fault is used as a model in preference to the gate delay fault.

8 ACKNOWLEDGEMENTS R. S. James and R. H. Blumberg are thanked for their management support. P. H. Bardell and Z. Barzilai are thanked for their encouragement and advice. I. M. Ratiu is thanked for his many useful comments. REFERENCES 1. T. Hayashi et al., "A Delay Test Generator for Logic LSI," Proc. 14th Int'1 Conf. Fault Tolerant Computing, June 1984, pp T. M. Storey and J. W. Barry, "Delay Test Simulation," Proc. 14th Design Automation Conf., June 1977, pp J. D. Lesser and J. J. Shedletsky, "An Experimental Delay Test Generator for LSI Logic," IEEE Trans. Computers, Mar. 1980, pp Z. Barzilai and B. K. Rosen, "Comparison of ACSelf-Testing Procedures," Proc Int'l Test Conf., pp Y. K. Malaiya and R. Narayanaswamy, "Testing for Timing Faults in Synchronous Sequential Integrated Circuits," Proc Int'1 Test Conf., Oct. 1983, pp N. N. Tendolkar, "Analysis of Timing Failures Due to Random AC Defects in VLSI Modules," Proc. 22nd Design Automation Conf., June R. B. Hitchcock, G. L. Smith, and D. D. Cheng, "Timing Analysis of Computer Hardware," IBM J. Research and Development, Vol. 26, No. 1, Jan.1982, pp