REGISTER-TRANSFER LEVEL FAULT MODELING AND TEST EVALUATION TECHNIQUES FOR VLSI CIRCUITS

REISTER-TRANSFER LEVEL FAULT ODELIN AND TEST EVALUATION TECHNIQUES FOR VLSI CIRCUITS Pradip A. Thaker Hughes Network Systes erantown, D 20876, USA pthaker@hns.co Vishwani D. Agrawal Bell Labs, Lucent Technologies urray Hills, NJ 07974, USA va@research.bell-labs.co ona E. Zaghloul eorge Washington University Washington, DC 20052, USA zaghloul@seas.gwu.edu Abstract Stratified fault sapling is used in RTL fault siulation to estiate the gate-level fault coverage of given test patterns. RTL fault odeling and fault injection algorith are developed such that the RTL fault list of a odule can be treated as a representative fault saple of the collapsed stuck-at fault set of the odule. The RTL coverage for the odule is experientally found to track the gate-level coverage within the statistical error bounds. For a VLSI syste, consisting of several odules, the overall coverage is a weighted su of RTL odule coverages. Several techniques are proposed to deterine these weights, known as stratu weights. For a syste tiing controller ASIC, the stratified RTL coverage of verification testbenches was estiated within 0.6% of the actual gate-level coverage. This ASIC consists of 40 odules (9,000 lines of Verilog HDL) that are synthesized into 7,26 equivalent logic gates by a coercial synthesis tool. Siilar results on two other VLSI systes are reported.. Introduction Test patterns for large VLSI systes are often deterined fro the knowledge of the circuit function. A fault siulator is then used to find the effectiveness of the test patterns in detecting gate-level stuck-at faults. Existing gate-level fault siulation techniques suffer prohibitively expensive perforance penalties when applied to the odern VLSI systes of larger sizes. Also, findings of such test generation and fault siulation efforts in the post logic-synthesis phase are too late in the design cycle to be useful for design-for-test (DFT) related iproveents in the architecture. Therefore, an effective register-transfer level (RTL) fault odel is highly desirable. Several high-level fault odels and fault siulation techniques have been proposed by Thatte and Abraha [23], Chakraborty and hosh [7], hosh [3], Ward and Arstrong [27], Arstrong et al. [4], Cho and Arstrong [0], and, Sanchez and Hidalgo [8]. None of these techniques establish the relationship between high-level fault coverage and gate-level fault coverage. ao and ulati [5] proposed an RTL fault odel and a siulation ethodology but did not establish the relationship of RTL faults to gate level faults. Their approach also required one to run fault siulation twice (first in an optiistic and then in a pessiistic ode) and to use the average of the results to reduce the difference between the RTL and the gatelevel fault coverages. This is an inefficient solution derived purely epirically. The authors did not establish any theoretical basis to generalize the application of their fault odel. Their experiental data indicated as uch as a 0% error between the actual gate-level fault coverage and the RTL fault coverage. Hayne and Johnson [4] developed a fault odel based on finding an abstraction of the industry standard single-stuckline faults in the behavioral doain. This fault odel was developed such that for every possible gate-level fault in the circuit there is a corresponding faulty RTL circuit. Siilar efforts by others were focused on developing a odel that, when applied to RT level description, could produce the behavior of all possible gate-level single stuck-at faults. The RTL fault odels that fall short of achieving this goal have been considered incoplete. The procedure presented in this paper works on the preise that all hardware (gate-level) faults ay not be represented at the RT level since the RT level description is a higher level of abstraction and ay not contain the low-level structural inforation needed to exactly replicate all gatelevel failures. Also, since the gate-level netlist changes drastically with every logic synthesis iteration, efforts to odel all possible gate faults at RT level are inefficient. Instead, in this paper, an RTL fault odel and faultinjection algorith are developed such that the RTL faultlist of a odule becoes a representative saple of the corresponding collapsed gate-level fault-list. The proposed RTL fault odel and the fault-injection algorith are ITC INTERNATIONAL TEST CONFERENCE 940 0-7803-6546-/00 $0.00 2000 IEEE

developed fro an analysis of the properties of the gatelevel SSF odel and apping of RTL constructs onto gatelevel structures during logic synthesis. The proposed RTL faults of a odule have a distribution of detection probabilities siilar to that for collapsed gate faults of a corresponding gate-level netlist. The difference between RTL and gate-level fault coverages of a odule for a given set of test patterns is expected to be within the error bounds established for the rando-sapling technique by Agrawal and Kato [3]. The effectiveness of the proposed RTL fault odel is verified using several real-life industryapplication VLSI circuits. It is observed that the total nuber of RTL faults in a odule does not represent the size of the gate-level faultlist. This lack of a clearly defined relationship between the nuber of RTL faults and the nuber of possible gatelevel faults presents a proble for a VLSI syste which consists of several odules. Although the RTL fault-list of each odule in a VLSI syste is a representative saple of the corresponding gate-level fault-list of that odule, the overall RTL fault-list of the syste does not constitute a representative saple of the overall gate-level fault-list. This observation led us to consider a technique known as stratified sapling []. A VLSI syste is divided into several non-overlapping strata according to RTL odule boundaries. The stratu weights for these odules are deterined using any of the proposed techniques described in a later section. RTL fault coverages of odules are added according their respective stratu weights to deterine the stratified RTL fault coverage for the VLSI syste. The stratified RTL fault coverage serves as an estiate of the gate-level fault coverage of the VLSI syste for the given set of test patterns. The error bounds for this estiate are statistically calculated. The stratified RTL fault coverages of several real-life industryapplication VLSI systes are copared with the corresponding gate-level fault coverages for various test pattern sets. Sections 2, 3 and 4 describe the research contribution of this paper. Section 2 contains a detailed description of the proposed RTL fault odel, the fault-injection algorith and the RTL fault siulation ethodology. The relationship of the proposed RTL faults and the traditional single stuck-at gate faults is elaborated using an exaple. Section 3 presents the application of stratified sapling theory to RTL fault odeling. Section 4 outlines the stratu weight extraction techniques. Section 5 describes the experiental work and results generated for several real-life industry-application VLSI systes. Section 6 suarizes conclusion and outlines liitation of the proposed approach. Section 7 contains acknowledgeent followed by a list of references in Section 8. 2. RTL Fault odel, Fault-Injection Algorith and Fault Siulation Hardware description languages (HDLs) are used to odel VLSI circuits. HDL constructs are classified into three types: structural, register-transfer level (RTL) and behavioral [2]. RTL constructs represent a subset of HDL constructs with the corresponding design guidelines eant to ensure the consistent synthesis of gate-level netlists by logic synthesis tools. With event scheduling and resource allocation inforation built-in, an RTL odel represents the icro-architecture of a circuit. Soe of the previous research in the area of high-level fault odeling scoped its application to behavioral design odeling [3, 8], while the other research aied towards RTL design odeling [4, 5]. The research presented in this paper focuses its application on RTL design odeling. In this paper, the Verilog HDL is used as a ediu to explain the proposed RTL fault odel. However, the concepts developed and described here can be applied to any other hardware description language. RTL constructs of the Verilog HDL are listed in [25]. A few clarifications on the terinology used in this paper are offered here: Language Operators: RTL language operators are classified into Boolean (&,, ^, ~), synthetic (+, -, *, >=, <=, <, >, = =,!=), and logical (&&,,!) operators. A further classification of these operators, though used in other contexts, is unnecessary for the purpose of RTL fault odel description. Identifiers: Identifiers are the naes that one gives to the objects like wires, gates and functions in the circuit. All identifiers that specify signal naes will be referred to as variables in this paper. 2. RTL Fault odel and Injection Algorith RTL fault odel and a fault-injection algorith presented in this paper are developed such that the RTL fault-list of a odule becoes a representative saple of the collapsed gate-level fault-list. The classical definition of the ter representative saple in the context of statistical theory is given by Stephan and ccarthy [20] as: A representative saple is a saple which, for a specified set of variables, resebles the population fro which it is drawn to the extent that certain specified analyses that are to be carried out on the saple (coputation of eans, standard deviations, etc., for particular variables) will yield results which will fall within acceptable liits set about the corresponding population values, except that in a sall proportion of such analyses of saples (as specified in the procedure 94

used to obtain this one) the results will fall outside the liits. In order for the RTL fault-list of a odule to be a representative saple of the collapsed gate-level fault-list, RTL faults should have a distribution of detection probabilities siilar to that for collapsed gate faults. The detection probability of a fault is defined by Seth et al. [9] as the probability of detecting a fault by a randoly selected pattern. In other words, if a given test set contains n patterns and a fault is detected k ties during fault siulation using this pattern set, the detection probability of the fault is given as k/n. When two fault-lists (an RTL and collapsed gate-level) with siilar detection probability distributions are siulated for a given set of test patterns, the respective fault coverages are expected to track each other closely within statistical error bounds. Agrawal and Kato [3] established error bounds for the rando fault-sapling technique in which detection probability distributions for a rando saple and that for the entire gate fault-population are expected to be siilar. If the RTL fault-list of a odule is indeed a representative saple of the collapsed gate-level fault-list, the difference between RTL and gate-level fault coverages of a odule for a given set of test patterns should be within the error bounds established for the rando sapling technique by Agrawal and Kato [3]. This assuption is supported by the data given in a later sub-section. RT level design description dictates the icro-architecture of the gate-level representation. During logic synthesis, RTL operators ap onto Boolean coponents of varying coplexities, e.g., Boolean and logical RTL operators ap onto Boolean gates, synthetic operators ap onto coponents such as adders, coparators, etc. The RTL variables ap onto signal lines in the gate-level netlist although the relationship ay not be a one-to-one apping. The goal of the proposed fault odel is to judiciously place RTL faults in the design description of a odule. This is assured by irroring properties of the gatelevel SSF odel in the RTL fault odel. These properties are listed below. Properties of the gate level SSF odel: Boolean coponents are assued to be fault-free. Signal lines contain faults: a stuck-at-zero (s-a-0) fault when the logic level is fixed at value 0 a stuck-at-one (s-a-) fault when the logic level is fixed at value According to the single stuck fault (SSF) assuption, only one fault is applied at a tie when a test set is either being created or evaluated. The fault-list is collapsed using the check-point theore []. The collapsed fault-list of a odule contains input as well as fan-out faults. Further collapsing ay be done using structural equivalence and doinance relationships. Properties of the RTL fault odel: Language operators (which ap onto Boolean coponents in the gate-level netlist) are assued to be fault-free. Variables (which ap onto signal lines in the gate-level netlist) contain faults: a stuck-at-zero (s-a-0) fault when the logic level is fixed at value 0 a stuck-at-one (s-a-) fault when the logic level is fixed at value The proposed RTL fault odel follows the single fault assuption and therefore only one fault is applied at a tie when a test set is evaluated. The RTL fault-list of a odule contains input as well as fan-out faults. RTL variables that are used ore than once in executable stateents or the instantiations of lower level odules of the design-hierarchy are considered to have fan-out. Input faults of a odule at the RT level have one-to-one equivalence to input faults of the odule at the gate-level. The fan-out faults of variables inside a odule at the RT level represent a subset of the fan-out faults of a possible gate-level ipleentation. The definition of the RTL fault odel and the faultinjection algorith encopasses odeling of faults for synthetic, Boolean and logical operators, sequential eleents and fan-out/ste variables, as well as the collapsing of RTL faults. RTL faults are depicted with crosses ( x ) in Figure. When RTL constructs contain synthetic operators, faults are injected only on the input variables of such operators. During logic synthesis, the synthetic operators are replaced by cobinational circuits ipleenting the respective functions, e.g., adder, subtracter, coparator, etc. The internal details of such functions represented by synthetic operators are not available at the RT level and therefore only the subset of the checkpoint faults of the gate-level representation of these operators, naely, the priary input faults are odeled. When a function is represented using RTL constructs that contain Boolean operators, faults are injected on variables that for Boolean equations. Soe internal signals of these constructs are available at the RT level and therefore RTL faults are placed at priary inputs and internal nodes 942

including signal stes and fan-outs. The post-synthesis gate-level representation of such a construct ay be structurally different fro the RTL Boolean representation. However, soe RTL faults have equivalent faults in a collapsed gate-level fault-list of any post-synthesis design. When RTL constructs contain logical operators, faults are injected on variables that constitute inputs of such operators. ost often the post-synthesis gate-level ipleentation of a function described using logical operators aintains the structure iplied in the RTL description. In such cases, RTL faults have a one-to-one equivalence to the collapsed gate faults of the synthesized logic. Hardware description languages support both types of sequential eleents, latch as well as flip-flop. In both cases, RTL faults are placed on input ports of these coponents. In the case of the flip-flop, faults are placed on clock as well as the reset variables. In the gate-level SSF odel, ste and fan-out faults are unique since neither equivalence nor doinance relations exist between the. Ste and fan-out faults are treated as special cases in the RTL fault odel as well. A separate RTL fault is injected on each fan-out of each bit of the variable. Also, a unique RTL fault is placed on each ste. In a VLSI syste, several odules are interconnected. The interconnecting signals between odules have siilar issues about ste and fan-out fault odeling. The properties described for ste and fan-out fault odeling for RTL constructs are applied for interconnecting signals between odules as well. The fault collapsing technique is widely used during gatelevel fault siulation to reduce the size of the fault-list []. Saller fault-lists require lesser resources, and iprove run-tie perforance. Although it is desirable, fault collapsing is not perfored at the RT level since the structural inforation needed to analyze the equivalence of faults is issing. At the iniu, the proposed RTL fault odel inherently avoids generating duplicate faults. 2.2 RTL Fault Siulation ethod The RTL fault siulator accepts the fault-injected RTL circuit description and the test pattern set as inputs. The RTL fault siulation ethod is analogous to the gate level approach, in which good and faulty circuits are created based on the single stuck-at fault assuption and siulated with a given set of test patterns. When the responses of a good circuit and a faulty circuit do not atch, the fault is considered detected. Fault siulation is continued until all faults are evaluated for the given set of test patterns. At the copletion of fault siulation, a fault report is generated which contains statistics and other inforation on detected b[] b[0] a[] a[0] c[] c[0] d[] d[0] clk reset_ + * - f [2:0] e [3:0] g [2:0] f [2:0] e [3:0] e [3:0] g [2:0] f [2:0] < > = Figure RTL Faults in a Scheatic Representation h j i U X v w k out_sig out_sig2 Table Design Data PI/PO/Bidi Code Area No. of Faults Size (gates) RTL ate (lines) NCF CF 8/4/0 28 55 24 72 62 2 37/0/0 24 428 390,92 65 3 32/68/0 89 98 976 4,00 2,262 4 22/90/0 648 3,68,490 7,002 5,500 D 36/7/0 673,70 678 2,254,332 D2 5/7/6 9,000 7,26 24,982 45,688 29,670 D3 34/5/0 8,580 04,88 27,08 07,290 73,374 as well as undetected RTL faults. The RTL fault coverage of a odule is defined as the ratio of the nuber of detected RTL faults to all RTL faults. The RTL fault siulator used in this research is Verifault- XL. Verifault-XL is suitable for use as an RTL fault siulator due to its capability of propagating fault effects through RTL circuit description. RTL faults are identified to Verifault-XL as zero-delay buffers inserted between variables and executable stateents as per the faultinjection algorith described in Section 2.. For ore details on the ethod of running RTL fault grading using Verifault-XL, one ay refer to ao and ulati [5] and Verifault-XL User s uide [6]. Several circuits (see Table ) were siulated using this ethod. 943

// odule Nae: iscellaneous Function odule isc_func(out_sig, out_sig2, a, b, c, d, clk, reset_); // i/o declarations input[:0] a, b, c, d; input clk, reset_; output out_sig, out_sig2; // Data Type Declarations // Functionality Ipleentation assign e[3:0] = a[:0] * c[:0]; assign f[2:0] = a[:0] + b[:0]; assign g[2:0] = c[:0] - d[:0]; always @(e or f) if(e < f) h = 'b; else h = 'b0; always @(f or g) if(f == g) i = 'b; else i = 'b0; always @(e or g) if(e > g) j = 'b; else j = 'b0; always @(posedge clk or negedge reset_) if(!reset_) out_sig <= 'b0; else out_sig <= (i & j)? h : out_sig; assign v = i & h; assign w = (!h) & j; assign k = v w; always @(posedge clk or negedge reset_) if(!reset_) out_sig2 <= 'b0; else out_sig2 <= k; endodule Figure 2 RTL Code Exaple 2.3 Study of Efficacy of RTL Fault odel and Fault-injection Algorith In this section, the effectiveness of the RTL fault odel and fault-injection algorith in odeling hardware faults at the RT level is discussed. 2.3. Coparison of RTL and ate Fault Lists In practice, an RTL odule contains several interconnected Boolean coponents described using various constructs. RTL faults are judiciously placed at input ports of the odule, in the input variables of the Boolean coponents, and on the fan-outs of interconnecting signals between Boolean coponents. The RTL faults ay also be placed on fan-outs of variables internal to the Boolean coponents if they are described using Boolean RTL operators. Therefore, an RTL fault-list of a odule contains not just pin faults but also various internal faults. This is illustrated by the exaple provided in Figure and Figure 2. Figure contains a scheatic representation of a hardware function. Figure 2 contains corresponding RTL description. The proposed RTL fault odel and fault-injection algorith when applied to the code, judiciously place faults in the RTL code. RTL faults are depicted with crosses ( x ) in Figure. As can be observed in Figure, the RTL fault set consists of pin faults as well as internal faults of the odule. Constraintdriven logic synthesis of the RTL code given in Figure 2 ay produce any different gate-level ipleentations. The gate-level ipleentations derive the icroarchitecture fro the RTL description. One of the gatelevel netlists was arbitrarily selected to deonstrate the relationship of RTL faults to the gate faults. An analysis of the RTL and gate-level fault-lists reveals that individual RTL faults, when applied one at a tie to the RTL design, produce behaviors that atch the corresponding behaviors of faulty gate-level circuits resulting fro individual stuckat gate faults applied one at a tie. Such RTL and gate faults are considered equivalent. The RTL and collapsed gate-level fault-lists contain 67 and 74 faults, respectively. Upon coparing the RTL fault-list to the collapsed gate-level fault-list of the selected ipleentation, it is found that each RTL fault is equivalent to a unique gate-level fault. There are 07 gatefaults that do not have equivalent RTL fault. In this case, an RTL fault-list is viewed as a representative sub-set of the gate-level fault-list. 2.3.2 Coparison of RTL and ate Fault Coverage Since the proposed RTL fault odel is expected to reseble statistical properties of the rando saple, the difference between the RTL and the gate-level fault coverages of a odule for a given set of test patterns is expected to be within the error bounds established for the rando-sapling technique. Agrawal and Kato [3] established the range of coverage for the rando sapling technique as, 2 α k 2 c ± + 4Nc( c) ( α k) () 2N where, k = N /, when N gate faults are sapled fro a total of gate faults in the circuit, α = 3. 00 obtained fro the aussian probability distribution function for a confidence probability of 0.998, and c is the ratio of detected to total aong sapled gate faults. 944

When equation () is used for error bounds of the gatelevel fault coverage estiated by the proposed RTL fault odeling technique, N represents the nuber of RTL faults in a odule, represents the nuber of gate faults in a odule and c represents the ratio of the nuber of detected RTL faults to all RTL faults. In this section, the RTL and the gate fault coverages of several real-life industry-application circuits are copared. An RTL fault-list is created for each RTL odule using the proposed fault odel and fault-injection algorith. RTL odules are then synthesized using the coercial logic synthesis tool Design Copiler [5] and a 0.35 icron COS technology library. A gate-level ipleentation is arbitrarily selected to easure the gate-level fault coverage of the given test patterns. RTL and gate-level circuits are siulated using the fault siulator Verifault-XL. Test pattern sets were written for circuits using their functional specifications. The error between RTL and gate-level fault coverage is expected to be within ± 3σ range with a confidence probability of 99.8% as per equation (). All circuits used for experients, -Counter (4-bit) odule, 2-Transit Buffer odule, 3-SDRA Controller odule, 4-DSP Interface odule, D-Frae Tiing Control ASIC, D2-Syste Tiing Controller ASIC, and D3-Digital Signal Processor ASIC, contain sequential as well as cobinational logic. Design data for these circuits (PI- No. of Priary Input signals, PO-No. of Priary Output signals, Bidi-No. of Bi-directional signals, Code Size- No. of lines of Verilog HDL code, and Area- ate area easured as No. of two-input NAND COS equivalent gates) is provided in Table. Table 2 contains epirical data. For all except four data-points, RTL coverage is found tracking gate-level coverage within statistical error bounds. These four cases are being investigated and ay contribute towards refineent of the proposed fault odel. Figure 3 and Figure 4 show correlation between RTL and gate-level fault coverage across 3 data points for odule 3. Siilar results are reported for other circuits (, 2 and 4) in [26]. Fro the experiental data (see Table 2), it can be conclusively derived that the RTL fault coverage is a good estiate of the gate-level fault coverage for ediu to large size odules. It is observed that for very sall odules such as odule (4-bit counter), the error between the RTL and the gate-level fault coverages, though within statistically calculated error bounds, is large (ore than 5%). This characteristic is a function of the saple size as well as population size and it is present in the rando sapling technique as well [2]. However, odern VLSI systes contain any odules of a variety of sizes and large estiation errors in a few sall odules are insignificant while calculating the overall fault coverage. RTL & ate Fault Cov (%) 20 00 80 60 40 20 0 RTL Cov ate Cov 0 500 000 500 2000 2500 3000 Test Vectors Figure 3 odule 3: RTL and ate Cov. v/s Test Vectors Table 2 Epirical Data for odules odule Test c (%) C (%) c -C (%) Estiation Error (%) (3σ bound) T 20.8 25.3 4.5 ± 22.6 T2 58.3 75.8 7.5 ± 26.3 T3 79.2 86.3 7. ± 22.6 T4 9.7 92.9.2 ± 7.5 T5 95.8 96.8.0 ± 4.9 T 5.4 8.9 3.5 ± 2.2 T2 25. 28.0 2.9 ± 4.2 2 T3 49.5 54. 4.6 ± 4.8 T4 77.9 80.8 2.9 ± 4.0 T5 82.6 83.6.0 ± 3.7 T 9.4 9.0 + 0.4 ± 2.9 T2 42.0 42.8 0.8 ± 3.6 3 T3 52.9 54.6.7 ± 3.6 T4 65.7 67.2.5 ± 3.4 T5 75.8 78.0 2.2 ± 3.0 T6 96.6 95.5 +. ±.3 T 6.2 5.4 + 0.8 ± 2.5 T2 24.2 23.9 + 0.3 ± 2.9 4 T3 47.9 44.5 + 3.4 ± 3.3 T4 70.7 68.9 +.8 ± 3.0 T5 84. 8.6 + 2.5 ± 2.4 T6 87.3 84.5 + 2.8 ± 2.2 Legend: c = RTL Coverage, C = ate Coverage, c -C = Error The ain conclusion of this section is that the proposed RTL fault odel can be used to estiate the gate-level fault coverage of a odule within statistical error bounds. 3. Application of Stratified Sapling The results presented in the previous section reveal that the RTL fault coverage provides a good estiate of the gatelevel fault coverage. The experiental data also reveals 945

that there is no straightforward relationship between the nuber of RTL faults and that of gate-level faults. Considering the fault odeling ethod, the nuber of RTL faults is a easure of the size of the RTL description of the odule. However, this nuber does not correlate with the gate count. For exaple, for odule, the nuber of gates and gate faults are ore than twice the nuber of RTL faults. For odules 2 and 3, the gate count is closer to the nuber of RTL faults, but there are alost twice as any gate-level faults. The ain conclusion of these experients is that the proposed RTL fault odel can be used to estiate the gate-level fault coverage of a odule. But, the total nuber of RTL faults in the odule does not represent the size of the gate-level fault-list. In general, a large VLSI syste consists of any odules. The lack of a defined relationship between the nuber of RTL faults and the nuber of possible gate-level faults presents a proble. A odule with a large contribution of RTL faults to the overall RTL fault-list of the VLSI syste ay get synthesized into a relatively saller gate-level ipleentation and subsequently ake a saller contribution of gate-level faults to the overall gate-level fault-list of that VLSI syste. Siilarly, a odule that contributes fewer faults to the RTL fault-list of the VLSI syste ay result in a relatively larger gate-level ipleentation after logic synthesis, and thus contribute a larger percentage of faults to the overall gate-level fault-list of the syste. Therefore, although the RTL fault-list of each odule in a VLSI syste is a representative saple of the corresponding gate-level fault-list of that odule, the overall RTL fault-list of the syste does not constitute a representative saple of the overall gate-level fault-list. Table 3 illustrates this proble for a hypothetical VLSI syste consisting of two odules, and 2. Based on the observation of the experients in the previous section, it is assued that the easured RTL fault coverage is close to the gate-level fault coverage in each odule. The overall RTL fault coverage of the syste is obtained as (9 00 + 39 00) / 200 = 65%. The overall gatelevel fault coverage of the syste is calculated as (90 50 + 40 400) / 550 = 54%. It is found that the overall coverages are quite different. This is because the two odules, although equal in size at the RT level, translate into quite different sizes at the gate-level. In order to find the gate-level fault coverage, odules RTL coverages should be weighted according to their relative gate-level sizes. Weighted RTL fault coverage can be obtained as 9 (50 / 550) + 39 (400 / 550) = 53%. The above observation leads us to consider a technique known as stratified sapling [22]. Error (RTL Cov - ate Cov) (%) 2.5 2.5 0.5 0 0 20 40 60 80 00 20-0.5 - -.5-2 -2.5 RTL Coverage (%) Error Figure 4 odule 3: Error v/s Fault Coverage Table 3 Inaccurate Estiation of ate Fault Coverage odeling Faults 2 Faults +2 Level Total Covered Total Covered Coverage RTL 00 9% 00 39% 65% ate 50 90% 400 40% 54% According to stratified sapling technique, the fault population is divided according to RTL odule boundaries. Thus, each odule is considered a stratu. Within a stratu, the RTL faults are considered as a saple of all (i.e., gate-level) faults. The ratio of the nuber of RTL faults to the nuber of gate-level faults will be the sapling fraction for the stratu. In general, if the nuber of RTL faults in a odule is larger, then a rando saple of those can also be used. Suppose, a VLSI syste has gate-level faults distributed aong odules (or strata.) The th odule has gate-level faults. Then, = and, Weight of th odule, W = (3) Fro the th odule, r RTL faults are siulated. These can either be all RTL faults (00% saple) or a rando saple of all RTL faults in the th odule. Further, two coverages for the th odule are defined as (2) 946

th Detected gate faults in odule C = (4) c = r r i= where y i are rando variables whose values are deterined by fault siulation: y i = if the i th sapled fault in th odule is detected, or y i = 0 if that fault is not detected. C is an unbiased estiate [26] for the gate-level fault coverage of the odule. C is the true gate-level fault coverage in the th odule which provides the total gate-level coverage of the VLSI syste as C = y i (5) C = WC (6) Here odule coverages have been weighted according to their sizes to eliinate the type of error illustrated in Table 3. The estiated value for the true gate-level coverage C of the VLSI syste is called stratified RTL fault coverage and is obtained as C = c = Wc (7) Notice that the stratified RTL fault coverage C is different fro the overall non-stratified RTL fault coverage, which is given by C = RTL = r c (8) r In general, the non-stratified RTL coverage can be quite different fro the true gate-level coverage. The variance of stratified RTL fault coverage is given as 2 W σ = c( c) (9) r For a given confidence probability, the range of coverage is given as [26] 2 C ± tσ (0) where t is the liit for which the area of the noralized (zero ean and unity variance) aussian probability density equals soe given confidence probability. The values of t can be selected fro tables of noral distribution. It is evident fro equations (7), (9) and (0), the paraeters that are crucial in deterining stratified RTL fault coverage and error bounds do not require knowledge of the absolute values of or. They require the ratio of the two quantities in the for of stratu weights. Techniques developed to deterine the stratu weights of odules in a given VLSI syste are described next. 4. Stratu Weight Extraction Techniques Approaches proposed for deterining the stratu weights of odules of a VLSI syste are classified in three categories: Logic synthesis based weight extraction, Entropy-easure based weight extraction [8, 6], and Floor-planning based weight extraction. For ore details on these proposed techniques, one ay refer to [26]. Accurate stratu weights are only available after final logic synthesis. However, the techniques proposed above allow one to estiate stratu weights of odules during early phases of the design cycle. The ipact of error in weight estiation on the overall stratified RTL fault coverage of the VLSI syste is observed to be negligible [26]. 5. Experiental Results Several industry-application VLSI systes ranging in size fro,000 to 05,000 gates were used for epirical studies. The experiental procedure is as follows, The RTL code is run through C++ parser. This parser processes the RTL code and generates the fault-injected RTL code without altering circuit behavior. The parser is developed according to the proposed fault odel and fault-injection algorith. Fro each odule of the VLSI syste, a set of RTL faults (all or a rando subset) is selected. These faults are siulated for the given set of test patterns and odule coverages are deterined. Stratu weights for odules are coputed using proposed techniques. Stratified RTL fault covearage is coputed using equation (7). The stratified RTL fault coverage serves as an estiate of the gate-level fault coverage of the VLSI syste. The range of the estiated coverage is obtained using equation (0). The experiental procedure described above was carried out using coercial electronic design autoation tools. The RTL fault siulation was perfored using the Verifault-XL siulator. The estiates of the gate-level fault coverages were copared with the non-stratified RTL fault coverages calculated using equation (8) as well as the actual gate-level fault coverages. The actual gate-level fault coverage of each VLSI syste was obtained by fault grading the gate-level netlist. ate-level fault siulations 947

were prefored using Verifault-XL. The gate-level netlist for each VLSI syste was obtained by perforing logic synthesis of the RTL code for an arbitrary set of optiization constraints. Design Copiler was used for logic synthesis [5]. Test patterns (test-benches) used for the RTL and gate-level fault siulations were anually generated for design verification using functional specifications of the systes. Experiental data provided in Table 4 indicates that the stratified RTL fault coverage is a good estiate of the gate-level fault coverage. In all except four cases, the true error is within statistical error bounds deterined fro equations (9) and (0). As can be noted in data for syste D3 (Table 4), the error bounds for test pattern sets T, T5, T6 and T7 are significantly wider than those for T2, T3 and T4. The RTL fault siulations for test pattern sets T, T5, T6 and T7 were perfored using a very sall rando saple of the overall RTL fault-list. As per equation (9), the size of the RTL fault saple in each odule and the error bounds of the overall stratified RTL coverage of the syste are related. The saller the nuber of RTL faults used in siulation, the wider the error bounds. This is confired by the data presented in Table 4. Therefore, in order to estiate the gate-level fault coverage within narrow error bounds, a reasonable nuber of RTL faults should be selected during siulations. D D2 D3 Test Table 4 Epirical Data for Systes C RTL (%) C (%) C (%) C C (%) Estiation Error (%) (3σ Bound) T 24.3 23.8 25.6.8 ± 5. T2 35.8 27.7 29.3.6 ± 4.6 T3 44. 32.9 35.4 2.5 ± 4.5 T4 42.6 32.2 35.9 3.7 ± 4.6 T5 43.4 35.3 38.9 3.6 ± 5.2 T6 87.3 8.9 82.0 0. ± 4.8 T7 84.8 82.0 82.7 0.7 ± 4.8 T 48.9 52.6 5.7 + 0.9 ± 0.9 T2 39.7 42.6 43.9.3 ±.0 T3 29.0 30.6 3.5 0.9 ±.0 T4 55.2 59.5 60.2 0.7 ± 0.9 T5 52.3 55.9 54.7 +.2 ± 0.9 T6 56.8 60.9 6.5 0.6 ± 0.9 T 56.4 55. 57.7 2.6 ± 8.0 T2 23.9 9.4 8.0.4 ±.7 T3 57.7 59.2 6.4 2.2 ± 2.4 T4 48.7 50.2 50.9 0.7 ± 2. T5 59.4 57.2 57.7 0.5 ± 7.9 T6 68.8 69.8 70.9. ± 9.3 T7 73.3 74.9 72.7 + 2.2 ± 8.8 6. Conclusion In this paper, a novel procedure that supports RTL fault siulation and generates an estiate of the gate-level fault coverage for a given set of test patterns is proposed along with experiental results fro several real-life industryapplication VLSI systes. The proposed procedure can be used as an integral part of the high-level test generation systes [9, 0, 2, 4, 7]. The results of test-evaluation using the proposed procedure can provide feedback for further iproving the quality of test patterns. As established by Thaker et al. [24] with epirical data, the architectural testability properties and the subsequent test weaknesses of a gate-level netlist are derived fro the RTL description and reain unchanged by the constraintdriven logic synthesis. The RTL fault siulation using the proposed fault odel provides eans to identify testability probles at the RT level prior to logic synthesis. The circuits that do not attain high fault coverage even with a large nuber of test patterns indicate test-related flaws inherent in the design architecture. The undetected RTL faults indicate hard-to-test functional areas of the design. The identification of these test probles early in the design cycle propts necessary architectural changes prior to logic synthesis, reducing the ipact on tie-to-arket. Existing fault siulation techniques, which are based on gate-level SSF odels, require a large eory and a lot of CPU tie. The RTL fault siulation approach presented in this thesis holds proise for significantly reducing the perforance penalties of the gate-level fault siulation approach. A true coparison of RTL and gate-level fault siulation perforances can be obtained if fault siulators optiized for RTL as well as gate-level fault odels were used. The liitation of the proposed procedure is that it requires one to preserve the partitioning of the VLSI systes across RTL odule-boundaries in order to be able to use stratu weights reliably. Soe of the advanced optiization techniques recoend flattening of the RTL structure/partitions during logic synthesis to axiize the area reduction. This and other siilar logic synthesis/optiization techniques that require reoval or restructuring of design partitions built into the RTL description as odules, should be avoided if the proposed procedure is to be effectively used. 7. Acknowledgent The authors thank Natalya Dvorson, Arthur Friedan, and John Vogel for their help. 948

8. References []. Abraovici,. A. Breuer, and A. D. Friedan, Digital Systes Testing and Testable Design, IEEE Press, New York, NY., 990. [2] V. D. Agrawal, Sapling Techniques for Deterining Fault Coverage in LSI Circuits, J. Digital Systes, vol. 5, Sept 98, pp. 89-202. [3] V. D. Agrawal and H. Kato, Fault Sapling Revisited, IEEE Design & Test of Coputers, vol. 7, August 990, pp. 32-35. [4] J. R. Arstrong, F. S. La, and P. C. Ward, Test eneration and Fault Siulation for Behavioral odels, Perforance and Fault odeling with VHDL, Prentice-Hall, Englewood Cliffs, NJ., 992, pp. 240-303. [5] H. Bhatnagar, Advanced ASIC Chip Synthesis, Kluwer Acadeic Publishers, Boston, A., 999. [6], Cadence Design Systes, Inc., Verifault-XL User s uide, San Jose, CA., 997. [7] T. Chakraborty and S. hosh, On Behavior Fault- odeling for Cobinational Digital Designs, Proc. International Test Conference, Sept 988, pp. 593-600. [8] K. T. Cheng and V. D. Agrawal, An Entropy easure for the Coplexity of ulti-output Boolean Functions, Proc. 27 th Design Autoation Conference, June 990, pp. 302-305. [9] S. Chiusano, F. Corno, and P. Prinetto, RT-level TP Exploiting High-Level Synthesis Inforation, Proc. 7 th IEEE VLSI Test Syposiu, April 999, pp. 34-346. [0] C. H. Cho and J. R. Arstrong, B-algorith: A Behavioral Test eneration Algorith, Proc. International Test Conference, Oct 994, pp. 968-979. [] W.. Cochran, Sapling Techniques, John Wiley & Sons, Inc., New York, NY., 977. [2] F. Corno, P. Prinetto, and. S. Reorda, Testability Analysis and ATP on Behavioral RT-level VHDL, Proc. International Test Conference, Nov 997, pp. 753-759. [3] S. hosh, Behavioral-level Fault Siulation, IEEE Design & Test of Coputers, vol. 5, no. 3, June 988, pp. 3-42. [4] R. J. Hayne and B. W. Johnson, Behavioral Fault odeling in a VHDL Synthesis Environent, Proc. 7 th VLSI Test Syposiu, April 999, pp. 333-340. [5] W. ao and R. ulati, Iproving ate Level Fault Coverage by RTL Fault rading, Proc. International Test Conference, Oct 996, pp. 50-59. [6] N. Pippenger, Inforation Theory and the Coplexity of Boolean Functions, atheatical Systes Theory, vol.0, 977, pp.29-67. [7] E.. Rudnick, R. Vietti, A. Ellis, F. Corno, P. Prinetto, and. S. Reorda, Fast Sequential Circuit Test eneration Using High-Level and ate-level Techniques, Proc. IEEE European Design Autoation and Test Conference, Feb 998. [8] P. Sanchez and I. Hidalgo, Syste Fault Siulation, Proc. International Test Conference, Oct 996, pp. 732-740. [9] S. C. Seth, V. D. Agrawal, and H. Farhat, A Statistical Theory of Digital Circuit, IEEE Trans. on Coputers, vol. 39, no. 4, April 990, pp. 582-586. [20] F. Stephan and P. ccarthy, Sapling Opinions: An Analysis of Survey Procedure, John Wiley & Sons, Inc., New York, NY., 958. [2] E. Sternhei, R. Singh, R. adhavan, and Y. Trivedi, Digital Design and Synthesis with Verilog HDL, Autoata Publishing Copany, San Jose, CA., 993. [22] A. Stuart, The Ideas of Sapling, Charles riffin and Copany, Ltd., High Wycobe, reat Britain, 984. [23] S.. Thatte and J. A. Abraha, Test eneration for icroprocessors, IEEE Transactions on Coputers, vol. C-29, June 980, pp. 429-44. [24] P. A. Thaker,. E. Zaghloul, and. B. Ain, Study of Correlation of Testability Aspects of RTL Description and Resulting Structural Ipleentations, Proc. 2 th International Conference on VLSI Design, Jan 999, pp. 256-259. [25] P. A. Thaker, V. D. Agrawal, and. E. Zaghloul, Validation Vector rade (VV): A New Coverage etric for Validation and Test, Proc. 7 th IEEE VLSI Test Syposiu, April 999, pp. 82-88. [26] P. A. Thaker, Register-Transfer Level Fault odeling and Test Evaluation Technique, eorge Washington University, Washington, DC, ay 2000. [27] P. C. Ward and J. R. Arstrong, Behavioral Fault Siulation in VHDL, Proc. 27 th Design Autoation Conference, June 990, pp. 587-593. 949