Why DFT, and How It Fits the Flow
Functional verification (see Logic Synthesis) proves the RTL does what the specification says. DFT solves a completely different problem: even a perfectly designed chip can come out of the fab with a manufacturing defect — a via that didn't form, two adjacent wires that bridged together, a memory cell too weak to hold its charge — and someone has to catch that specific physical die before it ships. At billions of transistors per chip, primary inputs and outputs alone can't control or observe enough internal state to find these defects efficiently, so DFT adds dedicated structures — scan chains, test controllers, self-test logic — purely to make the die testable.
DFT structures are planned and inserted right after (or alongside) logic synthesis, patterns are generated and verified against the gate netlist, then every physical die is exercised with these patterns on automatic test equipment (ATE) before it ships.
Fault Models
A fault model is a simplified, testable abstraction of how a real manufacturing defect might behave electrically. Nobody can test for every possible physical defect directly, so DFT targets a small set of well-understood fault models instead, on the theory (backed by decades of production data) that a pattern set that catches these models also catches most real defects.
| Fault model | What it represents |
|---|---|
| Stuck-at (SA0 / SA1) | A node behaves as if permanently tied to 0 or 1 — the oldest and simplest model, historically the primary target, still the DC baseline every design is tested against |
| Transition / delay fault | The node still reaches the correct final value, but too slowly to settle within the clock period — invisible to a slow, DC-style test and only caught by testing at the chip's real operating speed |
| Path delay fault | The cumulative delay along one specific critical timing path exceeds the clock period, even if no single transition fault would explain it on its own |
| Bridging fault | Two nets that should be electrically independent are unintentionally shorted together — a dominant real-world defect mechanism at advanced process nodes with extremely tight wire spacing |
| IDDQ (excess quiescent current) | A defect-free CMOS gate draws almost no current once signals settle; certain bridging and gate-oxide defects leave a detectable current leak even when the logic still reads out "correct" |
| Memory-specific faults | Coupling, address-decoder, pattern-sensitivity, and retention faults unique to regular array structures — covered in depth under MBIST & Memory Testing |
Scan Design & ATPG
Scan design is the foundation almost everything else in DFT builds on. In normal (functional) operation, a flip-flop's next state depends only on the design's own logic. Scan insertion adds a multiplexer in front of every flip-flop's data input so that, in test mode, each flop instead takes its input from the previous flop in a chain — turning every flip-flop in the design into one giant shift register that spans the chip. That single change gives a test engineer two things primary I/O alone never could: the ability to force any internal state directly (controllability) and the ability to read any internal state directly (observability).
Every scan flop gets a mux that, in test mode, feeds it from the previous flop's output instead of its normal data input — chaining all flops into one shift register. A test cycle shifts a known stimulus in, captures one real functional clock edge, then shifts the response out.
ATPG: generating the patterns
Automatic Test Pattern Generation (ATPG) is what actually decides what values to shift in. For every fault in the target fault list, the ATPG tool works backward from the fault site: it finds an input combination that would produce a different logic value at the fault site than a fault-free circuit would (fault activation), then finds a path from that site to an observable point — a scan flop or primary output — where the difference would actually show up (fault propagation). After a pattern is generated, fault simulation checks which other faults it happens to also detect, so those can be dropped from later patterns — this "fault dropping" is what keeps the final pattern count from growing linearly with the fault list. The result is the smallest pattern set the tool can find that still detects every fault it was asked to target.
Types of DFT Testing
Scan-based structural test is the backbone, but it's one of several complementary techniques used together, each catching defects the others are blind to or reaching parts of the system scan alone can't.
| Technique | What it catches / when it's used |
|---|---|
| Stuck-at scan test | The DC baseline — slow, structural, detects gross logic-level defects; run at low speed since it isn't checking timing |
| At-speed / transition-delay test | Same scan infrastructure, but the capture clock runs at the real operating frequency, so delay defects that stuck-at test can't see get caught |
| Logic BIST (LBIST) | The chip generates its own pseudo-random patterns and compacts its own responses on-chip, needing no external ATPG pattern set or tester channels — common for in-field/power-on self-test in automotive and other safety-critical (ISO 26262) applications |
| MBIST (Memory BIST) | The memory-specific counterpart to LBIST, running algorithmic self-test directly against on-chip SRAM/embedded memories — see the dedicated section below |
| Boundary scan / JTAG (IEEE 1149.1) | A shift-register cell at every I/O pin (the Boundary Scan Register) lets a test controller sample or drive every pin through a standard 4/5-wire Test Access Port (TDI/TDO/TCK/TMS[/TRST]) — used for board-level interconnect test and as the standard debug/programming access point into the chip |
| IDDQ testing | Measures quiescent supply current directly rather than reading logic values, catching certain bridging and leakage defects a purely logical test would miss; less discriminating at advanced nodes where background leakage is already high |
| Burn-in / stress test | Runs parts at elevated voltage and temperature to accelerate infant-mortality failures, screening out early-life defects before shipment — typically reserved for high-reliability parts given the added cost and time |
A pseudo-random pattern generator (PRPG, typically an LFSR) drives the logic under test; a Multiple-Input Signature Register (MISR) compacts the many response bits into one signature, which is compared against a known good value — entirely on-chip, no ATPG pattern set required.
MBIST & Memory Testing
Embedded memories now account for the majority of transistor count — and often die area — on a modern SoC, and they fail in ways random logic doesn't. A memory array is an extremely dense, regular structure where adjacent cells and bitlines can electrically interact with each other, where a single weak cell can lose its stored value over time, and where the address decoder itself can be defective in ways that have no equivalent in random logic. Scan-based logic ATPG is a poor fit for testing array internals efficiently, so memories get their own dedicated, algorithmic self-test instead: MBIST (Memory Built-In Self-Test).
Memory-specific fault models
| Fault | What it means |
|---|---|
| Stuck-At Fault (SAF) | A cell or line is permanently fixed at 0 or 1, regardless of what's written |
| Transition Fault (TF) | A cell fails to make a specific 0→1 or 1→0 transition |
| Coupling Fault (CF) | A transition in one cell (the aggressor) incorrectly changes or forces the state of a different cell (the victim) — subtypes include inversion (CFin), idempotent (CFid), and state (CFst) coupling |
| Address Decoder Fault (AF) | A given address accesses the wrong cell, multiple cells, or no cell at all |
| Neighborhood Pattern Sensitive Fault (NPSF) | A cell's behavior is disturbed by the specific pattern of values held in its physical neighbors |
| Data Retention Fault (DRF) | A cell loses its stored value after some delay — a "weak cell" that passes an immediate read-back but fails after time has passed |
March algorithms
Instead of random patterns, MBIST applies a March algorithm: a fixed sequence of read/write operations that "marches" through every address in ascending or descending order, chosen specifically to activate and detect the fault models above with a bounded, predictable number of operations. March notation uses ↑ for ascending address order, ↓ for descending order, and ⇅ when the order doesn't matter, with each step listing the read (r) or write (w) operations performed at every address in that pass.
Six passes, 10n operations for an n-cell memory. It detects stuck-at, address decoder, transition, and all standard coupling faults — the standard starting point that more specialized algorithms (March B, March SS, and others) extend to catch additional fault types at the cost of more operations per cell, trading test time against fault coverage.
The controller sequences address and data generators through the March algorithm against the memory; the comparator flags mismatches. If enough spare capacity exists, BIRA computes an optimal repair from the fail log and BISR permanently swaps in redundant rows/columns — turning what would be a scrapped die into a shippable part.
BIRA & BISR: repairing instead of scrapping
Dense memory arrays are usually built with a small number of spare rows and columns beyond what's architecturally needed, specifically so a handful of defective cells don't have to fail the entire die. Built-In Redundancy Analysis (BIRA) takes the fail log MBIST produced and computes an optimal repair — which redundant rows and/or columns should replace which faulty ones — while Built-In Self-Repair (BISR) then applies that solution permanently, typically by blowing fuses, anti-fuses, or programming non-volatile latches that reroute the faulty addresses to the spares. On large, dense memory arrays where even a single-bit defect would otherwise scrap an entire die, this repair step measurably improves yield.
At-speed memory test
Like logic, memories need testing at real operating frequency too — some defects, such as a marginally weak cell or a slow sense amplifier, only fail to meet timing once the memory is clocked at its actual speed, exactly the transition-fault problem covered earlier applied to array structures instead of random logic.
Test Coverage, Compression & Production Test
What "coverage" actually means
| Metric | Definition |
|---|---|
| Fault coverage | The percentage of modeled faults the pattern set actually detects |
| Test coverage | Fault coverage adjusted to exclude faults that can never be tested (e.g. in redundant or unreachable logic) — a fairer measure of pattern quality than raw fault coverage alone |
| Defect coverage | An estimate of how many real-world physical defects the pattern set would catch — necessarily statistical, since fault models are an abstraction and don't map 1:1 onto actual silicon defects |
| DPPM | Defective Parts Per Million — the fraction of shipped parts that are actually defective, normalized to one million units; this is the real business metric everything above is ultimately a proxy for, and what customers (especially automotive) set hard targets against |
Test compression (EDT)
A modern SoC can have millions of scan flip-flops, but the tester (ATE) has only a limited number of channels — often just tens to a few hundred. Loading and unloading every scan bit directly would make test data volume and test time impractically large. Embedded Deterministic Test (EDT) solves this by putting a small decompressor and compactor on-chip: the decompressor expands a handful of external bits into the many internal scan-chain bits, and the compactor reduces the resulting response bits back down to a small number of output bits. This works because ATPG-generated patterns are typically mostly "don't care" bits — often only a fraction of a percent to a few percent of bits are actually specified — so a compact seed is enough to reconstruct a full pattern deterministically on-chip.
Compression ratios of roughly 30× to 500× are typical in industrial designs, directly cutting both test data volume and test application time — a meaningful cost lever, since ATE time is billed per second across every die on every wafer.
From patterns to shipped parts
Once patterns are generated and verified, they're translated into the ATE's native format and applied to every physical die: first at wafer sort (probing the still-unpackaged die on the wafer, catching gross failures before the cost of packaging is spent on them), then again at final test after packaging (catching any defects introduced by packaging itself, and re-confirming everything still works). Passing parts are typically binned — sorted by measured speed or power — while failing parts are scrapped, and coverage/yield data feeds back to the fab as part of ongoing process and defect-density monitoring.
Sources
General industry research — this page is not sourced from vendor-specific internal documentation.
- Scan and Automated Test Pattern Generation in VLSI — IEEE Xplore
- Automatic Test Pattern Generation in VLSI — A Survey — IEEE Xplore
- Scan Methodology and ATPG DFT Techniques at Lower Technology Node — IEEE Xplore
- A March 5n FSM-Based Memory Built-In Self-Test (MBIST) Architecture with Diagnosis Capabilities — IEEE Xplore
- MBIST++: An Adaptive March Algorithm Generator for Memory Test Coverage Enhancement — IEEE Xplore
- SRAM Memory Built-In Self-Test Using MARCH Algorithm — IEEE Xplore
- Flash Memory Testing and Built-In Self-Diagnosis With March-Like Test Algorithms — IEEE Xplore
- Boundary scan / JTAG (IEEE 1149.1), logic BIST, IDDQ testing — general web research
- Test data compression (EDT), scan compression ratios and ATE channel constraints — general web research
- Fault coverage, test coverage, defect coverage, and DPPM methodology — general web research