The maximum aggressor (MA) fault model [Cuviello 1999] is a simplified model that many researchers use mainly for crosstalk analysis and testing. This model, shown in Figure 8.2, assumes the signal traveling on a victim line V may be affected by signals/transitions on other aggressor line(s)A in its neighborhood. The coupling can be represented by a generic coupling component Z. In general, the result could be noise and excessive delay that may lead to functional error and performance degradation, respectively. There is, however, controversy as to what patterns trigger maximal integrity loss. Specifically, in the traditional MA model that takes only coupling C into account, all aggressors make the same simultaneous transition in the same direction, whereas the victim line is kept quiescent for maximal ringing (see pattern pair 1) or makes an opposite transition for maximal delay (see pattern pair 2).

Figure 8.2. Signal integrity fault model using concept of aggressor/victim lines.

Figure 8.3 pictures six cases (patterns) for three line interconnects where the middle one is the victim based on the MA fault model. Test patterns for signal integrity are vector pairs. For example, when the victim line is kept quiescent at 0 or 1 (see columns 1 through 4), four possible transitions on the aggressors are examined.

Figure 8.3. The MA fault model and test patterns.

When mutual inductance comes into play, some researchers have shown that the MA model may not reflect the worst case and have presented other test generation approaches (using pseudo-random, weighted pseudo-random, or deterministic patterns) to stimulate the maximal integrity loss [Chen 1998, 1999] [Attarha 2002].

As reported in [Naffziger 1999], a device failed when the nearest aggressor lines change in one direction and the other aggressors change in the opposite direction. The MA fault model does not cover these and many similar scenarios. Exhaustive testing covers all situations, but it is time consuming because of the huge number of test patterns. In [Tehranipour 2004], the authors proposed a multiple transition (MT) fault model assuming a single victim, a limited number of aggressors, a full transition on victim, and multiple transitions on aggressors. In the MT model, all possible transitions on the victim and aggressors are applied, whereas in the MA model only a subset of these transitions is generated. Briefly, the MA-pattern set is a subset of the MT-pattern set.

Power supply is distributed in a VLSI chip through wires that contain parasitic R/L/C elements. Hence, drawing current from a power source produces voltage fluctuations. Noise is mainly created in the power supply lines because of the resistive and inductive parasitic elements. Specifically, the inductive noise, also known as di/dt noise, is caused by the instantaneous change in current drawn from the power supply. Inductive noise becomes significant in high-frequency designs because of the sharp rise and fall times. High-frequency switching causes the current to be drawn (from the power supply) for very short duration (usually in hundreds of picoseconds) causing very high di/dt. Resistive noise (IR drop) is dependent on the current drawn from the power supply. Hence, the power supply noise, shown as PSN(t) or simply PSN, is collectively given by:

For an n-input circuit, there are 2ⁿ (2ⁿ – 1 ≈) 2²ⁿ possible pattern pairs that may cause internal transitions. Because simulating all possible pairs is unrealistic, it is essential to be able to select a small set of pattern pairs without exhaustive simulation. One approach is to use random-pattern-based simulation. Unfortunately, because of the random nature of these patterns, such approaches cannot guarantee to create maximum PSN in a reasonable amount of simulation time. Researchers have, therefore, applied deterministic or probabilistic heuristics to find such pattern sets with no guarantee of optimality.

Authors in [Lee 2001] have presented the generation and characterization of three types of noise induced by electrostatic discharge in power supply systems. These three types are I/O protection induced signal loss, latent damage after electrostatic discharge stress, and power/ground coupling noise. To speed up the power supply noise analysis and test generation process, some works exploited the concept of random search. For example, the authors in [Jiang 1997] and [Bai 2001] used a genetic algorithm (with random basis) to stimulate the worst-case PSN. Some researchers, such as [Zhao 2000b], precharacterize cells using transistor-level simulators and annotate the information into the PSN analysis phase. A technique for vector generation for power supply noise estimation and verification is described in [Jiang 2001]. The authors used a genetic algorithm to derive a set of patterns producing high power supply noise. A pattern generation method to minimize the PSN effects during testing is presented in [Kristic 2001]. In [Nourani 2005], the authors identified three design metrics (level, fanin, and fanout) that have the maximum effects on PSN. A greedy algorithm and a conventional fault simulator are then used to quickly construct pattern pairs that simulate the worst-case PSN based on circuit topology, regardless of whether the circuit is in functional mode or in test mode.

As device technology progresses toward 45 nm and below, the fidelity of the process parameter modeling becomes questionable. For every process, there is some level of uncertainty in its device parameters because of limitations imposed by the laws of physics, imperfect tools, and properties of materials not fully comprehended [Visweswariah 2003]. The deviation of parameters from desired values because of the limited controllability of a process is called process variation (PV). Sources of process variation include random dopant fluctuation, annealing effects, and lithographic limitations. Typical variations are 10% to 30% across wafers and 5% to 20% across dies, and they may change the behavior of devices and interconnects [Borkar 2004a].

Researchers have explored various ways of analyzing and dealing with process variation. The solutions are broadly labeled design for manufacturability (DFM) techniques. DFM struggles to quantify the impact of PV on circuits and systems. This role has made DFM techniques of high interest to semiconductor and manufacturing companies [Nassif 2004]. There are tens of factors that affect or contribute to process variation, including interconnects, thermal effects, and gate capacitance [Dryden 2005]. Process variation has been shown to potentially cause a 40% to 60% variation for effective gate length L_eff, a 10% to 20% fluctuation in V_t and T_ox that may lead to malfunction and ultimately failure [Borkar 2004a].

The PV monitoring/analysis approaches can be classified using different criteria. From a source point of view, variation can be intradie (within-die) or interdie. The latter can be classified as a die-to-die, center-to-edge (in a wafer), wafer-to-wafer, lot-to-lot, or fab-to-fab variation. From a methodology point of view, the solutions are classified into two broad classes: statistical and systematic. Examples of statistical approaches are PV modeling [Sato 1998], analyzing the impact of parameter fluctuations on critical-path delay [Bowman 2000] [Agarwal 2003], mapping statistical variations into an analytical model [Cao 2005], and addressing the effect of PV on crosstalk delay and noise [Narasimha 2006].

In systematic approaches, because of the complexity of parameters, almost all researchers traced a limited number of PV metrics and their effects on design characteristics. [Orshansky 2000] explored the impact of the gate length on performance. The authors in [Chen 2005] proposed a current monitor component to design PV-tolerant circuits, and [Azizi 2005] analyzed the effect of voltage scaling on making designs more resistant to process variations. Other works that focused on the effect of PV on key design characteristics include [Mehrotra 1998], which studied the effect of manufacturing variation on microprocessor interconnects; [Ghanta 2005], which showed the effect of PV on the power grid; [Agarwal 2005], which presented the failure analysis of memories by considering the effect of process variation; and [Ding 2005], in which the authors investigated the effect of PV on soft error vulnerability.

Because of the nature of parameters (e.g., V_t, T_ox, and L_eff) affected by process variation, tracing and pinpointing each variation for any realistic circuit is not a viable option. Hence, it becomes necessary to abstract and limit the problem to a specific domain to look at it collectively. Such abstraction can be clearly seen in prior works that consider process variation for clock distribution [Bowman 2001], delay test [Lu 2004], defect detection [Acharyya 2005], PV monitoring techniques [Kim 2005], reliability analysis [Borkar 2004b], and yield prediction [Jess 2003]. The authors in [Mohanty 2007] considered simultaneous variation of V_t, T_ox, and V_dd for the transistor’s current characterization and optimization.

Tracing process variations for individual parameters is not possible because of the size, complexity, and unpredictability of playing factors. Like in conventional testing approaches (e.g., stuck-at fault, path-delay fault), we need a simplified model for PV-faults to be able to devise and apply a PV test methodology. In spite of its simplicity, the model should be generic in concept, straightforward in measurement, and practical in application. A single PV-fault model is defined in [Nourani 2006]. This model assumes that there exists only one grid (unit area) in the layout of the circuit under test, where a sensor planted in that region can generate a faulty metric z_f instead of a fault-free metric z such that Δz =|z_f – z| is measurable (in terms of delay, frequency, etc.).

Current sensors are often used to detect the completion of asynchronous circuits [Lampinen 2002] [Chen 2005]. Figure 8.4 shows a conventional current sensor. The supply current of a logic circuit block is mirrored through a current mirror transistor pair (M0 and M1) to a bias-generation circuit. The bias-generation circuit contains an N-channel metal oxide semiconductor (NMOS) biased as a resistor (M2). If the supply current is high, the voltage drop across M2 is high, which generates Done = 0 indicating the job is not completed. When the circuit operation is completed, only the leakage current flows through the circuit. This makes the voltage drop across M2 quite small, thus producing Done = 1.

Figure 8.4. Conventional current sensor.

In general, designing and fine-tuning the current sensors are challenging tasks. Yet, different versions of current sensors have been used for various monitoring and testing applications. For example, the authors in [Yang 2001] proposed boundary scan combined with transition power supply current (I_DDT) for testing interconnect buses; the authors in [Chen 2005] proposed a leakage canceling current sensor (LCCS). The sensor was then recommended for self-timed logic to design process-variation tolerant systems. The self-timed systems can accept input data synchronously and supply their outputs asynchronously (i.e., by a “Done” signal generated by the current sensor).

A PSN monitor was presented in [Vazquez 2004] by which the authors claimed to detect high-resolution (100ps) PSN at the power/ground lines. The schematic of this circuit is shown in Figure 8.5. Briefly, the three inverters work as a delay line, whose delay depends on its effective supply voltage. The charge supplied to C_x (voltage V_x) is proportional to the propagation delay of the inverter block. The V_x voltage at the end of sampling period (controlled by the NOR gate) depends on the supply voltage. Thus, the voltage V_x depends on the power/ground bounce: the higher the PSN is, the longer the propagation delay and the higher the voltage V_x will be.

Figure 8.5. Power supply noise monitor.

A modified cross-coupled P-channel metal oxide semiconductor (PMOS) differential sense amplifier is designed to detect integrity loss (noise) relative to voltage violations [Nourani 2002]. Figure 8.6 shows a noise detector (ND) sensor, which sits physically near the receiving Core j for sampling the actual signal plus noise transmitted through Core i. TE is connected to test mode to create a permanent current source in the test mode, and input is connected to V_DD to define the threshold level for sensing V_b, (i.e., the voltage received in x). By adjusting the size of the PMOS transistors (i.e., W and L), the current through transistors T₁ and T₂ and the threshold voltages to turn the transistors on or off can be tuned. A designer uses this tuning technique to set the high and low noise threshold levels (V_Hthr and V_Hmin) in the ND sensor. Each time when noise occurs (i.e., V_b >V_Hthr), the ND sensor generates a 0 signal that remains unchanged until V_b drops below V_Hmin. The ND sensor shows a hysteresis (Schmitt-trigger) property, which implies a (temporary) storage behavior. This property helps to detect the violation of two threshold voltages (V_Hthr and V_Hmin) with the same ND sensor.

Figure 8.6. Noise detector (ND) sensor using a cross-coupled PMOS amplifier.

The integrity loss sensor (ILS) is a delay violation sensor shown in Figure 8.7 [Tehranipour 2004]. The ILS sensor consists of two parts: the sensor and the detector (XNOR gate). An acceptable delay region (ADR) is defined as the time interval from the triggering clock edge during which all output transitions must occur. The test clock TCK is used to create a delayed signal b, and together they determine the ADR window. The input interconnect signal a is in the acceptable delay period if its transition occurs during the period when b is at logic 0. Any transition that occurs during the period when b is at logic 1 is passed through the transmission gates to the detector composed of an XNOR gate. The XNOR gate is implemented using dynamic precharged logic. Output c becomes 1 when a signal transition occurs during b = 1 and remains unchanged till b = 0, the next precharge cycle. Output c is used to trigger a flip-flop. The minimum detectable delay can be decreased by increasing the delay of inverter 2 (T_inv2) or decreasing the delay of inverter 1 (T_inv1). T_inv2 can be decreased until the duration is enough to precharge the dynamic logic.

Figure 8.7. Integrity loss sensor (ILS).

Jitter is often defined as the time deviation of a signal from its ideal location in time. Jitter characterization is important for phase-locked loops (PLLs) and other circuits with time-sensitive outputs. Jitter measurement of a data signal with sub-gate resolution can be done using two delay lines feeding a series of D latches as shown in Figure 8.8. Such a structure is known as a Vernier delay line (VDL) [Gorbics 1997]. Assuming the clock signal is jitter-free, the propagation delay of the clock and data paths differ by ΔT = T_d – T_c (e.g., the time difference between rising edges). The time difference decreases by ΔT after each stage, and the phase relationship between these two rising edges is recorded by a D latch in each stage. A counter reads the output of the D latch and counts the number of times the data signal leads the clock signal with a delay difference that depends on the position of D latch in the chain. Alternatively, the histogram of the jitter (i.e., the jitter’s probability density function) can be directly derived by ORing the outputs of all D latches and counting the number of 1’s over the time period of the clock. The accuracy of jitter measurement using VDL depends on the matching of delay elements between stages [Chan 2001].

Figure 8.8. Jitter monitor using VDL.

Using ring oscillators (ROs) to probe on-die process variation is a long-standing practice. The oscillators inserted into the system are affected by process variation (PV) along with the rest of the system. The variation of delay caused by PV-faults in any of the inverters in the loop results in deviation in the frequency of the oscillator, which can be detected. Several foundries have already used ring oscillators on wafers to monitor process variations. This often serves as a benchmark performance measure (sanity check) [MOSIS 2007]. Conventionally, several in-wafer ROs are placed on dicing lines (scribe lines) for process parameter monitoring. Unfortunately, this is insufficient for evaluating variations on each die, as there is a growing demand for sensors and methodologies that allow process variations to be evaluated with precision.

Ring oscillators are implemented by cascading an odd number of inverters to form a loop. By using an odd-numbered loop, we can assure that the output of the last inverter is the opposite (inverse) of the previous input to the first inverter, thus preventing it from stabilizing to a steady state. The oscillation frequency of a ring oscillator is given as the reciprocal of the total delay of the inverters. That is f_RO = 1/(N_invT_inv), where N_inv is an odd number of inverters and T_inv is the delay of one inverter. Using standard CMOS inverters, the following equation can be written [Rabaey 1996]:

This equation is a first-order approximation of the relationship among the current, load capacitance, and frequency of an oscillator. Being an approximation, the formula cannot accurately capture the complex relationships among the factors. Yet, in general, process variation collectively causes a measurable frequency shift (Δf) in the output of a ring oscillator. For example, simulation results using a commercially available SPICE circuit simulator at a TSMC 180-nm process node for a 41-stage ring oscillator shows a shift in frequency of 16 MHz and 6 MHz for 10% variation of threshold voltage (V_t) and transistor oxide thickness (T_ox), respectively [Nourani 2006].

In a logic BIST environment, a test pattern generator (TPG) is used to generate pseudo-random patterns for detecting manufacturing faults in a circuit under test (CUT). An output response analyzer (ORA) is used to compact the test responses of the CUT and form a signature. Under the control and coordination of the BIST controller, the final signature is then compared against an embedded golden signature to determine pass/fail of the CUT. Figure 8.9 shows a typical logic BIST architecture to test SOC interconnects for integrity. The integrity loss monitoring cell (IL sensor) can be any of those sensors discussed earlier such as ND or ILS. The TPG and ORA are located on the two sides of the interconnect under test (IUT). The IUTs can be long interconnects or those suspicious of having noise/delay violations as a result of environmental factors, (crosstalk, electromagnetic effects, environmental noise, etc.).

Figure 8.9. Typical logic BIST architecture for integrity testing.

The rationale in using pseudo-random patterns for integrity testing is the fact that finding patterns that are guaranteed to create the worst-case scenarios for integrity loss (e.g., noise and delay) is prohibitively expensive with the current state of knowledge. This is mainly because of the complexity of the distributed resistance-inductance-capacitance (RLC) interconnect model, parasitic values, and too many influential factors.

Detecting signals that leave the noise-safe and time-safe regions is a crucial step in IL monitoring and testing. Various IL sensors may be needed per interconnect to detect noise (crossing the threshold supply voltage V_Hthr and the minimum supply voltage V_Hmin) and delay violations. The test architecture used to read out the information stored in these cells is based on a DFT decision, which depends on the overall SOC test methodology, testing objective, and cost consideration. Figure 8.10 shows one such test architecture given in [Nourani 2002]. IL sensors are pairs of ND and ILS cells, which, in coordination with scan cells, record the occurrence of any noise or delay violation. The results are scanned out via Sout to the scan-out chain for analysis. In test mode, the flag signal is first transmitted through the multiplexer to the test controller. When a noise or delay violation (low integrity signal) occurs (flag = 1), the contents of all scan cells are then scanned out through Sout for further reliability and diagnosis analysis. Suppose an n-bit interconnect is under test for m cycles (i.e., with m pseudo-random test patterns). The pessimistic worst-case scenario in terms of test time is a case in which all lines are subject to noise in all m test cycles. This situation requires overall m and mn cycles for response capture and readout, respectively. In practice, a much shorter time (e.g., kn, where k<<m) is sufficient, as the presence of defects or environmental factors causing an unacceptable level of noise/delay (integrity loss) is limited.

Figure 8.10. The readout circuitry.

The IEEE 1149.1 boundary-scan test standard [IEEE 1149.1-2001], also known as Joint Test Action Group (JTAG) standard, has been widely accepted and practiced in the electronics industry for testing interconnects between devices and providing external access to a device under test or diagnosis. The standard provides excellent test and diagnosis capabilities for devices mounted on a printed-circuit board (PCB) or embedded in a system with low complexity, but it was not intended to address high-speed testing and signal integrity loss.

To address signal integrity loss, in [Whetsel 1996], the author proposed a method to simplify the development of a mixed-signal test standard by adding the analog interconnect test to 1149.1. The IEEE 1149.4 mixed-signal test bus standard [IEEE 1149.4-1999] was then developed to allow access to the analog pins of a mixed-signal device. In addition to the ability to test interconnects using digital patterns, the 1149.4 standard includes the ability to measure actual passive components, such as resistors and capacitors; however, it cannot support high-frequency phenomena, such as crosstalk on interconnects. To deal with high-speed testing, the IEEE 1149.6 standard provides a solution for testing AC-coupled interconnects between integrated circuits on PCBs or systems [IEEE 1149.6-2003]. Various issues on the extended JTAG architecture to test SOC interconnects for signal integrity are reported in [Ahmed 2003], [Tehranipour 2003a], and [Tehranipour 2003b] where maximum aggressor (MA) and multiple transition (MT) fault models are employed.

Integrating pseudo-random pattern generators and IL sensors within scan test architecture is a relatively straightforward task. To activate IL sensors, a separate test mode is needed. For example, the authors in [Tehranipour 2004] proposed to modify the boundary-scan cells (BSCs) for testing integrity loss on interconnects. At the driving side of an interconnect, a modified BSC that generates test patterns, called pattern generation BSC (PGBSC), is used. At the receiving side of the interconnect, the authors proposed to use an observation BSC (OBSC) that includes an integrity loss sensor.

Figure 8.11 shows the overall test architecture with n interconnects between core i and core j in a two-core SOC. The five standard JTAG interfaces (TDI, TCK, TMS, TRST, and TDO) are still used without any modification. Two new instructions (called G-SITEST and O-SITEST) have been defined for signal integrity test, one to activate PGBSCs to generate test patterns and the other to read out the test results. The cells at the output pins of core i are changed to PGBSCs, and the cells at the input pins of core j are changed to the OBSCs. The remaining cells are standard BSCs, which are present in the scan chain during signal integrity test mode. In the case of bidirectional interconnects, boundary-scan cells used at both ends are a combination of PGBSC and OBSC to test the interconnects in both directions. The IL sensing part of OBSCs does not need any special control and automatically captures the occurrence of integrity loss. After all patterns are generated and applied, signal integrity information stored in the IL sensing scan cell is scanned out to determine which interconnect has a problem.

Figure 8.11. Test architecture.

In PV testing, because of the self-generating and on-spot nature of process variation, no fault stimulation is needed. However, the output of a sensor needs to be carried out to an observation point for analysis. Researchers have observed that the intradie variations are significantly more difficult to predict and deal with than die-to-die variations on a wafer [Bowman 2000] [Nassif 2004]. On-chip ROs with counters, embedded in a test chip, were presented in [Hatzilambrou 1996] to detect process variation by measuring the RO’s frequency shifts. This frequency variation was then used to grade the die performance or the performance of individual cores. This approach is not intended as a pass/fail test but instead as a grading test.

There are a number of techniques on PV probing and monitoring. Two examples were described in [Ukei 2001] and [Samaan 2003]. The monitor test element group (TEG) proposed in [Ukei 2001] consists of a ring oscillator and a control circuitry. Five TEGs are arranged in the four corners and the middle of a die, and their signals are reported one by one for process variation and manufacturing yield analysis. In [Samaan 2003], ROs are disposed over an integrated circuit chip depending on available layout space. To record its oscillation frequency, only one RO is allowed to operate at any one time. An analog-frequency wire is used to deliver test data to the counting and monitoring units for analysis. In [Bhushan 2006], the authors employed ring oscillators to evaluate the effect of process variations on key transistor parameters like switching delay and active/leakage power. These metrics reflect the average behavior of a few hundred MOSFETs embedded within each RO test structure. The authors experimented with IBM’s 90-nm and 65-nm circuits and showed that their test mechanism can be useful for manufacturing test.

In [Nourani 2006], a distributed network of several (extendable to a large number of) ring oscillators per die was presented. The methodology targets detecting those process variation changes that collectively cause a measurable frequency shift (Δf) in the output of a ring oscillator planted in that region. These measurements can be further used to identify the problematic region(s) of the die and even grade the quality of the die or assembled chip. This approach carefully chooses three parameters of architecture, namely, types, numbers, and positions of ring oscillators. The basic architecture is shown in Figure 8.12.

Figure 8.12. Basic concept of PV test architecture with ROs and compactor(s).

The layout under PV test may be a full die or portion of die such as a sensitive core. In this figure, each RO symbolically occupies one or more regions out of 9 × 9 = 81 regions. Practically, the placement/layout generation tools position ROs automatically. The concept of fault sampling was used to stay practical while collecting a good estimate of coverage. The authors assumed that the area of each RO is a multiple of a grid area and the size of a die is equivalent to N_p grids. Applying the theory of sampling and the tradeoff between accuracy versus number of samples, the authors randomly chose N_s grids (where PV-faults occur) out of N_p and devised sensors to collect data on process variations.

Structural tests are fault-model-based tests that usually include stuck-at tests for detecting stuck-at faults and delay tests for detecting transition faults and path-delay faults. In the 1980s and 1990s, the most commonly used structural tests are stuck-at tests. Because stuck-at tests have difficulty in meeting a product’s DPM goal, functional tests are often used to supplement these structural tests during manufacturing test. An experiment conducted in [Maxwell 1991] has shown that a structural test with 92% single stuck-at fault coverage had lower overall defect coverage than a combined structural and functional test with only 82% single stuck-at fault coverage. More recent experiments further confirm that even a structural test with 100% stuck-at fault coverage is inadequate to screen most manufacturing faults [Ferhani 2006].

To further improve the circuit’s defect coverage, at-speed delay tests have been used to supplement stuck-at tests since the 1990s when process node started to move to 180 nanometers and below [Foote 1997]. One study on a 733-MHz PowerPC microprocessor designed at IBM showed that if at-speed delay tests were removed from the test program, the escape rate would rise nearly 3% [Gatej 2002]. As a result, at-speed delay testing has become mandatory [Iyengar 2006] [Tendolkar 2006] [Vo 2006] for designs manufactured at 90 nanometers and below. These at-speed delay tests can come from scan or BIST [Wang 2005, 2006].

Modern ATPG and logic BIST programs can also take test power consumption into consideration when generating power-aware structural tests. These power-aware structural tests can avoid excessive heat during shift operation and IR-drop-induced yield loss during capture operation [Girard 2002] [Nicolici 2003] [Butler 2004] [Wen 2005] [Remersaro 2006] [Wen 2006]. These techniques have been extensively discussed in Chapter 7.

Defect-based tests include tests that are generated to target specific manufacturing faults arising from imprecise process technologies such as process variation and lithography. These defect-based test methods have been found crucial in screening additional physical failures during manufacturing test for designs at 130-nm process node or below. To increase manufacturing yield and meet a stringent DPM goal, these defect-based tests must supplement structural tests.

Functional testing, once the sole test method that allows for testing actual functional paths at-speed, has begun to regain its acceptance in the industry. Microprocessor testing is one particular example [Sengupta 1999]. To meet the aggressive DPM goal, functional tests must be added to supplement structural tests (at-speed tests, stuck-at tests, and bridging tests).

Traditionally, functional tests are manually generated. It is a resource-intensive process, and fault coverage can only be assessed through fault simulation (again, a tedious process). Usually, fault coverage with functional tests cannot be improved upon easily, because the circuit could be complex and few commercial tools are available to help with this manual test generation process.

Efforts have been made to utilize validation techniques to tackle this problem. One of the common postsilicon validation techniques is that of random test generation with random instruction and data [Shen 1998]. With the proper test templates, these procedures can permute instruction sequences, addressing modes, data types, etc., to allow a more diverse set of tests to find potential design errors. These types of tests also help in detecting more manufacturing faults if deployed during manufacturing test. The limitation with doing this in manufacturing has been the immense amount of tester storage required to hold all of these randomly generated test vectors. The authors in [Parvathala 2002] came up with an idea to utilize the large cache that is a common feature for modern-day microprocessors. They shoehorned a version of this random test generator into the cache of a microprocessor. The area overhead required to load the test generator into the cache and run the code without invalidating the cache is considered very small as it piggybacks on other memory test (DFT) architectures. By running this test generator on-chip repeatedly, an infinite number of new test vectors can be generated with minimal additional test storage since we only need to load up the cache memory just once. Fault detection is through the periodic signature compression of the memory maps (the cached memory), further reducing bandwidth requirements. The additional benefit of this mode of testing is that the test can be run on the processor core at-speed, thus detecting delay faults as well as signal integrity faults. The authors in [Parvathala 2002] provided data showing that this method is effective in catching additional faulty chips and has improved DPM. The only limitation to this test method is that portions of the device dealing with external bus transactions and the cache miss related logic cannot be covered.

Another advancement came in the area of actually generating specific instruction sequences targeting manufacturing faults. [Tupuri 1997] and [Tupuri 2002] described such methods to reuse deterministic ATPG for targeted faults within an embedded module while extracting the input/output constraints for delivering those tests to the targeted module. The authors in [Chen 2003] used basic test templates and learned the characteristics (how they can reach control states and how they can propagate key signals, etc.) of these instruction sequences. Once a sufficient number of test templates are learned, this test generator is able to piece together these instruction sequences to activate the nodes (to be tested) and enable the propagation logic to allow them to be observable. Although these are promising early results, these techniques have to be proven on more complicated test cases. More functional test methods can also be found in Chapter 11.

An optimal test ordering of these tests plays an important role in minimizing the overall test time while maintaining the fault coverage. The study in [Butler 2000] revealed that functional tests should be placed early in the test flow before the use of transition tests, stuck-at tests, and I_DDQ tests. The authors in [Pouya 2000] and [Ferhani 2006] have also indicated that an optimal test ordering to have the shortest test time is to apply path-delay tests, transition tests, and stuck-at tests, in that order. However, finding an optimal test sequence is not a simple process, and the shortest test time is not always the best when tests are required for yield, defect, and performance learning. In that case, an ideal optimal test sequence should mean to trade off test time with test data collection and to pick the best point.

The key issue is thus how to generate these manufacturing tests (made up of structural tests, defect-based tests, and functional tests) in a timely manner to best meet time-to-market, DPM, and test budget goals all at the same time. In manufacturing processes at the 65-nm node and below, the test data volume can become so considerable that the cost of testing will soar. Therefore, we expect test compression to become indispensable. Similarly, functional BIST techniques like the cache-resident functional test generator described earlier may become more of a necessity. Active research will be more directed toward reducing scan ATPG time and test power, physical fault modeling, speedup of concurrent fault simulation, coverage enhancement of logic BIST, and logic built-in self-repair (BISR) [SIA 2005, 2006].

Ring oscillators have long served this purpose. With an odd number of inverter stages, a ring oscillator will oscillate naturally, and its frequency can be measured easily with a counter clocked appropriately. Because many factors can affect the frequency of the ring oscillator, it is generally difficult to de-convolute the cause(s) of the varied frequency. The authors in [Samaan 2003], [Stinson 2003], [Nassif 2004], and [Krishnamoorthy 2006] have proposed the use of multiple ring oscillators of varying design parameters. With many of these embedded ring oscillators, de-convolution of the process variation, temperature, and even voltage is possible, providing an immense source of information during manufacturing and online operational feedback. Because these sensors are so helpful, hundreds of them can be sprinkled onto different areas of the die to provide useful information about on-die process variation, local temperature (hot spots), and local power grid fluctuation, serving multiple purposes with a single set of sensors. The only requirement is that one has to know how to gain access to these sensors, and analysis must be done to de-convolute the underlying changes, which may be difficult to be carried out with on-die resources alone.

Another type of process variation sensor utilizes an analog circuit, which is sensitive to process parameters; in fact, almost all analog circuits are sensitive to different process parameters [Cherubal 2001]. It is not critical to pick an ideal circuit, as the analog circuit may have multiple specifications and these specifications may in turn be sensitive to different process parameters. These specifications can be measured using any on-die or instrumentation-based test methods. Once enough data are collected on a large sample of sensors (in a die or even from various locations of the die for across-die process variation) and with appropriate statistical analysis techniques such as principal component analysis (PCA), the authors claimed that they can de-convolute the various device/process parameters to which the circuit is sensitive. The technique is similar to solving the variables with many equations and many unknowns. In this case, one must be careful about choosing the analog circuit itself. If the circuit is not sensitive to some types of process parameters, the analysis will not reveal any such variation at all. Because the analysis is essentially based on statistical methods, a large sample of data is needed. Unlike ring oscillators, the analog process variation sensor also does not report the process variation at the specific spot on the die (unless enough data are collected from that very spot). It is also unlikely that one can extract and analyze these data in real time.

This leads us to the discussion of more mission-critical sensors, such as thermal sensors. As high performance drives higher-frequency operations and a higher level of power consumption, today’s processors and high-end SOC designs could generate lots of heat, which needs to be dissipated properly. If, for whatever reason, the heat sink is not properly mounted or the cooling fan (a mechanical device) fails to turn, the device can accumulate enough heat to go into thermal runaway. In an extreme situation, it may cause irreversible damage to the chip. Thus, thermal sensors are extremely important for protecting the chip as well as the rest of the system (power supply, socket, motherboard, etc.). As a result, the industry has started putting thermal sensors onto the heat sink or the motherboard itself. Putting thermal sensors on the motherboard or even inside packages may not have the fast response time needed (thermal conduction is a relatively slow process as opposed to electronic processes) to control power consumption. Often, hot spots are local (such as in the floating point unit [FPU] or integer execution unit [IEU]), and the device can heat up and cool off quickly with code changes. Power control has to happen really fast; otherwise, the accumulated heat may lead to circuit failure or, worst yet, may melt down as a result of thermal runaway. Designing conservatively so heat will never be a problem can be a solution, but that leaves performance on the table. There is also the inevitable accident that the heat sink may fall off or the fans may stop working. All of these require on-chip thermal sensors to act as the last defense to prevent system crash or permanent damage to the chip. Therefore, these are mission-critical sensors.

An example of a thermal sensor is illustrated in Figure 8.14 [Pham 2006]. It is essentially a diode coupled with a current source. The diode current (and voltage) is a function of temperature, so the trip point can be set to detect the reach of a particular temperature. With multiple sensors, one can construct a system whereby different temperatures trigger different events—for example, slowing the clock down with the first trigger; if the second trigger happens, a more drastic measure has to be taken, such as stopping all clocks; and the last sensor will shut down the system power supply to protect itself.

Figure 8.14. Thermal sensor example.

Diode does have its issues (same for any fabricated device), as the diode voltage varies with process variation and not just with its design parameters. In applications where absolute temperature measurement is needed, calibration is necessary. It can be accomplished at manufacturing time and with correction factors burned into on-chip fuses. For protection mechanisms like the one described earlier, calibration may be optional.

Thermal protection actually brought us to an important system feature that has made a significant impact on the world of testing. The chips of today are increasingly adaptive because of power savings, maximizing performance within a given power envelop, multiple clock domains with variable frequencies, high-speed IO interfaces, etc. Using the thermal diode as an example, each diode is slightly different from another because of fabrication variation. Each chip also may consume power differently (varying load capacitance and leakage). So the trip point from one die to the next can be very different. When they trip can also be different, even though both of them run the same patterns. Although this poses few issues with system-level operation (nobody would figure out down to the millisecond when the trigger event occurs), this is totally unacceptable in the digital testing paradigm.

The digital testing paradigm rests on the principle of stored stimuli and stored responses. Automatic test equipment (ATE) essentially stored all test patterns during logic or RTL simulation, and the device under test (DUT) is expected to perform exactly as simulated. Any bits coming off in an earlier or later cycle cause an error and the device is discarded. ATEs simply do not have the intelligence to figure out that the clock has changed to a different frequency, especially when the trip point can vary so much in time because of all the variances. Similar nondeterminism happens with all the conditions mentioned earlier, so our digital chips are increasingly difficult to test. One can implement DFT to turn off this nondeterminism (if one knows about it), but then we are either not testing a particular chip feature or will pose much greater design effort to turn off a natural feature of the chip. The saving grace is that structural tests are not impacted (because logic is tested from latch to latch anyway with structural testing). However, we are losing coverage as increasingly we have to turn an adaptive chip into a nonadaptive chip.

Another adaptive feature for power management is dynamic voltage scaling (DVS) [Flautner 2001]. As an efficient power reduction technique, DVS has been implemented in several commercial embedded microprocessors such as Transmeta Crusoe [Transmeta 2002], Intel Xscale [Intel 2003], and ARM IEM [ARM 2007]. DVS exploits the fact that the clock frequency (f) of a processor changes proportionally with the supply voltage (V), whereas the dynamic energy (P) is proportional to the square of the processor’s supply voltage (P α V²f). Thus, to save power, one can simply lower the clock frequency of the processor. If the frequency is lowered, then the voltage supply also will be lowered, resulting in a cubic power reduction. When the system goes into a period of low activity (e.g., a user is looking at the screen while thinking), it will signal the circuit to go into a low power state whereby frequency and voltage are scaled down. Once there is a need to process more data (e.g., a key is pressed), the system will resume to higher voltage and frequency, making the system appear to be responsive all the time. An example of the DVS scheme is shown in Figure 8.15.

Figure 8.15. Dynamic voltage scaling scheme.

Additional adaptability features may fit into this category. One example is the use of sleep transistors [Tschanz 2003] (which essentially scales the voltage close to 0 for specific circuits at a specific time) and dynamic body biasing (which varies the back bias of the transistor to increase or decrease the threshold voltage) to save power. The function of the back bias is to affect the threshold voltage V_t of the transistor. It can be forward biased and it will lower V_t and speed up the transistor, but at the expense of leaking much more current. It can also be reversed biased, and it will increase V_t and lower the leakage current, but it will slow down the transistor. The other example is the adaptive test method [Edmondson 2006] for smart binning (not necessarily just speed), whereby devices are tested for power level before the optimal voltage/frequency classification of the chip is made. This is done through a voltage identifier (voltage ID), which is supplied by the chip to the voltage regulator module (VRM) on the motherboard during power up. The core frequency is determined by an internal multiplier, which is programmed during test through a fuse (after determining how much power it consumes). The voltage ID is also fused at the same time. Both uses of sleep transistors and adaptive testing are unconventional ways of adaptations to cope with process variations.

One approach to improve the reliability of a chip is to remove the source of soft errors. Because the early discovery of soft error was the result of contaminated packaging material, the solution was simple: eliminate the radiation contaminant from packaging material [May 1979]. However, trace amounts of radioactive isotopes do exist in common processing and packaging materials—such as the boron in borophosphosilicate glass (BPSG) and ceramics and the lead in solder—and their removal is costly. Their radioactive decay still leads to some level of soft error rate. Because alpha-particle radiation (see the previous section) can be stopped on the surface of the die, a die coating (epoxy resins that are deposited on the surface of the die) was introduced and used for some period of time. Die coating is only effective if the radiation comes from the outside and is of limited value if the alpha emitter is among the materials that transistors or interconnects are made of. As we move from wire bonding packaging to flip-chip solder (tin/lead) joint (or C4) packaging, solders are never far away from the surface of the die and die coatings would have no effect at all. Today, the primary alpha-particle source is solders (lead radiation isotopes). The careful selection of raw material has resulted in low-alpha solder. As a result of environmental and health concerns over lead, tin/lead solder is being phased out in packaging material, which will reduce alpha-induced soft errors. However, the other source of radiation, high-energy neutrons, cannot be stopped by anything associated with packaging.

All of these preventive measures combined with advances in manufacturing process technology have improved the system-level reliability substantially. In the past, soft errors were not critical for most computer systems for terrestrial applications. Thus, traditionally, only high-reliability applications, especially those deployed in the financial transaction, transportation, and aerospace/defense industries, have required fault tolerance to prevent the systems from crashes and silent data corruption errors.

As these measures are not effective enough to prevent soft errors from happening, traditional fault tolerance schemes commonly used for high-reliability applications have started to emerge. There are three fundamental fault tolerance schemes that can be used to protect such systems or devices from hard errors or soft errors: (1) hardware (special) redundancy, (2) time (temporal) redundancy, and (3) information redundancy [Pradhan 1996] [Siewiorek 1998] [Lala 2001]:

Having detection capability is only half the story. After an error is detected, some recovery actions have to be taken. The most common action is for the operating system to stop the application, generate the necessary error message/log, and close the application. This action has varying degrees of system integrity implications, as partially computed results may have been written to disk already. Of course, this is better than simply letting the system crash, but we need better schemes that can provide more integrity. Checkpointing and rollback constitute one such scheme. Checkpointing is essentially taking a snapshot of the system states, which when revoked (rollback) will cause the system to restart from that point without rebooting or terminating the application. However, one has to ensure that no error has occurred (and the system is intact) before the checkpoint. One also has to consider where (or how regular) checkpoints are done to optimize for performance (because of the checkpointing process) as well as make sure that system states are not contaminated before the checkpoint.

Thus, having explained the basic principle, what are some of the common fault tolerance schemes used in high reliability systems? As mentioned before, duplicate and compare is one method that is commonly used in mainframes and high-end servers [Spainhower 1999] [Bartlett 2004]. For systems that cannot fail, a more secure system is triple modular redundancy (TMR) [Sklaroff 1976] [Siewiorek 1998] [Lala 2001]. Consider the TMR example shown in Figure 8.19. Here we have three pieces of computing units (modules), and their results are constantly compared. Because we have three results, the two matched results outvote the mismatched result and the deemed correct result will be sent on. The aerospace industry particularly favors this approach (for obvious reasons). More recently, because a central processing unit (CPU) is capable of running multiple threads (different streams of instructions that can be run in parallel on a CPU), one can also send a redundant thread through another path (virtual compute units) and check the results before retiring the thread/instructions. This is called redundant multithreading (RMT) [Mukherjee 2002].

Figure 8.19. A TMR example.

The incorporation of fault tolerance in a compute system did not begin with the processor. It began with the circuit that had the highest transistor density and the part of the system that had the most transistors—the main memory. The protection scheme is the use of ECC, which is quickly followed by redundant array of inexpensive disk (RAID). Even though the disk system does not necessarily have the highest number of transistors, disk drives are susceptible to mechanical failures; hence, it is essential to protect the data that it holds. Because of the need to have signals routed over long wires or traces, buses and backplanes that interconnect various subsystems are protected with parity. The networking communication protocols also contain error codes, such as cyclic redundancy check (CRC) and checksum (the sum of all the binary numbers in a particular packet of data). In the early 1990s, the importance of fault tolerance to CPUs became apparent, as on-chip cache memories have become large enough to warrant their own ECC protection. On some high-end server CPUs, register files are protected with parity, and duplicated execution blocks help to identify errors [Spainhower 1999]. So the last holdout seems to be flip-flops and combinational logic. Researchers have come up with hardened latch/flops [Calin 1997], where circuit design has decreased the internal nodes’ vulnerability to a radiation strike. More recently, enhancing the storage elements or scan cells to fill the role of duplication (as the states are already duplicated) has been suggested [Franco 1994] [Austin 1999] [Ernst 2003] [Mitra 2005] [Tamhankar 2005]. These on-chip fault tolerance schemes are referred to as error resilience.

As we move toward the nanotechnology era, more and more system-level functions (in the form of IP cores) will be integrated on a single piece of silicon (or package). This trend has substantially exposed the nanometer SOC design to ever more manufacturing faults and soft errors; therefore, it is becoming more and more important to embed online error detection or correction schemes in these chips as the distinction between computer systems and systems-on-chip (SOCs) increasingly narrows in nanometer designs.

Because hardware redundancy requires one or more redundant modules for error detection or correction, the hardware overhead using this fault tolerance scheme is a concern for use in chips. At the same time, while information redundancy can significantly reduce hardware overhead for array logic such as programmable logic array (PLA) and memory, this fault tolerance scheme is not applicable for random logic. This has left time redundancy as a viable solution to providing online error detection or correction for random logic on-chip.

These on-chip fault tolerance schemes for error detection or correction, referred to as error resilience, were first proposed for processor designs. While the major purpose of these error-resilient processor microarchitectures is to achieve maximum processor performance and power savings using dynamic voltage scaling (DVS), the online error detection and correction circuits used therein are applicable for soft error protection.

In this section, we only discuss two representative error-resilient processor microarchitectures: DIVA [Austin 1999] and Razor [Ernst 2003] [Ernst 2004]. Both DIVA and Razor adopt the fault tolerance scheme using spatial redundancy. DIVA uses a simpler DIVA checker to verify the recomputed results before commit, while Razor uses a Razor flip-flop similar to the stability checker (see Figure 3.17 of Chapter 3) proposed in [Franco 1994] to check whether each main flip-flop during normal operation functions correctly. For more information on other DVS schemes that are also applicable for soft error protection, refer to [Ernst 2003] and [Ernst 2004]. Chapter 3 of this book also provides a good reference to the basics of these fault tolerance schemes. For a more specific explanation, other implementations of the error-resilient microarchitectures can be found in [Patel 1982], [Metra 1998], [Oh 2002], [Favalli 2002], and [Tamhankar 2005].

DIVA

One error-resilient processor microarchitecture is the dynamic implementation verification architecture (DIVA) [Austin 1999]. As illustrated in Figure 8.20, DIVA uses a smaller and simpler shadow processor (DIVA checker) that computes concurrently as the main processor (DIVA core). Instead of using two large complex cores as in the case of using the double modular redundancy (DMR) scheme, the DIVA checker largely depends on the DIVA core to do the computation while it verifies the correctness of the core processor’s computation with simpler hardware (to save on silicon cost).

Figure 8.20. DIVA architecture.

The DIVA core constitutes the entire microprocessor design except the retirement stage. The main processor core fetches, decodes, and executes instructions, holding their speculative results in the reorder buffer (ROB). The DIVA checker contains a functional checker stage (CHK) that verifies the correctness of all core computations, only permitting correct results to pass through to the commit stage (CT) where they are written to architected storage. A watchdog timer (WT) is added to detect faults that can lock up the core processor or put it into a deadlock or livelock state where no instructions attempt to retire. If an error is detected during any core computation, then the DIVA checker will fix the errant computation, flush the processor pipeline, and restart the processor at the next instruction.

This dynamic verification scheme, a microarchitecture-based technique that can significantly reduce the burden of correctness in microprocessor designs, is only applicable to the processor world where these microarchitectures make sense. This implies the protection is only limited to portions of the design which are not shared; because the whole bus unit, instruction decoding, and the backend of the pipeline are shared, they are not protected. Like any DMR scheme, this technique is good for detecting an error (be it permanent or SER); recovery is yet another issue. Similarly to DMR, it can be coupled with checkpointing and rollback as a reasonable error recovery scheme to achieve fault tolerance.

Razor

With increasing clock frequencies and silicon integration that come with scaling, power-aware computing has become a critical concern in the design of high-performance computing. In addition, the energy consumption and dissipation issues also spread to embedded processors and SOCs. One approach for power conservation is to run the circuit at the lowest V_DD where it still executes correctly. Instead of having a fixed V_DD, the voltage is adjusted dynamically, hence dynamic voltage scaling (DVS). DVS is one of the more effective and widely used methods for power-aware computing [Pering 1998]. To obtain maximum power savings from DVS, it is essential to scale the supply voltage as low as possible while ensuring correct operation of the design. This critical supply voltage is difficult to be set correctly all the time considering a wide diversity of process and environmental variations, where the design might not operate correctly.

The authors in [Austin 1999] attempted to address the power conservation issues by using a self-tuned clock and voltage scheme in which dynamic verification is used to reclaim frequency and voltage margins. The Razor scheme proposed in [Ernst 2003] and [Ernst 2004], on the other hand, is based on the use of in situ timing error detection and correction to permit increased energy reduction as voltage margins are completely eliminated. The key idea of Razor is to tune the supply voltage by monitoring the error during circuit operation, thereby eliminating the need for voltage margins and exploiting the data dependence of circuit delay. Similar to DIVA, this is accomplished with a shadow unit, but this shadow unit has been pushed all the way down into a Razor flip-flop. This Razor flip-flop, shown in Figure 8.21a, double-samples pipeline stage values, one with a fast clock, clk, and the other with a time-borrowing delayed clock, clk_del. It includes a main flip-flop controlled by the fast clock and a shadow latch controlled by the delayed clock. The value of the shadow latch is assumed to be correct under any operating voltage. A metastability-tolerant comparator then validates the values stored in the main flip-flop.

Figure 8.21. Razor flip-flop: (a) schematic of the Razor flip-flop, (b) reduced overhead Razor flip-flop with metastability detection circuit, and (c) waveform.

Actually, using a delay checker for on-chip error detection was first proposed in [Franco 1994], long before power became a significant issue in chip design. The stability checker proposed in that paper was designed to deal with delay degradation (reliability). The delayed data are sampled and checked against the primary data. A transistor-level design that integrates the stability checker into a flip-flop is also given, which significantly reduces the overhead. The paper also discussed the possibility of moving the checking ahead of the primary latch to detect oncoming timing errors and changing the dynamic frequency of the circuit to cope with the CUT where field repair is not possible. However, the earlier paper does not address (1) power saving when power was not yet an issue and (2) methods for dealing with an error when it occurs. These are crucial elements in all time redundancy (delay detection) schemes. Razor documents the whole error handling part in detail.

A reduced overhead Razor flip-flop with the metastability detection circuit is illustrated in Figure 8.21b. The operating voltage is tuned to the level so that the worst-case delay is guaranteed to meet the shadow latch setup time, even though the main flip-flop could fail. By comparing the values latched by the main flip-flop and the shadow latch during each clock cycle, a delay error in the main flip-flop can be detected. The value stored in the shadow latch is then used to correct the error.

The operation of the Razor flip-flop is illustrated in Figure 8.21c. In clock cycle 1, the combinational logic L1 meets the setup time by the rising edge of both clocks so both the main flip-flop and the shadow latch will latch the correct data. In this case, the error signal at the output of the XOR gate remains logic 0, and the operation of the pipeline is unaltered. In clock cycle 2, we show an example of the operation when the combinational logic L1 exceeds the intended setup time of the main flip-flop but does not exceed the worst-case setup time of the shadow latch during subcritical voltage scaling. In this case, the data are not correctly latched by the main flip-flop but are successfully latched by the shadow latch because the shadow latch is controlled by a delayed clock. This means, in order to guarantee that the shadow latch will always latch the input data correctly, the allowable operating voltage must be constrained at design time so under worst-case conditions, the logic delay in L1 will never exceed the setup time of the shadow latch. By comparing the valid data of the shadow latch with the incorrect data latched by the main flip-flop, an error signal, Error_L, is then generated in clock cycle 3. In clock cycle 4, the valid data in the shadow latch are restored into the main flip-flop and become available to the next pipeline stage L2. These local error signals are OR’ed together to ensure that all contents of the main flip-flops are restored even when only one of the Razor flip-flops generates an error.

Having said that, it is still a delicate balance that we have to guarantee the shadow latch latches the correct data. If both of them are latched incorrectly as a result of unpredictable timing mismatches caused by whatever reasons, the corrupted system will remain undetected and becomes a silent data corruption (SDC). This also involves a complicated pipeline reloading mechanism (see Figure 8.21), and it is unclear what the implication would be for applications of a nonpipelined (finite-state machine) type. The voltage adjustment mechanism also has to be designed such that it can be changed reasonably fast (within a couple of clock cycles); otherwise the whole system will keep circulating until the main flip-flop matches the shadow latch. This can be a problem for large circuits where a power-adjusting circuit would not be able to react fast enough to the heavy load.

The objective of soft error mitigation techniques is to provide partial immunity of a design to potential soft errors while significantly minimizing the required cost over fault tolerance schemes. Thus, these methods are highly suitable for mainstream applications where the SER is reduced in a cost-effective manner without providing complete tolerance capabilities. We review three soft error mitigation methods through built-in soft-error resilience (BISER) [Mitra 2005] and circuit-level modifications [Zhou 2006] [Almukhaizim 2006].

Built-In Soft-Error Resilience

The built-in soft-error resilience (BISER) proposed in [Mitra 2005] can be used to allow scan design to protect a device from soft errors during normal system operation. BISER is based on the observation that soft errors either (1) occur in memories and storage elements and manifest themselves by flipping their stored states or (2) result in a transient fault in a combinational gate, as caused by an ion striking a transistor within the combinational gate, and can be captured by a memory or storage element [Nicolaidis 1999]. Data from [Mitra 2005] show that combinational gates and storage elements contribute to a total of 60% of the soft error rate (SER) of a design manufactured using current state-of-the-art technology versus 40% for memories. Hence, it is no longer enough to consider soft error protection only for memories without considering any soft error protection for storage elements as well.

Figure 8.22 shows the BISER scan cell design [Mitra 2005] that reduces the impact of soft errors affecting storage elements by more than 20 times. This scan cell consists of a system flip-flop and a scan portion, each comprising a one-port D latch and a two-port D latch, a C-element, and a bus keeper. This scan cell supports two operation modes: system mode and test mode.

Figure 8.22. Built-in soft-error resilience (BISER) scan cell.

In test mode, TEST is set to 1, and the C-element acts as an inverter. During the shift operation, a test vector is shifted into latches LA and LB by alternately applying clocks SCA and SCB while keeping CAPTURE and CLK at 0. Then, the UPDATE clock is applied to move the content of LB to PH₁. As a result, a test vector is written into the system flip-flop. During the capture operation, CAPTURE is first set to 1, and then the functional clock CLK is applied which captures the circuit response to the test vector into the system flip-flop and the scan portion simultaneously. The circuit response is then shifted out by alternately applying clocks SCA and SCB again.

In system mode, TEST is set to 0, and the C-element acts as a hold-state comparator. The function of the C-element is shown in Table 8.3. When inputs O₁ and O₂ are unequal, the output of the C-element keeps its pervious value. During this mode, a 0 is applied to the SCA, SCB, and UPDATE signals, and a 1 is applied to the CAPTURE signal. This converts the scan portion into a master-slave flip-flop that operates as a shadow of the system flip-flop. That is, whenever the functional clock CLK is applied, the same logic value is captured into both the system flip-flop and the scan portion. When CLK is 0, the outputs of latches PH₁ and LB hold their previous logic values. If a soft error occurs either at PH₁ or at LB, O₁ and O₂ will have different logic values. When CLK is 1, the outputs of latches PH₂ and LA hold their previous logic values, and the logic values drive O₁ and O₂, respectively. If a soft error occurs either at PH₂ or at LA, O₁ and O₂ will have different logic values. In both cases, unless such a soft error occurs after the correct logic value passes through the C-element and reaches the keeper, the soft error will not propagate to the output Q, and the keeper will retain the correct logic value at Q.

Table 8.3. C-Element Truth Table

O1	O2	Q
0	0	1
1	1	0
0	1	Previous value retained
1	0	Previous value retained

The beauty of this scheme is that the BISER scan design has self-correction capability. Each BISER scan cell can still function as a normal scan cell in test mode. Once the chip is in the final application, it can be configured in self-checking mode (system mode) and no errors will propagate any further than the C-element. There are no new routing and new control signals to be added other than the existing scan control signals.

The only shortcoming, however, is that this will incur more power and area to some degree. The scan portion of the scan cell is much weaker because scan routing does not have to go far and each scan chain can run much slower (to ease design complexity) than the functional logic. For the scan cell to latch the same data, it has to be sized up appropriately so that it can run at more or less the same speed as the normal system flip-flop. This will increase loading and power to some degree (up to 2×). However, as not all system flip-flops need to be protected before we can achieve a 20× reduction of the SER, the area and power penalty for the whole chip is in the 3% to 5% range, much smaller than any conventional SER detection mechanism like DMR (where it is at least 100% more) [Mitra 2005].

Another important attribute of this scheme is that it is applicable for any latch-based or flip-flop-based logic design. Other architectural-level solutions, such as checkpointing and rollback, are good for processor designs but are totally nonrelevant for nonprocessor types of logic design.

Circuit-Level Approaches

Circuit-level approaches attempt to increase the ability of logic circuits to mask glitches by increasing the soft error masking factors in the circuit. While the reduction in the ability of a circuit to mask soft errors via latching-window masking is a consequence of the rapid increase in the operating frequency of logic circuits, the electrical and logical masking factors can be improved in a cost-effective manner for a targeted design. We describe two techniques that successfully mitigate soft errors in logic circuits by improving the electrical masking and logical masking factors of a design using gate resizing [Zhou 2006] and netlist transformations [Almukhaizim 2006], respectively.

Gate resizing for soft error mitigation [Zhou 2006] is based on physical-level design modifications, wherein individual transistor characteristics are perturbed to reduce the sensitivity of gates to glitches. Specifically, a select set of gates are resized, by altering the width/length (W/L) ratios of transistors in these gates, in order to increase their immunity to glitches and, by extension, reduce the SER of the logic circuit. Figure 8.23 illustrates the effect of gate resizing on the amplitude and width of a 0-to-1 transient at the output of a gate. As illustrated in the figure, the magnitude and duration of the transient diminish rapidly as the size of the transistor(s) that are collecting this charge. Because there may be multiple transistor diffusions (capacitors) on any given node, the collected charge tends to redistribute among the nodes once it is collected at any given junction. It also follows the RC discharge curve, as the wires connecting these diffusion areas are resistive. Thus, transistors in highly susceptible gates can be resized to disperse the injected charge as quickly as it is collected; hence, the transient does not achieve sufficient magnitude and duration to propagate to the fanout of the gate. SER estimation and assessment of the susceptibility of logic gates to soft errors is performed either through fault injection and simulation [Zhou 2006], wherein the soft error masking factors are evaluated separately, or through symbolic representation [Miskov-Zivanov 2006], wherein all the masking factors are evaluated in a unified approach. In both cases, gate resizing is performed for the most susceptible logic gates (i.e., the ones that contribute the most to the SER of the design). Results in [Zhou 2006] indicate that a 10-fold reduction in the SER of logic circuits implemented using present-day technologies is achievable at an overhead of roughly 30% in area and power consumption.

Figure 8.23. Effect of gate resizing on the amplitude/width of SETs [Zhou 2006].

More recent data reported in [Seifert 2006] indicate that SER may be flattened or even declined with scaling, and it points to the collection efficiency of the smaller diffusion area. This is still somewhat controversial as the same effect has not been reported by the majority of the researchers. However, if this theory is proved true, the gate resizing method would have to be considered carefully as it may increase the collection area and hence increase SER.

Netlist transformation for soft error mitigation [Almukhaizim 2006] is based on logic-level design modifications, wherein the logic circuit is modified while preserving the functionality of the netlist, to reduce the probability of sensitizing glitches to an output of the circuit. This has to take into account the vulnerability of all gates in the circuit, minimizing the overall vulnerability of the circuit and not just shifting the SER of one path to another. Design modification is performed using an ATPG-based rewiring method to generate functionally equivalent yet structurally different gate-level circuit implementations. Together with a SER estimation method, the design is iteratively modified through the selection of rewiring operations that minimize the overall SER of the circuit.

Consider, for example, the logic circuit in Figure 8.24. If rewiring is performed on the dashed wire in the circuit in Figure 8.24a, the dashed wire is replaced with input c in the circuit in Figure 8.24b. Performing a second rewiring on the dashed wire in the circuit in Figure 8.24b generates the circuit in Figure 8.24c. The soft error failure rate computed using SERA [Zhang 2006] indicates that the circuit in Figure 8.24c is improved by 5.00% over the circuit in Figure 8.24b and by 9.50% over the original circuit in Figure 8.24a. Because soft errors are mitigated at the logic level, the method proposed in [Almukhaizim 2006] is technology independent and, thus, enables design modifications for SER reduction that are equally effective, independent of the technology to which the circuit will be eventually mapped. Moreover, the mechanisms through which soft errors are mitigated at the logic level are orthogonal to those at the physical level; hence, not only does it provide a better starting point, it may also be applied synergistically with the current state of the art in gate resizing-based soft error mitigation techniques. Results in [Almukhaizim 2006] indicate that it is often possible to reduce the SER of a logic circuit without incurring any overhead in terms of area, delay, or power consumption.

Figure 8.24. Example of rewiring to reduce the soft error failure rate: (a) original circuit, (b) circuit after first rewiring, and (c) circuit after second rewiring.