Skip to content
VLSIMentor

DFT · Chapter 5 · ATPG

How ATPG Reasons: Controllability & Observability

The engine of ATPG is a search built on two ideas from Chapter 2. To detect a fault, ATPG must control the fault site to the exciting value and observe its effect at a scan cell or output. Controllability comes from justification, working backward from a required node value toward primary inputs and scan cells and pushing implications forward. Observability comes from propagation, working forward and sensitizing a path so a change reaches an observable point. ATPG tracks the fault effect with the D-calculus, labeling it one in the good machine and zero in the faulty machine, and advances the D-frontier toward an output. The search runs by decisions, implications, and backtracking, ending either with a valid pattern or a proof that the fault is redundant. Testability measures guide the search for speed, and scan lets ATPG treat flops as pseudo inputs and outputs.

Intermediate14 min readDFTATPGJustificationPropagationD-Algorithm

Chapter 5 · Section 5.2 · ATPG

Project thread — this is the reasoning ATPG applies to the scannable FSM (4.5) in 5.6: justify a state, propagate a fault effect to a scan cell.

1. Why Should I Learn This?

This is how ATPG actually thinks — the algorithm behind every pattern, and the key to why some faults are hard or redundant (5.5).

  • Detect = control the excite value (justification, backward) + observe the effect (propagation, forward).
  • The D-calculus tracks the fault effect (D/D') along the D-frontier to an output.
  • The search is decisions → implications → backtracking — ending in a pattern or a redundant proof.
  • SCOAP testability measures guide the search (heuristics); scan gives state C/O (3.1).

2. Real Silicon Story — the fault that needed observability, not effort

An undetected fault was stalling coverage closure. The team's reflex was to crank up ATPG effort (raise the abort/backtrack limit) — but it stayed undetected, burning runtime with no gain.

Splitting the reasoning told the real story. ATPG could justify the excite value (controllability was fine — it set the fault site to the required value). What failed was propagation: every sensitized path from the fault to an observable point was blocked by a side-input the logic couldn't hold non-controlling — an observability problem. More effort couldn't help, because the circuit offered no observe path, not because the search gave up early.

The fix was observability — an observe/scan point near the fault (Chapter 6) — after which the same fault was detected immediately. Lesson: when ATPG can't detect a fault, ask which half failed — justification (controllability) or propagation (observability) — because the fix is different, and 'more effort' only helps when the search was aborting, not when the path doesn't exist.

3. Factory Perspective — ATPG reasoning through each lens

  • What the test engineer sees: why a fault is hard — a justification conflict vs a propagation block — and whether more effort (aborts) or a design change (C/O) is needed (5.5).
  • What the yield engineer sees: that ATPG's sensitized paths are also diagnosis paths — a failing pattern's propagation path localizes the defect.
  • What the RTL/DV engineer sees: that poor controllability/observability in their logic shows up as hard/undetected faults — the same SCOAP intuition guides testability improvement (Ch6).
  • What management cares about: that ATPG effort (runtime) trades against coverage — and that redundant faults (no pattern exists) are an inherent ceiling, not an effort problem (5.5).

4. Concept — justification, propagation, the D-frontier, and search

Controllability via justification (backward):

  • ATPG needs a node at a required value (e.g. the fault's excite value). Justification works backward: choose input/scan-cell assignments that force it, propagating implications forward as it commits values.
  • Controllable = a justification exists that reaches controllable points (PIs / scan cells) without conflict.

Observability via propagation (forward):

  • ATPG must carry the fault effect to an observable point. Propagation works forward: sensitize a path by holding side-inputs non-controlling (2.2) so the difference travels to a scan cell / PO.
  • Observable = a sensitized path to an observable point exists.

The D-calculus and D-frontier:

  • The fault effect is a D (1/good, 0/faulty) or D' (0/good, 1/faulty) — a symbol that is both machines at once.
  • The D-frontier = gates whose output could become D/D' next. ATPG advances the D-frontier toward an output (propagation) and justifies the side-inputs that keep the path sensitized.

The search — decisions, implications, backtracking:

  • Decision: assign a value (pick a justification/propagation choice).
  • Implication: propagate forced consequences (e.g. an AND with a 0 input → output 0).
  • Conflict: a node is forced to two values → backtrack to the last decision and try another.
  • Termination: a consistent assignment → a pattern (fault testable); the search exhausts all choices with no solution → the fault is redundant (5.5).
  • The historic engines — D-algorithm, PODEM, FAN — are increasingly clever ways to prune this search.

Testability measures (SCOAP) — heuristics, not truth:

  • CC0/CC1 (controllability) and CO (observability) estimate how hard it is to set/observe a node.
  • ATPG uses them to choose easy decisions first — a speed heuristic; they don't change what's testable.

Scan's role:

  • Scan gives controllability/observability of state (3.1), so ATPG justifies/propagates over the combinational logic with flops as pseudo-PI/PO — the reason the search is tractable.
ATPG justifies the excite value backward to controllable points and propagates the fault effect forward along a sensitized path to an observable pointPIs / scan cellscontrollable pointsJUSTIFY (backward)set excite value →controllabilityFault site (D/D')excited: good ≠ faulty herePROPAGATE (forward)sensitize path, side-inputsnon-controllingScan cell / POobservable point →observabilityPattern iff BOTHsucceedconflict → backtrack; none→ redundant (5.5)12
Figure 1 — ATPG's two directions: justify backward, propagate forward (representative). At the FAULT SITE, ATPG must EXCITE the node (set it to the fault's opposite value) -- achieved by JUSTIFICATION working BACKWARD to primary inputs / scan cells (controllability). The fault effect (a D) must then reach an OBSERVABLE point -- achieved by PROPAGATION working FORWARD along a sensitized path, holding side-inputs NON-CONTROLLING (observability). The D-frontier is advanced toward an output. A pattern exists only if BOTH succeed simultaneously without conflict; if a needed value conflicts, ATPG BACKTRACKS.

5. Mental Model — a detective placing a suspect and a witness

ATPG detecting a fault is like a detective proving a specific event happened.

  • Justification (controllability) is placing the suspect at the scene: the detective works backward from 'the crime occurred here' to arrange the circumstances (input values) that put the fault in its exciting state — reasoning from the conclusion back to things they can control.
  • Propagation (observability) is getting a witness who can see it: the detective works forward to arrange a clear line of sight (a sensitized path) so the event is visible at a camera (a scan cell / output) — keeping obstructions (side-inputs) out of the way (non-controlling).
  • The case only holds if both are arranged at once — suspect placed and witness watching. If arranging one ruins the other (a conflict), the detective backtracks and tries a different setup.
  • If no arrangement can ever put a witness on the event (no observe path exists), the case is unprovable — the fault is redundant (5.5), and trying harder won't help.

Place the suspect and the witness, simultaneously — or, if it's impossible, prove it's impossible.

6. Working Example — justify and propagate on a small cone

Trace ATPG's reasoning on a small logic cone:

Azvya Education Pvt. Ltd.VLSI Mentor
Snippet
# ATPG reasoning on a cone — REPRESENTATIVE, SIMPLIFIED, tool-neutral:
# Target: node n5 STUCK-AT-0 (need to EXCITE n5=1, and PROPAGATE to output z)
#   Logic: n5 = a AND b ;  m = n5 OR c ;  z = m AND d
#
#   EXCITE (justify n5=1, backward):  a=1 AND b=1  -> n5=1 (good) / 0 (faulty)  -> D at n5
#   PROPAGATE (forward to z):
#     m = n5 OR c : hold c=0 (non-controlling for OR) -> m follows n5 -> D reaches m
#     z = m AND d : hold d=1 (non-controlling for AND) -> z follows m -> D reaches z (OBSERVABLE)
#   RESULT: pattern a=1,b=1,c=0,d=1 detects n5 SA0 (good z=1, faulty z=0) -> DETECTED
#
#   CONFLICT example: if some other constraint forced c=1, then m=1 regardless -> D BLOCKED at m
#     -> ATPG BACKTRACKS / seeks another path ; if none exists -> redundant (5.5)
Azvya Education Pvt. Ltd.VLSI Mentor
Snippet
# SCOAP-style testability measures (heuristic guides) — REPRESENTATIVE:
  node   CC0  CC1  CO      # CC0/CC1 = effort to set 0/1 (controllability) ; CO = effort to observe
  a       1    1   4
  n5      2    3   3       # higher numbers = harder to control/observe -> ATPG prefers easier decisions first
  z       -    -   0       # a primary output is directly observable (CO=0)
# SCOAP GUIDES the search (pick easy justifications/propagations); it does NOT decide testability.

7. Industry Flow — the per-fault search inside ATPG

Each pattern comes from this search, feeding generation + fault sim (5.3):

Target a fault, justify the excite value, propagate to an observable point, backtrack on conflict, ending in a pattern or a redundant proofATPG's per-fault search: excite → propagate → backtrack → pattern/redundantATPG's per-fault search: excite → propagate → backtrack → pattern/redundant1Target a faultneed excite value + observe path2Justify (excite)backward to controllable points3Propagateforward: sensitize path to an observable point4Conflict? Backtracktry another decision (D-algorithm/PODEM/FAN)5Pattern / Redundantsuccess → pattern (5.3); exhausted → redundant (5.5)
Figure 2 — ATPG's per-fault search (representative). TARGET a fault -> EXCITE it by JUSTIFICATION (backward to controllable points) -> PROPAGATE the D-frontier FORWARD to an observable point (sensitize a path) -> if a CONFLICT arises, BACKTRACK and try another decision. SUCCESS -> a valid PATTERN (fault testable) that goes to fault simulation (5.3). EXHAUSTED with no solution -> the fault is REDUNDANT (5.5). SCOAP measures guide the decision order for speed. Scan makes this a COMBINATIONAL search (flops as pseudo-PI/PO, 3.1).

8. Debugging Session — a fault ATPG won't detect

1

A fault stalls coverage and the team raises ATPG effort with no result; the fix depends on which half of the reasoning fails -- a justification conflict (can't control the excite value) versus a propagation block (can't observe the effect) -- and if no sensitized path can ever exist the fault is redundant, so more effort is futile and the real fix is added controllability or observability

ASK WHICH HALF FAILS: JUSTIFICATION (CONTROL) vs PROPAGATION (OBSERVE)
Symptom

A specific fault stays undetected and stalls coverage closure. The team keeps raising ATPG effort (abort/backtrack limits), burning runtime, with no improvement.

Root Cause

'Undetected' is not one problem — it's either a justification (controllability) failure, a propagation (observability) failure, or a genuine redundancy, and more effort only helps the first when the search was actually aborting. Break the reasoning into its two halves (this lesson's core): ATPG must (a) justify the fault's excite value (control the site) and (b) propagate the effect to an observable point. If justification keeps hitting a conflict — the excite value requires side-conditions that contradict something else — the fault is hard to control, and if no consistent justification exists, no pattern exists. If propagation is blocked — every path to an observable point is desensitized by a side-input the logic can't hold non-controlling — the fault is hard to observe, and if no sensitized path can ever exist, again no pattern exists. In both 'no exists' cases the fault is redundant (5.5), and raising effort is futile — the search isn't aborting for lack of time; it's exhausting because there is no solution. Raising effort only helps when the fault is testable but the search was backtracking past the abort limit (an aborted fault, 5.5). The team's error is treating all undetected faults as abort cases.

Fix

Diagnose which half fails, then apply the matching fix — controllability, observability, effort, or accept redundancy. Use the justify/propagate trace and SCOAP measures: if the node has high CC0/CC1 (hard to control) and justification conflicts, add controllability (a control/test point near it, Chapter 6); if it has high CO (hard to observe) and propagation is blocked, add observability (an observe/scan point, Chapter 6) — exactly the story's fix. If ATPG proves no pattern exists, the fault is redundant — accept it (remove from the denominator, 5.5), don't chase it. Only if the fault is aborted (testable but the search timed out) does raising effort help. The principle to lock in: ATPG detects a fault by simultaneously controlling its site to the exciting value (justification, working backward) and observing its effect at a scan cell or output (propagation, working forward), tracking the fault as a D through the D-frontier and searching by decisions, implications, and backtracking — so an undetected fault is a failure of controllability, of observability, or a proof of redundancy, and the correct remedy (add a control point, add an observe point, raise effort, or accept redundancy) depends entirely on which half of the reasoning failed, not on blindly increasing effort. (Fault classification is 5.5; testability improvement / test points are Chapter 6.)

9. Common Mistakes

  • Treating every undetected fault as an 'abort.' It may be a justification/propagation limit or redundant — effort won't help.
  • Confusing controllability and observability fixes. A control point and an observe point solve different halves.
  • Reading SCOAP as truth. It's a heuristic guide; it estimates difficulty, doesn't decide testability.
  • Forgetting scan enables the search. ATPG reasons combinationally only because scan gives state C/O (3.1).
  • Ignoring backtracking's meaning. Exhausted search = redundant (no pattern); aborted = effort limit (maybe testable).

10. Industry Best Practices

  • Diagnose undetected faults by half — justification (control) vs propagation (observe) vs redundant.
  • Add test points where SCOAP flags hard control/observe nodes (Chapter 6).
  • Raise effort only for aborted faults — not for proven-redundant ones.
  • Use the justify/propagate trace to guide testability and diagnosis.
  • Rely on scan for state C/O so the search stays combinational (tractable).

11. Senior Engineer Thinking

  • Beginner: "This fault won't detect — raise ATPG effort until it does."
  • Senior: "First: which half fails? If ATPG can justify (control) but can't propagate (observe), it's an observability problem — a control point won't help; I add an observe point. If the search exhausts all choices, it's redundant — effort is futile. Effort only helps aborted faults. Justification vs propagation vs redundant — the remedy depends on which."

The senior splits the reasoning and matches the fix to the failing half, never blindly raising effort.

12. Silicon Impact

Understanding ATPG's reasoning is what makes coverage closure (Chapter 6) intelligent instead of brute-force. Every pattern ATPG generates is the product of a two-sided constraint search — justify the excite value (controllability, backward) and propagate the effect to an observable point (observability, forward) — tracked with the D-calculus and driven by decisions, implications, and backtracking. That structure explains the three fates of a fault and their different remedies: a justification failure calls for controllability (a control point), a propagation failure calls for observability (an observe point), and an exhausted search means the fault is redundant (no pattern exists, accept it, 5.5) — while only a genuinely aborted search (testable but timed out) benefits from more effort. Conflating these is the most common, most wasteful ATPG mistake — burning runtime on redundant faults, or adding controllability where the problem was observability. The same reasoning also powers diagnosis (a failing pattern's sensitized path localizes the defect) and testability design (SCOAP's CC/CO flag the hard nodes worth test points, Chapter 6). And it all rests on scan: because scan supplies controllability/observability of state (3.1), the search is combinational and therefore tractable — the concrete reason full scan (Chapter 3) was worth its cost. For the RTL/DV engineer, the payoff is a precise vocabulary for testability: a hard fault is hard because it's hard to control or hard to observe, and your design decisions move those measures — which is exactly what the FSM reasoning in 5.6 will make concrete.

13. Engineering Checklist

  • Framed detection as justify (control excite) + propagate (observe effect) — both required.
  • For undetected faults, diagnosed which half failed (SCOAP + trace).
  • Applied the matching fix — control point, observe point, effort, or accept redundant (5.5).
  • Raised effort only for aborted faults (testable-but-timed-out).
  • Relied on scan (state C/O, 3.1) to keep the search combinational.

14. Try Yourself

  1. For n5 = a AND b; m = n5 OR c; z = m AND d, target n5 SA0: justify n5=1 and propagate to z (find c, d).
  2. Add a constraint c=1 and show propagation is blocked at m → ATPG must backtrack / find another path.
  3. Label the fault effect as D and trace the D-frontier from n5 to z.
  4. Given SCOAP CC/CO for the nodes, pick which decisions ATPG would try first (easiest).
  5. For an undetected fault, decide whether the failure is justification, propagation, or redundant — and the matching fix.

The reasoning is tool-neutral — pen and paper suffice. Real SCOAP/traces come from the ATPG tool. No paid tool required.

15. Interview Perspective

  • Weak: "ATPG figures out inputs that test a fault."
  • Good: "ATPG controls the fault site to the excite value and propagates the effect to an output, backtracking on conflicts."
  • Senior: "ATPG detects a fault with a two-sided search: justification (work backward to control the fault site to its excite value) and propagation (work forward to sensitize a path so the effect is observable at a scan cell/PO). It tracks the fault as a D (good/faulty) and advances the D-frontier to an output, searching by decisions, implications, and backtracking — ending in a pattern (testable) or a proof no pattern exists (redundant). SCOAP measures (CC0/CC1/CO) guide the decisions for speed. So an undetected fault is a controllability failure, an observability failure, or redundant — and the fix (control point, observe point, effort, or accept) depends on which. It's all combinational because scan gives state C/O."

16. Interview / Review Questions

17. Key Takeaways

  • ATPG detects a fault by simultaneously controlling its site to the exciting value (justification, working backward to PIs/scan cells) and observing its effect at a scan cell/PO (propagation, working forward along a sensitized path) — the excite + propagate of 2.2 as an algorithm.
  • It tracks the fault effect with the D-calculus (D/D') and advances the D-frontier toward an output, searching by decisions, implications, and backtracking (D-algorithm/PODEM/FAN).
  • The search ends in a valid pattern (fault testable) or a proof no pattern exists (fault redundant, 5.5) — so an undetected fault is a controllability failure, an observability failure, or redundant.
  • SCOAP testability measures (CC0/CC1/CO) guide the search toward easy decisions — a heuristic for speed, not a truth about testability.
  • Scan provides controllability/observability of state (3.1), so ATPG reasons over the combinational logic (flops as pseudo-PI/PO) — the reason the search is tractable; the right fix for a hard fault depends on which half failed. Next: 5.3 — pattern generation & fault simulation.

18. Quick Revision

How ATPG reasons. Detect = CONTROL the excite value (JUSTIFICATION, backward to PIs/scan cells) + OBSERVE the effect (PROPAGATION, forward, sensitize a path, side-inputs non-controlling) — the excite+propagate of 2.2 as a search. Track the fault as D/D' along the D-frontier to an output. Search = decisions → implications → backtracking (D-algorithm/PODEM/FAN) → a pattern (testable) or no pattern exists (redundant, 5.5). SCOAP (CC0/CC1/CO) GUIDES decision order (heuristic, not truth). Scan gives state C/O (3.1) → combinational search → tractable. Undetected = control fail / observe fail / redundant → fix = control point / observe point / accept; effort only helps ABORTED faults. Next: 5.3 — pattern generation & fault simulation.