DFT · Chapter 6 · Coverage & Signoff
Debugging Coverage Loss
When test coverage falls below target, the skill is not to stare at the top-line percentage but to decompose it and find where and why coverage is lost. This lesson is that methodology, a repeatable debug loop. Start from the fault-class summary, recovering aborts with effort and accepting the redundant, then localize the undetected faults to a region or block, because a few blocks usually dominate the loss. Next diagnose which half of the reasoning failed, controllability meaning the excite value cannot be justified, or observability meaning the effect cannot propagate to a scan cell. Then identify the cause, such as black-box interfaces, an over-constrained test mode, unknown sources, non-scan logic, or clock gating that is not test-controllable. Finally fix at the cause with test points, scan-readiness fixes, or relaxed constraints, then re-run and iterate.
Intermediate13 min readDFTCoverage DebugControllabilityObservabilityX-Sources
Chapter 6 · Section 6.3 · Coverage & Signoff
Project thread — the FSM's one AU fault (5.6) gets debugged here: localize → diagnose half (observability) → cause (unobservable illegal-state output) → fix (test point, 6.4).
1. Why Should I Learn This?
Coverage debug is a methodology, not a knob — decompose the shortfall, don't stare at the percentage.
- Start from the fault-class summary (5.5) — recover aborts, accept RE, investigate AU/undetected.
- Localize undetected faults to a block — a few blocks usually dominate the loss.
- Diagnose the failing half (5.2) — controllability vs observability (different fixes).
- Find the cause (black box, over-constraint, X-source, non-scan, clock-gating) and fix there.
2. Real Silicon Story — one X-source that sank the whole chip
A chip's coverage was stuck low, and the team was grinding ATPG effort across the entire design, gaining almost nothing. It felt like a pervasive testability problem.
Localizing the undetected faults told the truth: the loss was dominated by one region — everything downstream of a small non-scan sub-block. That sub-block was an X-source: its uninitialized, non-scan flops produced unknown (X) values that propagated downstream and blocked observation of everything behind them (3.4). It wasn't thousands of independent hard faults — it was one root cause poisoning a whole cone with X.
The fix was at the source: make the sub-block scannable (or tie/initialize it correctly, or mask it properly). Coverage jumped across the entire downstream region at once. Lesson: localize before you chase — a low chip-wide number is often one block / one X-source, and fixing the root cause recovers coverage wholesale, where per-fault effort would have recovered nothing.
3. Factory Perspective — coverage debug through each lens
- What the test engineer sees: the undetected-fault report by region and the justify/propagate traces — the tools to localize and diagnose (not just a top-line %).
- What the yield engineer sees: that coverage-loss regions map to escape hot-spots — the blocks whose defects would ship undetected (DPPM risk, 1.5).
- What the RTL/DV engineer sees: that the root causes (X-sources, non-scan, black boxes, over-constraint) are their design/constraint issues — fixable at the source (Ch4/6.4).
- What management cares about: that coverage closes fastest by fixing the few dominant causes, not by brute-force effort — a schedule and DPPM win (1.4/1.5).
4. Concept — the debug loop
Step 1 — Start from the fault classes (5.5):
- DT done; RE accept; AB → raise effort (recover); AU/undetected → investigate.
- Don't debug what's already recoverable (aborts) or accepted (redundant) — focus on the real gap.
Step 2 — Localize (by hierarchy):
- Group undetected faults by module/block. Coverage loss is concentrated — find the few blocks that dominate.
- A region-wide loss often signals one root cause (an X-source, a black box), not many independent faults.
Step 3 — Diagnose the failing half (5.2):
- Controllability failure: ATPG can't justify the fault's excite value (can't set the node).
- Observability failure: ATPG can't propagate the effect to a scan cell (can't see it).
- Use SCOAP (high CC = hard control; high CO = hard observe) and the justify/propagate trace.
Step 4 — Identify the cause:
| Cause | Breaks which half | Typical fix |
|---|---|---|
| Uncontrollable node | controllability | control test point (6.4) / fix constraint |
| Unobservable node | observability | observe test point (6.4) |
| Black box (IP/analog/memory IF) | both (boundary) | wrap / boundary scan (Ch10) / MBIST (Ch8) |
| Over-constrained test mode | controllability | relax pin constraints / add a test mode |
| X-source (non-scan/uninit/bus contention) | observability (broadly) | scan it / initialize / tie / mask (3.4/4.x) |
| Clock gating not test-controllable | controllability | ICG test-enable / OCC (4.4) |
| Redundant logic | (undetectable) | accept (RE) / remove logic (2.5) |
Step 5 — Fix at the cause; Step 6 — re-run and iterate.
- Fix the root cause (not individual faults), re-measure, and repeat on the next-dominant region.
A given cause breaks a specific half and has a specific fix:
5. Mental Model — a detective narrowing the scene
Debugging coverage loss is detective work, not brute force.
- You don't interrogate every citizen (raise effort on every fault) — you narrow the scene: which neighborhood has the crimes (localize to a block)?
- Then you ask what kind of failure: could the witness not get to the scene (controllability) or not see it (observability)? Different investigations.
- Then you find the single cause: a blackout on the whole street (an X-source blinding a cone), a sealed building (a black box), or a curfew that kept everyone home (an over-constrained test mode).
- You fix the cause — restore the streetlights (fix the X-source), get a key to the building (wrap the black box), lift the curfew (relax constraints) — and many cases close at once.
- Interrogating citizens one by one (per-fault effort) while the street is blacked out solves nothing.
Narrow the scene, name the failure type, find the one cause, fix it — and coverage recovers wholesale.
6. Working Example — localize, diagnose, fix
Debug a coverage shortfall by region and cause:
# Coverage-loss report BY REGION — REPRESENTATIVE, SIMPLIFIED, tool-neutral:
Block undetected faults note
core/alu 12 scattered -> a few control/observe test points (6.4)
core/ctrl_fsm 1 AU: an output only on an ILLEGAL state -> observe point (6.4)
legacy/nonscan_sub 900 <-- DOMINATES: X-source! non-scan flops leak X -> blocks a whole downstream cone
io/analog_if 40 BLACK BOX (analog) -> wrap / accept + insure (1.5)
# 90% of the loss is ONE block (legacy/nonscan_sub) -> LOCALIZE first. Don't chase the 12 in alu while 900 sit there.# Diagnose + fix the dominant cause — REPRESENTATIVE:
legacy/nonscan_sub: justify/propagate trace -> faults FAIL on PROPAGATION (observability) across the cone
-> ROOT CAUSE: uninitialized NON-SCAN flops produce X -> X blocks propagation downstream (3.4)
-> FIX at the SOURCE: make the sub-block SCAN (Ch4) [best], or initialize/tie known values, or mask correctly
-> RE-RUN: the 900 (and downstream) recover AT ONCE. Then tackle the next region (alu test points, 6.4).
# CONTROLLABILITY example would show justify failing instead -> a control point / relax a constraint.7. Industry Flow — debug feeds testability fixes and signoff
The debug loop's output drives the testability fixes (6.4) and the signoff residual (6.5):
8. Debugging Session — chip-wide low coverage, brute-forced
Coverage is low across the whole chip and the team raises ATPG effort everywhere with no gain; localizing shows one non-scan sub-block dominates the loss because it is an X-source whose unknowns block propagation across an entire downstream cone -- so the fix is at the X-source (scan/initialize/mask), recovering coverage wholesale, not per-fault effort
LOCALIZE FIRST — ONE X-SOURCE CAN BLOCK A WHOLE CONE'S OBSERVABILITYCoverage is low across the whole chip. The team is raising ATPG effort everywhere and chasing individual undetected faults, with almost no improvement. It looks like a pervasive testability problem.
The loss is not pervasive — it is dominated by one region downstream of a single X-source, whose unknown values block observability across an entire cone, so brute-force per-fault effort can't help and localization is the missing first step. When you group the undetected faults by hierarchy, the loss concentrates: a non-scan sub-block with uninitialized flops (or bus contention) produces unknown (X) values, and those X's propagate downstream and desensitize every path through the affected cone (3.4) — so thousands of downstream faults can't propagate to a scan cell and come back undetected, not because they're individually hard, but because a common resource (a clean observable path) is poisoned by X. Diagnosing the failing half (5.2) confirms it: the faults fail on propagation (observability), uniformly across the region — the signature of an X-source, not many independent controllability problems. Raising ATPG effort does nothing because the issue isn't search depth; it's that the circuit is injecting X that no pattern can see through. And chasing individual faults is hopeless when one root cause accounts for the vast majority of the loss.
Localize first, then fix the X-source at its root — coverage recovers across the whole downstream cone at once. Follow the loop: localize (find that the non-scan sub-block dominates), diagnose the half (observability, via the trace), identify the cause (X-source from uninitialized/non-scan logic), and fix at the source — the best fix is to make the sub-block full scan (Chapter 4) so its state is known and observable; alternatives are to initialize/tie it to known values or mask it correctly (without inflating coverage, 6.1). Re-run: the entire downstream region's faults become propagatable and coverage jumps wholesale. Only then move to the next-dominant region (e.g. scattered ALU faults → control/observe test points, 6.4; the FSM's illegal-state output → an observe point; the analog black box → wrap or accept + insure, 1.5). The principle to lock in: debugging coverage loss is a decomposition, not a knob — start from the fault-class summary, localize the undetected faults to the few blocks that dominate, diagnose whether each fails on controllability or observability, identify the root cause (X-source, black box, over-constraint, non-scan, clock-gating), and fix at the cause; a chip-wide low coverage is very often one X-source blinding a whole cone, so raising effort or chasing individual faults wastes time where a single root-cause fix recovers coverage wholesale. (The C/O reasoning is 5.2; the fault classes are 5.5; test points and scan-readiness fixes are 6.4/Chapter 4; X-handling is 3.4/Chapter 7.)
9. Common Mistakes
- Staring at the top-line %. Decompose it — localize, classify, diagnose the half, find the cause.
- Raising effort blindly. Effort helps aborts (5.5) — not X-sources, black boxes, or over-constraint.
- Chasing individual faults. A few root causes (one X-source, one block) usually dominate — fix those.
- Ignoring which half fails. Controllability and observability have different fixes (5.2/6.4).
- Masking an X-source to 'fix' coverage. Fix the source; don't inflate the number via masking (6.1/6.2).
10. Industry Best Practices
- Localize undetected faults by hierarchy first — find the dominant blocks.
- Diagnose the failing half (5.2) before choosing a fix (control vs observe).
- Fix root causes (X-sources, black boxes, over-constraint, non-scan) — not individual faults.
- Recover aborts with effort; accept redundant (5.5) — don't debug those.
- Re-run and iterate on the next-dominant region; keep the denominator honest (6.1).
11. Senior Engineer Thinking
- Beginner: "Coverage is low everywhere — crank ATPG effort across the chip."
- Senior: "Localize first. If one non-scan block dominates and its faults fail on propagation, that's an X-source blinding a cone — effort won't touch it. I fix the source (scan/initialize/mask), and coverage recovers wholesale. Then I diagnose the next region by which half fails and add test points (6.4). Root causes, not individual faults."
The senior decomposes the shortfall — localize, diagnose the half, fix the cause — never brute-forcing the percentage.
12. Silicon Impact
Coverage-loss debugging is where a daunting top-line shortfall becomes a short, prioritized list of fixable causes — and doing it systematically is the difference between closing coverage in days and grinding effort for weeks with nothing to show. The core insight is that coverage loss is concentrated, not uniform: a handful of root causes — an X-source blinding a whole cone, a black-box interface, an over-constrained test mode, a non-scan sub-block, clock gating that isn't test-controllable — usually account for the vast majority of undetected faults, so localizing first and fixing the cause recovers coverage wholesale, where per-fault effort recovers nothing. The methodology also routes each problem to the right fix by diagnosing the failing half (5.2): controllability failures want control points / relaxed constraints, observability failures want observe points / X-source fixes, and redundant faults are accepted (5.5). This matters for schedule and DPPM (1.4/1.5) because it prevents two classic wastes — raising ATPG effort where the problem isn't search depth (X-sources, black boxes), and chasing individual faults while a single dominant cause sits unaddressed. It also keeps the number honest: the temptation to mask an X-source to 'fix' coverage is exactly the inflation 6.1/6.2 warn against — the right move is to fix the source. For the RTL/DV engineer, the dominant loss region is usually your design or constraint issue (a non-scan block, an uninitialized X-source, a hard-constrained pin), and fixing it at the source — ideally in RTL (6.4) — is both the cheapest and the most durable way to reach the signoff target (6.5), turning the FSM's lone AU fault into a one-test-point fix instead of a mystery.
13. Engineering Checklist
- Started from the fault-class summary (recovered aborts, accepted RE, isolated AU/undetected).
- Localized undetected faults by block — identified the dominant loss regions.
- Diagnosed the failing half (controllability vs observability) per region (5.2).
- Identified the root cause (X-source / black box / over-constraint / non-scan / clock-gating).
- Fixed at the cause (test points 6.4 / scan-readiness 4.x / relax / wrap), re-ran, and iterated.
14. Try Yourself
- Given an undetected-fault report by region, identify the dominant loss block.
- For that block, use a justify/propagate trace to decide the failing half (controllability vs observability).
- Name a root cause consistent with the half (e.g. X-source → observability) and the fix at the source.
- Show how fixing one X-source recovers a whole downstream cone at once.
- Debug the FSM's one AU fault: illegal-state output → observability → observe point (6.4).
The methodology is tool-neutral. Real reports/traces come from the ATPG tool. No paid tool required to practice the loop.
15. Interview Perspective
- Weak: "If coverage is low, I run ATPG with more effort."
- Good: "I find the undetected faults, see what's causing them, and add test points or fix scan issues."
- Senior: "I run a debug loop, not a knob. Start from the fault classes — recover aborts (effort), accept redundant. Localize undetected faults by block — the loss is concentrated, so a few blocks dominate. Diagnose the failing half (5.2): controllability (can't justify) vs observability (can't propagate), via SCOAP and the trace. Identify the cause — often an X-source (non-scan/uninitialized) blinding a whole cone, a black box, or an over-constrained test mode. Fix at the cause — scan the sub-block, add test points (6.4), relax constraints, wrap black boxes — and re-run. A chip-wide low number is usually one root cause; localize before you chase, and effort only helps aborts."
16. Interview / Review Questions
17. Key Takeaways
- Coverage-loss debugging is a methodology, not a knob: start from the fault-class summary (5.5) — recover aborts, accept redundant — then investigate the real AU/undetected gap.
- Localize undetected faults by hierarchy — the loss is concentrated, and a few blocks (or one root cause) usually dominate; a chip-wide low number is often one X-source blinding a whole cone.
- Diagnose the failing half (5.2) — controllability (can't justify) vs observability (can't propagate) — using SCOAP and the justify/propagate trace, because the two have different fixes.
- Identify the root cause — X-source (non-scan/uninitialized/bus contention), black box (IP/analog/memory IF), over-constrained test mode, clock gating not test-controllable (4.4), redundant logic (accept, 2.5) — and fix at the cause.
- Fix root causes, not individual faults — a single fix (scan a sub-block, one test point) recovers coverage wholesale; effort helps only aborts, and masking an X-source to 'fix' coverage is inflation (6.1/6.2), not a fix. Next: 6.4 — improving testability from RTL.
18. Quick Revision
Debugging coverage loss — a methodology, not a knob. LOOP: (1) start from fault classes (5.5) — recover aborts (effort), accept RE; (2) LOCALIZE undetected faults by block (loss is concentrated — a few blocks dominate); (3) diagnose the failing HALF (5.2): controllability (can't justify) vs observability (can't propagate), via SCOAP + trace; (4) find the CAUSE: X-source (non-scan/uninit/bus contention — blocks a whole cone), black box, over-constrained test mode, clock-gating (4.4), redundant (accept); (5) FIX AT THE CAUSE (test points 6.4, scan-readiness 4.x, relax, wrap) → re-run → iterate. Chip-wide low = often ONE X-source blinding a cone → fix the source, recover wholesale. Effort only helps ABORTS; don't mask to inflate (6.1). Next: 6.4 — improving testability from RTL.