Working Example: Faults on a Single Flip-Flop

Chapter 2 · Section 2.6 · Fault Models — chapter capstone

Project thread — we return to the original single D flip-flop (Chapter 0) and enumerate its faults across all models. The punchline — an embedded flop is uncontrollable/unobservable — is precisely what scan (Chapter 3) fixes.

1. Why Should I Learn This?

This lesson turns Chapter 2's models into a concrete fault list on one flop — and reveals why scan must exist.

• Enumerate the flop's faults: stuck-at (D/Q/QN/clk/reset), transition (Q), bridging (Q–QN), IDDQ (internal short).
• The decisive fact: an embedded flop is uncontrollable (D driven upstream) and unobservable (Q feeds downstream).
• So most modeled faults are untestable without scan — you can model them but not detect them.
• Scan (Chapter 3) makes the flop a controllable/observable scan cell → the faults become detected.

2. Real Silicon Story — a perfect fault list, unreachable

A junior engineer proudly generated a complete fault list for a block full of flip-flops — every stuck-at, transition, and bridging fault enumerated. Then ATPG came back with dismal coverage, and they assumed the tool was broken.

It wasn't. The block had no scan. Every flop's D was buried behind upstream logic (hard to control to a specific value) and every Q fed downstream logic (hard to observe at an output). ATPG could excite almost nothing and propagate almost nothing — so nearly the entire, beautifully-enumerated fault list came back AU (uncontrollable/unobservable) (2.5). The models were perfect; the access was absent.

Inserting scan (Chapter 3) — making each flop a scan cell you can load (control) and unload (observe) — turned the same fault list from mostly-undetectable to high coverage. Lesson: a fault list is a wish list; controllability + observability (scan) is what grants it.

3. Factory Perspective — the flop's faults through each lens

• What the test engineer sees: the flop's fault list and, without scan, a wall of AU faults — with scan, a loadable/observable cell they can target with excite + propagate patterns.
• What the yield engineer sees: if the flop's faults are untestable, defects on it become escapes — a DPPM contributor that only scan can convert into a catchable, binnable defect.
• What the RTL/DV engineer sees: that their ordinary always_ff flop is untestable when embedded — motivating scan-friendly RTL (synchronous reset discipline, no gated-clock hacks) that Chapter 4 will require.
• What management cares about: that coverage on embedded state is impossible without scan — a schedule/architecture decision (insert scan early) with a direct line to the DPPM commitment (1.5).

4. Concept — the flop's fault sites, across all models

The design under test — one D flip-flop (fault sites: D, clk, Q, QN, rst_n):

Stuck-at faults (2.2) — two per node:

• D SA0/SA1 — the data input frozen; the flop captures a constant.
• Q SA0/SA1 — the output frozen; downstream sees a constant.
• QN SA0/SA1 — the complement frozen.
• clk stuck — no capture (a special, high-impact site).
• rst_n SA0 (reset looks always asserted → Q stuck at reset value) / rst_n SA1 (reset never asserts).

Transition faults (2.3):

• Q slow-to-rise / slow-to-fall — the flop switches, but too slowly for the rated period → needs an at-speed two-pattern test (launch on one clock, capture the next).

Bridging & IDDQ (2.4):

• Q–QN bridge — a natural target: Q and QN should be complementary, so they're always opposite → the bridge's opposite-value condition is inherent, making it detectable (and current-visible via IDDQ).
• IDDQ — an internal short in the flop draws elevated quiescent current.

Untestable classification (2.5) — the crux:

• Embedded, non-scan: D is set by upstream logic (poor controllability) and Q feeds downstream logic (poor observability) → most faults are AU (uncontrollable/unobservable) — untestable as-built.
• A truly redundant reset term would be RE (accept), but the dominant problem here is access, which is fixable — with scan.

The models are complete — but access is the problem:

5. Mental Model — a diary locked in a vault

Imagine the flip-flop as a diary (it stores a value) locked inside a vault (the surrounding logic).

• You have a perfect list of things to check in the diary (the fault list) — but the diary is sealed in the vault: you can't write a chosen page (control D) and you can't read it (observe Q).
• So your beautiful checklist is useless — not because it's wrong, but because you can't reach the diary.
• Scan installs a mail slot: you can slide a chosen page in (shift-in → controllability) and slide the page out to read (shift-out → observability).
• Suddenly the same checklist is fully actionable — every item can be written and read.

The list was never the problem; access was. Scan is the mail slot that grants access to every flop's diary.

6. Working Example — the DFF in tri-HDL, its faults, and the coverage gap

The project's original flip-flop, in three languages:

// SystemVerilog — the project's original D flip-flop (Chapter 0), the design under test
module dff (input logic clk, rst_n, d, output logic q, qn);
  always_ff @(posedge clk or negedge rst_n)
    if (!rst_n) q <= 1'b0;
    else        q <= d;
  assign qn = ~q;
endmodule

// Verilog-2001 — same flip-flop
module dff (clk, rst_n, d, q, qn);
  input clk, rst_n, d; output reg q; output qn;
  always @(posedge clk or negedge rst_n)
    if (!rst_n) q <= 1'b0;
    else        q <= d;
  assign qn = ~q;
endmodule

-- VHDL — same flip-flop
library ieee; use ieee.std_logic_1164.all;
entity dff is port (clk, rst_n, d : in std_logic; q, qn : out std_logic); end entity;
architecture rtl of dff is signal q_i : std_logic; begin
  process (clk, rst_n) begin
    if rst_n = '0' then q_i <= '0';
    elsif rising_edge(clk) then q_i <= d; end if;
  end process;
  q <= q_i; qn <= not q_i;
end architecture;

The complete fault list for the flop, across models:

# DFF fault list — REPRESENTATIVE, SIMPLIFIED, tool-neutral (all Chapter 2 models):
  STUCK-AT (2.2):   d SA0, d SA1, q SA0, q SA1, qn SA0, qn SA1, rst_n SA0, rst_n SA1, clk-stuck
  TRANSITION (2.3): q slow-to-rise, q slow-to-fall          (at-speed 2-pattern)
  BRIDGING (2.4):   q--qn bridge  (q,qn are complementary -> opposite-value condition is inherent -> detectable)
  IDDQ (2.4):       internal short -> elevated quiescent current
  UNTESTABLE (2.5): in a NON-SCAN embedded flop, most of the above are AU (D uncontrollable, Q unobservable)

The coverage gap — the same list, without vs with scan:

# Coverage on the flop — REPRESENTATIVE (illustrative):
                         NON-SCAN (embedded)     WITH SCAN (Ch3)
  Controllability of D   poor (upstream logic)   FULL (shift a value in)
  Observability of Q     poor (downstream logic) FULL (shift the value out)
  Modeled faults         all enumerated          all enumerated
  DETECTED faults        few  -> LOW coverage     most -> HIGH coverage
# The fault LIST is identical. Only ACCESS (controllability + observability) changed. That is what SCAN buys.

A fault only 'shows' when the good and faulty flop differ where you can see it:

7. Industry Flow — this gap is the hinge to scan

The flop's untestability is the bridge from fault modeling (Ch2) to scan (Ch3):

8. Debugging Session — a full fault list, almost no coverage

9. Common Mistakes

• Believing a fault list means coverage. A list is a wish — controllability + observability grant it.
• Blaming ATPG for embedded-flop coverage. The flops are uncontrollable/unobservable — the fix is scan, not effort.
• Testing embedded flops functionally only. Functional access to internal state is weak — structural scan is the answer.
• Forgetting Q–QN is a natural bridge target. Complementary nodes are always opposite → the bridge condition is inherent.
• Treating this as a special case. Most chip faults live on embedded flops — the gap is the general case.

10. Industry Best Practices

• Assume embedded flops are untestable without scan — plan scan from the start (Chapters 3–4).
• Use the flop's fault list to justify scan — the coverage delta (non-scan → scan) is the business case.
• Write scan-friendly RTL — synchronous discipline, clean reset, no gated-clock hacks (Chapter 4).
• Target complementary/related nodes (Q–QN) for bridging where the opposite-value condition is natural.
• Report coverage with scan assumed — non-scan numbers understate what the design can achieve.

11. Senior Engineer Thinking

• Beginner: "The fault list is complete but coverage is terrible — the tool must be bad."
• Senior: "The flops are embedded — D is upstream (can't control), Q is downstream (can't observe) — so the faults are AU, not tool failures. A model doesn't test anything; access does. I insert scan to make each flop a loadable/observable cell, and the same list becomes high coverage."

The senior reads 'complete list, low coverage' as an access problem and reaches for scan — the whole point of Chapter 3.

12. Silicon Impact

This capstone delivers the single most important transition in the DFT curriculum: from modeling faults to actually detecting them. Chapter 2 built a portfolio of models (2.1) — stuck-at, transition, bridging/IDDQ — and a way to classify the undetectable (2.5). Applied to the project's flip-flop, those models produce a complete fault list — and then collide with reality: an embedded flop is uncontrollable and unobservable, so almost none of that list is detectable in a non-scan design. Because the overwhelming majority of a chip's faults live on embedded state (flops), this isn't a corner case — it's the structural reason that a non-scan design has a coverage ceiling near the floor, and thus enormous escapes and DPPM (1.5). The resolution is architectural, not algorithmic: scan (Chapter 3) turns every flop into a controllable, observable scan cell, and the same, unchanged fault list goes from mostly-AU to mostly-detected. That is why the next four chapters — scan (3), scan insertion (4), ATPG (5), coverage closure (6) — exist: they are the machinery that converts a fault list into achieved coverage. For the RTL/DV engineer, the takeaway is concrete and forward-looking: your ordinary flop is untestable once embedded, so scan-friendly design is not optional — it's what lets the models you learned in this chapter actually protect the customer.

13. Engineering Checklist

• Enumerated the flop's fault list across all models (stuck-at, transition, bridging, IDDQ).
• Recognized the embedded flop is uncontrollable (D) and unobservable (Q) → faults are AU without scan.
• Quantified the coverage delta between non-scan and scan.
• Planned scan (Ch3) and scan-friendly RTL (Ch4) as the fix — not more ATPG effort.
• Framed this as the general case (most faults live on embedded flops), not a special one.

14. Try Yourself

1. Write the flop's stuck-at fault list (D/Q/QN/clk/rst_n) and the excite + propagate condition for Q SA0.
2. Add the transition faults (Q slow-to-rise/fall) and sketch the two-pattern at-speed test.
3. Add the Q–QN bridge and note why its opposite-value condition is inherent (Q and QN are complementary).
4. For an embedded flop, argue why D is hard to control and Q hard to observe → most faults are AU.
5. Show that scan (load a value into the flop, capture, shift it out) converts those AU faults to detected — the same list, new access.

The reasoning is tool-neutral — pen and paper suffice; a free simulator can show good-vs-faulty capture. Real scan/coverage come from Chapters 3–6. No paid tool required.

15. Interview Perspective

• Weak: "You list the flip-flop's faults and test for them."
• Good: "You can model the flop's faults, but an embedded flop is hard to control and observe, so you need scan."
• Senior: "Applying every model to the flop gives a complete fault list — stuck-at on D/Q/QN/clk/reset, transition on Q, a Q–QN bridge, IDDQ for an internal short. But detection needs controllability and observability, and an embedded flop has neither: D is driven by upstream logic and Q feeds downstream logic, so ATPG can't reliably excite or propagate — the faults come back AU (uncontrollable/unobservable), not because the models or tool are wrong, but because there's no access. Scan fixes exactly this — it makes each flop a scan cell you can load and read — so the same fault list becomes high coverage. That's why scan is the foundation of structural test, and it's the whole point of the next chapter."

16. Interview / Review Questions

17. Key Takeaways

• Applying every Chapter 2 model to the project's D flip-flop yields a complete fault list — stuck-at (D/Q/QN/clk/rst_n), transition (Q slow-to-rise/fall), a Q–QN bridge, and an IDDQ internal-short target.
• Detection needs controllability and observability, not just a model — a fault list is a wish, access grants it.
• An embedded flip-flop has poor controllability (D driven upstream) and poor observability (Q feeds downstream), so most of its modeled faults are untestable (AU) in a non-scan design — and this is the general case, since most chip faults live on embedded flops.
• Scan (Chapter 3) turns each flop into a controllable, observable scan cell (load + capture + unload) — the same, unchanged fault list goes from mostly-untestable to high coverage.
• This lesson is the hinge of the curriculum: fault models (Ch2) tell you what to detect; scan/insertion/ATPG/coverage (Chapters 3–6) are what let you actually detect it — so scan-friendly RTL is essential. Next: Chapter 3 — Scan Architecture (the scan flip-flop, chains, and how they grant controllability & observability).

18. Quick Revision

Faults on a single flip-flop (Ch2 capstone). Apply ALL models to the DFF → fault list: stuck-at (D/Q/QN/clk/rst_n), transition (Q STR/STF), Q–QN bridge (complementary → opposite-value inherent), IDDQ (internal short). Punchline: an EMBEDDED flop is uncontrollable (D driven upstream) + unobservable (Q feeds downstream) → most faults are AU (untestable) WITHOUT scan. A model doesn't test — ACCESS does. SCAN (Ch3) makes the flop a controllable/observable scan cell (load + capture + unload) → the SAME list becomes HIGH coverage. This is the hinge from modeling to achieving coverage → scan-friendly RTL matters. Next: Chapter 3 — Scan Architecture.