DFT · Chapter 6 · Coverage & Signoff

Test Coverage vs Fault Coverage

Coverage is not one number but two metrics with different denominators, and confusing them is a classic quality mistake. Fault coverage is detected faults divided by all faults, so it counts the mathematically undetectable redundant and untestable faults against you and is pessimistic. Test coverage is detected faults divided by all faults minus the proven-untestable ones, and it is the honest number you actually sign off against. The iron rule is that you may only remove faults you have proven redundant or untestable from the denominator, never aborted faults and never through aggressive masking, because doing so inflates the number and ships escapes. Both metrics are measured against the fault model, so neither is a guarantee that the part is defect-free.

Foundation12 min readDFTTest CoverageFault CoverageDenominatorSignoff

Chapter 6 · Section 6.1 · Coverage & Signoff

Project thread — the FSM's ATPG report (5.6) gives DT/RE/AU/AB; this lesson turns those counts into the two coverage metrics you'll sign off (6.5).

1. Why Should I Learn This?

Signoff is against a coverage number — and which number (fault vs test) and which denominator decides whether that number is honest.

Fault coverage = DT / all faults — pessimistic (counts undetectable faults against you).
Test coverage = DT / (all − RE − AU) — the honest signoff number (removes proven-untestable).
Only proven redundant/AU may leave the denominator — not aborts, not by masking.
Both are vs the model (2.1) — not a defect-free guarantee.

The five questions — test vs fault coverage

1 — Why do two metrics exist? Because some faults are provably undetectable (5.5), and it's unfair to grade detection against faults no pattern can catch — hence a second, honest denominator.
2 — What manufacturing problem does it solve? It gives a fair, signoff-grade coverage number tied to the achievable — the basis of the DPPM commitment (1.5).
3 — What happens if it's confused/gamed? Reporting fault coverage as if it were test coverage (or inflating by removing unproven faults) misleads signoff → escapes.
4 — Which team owns it? DFT/test engineering compute and report; signoff/management consume; the denominator discipline is a shared integrity rule.
5 — How does it connect up/down-stream? Fault classes (5.5) → the two metrics (this lesson) → blind spots (6.2) → closure/signoff (6.5) → DPPM (1.5).

2. Real Silicon Story — two 'coverage' numbers for one design

Two teams reviewed the same block and reported different coverage — one said 96.2%, the other 99.4%. A tense meeting ensued: was the design worse than thought, or was someone fudging?

Neither. One team quoted fault coverage (DT / all faults = 96.2%), which counts the redundant/untestable faults against the design. The other quoted test coverage (DT / (all − RE − AU) = 99.4%), which removes the proven-undetectable faults from the denominator. Both were correct — they were different metrics with different denominators, not a discrepancy.

The real risk surfaced next: a third proposal wanted to push test coverage higher by also removing the aborted faults from the denominator — but aborts are unproven (5.5), so that would have been inflating the number dishonestly. Lesson: always state which metric and confirm the denominator only excludes proven untestable faults — reconcile by definition, and never inflate coverage by removing faults you haven't earned the right to remove.

3. Factory Perspective — the two metrics through each lens

What the test engineer sees: fault vs test coverage side by side, and the fault-class summary (5.5) that sets both denominators — the number to close and sign off.
What the yield engineer sees: that test coverage is the statistical lever on escapes (1.5) — but only if the removed faults were genuinely undetectable.
What the RTL/DV engineer sees: that AU in the denominator is their controllability/observability debt (6.4) — removing it is honest only after it's proven (or better, fixed).
What management cares about: that signoff uses test coverage against a DPPM-driven target (6.5, 1.5), and that denominator integrity is a quality-control issue — an inflated number is a hidden liability.

4. Concept — the two metrics and the denominator rule

Fault coverage (pessimistic):

Fault coverage = DT / (all faults).
Counts redundant (RE) and ATPG-untestable (AU) faults against you — even though no pattern can detect them.
Useful as a conservative view; not what you sign off (it penalizes the impossible).

Test coverage (the honest signoff number):

Test coverage = DT / (all − RE − AU) — removes the proven-undetectable faults from the denominator.
Rationale: you cannot detect the mathematically-undetectable, so grading against them is meaningless.
This is the number closed to a target and signed off (6.5).

The denominator rule (integrity):

You may remove a fault from the denominator only if it is proven redundant or ATPG-untestable (the ATPG search exhausted or proved it, 5.5).
Never remove aborts — they're unproven (might be testable → recover with effort, 5.5).
Never remove faults by aggressive masking (Chapter 7) and count them as 'not there' — masking hides observation, it doesn't make a fault undetectable-in-principle.
Violating this inflates test coverage into a dishonest number → escapes.

Tool naming (don't get lost):

Some tools call DT / testable 'ATPG coverage' or use other labels. The label doesn't matter — always ask what's in the denominator.

Both are vs the model (2.1):

Neither metric is a defect-free claim — 100% test coverage of a model ≠ 0 DPPM (1.5); unmodeled defects escape.

Figure 1 — the two coverage denominators (representative). Start from ALL faults, classified (5.5) into DETECTED (DT), REDUNDANT (RE, proven no pattern), ATPG-UNTESTABLE (AU, provably untestable), and ABORTED (AB, unproven). FAULT COVERAGE = DT / ALL (counts RE+AU+AB against you -> pessimistic). TEST COVERAGE = DT / (ALL - RE - AU) -> removes ONLY the PROVEN-untestable -> the honest signoff number. CRITICAL: aborts (AB) STAY in the denominator (unproven), and you must NOT remove faults by masking -- doing so inflates the number dishonestly.

5. Mental Model — grading a test, fairly but honestly

Think of coverage like grading a student on an exam where some questions are impossible to answer (they have no correct answer — the redundant/AU faults).

Fault coverage = score out of all questions, including the impossible ones. That's unfair — you're marked wrong on questions nobody could answer.
Test coverage = score out of the answerable questions — you remove the impossible ones from the total. That's the fair, honest grade.
But there's an integrity line: you may only strike a question as 'impossible' if you've verified it truly has no answer (proven RE/AU). Striking questions you just didn't finish (aborts) — or crossing out ones you chose not to read (masking) — is cheating the grade upward.
And even a perfect score on the answerable questions doesn't mean the student knows everything — the exam only covered this syllabus (the model, 2.1).

Grade out of the answerable questions (test coverage), but only strike questions you've proven unanswerable — anything else is inflation.

6. Working Example — the FSM's two coverage numbers

From the FSM's ATPG report (5.6), compute both metrics:

Azvya Education Pvt. Ltd.VLSI Mentor

Snippet

# FSM coverage — REPRESENTATIVE, from the 5.6 fault-class summary:
  Total faults   = 96
  DT  Detected   = 92
  RE  Redundant  =  2   (PROVEN no pattern)
  AU  Untestable =  1   (provably untestable)
  AB  Aborted    =  1   (UNPROVEN -> stays in denominator; recover with effort, 5.5)
#
  FAULT coverage = DT / total            = 92 / 96          = 95.8%   (counts RE+AU+AB against you)
  TEST  coverage = DT / (total - RE - AU) = 92 / (96-3)      = 98.9%   <- honest signoff number
#
  NOTE: the aborted fault is NOT removed -> if we recover it with effort (5.5) DT->93 -> test cov = 93/93 = 100%
        (of the stuck-at MODEL -- still NOT 0 DPPM, 2.1/1.5).
# WRONG (inflation): "test cov = 92/(96-3-1) = 100%" by ALSO removing the abort -> DISHONEST (abort is unproven).

7. Industry Flow — from fault classes to the signoff metric

The two metrics flow from the 5.5 classification into signoff:

Figure 2 — from fault classification to the signoff metric (representative). ATPG classification (5.5) yields DT/RE/AU/AB. FAULT COVERAGE (DT/all) is the pessimistic view. TEST COVERAGE (DT/(all-RE-AU)) removes ONLY the proven-untestable -> the honest number closed to a DPPM-driven TARGET (6.5, 1.5) and SIGNED OFF. Aborts must be RECOVERED (effort, 5.5) or left in the denominator -- never removed unproven. The integrity of the denominator is what makes the signed-off number trustworthy.

8. Debugging Session — 'our coverage is higher than yours'

Two teams report different coverage for the same design and someone suspects fudging; in fact one used fault coverage (DT/all) and the other test coverage (DT/(all-proven-untestable)) -- different denominators, both valid -- and the real risk is a proposal to inflate test coverage further by removing UNPROVEN aborted faults or masked faults, which must be refused

RECONCILE BY DENOMINATOR — REMOVE ONLY PROVEN-UNTESTABLE, NEVER ABORTS/MASKED

Symptom

Two teams report different coverage for the same design (e.g. 96% vs 99%). Someone suspects fudging or a broken flow. A proposal appears to 'reconcile upward' by removing more faults from the denominator.

Root Cause

The two numbers are different metrics with different denominators — fault coverage vs test coverage — both legitimate; the actual danger is a proposal to inflate test coverage by removing faults that were never proven untestable. Fault coverage = DT / all faults counts the redundant and ATPG-untestable faults against the design; test coverage = DT / (all − RE − AU) removes those proven-undetectable faults, so it is higher by construction. Neither team is wrong — they just quoted different denominators, and the only correct reconciliation is to agree which metric you're discussing and confirm the classification underneath it. The real problem is the 'reconcile upward' proposal: if it removes aborted faults (which are unproven — they might be testable, 5.5) or treats masked observation points (Chapter 7) as 'faults that aren't there,' it shrinks the denominator without justification and inflates test coverage into a dishonest number. That number would overstate the design's real detection ability, mislead signoff, and ship escapes — the precise failure mode coverage exists to prevent.

Fix

Standardize on test coverage for signoff, state the denominator explicitly, and enforce that only proven-untestable faults are removed — recover aborts, don't delete them. Agree the signoff metric is test coverage (DT / (all − RE − AU)), and always report both numbers with the fault-class counts so the denominator is transparent. Enforce the integrity rule: a fault leaves the denominator only when ATPG has proven it redundant or ATPG-untestable (5.5); aborted faults stay in and are recovered with effort (5.5) or fixed with test points (6.4), never quietly removed; and masked points are not counted as absent faults. The principle to lock in: fault coverage (DT / all faults) is pessimistic because it counts the mathematically-undetectable against you, while test coverage (DT / (all − proven-untestable)) is the honest signoff number — but you earn the right to remove a fault from the denominator only by proving it redundant or ATPG-untestable; removing aborts (unproven) or masked faults inflates test coverage dishonestly, so always report both metrics with their fault-class counts and reconcile disagreements by denominator, never by shrinking it without proof. (Fault classes are 5.5; blind spots and masking caveats are 6.2; closure/signoff is 6.5.)

9. Common Mistakes

Quoting one metric as 'the' coverage. Always say fault vs test coverage and state the denominator.
Removing aborts from the denominator. They're unproven (5.5) — recover them, don't delete them.
Inflating via masking. Masked points aren't 'faults that don't exist' — don't shrink the denominator with them (6.2/Ch7).
Reading test coverage as defect-free. It's vs the model (2.1) — 100% ≠ 0 DPPM (1.5).
Comparing numbers across tools without checking denominators. Names differ — the denominator is what matters.

10. Industry Best Practices

Sign off on test coverage — the honest metric (proven-untestable removed).
Report both fault and test coverage with fault-class counts — transparent denominators.
Enforce the denominator rule — only proven RE/AU removed; recover aborts.
State the model — coverage is per-model (portfolio, 2.1); not a defect-free claim.
Audit for inflation — masking or unproven removals are a quality risk.

11. Senior Engineer Thinking

Beginner: "Their coverage is 99%, ours is 96% — someone's number is wrong."
Senior: "Different metrics — fault (DT/all) vs test (DT/(all−RE−AU)) — both valid; I reconcile by denominator. Signoff uses test coverage. And I won't inflate it by removing aborts (unproven — I recover them) or masked faults. I report both with the fault classes so the denominator is auditable."

The senior reconciles by denominator and guards its integrity — no removing faults you haven't proven untestable.

12. Silicon Impact

The distinction between fault and test coverage looks like bookkeeping but is actually a quality-integrity issue, because signoff — and therefore the DPPM commitment (1.5) — rides on a coverage number, and which denominator that number uses determines whether it's honest. Fault coverage is pessimistic (it counts the mathematically-undetectable against the design), so grading against it would demand chasing the impossible; test coverage removes the proven-undetectable and is the fair, achievable number you close to a target. But the honesty of test coverage is entirely dependent on the integrity of the denominator: the moment faults are removed that weren't proven untestable — aborts (which are merely unfinished, 5.5) or masked observation points (Chapter 7) — the number inflates, overstates real detection ability, and quietly ships escapes that the DPPM plan assumed weren't there. This is why mature teams report both metrics with the fault-class counts, standardize on test coverage for signoff, and treat denominator changes as auditable events. It's also why tool-name confusion ('ATPG coverage' vs 'test coverage') must be cut through to the underlying question — what's in the denominator? For the RTL/DV engineer, the gap between fault and test coverage is a map of your design's RE/AU — the redundant logic and controllability/observability debt (6.4) — and the right way to raise test coverage is to fix or recover those faults, not to remove them from the denominator without proof. Get this precise, and the rest of Chapter 6 — blind spots, debugging loss, testability, and signoff — is built on a number you can trust.

13. Engineering Checklist

Reported both fault coverage and test coverage with fault-class counts.
Used test coverage for signoff (proven-untestable removed).
Removed from the denominator only proven RE/AU — recovered aborts (5.5), didn't delete them.
Did not inflate via masking or unproven removals.
Stated the model — coverage is per-model (2.1), not a defect-free claim (1.5).

14. Try Yourself

From a class summary (DT/RE/AU/AB), compute fault coverage and test coverage; note the difference.
Show why removing aborts from the denominator is inflation (aborts are unproven, 5.5).
Reconcile two 'different' coverage numbers for one design by identifying the metric/denominator each used.
Explain why test coverage is the signoff metric but still isn't a defect-free guarantee (2.1/1.5).
Identify, for a real report, exactly which faults are in each denominator.

The definitions are tool-neutral — the arithmetic is illustrative. Real classes/coverage come from the ATPG tool. No paid tool required.

15. Interview Perspective

Weak: "Coverage is the percentage of faults you detect."
Good: "Fault coverage divides detected by all faults; test coverage divides by all minus untestable ones."
Senior: "There are two metrics. Fault coverage = DT / all faults — pessimistic, because it counts the redundant and ATPG-untestable faults against you even though no pattern can catch them. Test coverage = DT / (all − proven-untestable) — the honest number you sign off, because you can't detect the undetectable. The integrity rule is that you remove from the denominator only faults proven RE/AU (5.5) — never aborts (unproven — recover them) and never by masking — or you inflate the number and ship escapes. Tool names differ, so I always ask what's in the denominator. And both are vs the model — 100% test coverage isn't 0 DPPM."

16. Interview / Review Questions

17. Key Takeaways

Coverage is two metrics with different denominators: fault coverage = DT / all faults (pessimistic — counts the undetectable against you) and test coverage = DT / (all − proven-untestable) (honest — the signoff number).
Test coverage removes only the proven-undetectable faults (redundant + ATPG-untestable, 5.5) — because you cannot detect the mathematically-undetectable.
The denominator rule (integrity): remove a fault only if proven RE/AU — never aborts (unproven → recover with effort) and never by masking (Chapter 7); violating it inflates coverage and ships escapes.
Tool naming varies ('ATPG coverage', etc.) — the label doesn't matter; always ask what's in the denominator, and report both metrics with the fault-class counts.
Both metrics are vs the model (2.1), so 100% test coverage ≠ 0 DPPM (1.5) — and the gap between fault and test coverage is your RE/AU, a map of redundant logic and C/O debt to fix (6.4). Next: 6.2 — coverage metrics & what they miss.

18. Quick Revision

Test vs fault coverage (Ch6 opener). FAULT coverage = DT / ALL faults → pessimistic (counts RE+AU+AB against you). TEST coverage = DT / (ALL − proven-untestable) = DT/(all−RE−AU) → the HONEST signoff number (can't detect the undetectable). Integrity rule: remove from the denominator ONLY faults PROVEN redundant/ATPG-untestable (5.5) — NEVER aborts (unproven → recover) or by masking (Ch7) → else you INFLATE dishonestly → escapes. Tool names differ ('ATPG coverage') → always ask WHAT'S IN THE DENOMINATOR; report BOTH with fault-class counts. Both vs the MODEL → 100% test cov ≠ 0 DPPM (2.1/1.5). Gap fault→test = your RE/AU (fix in 6.4). Next: 6.2 — coverage metrics & what they miss.