Untestable, Aborted & Redundant Faults

Chapter 5 · Section 5.5 · ATPG

Project thread — this is how ATPG classifies the FSM's faults in 5.6: most DT, a few RE/AU, and any AB recovered with effort.

1. Why Should I Learn This?

The abort-vs-redundant distinction is the crux of efficient coverage closure — the difference between recoverable faults and an inherent ceiling.

• Detected (DT): pattern found. Redundant (RE): search proved no pattern → remove from denominator.
• ATPG-untestable (AU): provably untestable (structure/constraint) → remove/handle.
• Aborted (AB): search gave up on an effort limit → might be testable → raise effort to recover.
• Redundant = proven impossible (accept); aborted = unfinished (recover with effort) — never confuse them.

2. Real Silicon Story — the aborts everyone gave up on

A team was 1.5% short of their coverage target and had classified the shortfall as 'untestable' — resigning themselves to it and planning extra insurance. But the residual was mostly labeled ABORTED, not redundant.

Someone noticed the distinction. Aborted doesn't mean untestable — it means the search hit the abort/backtrack limit and stopped without proving anything. Raising the abort limit and effort let ATPG finish those searches, and a large fraction of the aborts turned into DETECTED — closing most of the gap without any design change, just more runtime. The genuinely redundant/AU remainder was accepted (removed from the denominator) and the truly hard C/O-limited faults got test points (Chapter 6).

Lesson: aborted ≠ untestable. Treating aborts as a ceiling left real coverage on the table; recovering them with effort was nearly free. Conversely, chasing redundant faults with effort would have been pure waste — the two demand opposite responses.

3. Factory Perspective — the fault classes through each lens

• What the test engineer sees: the fault-class summary (DT/RE/AU/AB) and the effort knob — recover aborts to close coverage vs accept redundant/AU.
• What the yield engineer sees: that faults on redundant logic are invisible (can hide defects — a subtle reliability note, 2.5) and that the coverage ceiling is set by RE/AU, not aborts.
• What the RTL/DV engineer sees: that AU faults trace to their controllability/observability (test-point candidates, Ch6), and RE to synthesis redundancy.
• What management cares about: whether the shortfall is recoverable (aborts → effort/runtime) or an inherent ceiling (RE/AU → accept/insure) — a schedule and DPPM decision (1.5).

4. Concept — how the search produces each class

Detected (DT):

• The 5.2 search succeeded — a consistent justify + propagate assignment exists → a pattern detects the fault.

Redundant (RE):

• The search explored all decisions and backtracked to exhaustion with no solution → a proof that no pattern can exist.
• Cause: redundant logic (2.5) — the fault can't be excited-and-propagated under any input.
• Removed from the coverage denominator → the basis of test coverage (vs fault coverage).

ATPG-untestable (AU):

• Provably untestable given the structure or test constraints — uncontrollable/unobservable nodes, tie-offs, test-mode pin constraints.
• Also removed from the denominator or explicitly handled; some AU is fixable with test points (C/O — Chapter 6), unlike pure redundancy.

Aborted (AB) — the key class:

• The search hit the abort limit — a cap on backtracks or time — and stopped without proving detectable or redundant.
• The fault might be testable; the tool simply didn't finish. Raising the abort limit / effort can recover aborts into DT (or occasionally resolve them to RE).
• Aborted ≠ redundant: one is unfinished (recover with effort), the other is proven impossible (accept).

(Minor) Possibly-detected (PT): the fault effect reaches an output as X; detected only if the X resolves favorably — usually counted conservatively.

Coverage math (from the report):

• Fault coverage = DT / (all faults) — counts RE/AU against you.
• Test coverage = DT / (all − RE − AU) — the honest number (proven-untestable removed).
• Aborts count against coverage until recovered — so effort directly moves the number.

The one distinction to never blur — effort vs proof:

5. Mental Model — a locksmith: 'no key exists' vs 'ran out of time'

Picture a locksmith trying to open every lock (detect every fault).

• Detected = opened the lock (found a pattern).
• Redundant = after trying every possible approach, the locksmith proves the lock has no keyhole — no key can ever open it. Trying longer is pointless; you accept it's not openable (and don't count it as a failure — it was never openable).
• ATPG-untestable = the lock is welded to the wall by the building's rules (a test-mode constraint) — provably unopenable as configured; sometimes you can change the configuration (add a test point) to make it openable.
• Aborted = the locksmith's shift ended before finishing a hard lock — they didn't prove anything; give them more time (raise effort) and they'll likely open it.
• The fatal mistake: treating a shift-ended lock (aborted) as 'no keyhole' (redundant) — you'd abandon a lock you could open. And the reverse — grinding forever on a no-keyhole lock — is pure waste.

'No key exists' (redundant) is a proof; 'ran out of time' (aborted) is a pause. Spend effort on the pauses.

6. Working Example — a fault-class summary and effort recovery

Read the classes and recover aborts with effort:

# ATPG fault-class summary (default effort) — REPRESENTATIVE, SIMPLIFIED, tool-neutral:
  Total faults (collapsed) = 12,480
  DT  Detected             = 12,000
  RE  Redundant            =    140   (search PROVED no pattern -> remove from denominator)
  AU  ATPG-untestable      =     70   (structure/constraint -> remove/handle; some -> test points, Ch6)
  AB  Aborted              =    270   (hit abort limit -> UNPROVEN -> recoverable!)
  Fault coverage = DT/total            = 12,000/12,480      = 96.2%
  Test  coverage = DT/(total-RE-AU)    = 12,000/12,270      = 97.8%   (aborts STILL count against it)

# Recover ABORTS with effort — REPRESENTATIVE:
  Raise abort limit / effort -> ATPG FINISHES the 270 aborted searches:
    ~230 -> DETECTED (they WERE testable) ;  ~30 -> REDUNDANT (proven) ;  ~10 stay aborted (raise again or accept)
  New: DT = 12,230 ; RE = 170 ; AU = 70
  Test coverage = 12,230/(12,480-170-70) = 99.4%   <- closed the gap with EFFORT, no design change
# REDUNDANT/AU were never recoverable (accept). ABORTS were -- effort traded runtime for +coverage.

7. Industry Flow — classification drives the coverage-closure moves

The class of each fault dictates the closure action:

8. Debugging Session — coverage short, blamed on 'untestable'

9. Common Mistakes

• Treating aborts as untestable. Aborts are unproven — often recoverable with effort; don't write them off.
• Chasing redundant faults with effort. They're proven impossible — accept them (remove from denominator).
• Reporting only fault coverage. It counts RE/AU against you — also report test coverage.
• Confusing AU with redundant. AU is often fixable with test points (C/O); pure redundancy isn't.
• Insuring a recoverable gap. Recover aborts first — don't pay insurance for coverage you can generate.

10. Industry Best Practices

• Recover aborts with effort before declaring any ceiling.
• Accept redundant (remove from denominator); delete unneeded redundant logic where possible.
• Fix AU with test points (controllability/observability — Chapter 6).
• Report fault and test coverage — distinguish detected from proven-untestable.
• Insure only the true residual per the DPPM goal (1.5).

11. Senior Engineer Thinking

• Beginner: "We're short of target and the rest is untestable — add insurance."
• Senior: "How many are ABORTED vs REDUNDANT/AU? Aborts are unproven — I raise effort and most turn DETECTED. Redundant/AU were proven impossible — I accept them (and add test points for the fixable AU). I recover the free coverage first, then insure only the true ceiling. Aborted ≠ redundant — effort vs proof."

The senior recovers aborts with effort before accepting a ceiling, and never confuses unfinished with impossible.

12. Silicon Impact

This lesson is where coverage closure becomes a decision problem instead of a grind, and the payoff is both higher coverage and lower wasted runtime. The ATPG search (5.2) itself assigns each fault a class, and the classes carry completely different meanings for effort: detected is done; redundant and ATPG-untestable are proven impossible (accept them, remove them from the denominator — the basis of test coverage); and aborted is the subtle one — the search ran out of effort without proving anything, so the fault is in an unknown state that is often recoverable. The single most valuable habit here is to never conflate aborted with untestable: teams that do either write off recoverable coverage (leaving DPPM risk they then over-insure against) or, inversely, grind effort on genuinely redundant faults (pure waste). The correct sequence — recover aborts with effort, accept redundant, fix AU with test points (Chapter 6), and insure only the true residual (1.5) — is what turns a coverage shortfall into a prioritized, mostly-free closure plan. There's also a reliability subtlety (2.5): a defect on redundant logic is invisible to test, so it can hide, which matters for safety parts. For the RTL/DV engineer, the AU bucket is the actionable one — it's your controllability/observability debt, and it's fixable (test points/RTL changes) unlike pure redundancy — so the fault-class summary is a direct testability to-do list, exactly the kind that makes the FSM in 5.6 close cleanly.

13. Engineering Checklist

• Read the fault-class summary (DT/RE/AU/AB) — not just the coverage number.
• Recovered aborts by raising effort before accepting any ceiling.
• Accepted redundant (removed from denominator); considered deleting redundant logic.
• Fixed AU controllability/observability with test points (Ch6).
• Reported fault + test coverage; insured only the true residual (1.5).

14. Try Yourself

1. From a class summary (DT/RE/AU/AB), compute fault coverage and test coverage.
2. Raise effort: convert most aborts to DT (some to RE); recompute coverage.
3. Explain why redundant faults were never recoverable (search proved no pattern).
4. Identify an AU fault and propose a test point (C/O) to make it DT (Ch6).
5. Decide, for a residual, whether to recover (effort), accept (RE/AU), or insure (1.5) — and why.

The classification is tool-neutral — the arithmetic is illustrative. Real classes come from the ATPG tool. No paid tool required.

15. Interview Perspective

• Weak: "Some faults are detected, some aren't."
• Good: "ATPG classifies faults as detected, redundant, untestable, or aborted; redundant ones come out of the denominator."
• Senior: "The ATPG search produces each class. Detected = pattern found. Redundant = the search exhausted all decisions and proved no pattern exists → removed from the denominator (fault vs test coverage). ATPG-untestable = provably untestable by structure/constraint (some fixable with test points). Aborted = the search hit its effort/backtrack limit without proving anything → the fault might be testable → raise effort to recover. The distinction that matters: redundant/AU were proven impossible (accept), aborted merely ran out of effort (recover). So I recover aborts with effort first, accept the redundant, add test points for the fixable AU, and insure only the true residual — never chasing redundant faults or writing off recoverable aborts."

16. Interview / Review Questions

17. Key Takeaways

• The ATPG search (5.2) produces each fault's class: Detected (pattern found), Redundant (search proved no pattern → removed from the denominator), ATPG-untestable (provably untestable by structure/constraint → removed/handled), and Aborted (search hit its effort limit without proving anything).
• The decisive distinction: redundant/AU were proven impossible → accept them; aborted merely ran out of effort → recover them by raising the abort limit (trading runtime). Aborted ≠ untestable.
• Coverage math: fault coverage = DT / all; test coverage = DT / (all − RE − AU) (the honest number) — and aborts count against coverage until recovered.
• Closure is a three-move game: recover aborts with effort, accept redundant (remove from denominator; optionally delete the logic), and fix AU with test points (Chapter 6) — then insure only the true residual (1.5).
• The classic mistakes are chasing redundant faults (futile) and writing off recoverable aborts (lost coverage) — so classify, don't guess, and note a defect on redundant logic is invisible (a reliability concern, 2.5). Next: 5.6 — a working example: ATPG on the FSM.

18. Quick Revision

Untestable, aborted & redundant (ATPG side). The 5.2 search classifies every fault: DT (pattern found), RE redundant (search PROVED no pattern → remove from denominator), AU ATPG-untestable (provably untestable by structure/constraint → remove/handle; some fixable with test points), AB aborted (hit the effort/backtrack limit WITHOUT proof → MIGHT be testable). Decisive split: RE/AU = proven impossible (ACCEPT); AB = ran out of effort (RECOVER with effort) — aborted ≠ untestable! Coverage: fault cov = DT/all; test cov = DT/(all−RE−AU); aborts count against until recovered. Closure: recover aborts (effort) → accept RE → fix AU (test points, Ch6) → insure residual (1.5). Don't chase redundant or abandon aborts. Next: 5.6 — ATPG on the FSM.