Skip to content
VLSIMentor

DFT · Chapter 2 · Fault Models

Why Some Faults Are Untestable

Not every fault can be detected, and some are provably undetectable, a mathematical property of the logic rather than a weakness of the ATPG tool. A redundant fault sits on logic that no input assignment can make observable, so it can never be excited and propagated; ATPG proves it redundant and removes it from the coverage denominator, which is the precise origin of fault coverage versus test coverage. A second class is untestable from poor controllability or observability, a node you cannot set or observe, and this kind is usually fixable by adding scan or observe points. Never confuse either with an aborted fault, which the tool merely gave up on under effort limits and might still be testable. Classifying faults lets you separate an inherent coverage ceiling from a testability problem you can still fix.

Intermediate14 min readDFTUntestable FaultsRedundancyTest CoverageATPG

Chapter 2 · Section 2.5 · Fault Models

Project thread — 2.2–2.4 detected faults on the counter; here we meet the faults on it that can't be detected, learn to classify them, and see which ones scan can fix (setting up Chapter 3).

1. Why Should I Learn This?

Untestable faults cap coverage — and you can't close coverage honestly without classifying them.

  • Redundant faults are provably undetectable — removed from the denominator (fault vs test coverage).
  • Uncontrollable/unobservable faults are untestable but often fixable with scan (Ch4/6).
  • Aborted ≠ untestable — the tool hit an effort limit; the fault might be testable.
  • Chasing a naive 100% without classifying wastes effort and hides real testability debt.

2. Real Silicon Story — the last 2% that wasn't a tool problem

A team was stuck at ~98% fault coverage and burned weeks throwing ATPG effort at the remaining 2%, assuming a stronger setup would crack it.

Classifying the residual faults told a different story. Half were on redundant logic the synthesizer had added for glitch-suppression — provably undetectable, no pattern could ever excite+propagate them. Chasing them was futile; the fix was to remove them from the denominator (reporting test coverage) and, where the redundancy wasn't needed, let synthesis remove the redundant logic. The other half were unobservable nodes behind poorly-observed logic — not redundant, and fixable: adding scan/observe points made them detected.

The '2% wall' dissolved once the faults were classified: some were an inherent ceiling (redundancy), the rest were testability debt (fixable). Lesson: don't grind ATPG effort on an unclassified residual — classify first, then accept, redesign, or add scan.

3. Factory Perspective — how each role reads untestable faults

  • What the test engineer sees: the ATPG fault-class summary (detected / redundant / ATPG-untestable / aborted) and the gap between fault coverage and test coverage — deciding what to chase vs accept.
  • What the yield engineer sees: that faults on redundant logic are invisible — a latent defect there won't fail test, a subtle reliability consideration for safety parts.
  • What the RTL/DV engineer sees: that uncontrollable/unobservable untestables trace to their logic (tie-offs, unused outputs, poor observability) — actionable in RTL/scan.
  • What management cares about: whether the coverage shortfall is an inherent ceiling (redundancy — accept, or pay to redesign) or fixable debt (scan) — the answer changes the schedule and DPPM story.

4. Concept — the classes of untestable, and honest coverage

Redundant / provably undetectable:

  • A fault where no input assignment makes good ≠ faulty at any observable output — excite + propagate is impossible.
  • Comes from redundant logic: synthesis-added redundancy (timing, glitch), don't-cares, reconvergent fanout.
  • ATPG can prove it redundant → it is removed from the coverage denominator. This is why fault coverage ≠ test coverage.

Untestable from poor controllability/observability:

  • Uncontrollable: you can't set the node (tie-offs, unused logic, constant-driven).
  • Unobservable: you can't observe its effect (no sensitized path to any output/scan cell).
  • Key difference from redundancy: this is usually fixable — add scan/observe points (Ch4/6) and the fault becomes detectable. It's testability debt, not an inherent ceiling.

ATPG-untestable by constraint:

  • Test-mode pin constraints / tie-offs (e.g. a pin held for test) can make a fault untestable in that setup — sometimes relaxable by a different test mode.

Aborted (do NOT confuse with untestable):

  • The tool gave up under effort/time limits — it did not prove the fault undetectable. It might be testable with more effort or a better setup. Reducing aborts is a real lever; treating them as untestable understates achievable coverage.

Coverage math (the honest version):

  • Fault coverage = detected / all faults (counts redundant/untestable against you).
  • Test coverage = detected / (all − proven-untestable) — the higher, more honest number, since you can't detect the mathematically-undetectable.
  • Report both, and know which untestables are redundant (accept) vs fixable (scan).
A redundant AND term in y = a OR (a AND b) cannot change the output for any input, so a fault inside it is provably undetectable and removed from the denominatorRedundant term: a ANDbfault here can't beexcited+propagatedy = a OR (a AND b)'a' alone already sets y —AND term never changes yATPG proves REDUNDANTgood y = faulty y for allinputsRemove fromdenominator→ test coverage (honest)12
Figure 1 — a redundant fault that cannot be excited (representative). y = a OR (a AND b). The term (a AND b) is REDUNDANT: whenever it could pull y high, 'a' alone ALREADY makes y=1, so the AND term never CHANGES y. A stuck-at fault inside that redundant term cannot be EXCITED-and-PROPAGATED to y under ANY input -- good and faulty y are identical for all inputs -> PROVABLY UNDETECTABLE. ATPG proves it redundant and REMOVES it from the coverage denominator (fault vs test coverage). Redundancy like this is often ADDED by synthesis (glitch/timing) or arises from reconvergent fanout.

5. Mental Model — spare wiring in a machine

Think of a fault as a wire you want to prove works by wiggling it and watching a dial.

  • A redundant fault is a spare wire that changes no dial, under any setting — the machine was designed with a backup that masks it. You can wiggle forever; nothing moves. It's not testable — and pretending it is just wastes time. You either accept it (it's harmless spare) or remove the spare if you don't need it.
  • An unobservable fault is a real, working wire whose dial was never installed — add a dial (an observe/scan point) and now you can test it. That's fixable debt.
  • An aborted fault is a wire you ran out of time checking — maybe it moves a dial; you just stopped early. Give it more time (effort) before declaring anything.

The skill is telling these apart: no dial exists by design (redundant — accept/redesign) vs no dial installed (unobservable — add scan) vs didn't finish checking (aborted — more effort).

6. Working Example — classify faults on the counter/FSM logic

Classify residual faults instead of grinding effort:

Azvya Education Pvt. Ltd.VLSI Mentor
Snippet
# ATPG fault-class summary — REPRESENTATIVE, SIMPLIFIED, tool-neutral:
  Total faults (collapsed)      = 10,000
  DT  Detected                  =  9,750
  RE  Redundant (undetectable)  =    120   <- provably no excite+propagate (synthesis glitch logic, reconvergence)
  AU  ATPG-untestable           =     80   <- uncontrollable/unobservable OR test-mode constrained
  AB  Aborted (effort limit)    =     50   <- NOT proven undetectable -> raise effort / better setup
#
  Fault coverage = DT / total              = 9,750 / 10,000        = 97.5%
  Test  coverage = DT / (total - RE - AU)  = 9,750 / (10,000-200)  = 99.49%   <- honest (removes provably-untestable)
# Action: RE -> accept (or remove redundant logic if unneeded); AU -> add scan/observe (Ch4/6); AB -> more ATPG effort.
Azvya Education Pvt. Ltd.VLSI Mentor
Snippet
# Two residual faults on the counter, classified — REPRESENTATIVE:
# (1) fault inside a synthesis-added glitch-suppression term  -> REDUNDANT -> remove from denominator (or delete logic)
# (2) SA0 on an unused/unobserved status bit                  -> UNOBSERVABLE -> add a scan/observe point -> becomes DT
# Same 'undetected' label, OPPOSITE remedies: accept vs fix. Classification tells you which.

7. Industry Flow — classification drives the fix

ATPG classifies every fault; the class dictates the remedy:

ATPG classifies each undetected fault as redundant, uncontrollable/unobservable, or aborted, each leading to a different remedyFault classification → the right remedyFault classification → the right remedy1ATPG attempts each faultexcite + propagate?2Redundant?provably undetectable → remove from denominator / delete logic3Uncontrollable/unobservable?fixable → add scan/observe (Ch4/6)4Aborted?effort limit → raise effort / better setup5Honest coveragetest coverage + a fix list (Ch6)
Figure 2 — the ATPG fault-classification loop and its remedies (representative). ATPG attempts each fault: DETECTED -> counts toward coverage. Not detected -> WHY? REDUNDANT (proven no excite+propagate) -> remove from denominator (test coverage) or delete redundant logic. UNCONTROLLABLE/UNOBSERVABLE -> add scan/observe points (Ch4/6) -> becomes detectable. ABORTED (effort limit) -> raise effort / better setup -> re-attempt. Classifying is what turns an undifferentiated 'undetected %' into three DIFFERENT actions: accept, fix testability, or spend more effort.

8. Debugging Session — the coverage wall that won't move

1

Coverage stalls near a target and the team pours ATPG effort at the residual undetected faults with no gain; classifying them shows a mix of provably-redundant faults (chasing them is futile -- remove from the denominator or delete the logic) and unobservable faults (fixable with scan) and a few aborts (need more effort) -- three different remedies hiding under one 'undetected' number

CLASSIFY BEFORE YOU CHASE — REDUNDANT vs FIXABLE vs ABORTED
Symptom

Fault coverage is stuck just short of the target. The team keeps raising ATPG effort on the undetected residual, with little or no improvement, and concludes the tool or the design is 'just hard.'

Root Cause

The undetected residual is a mix of fundamentally different classes, and grinding ATPG effort only helps one of them — so effort spent without classifying is mostly wasted. Break the residual apart: (1) Redundant faults — on logic where no input assignment can make good ≠ faulty at any output (synthesis-added glitch/timing redundancy, reconvergent fanout). These are provably undetectable; no amount of ATPG effort can ever detect them, because excite + propagate is mathematically impossible. Chasing them is the wasted weeks in the story. (2) Uncontrollable/unobservable faults — real logic you can't set or can't observe; ATPG effort won't help because the circuit as-built offers no sensitized path, but adding scan/observe points fixes them. (3) Aborted faults — the tool stopped under an effort limit and did not prove anything; these are the only class where more effort legitimately helps. Lumping all three under one 'undetected %' hides the fact that they need three different remedies — and it also misreports coverage, since the redundant ones shouldn't even be in the denominator.

Fix

Classify the residual first, then apply the class-specific remedy — and report test coverage, not just fault coverage. Run the ATPG fault classification and split the undetected into RE (redundant), AU (uncontrollable/unobservable), and AB (aborted). For RE: stop chasing — remove them from the coverage denominator (report test coverage), and where the redundancy is unneeded, let synthesis remove the redundant logic (which also eliminates a place a defect could hide). For AU: add scan/observe points (Chapters 4/6) so a sensitized path exists — these convert to detected. For AB: raise ATPG effort or improve the setup and re-attempt — the only class where effort pays. The principle to internalize: some faults are provably undetectable (redundant) — a mathematical property of the logic, not a tool weakness — and are removed from the denominator (fault coverage vs test coverage); others are untestable only because of poor controllability/observability and are fixable with scan; and an aborted fault (effort limit) is neither — so you must classify undetected faults into redundant / uncontrollable-unobservable / aborted and accept, fix, or spend effort accordingly, rather than grinding ATPG at an undifferentiated residual. (Controllability/observability fixes are Chapters 4/6; coverage closure is Chapter 6.)

9. Common Mistakes

  • Chasing redundant faults. They're provably undetectable — no effort detects them; remove from the denominator.
  • Reporting only fault coverage. It counts undetectable faults against you — also report test coverage.
  • Treating aborted as untestable. Aborts hit an effort limit — they may be testable; try more effort.
  • Assuming untestable = unfixable. Controllability/observability untestables are usually fixable with scan.
  • Ignoring redundant-logic risk. A defect on redundant logic is invisible — a latent/reliability concern in safety parts.

10. Industry Best Practices

  • Classify before you chase — split undetected into redundant / uncontrollable-unobservable / aborted.
  • Report fault and test coverage — remove proven-untestable from the denominator for an honest number.
  • Fix controllability/observability with scan (Ch4/6); accept or delete redundancy.
  • Reduce aborts with effort/setup before declaring a ceiling.
  • Flag redundant logic in safety parts — a defect there hides; consider removing it or adding checks.

11. Senior Engineer Thinking

  • Beginner: "Coverage is stuck — crank up ATPG effort until it moves."
  • Senior: "First classify the residual. Redundant → impossible to detect, remove from the denominator (or delete the logic). Unobservable → fixable, add a scan point. Aborted → more effort may help. Three buckets, three actions — and I report test coverage, not a number that counts the mathematically-undetectable against me."

The senior classifies first and matches remedy to class, never grinding effort blindly.

12. Silicon Impact

Understanding untestable faults is what makes coverage closure (Chapter 6) tractable and honest. Without it, teams burn schedule chasing an impossible 100% and misreport quality by counting mathematically-undetectable faults against themselves. The core insight is a separation of concerns: a redundant fault is an inherent property of the logic — no tool, no effort, no scan can detect it without removing the redundancy — so it belongs out of the denominator (the origin of fault vs test coverage), while an uncontrollable/unobservable fault is testability debt that scan can fix (Chapters 4/6), and an aborted fault is merely unfinished work. Classifying correctly turns a demoralizing 'coverage wall' into a prioritized action list: accept, redesign, add scan, or spend effort. There's also a reliability dimension that matters for safety/automotive (1.5): a defect on redundant logic is invisible to manufacturing test, so it can lie dormant — masking a fault until a primary path also fails — which is why safety-conscious teams sometimes remove unneeded redundancy or add in-field self-test (Chapter 9). For the RTL/DV engineer, this lesson is empowering: the AU bucket is a direct, fixable to-do list rooted in your logic's controllability/observability — and fixing it early is exactly how the project's flip-flop becomes fully testable in the next chapter via scan.

13. Engineering Checklist

  • Classified undetected faults into redundant / uncontrollable-unobservable / aborted.
  • Reported fault coverage and test coverage (proven-untestable removed from the denominator).
  • Fixed controllability/observability untestables with scan/observe (Ch4/6).
  • Reduced aborts via effort/setup before declaring a ceiling.
  • Reviewed redundant logic for hidden-defect/reliability risk in safety parts.

14. Try Yourself

  1. Build y = a OR (a AND b) and argue the (a AND b) term is redundant — no input makes a fault there change y.
  2. Show ATPG would classify a fault in that term as redundant and remove it from the denominator.
  3. Take an unused status bit on the counter, mark it unobservable, and show adding an observe point makes its fault detected.
  4. Compute fault coverage and test coverage from a small class summary (DT/RE/AU/AB) and explain the difference.
  5. Take an aborted fault and explain why it is not the same as untestable.

The reasoning is tool-neutral — a truth table proves redundancy by hand. Real fault classification comes from any ATPG flow (Chapters 5–6). No paid tool required.

15. Interview Perspective

  • Weak: "Some faults just can't be tested."
  • Good: "Redundant faults can't be detected and are removed from coverage; some untestable faults are fixable with scan."
  • Senior: "Undetected faults are not one thing. A redundant fault is provably undetectable — no input makes good ≠ faulty at any output (synthesis glitch/timing logic, reconvergent fanout) — so ATPG proves it and removes it from the denominator; that's why fault coverage ≠ test coverage. An uncontrollable/unobservable fault is untestable in the current circuit but usually fixable with scan/observe points. An aborted fault only hit an effort limit — it might be testable, so I don't count it as a ceiling. The skill is classifying — accept the redundant, fix the observability, spend effort on the aborts — and reporting test coverage honestly."

16. Interview / Review Questions

17. Key Takeaways

  • Not every fault is detectable, and some are provably undetectable — a mathematical property of the logic, not an ATPG-tool weakness.
  • A redundant fault (on synthesis/glitch redundancy, don't-cares, reconvergent fanout) can never be excited-and-propagated, so ATPG proves it redundant and removes it from the coverage denominator — the origin of fault coverage vs test coverage.
  • Uncontrollable/unobservable faults are untestable in the current circuit but usually fixable with scan/observe points (Chapters 4/6) — testability debt, not an inherent ceiling.
  • An aborted fault (effort/time limit) is not untestable — it may be testable with more effort; don't count it as a ceiling.
  • Classify undetected faults (redundant / uncontrollable-unobservable / aborted) to get honest coverage and the right remedy — accept, add scan, or spend effort — and remember a defect on redundant logic is invisible (a reliability concern for safety parts). Next: 2.6 — a working example enumerating all these faults on the single flip-flop.

18. Quick Revision

Why some faults are untestable. Detection = excite + propagate — sometimes impossible. REDUNDANT faults (synthesis glitch/timing logic, reconvergent fanout): provably undetectable → ATPG proves them → remove from the denominator (fault coverage counts all; test coverage = DT/(all − proven-untestable), the honest number). UNCONTROLLABLE/UNOBSERVABLE: untestable now but fixable with scan/observe (Ch4/6). ABORTED ≠ untestable (effort limit → try more effort). Classify the residual → accept / fix / spend effort; don't grind ATPG blindly. Redundant logic can hide defects (reliability). Next: 2.6 — faults on a single flip-flop.