https://doi.org/10.1007/s10836-020-05856-7

High-Level Implementation-Independent FunctionalSoftware-Based Self-Test for RISC Processors

Adeboye Stephen Oyeniran1 · Raimund Ubar1 ·Maksim Jenihhin1 · Jaan Raik1

Received: 9 August 2019 / Accepted: 12 January 2020© Springer Science+Business Media, LLC, part of Springer Nature 2020

AbstractThe paper proposes a novel high-level approach for implementation-independent generation of functional software-basedself test programs for processors with RISC architectures. The approach enables fast generation of manufacturing tests withhigh stuck-at fault coverage. The main concept of the method is based on separate test generation for the control and dataparts of the high-level functional units. For the control part, a novel high-level control fault model is introduced whereas forthe data part, pseudo-exhaustive test approaches can be applied to keep the independence from the implementation details.For the control parts, a novel high-level fault simulation method is proposed for evaluating the high-level fault coverage.The approach can be used for easy identification of redundant gate-level faults in the control part. The redundant faultscan be identified by simple gate-level fault simulation of the generated high-level test when implementation is available.Experimental results of test generation for different units of a RISC processor support the solutions presented in the paper.

Keywords Processor testing · High-level control fault model · Functional test generation · Fault simulation ·High-level fault coverage · Low-level fault redundancy

1 Introduction

Technology scaling in today’s deep-submicron processesproduces new failure mechanisms in electronic devices.This has forced researchers both, to develop more advancedfault models compared to the traditional stuck-at fault (SAF)model [41], and to investigate the possibilities of reasoningthe faulty behavior of systems without using any particularfault models [12, 39]. The importance of the latter approachis ever increasing, due to the growing number of low-levelredundant faults in today’s complex systems. On the otherhand, the implementation details of the processor circuitsare not always available, when testing is needed.

Fault models for digital circuits have been developedfor different types of failure mechanisms such as signalline bridges [22], transistor stuck-opens [21] or failures

Responsible Editor: D. Gizopoulos

� Adeboye Stephen Oyeniranadeboye.oyeniran@taltech.ee

Raimund Ubarraiub@pld.ttu.ee

1 Akadeemia tee 15A, 12618, Tallinn, Estonia

due to increasing circuit delays [19]. Another trend hasemerged to develop general fault modeling mechanismsand corresponding test tools that can effectively analyzearbitrary fault types. The oldest example is the D-calculus[32]. A generalization of this approach has been found in theinput pattern fault model [5], and in the pattern fault model[17]. These can represent any arbitrary change in the logicfunction of a circuit block, where a block is defined to beany combinational sub-circuit described at any level of thedesign abstraction.

A similar pattern related fault modeling approach calledfunctional fault model was proposed earlier in [38] for themodule level fault diagnosis in combinational circuits. Thefunctional (or pattern) fault model allows an arbitrary setof signal lines to be grouped into activation conditions fora single fault site, allowing a variety of physical defecttypes to be modeled. Based on the functional fault modela deterministic defect-oriented test pattern generator DOTwas developed in [30] which allowed proof of the logicredundancy of not detected physical defects.

In [23], a similar model called conditional faults wasproposed for test generation purposes, and in [15] fordiagnosis purposes. A conditional fault allows additionalsignal line objectives to be combined with the detectionrequirements of a particular fault. To completely exercise

Journal of Electronic Testing (2020) 36:87–103

/ Published online: 20 March 2020

gate-level blocks in combinational circuits, a similar patternoriented gate-exhaustive fault model was proposed in [10],which was extended to target bigger regions (collections ofgates) by region-exhaustive fault model in [16].

The described functional, conditional and pattern faultmodels offer high flexibility in defect modeling beyondsingle SAF model. Further advancements of the low-levelfault modeling have been achieved by introducing the faulttuple fault model [11], realistic sequential cell fault model[29], or cell-internal defect model [14], where the lasttwo cases provide general capability of handling sequentialmisbehavior of circuits.

The conditional SAF model (and also other listed mo-dels) [5, 10, 11, 14–17, 23, 29, 30, 38] support hierarchicaltest approach, where the test pattern (or sequence), whichactivates a low level fault (e.g. physical defect) at the lowerlevel, can be considered as the high-level condition (or cons-traint) for the functional fault defined at the higher level.

To increase the speed of test generation and faultcoverage evaluation, high-level (functional or behavioral)fault models have been developed. Such a model canbe considered efficient, if the tests generated using thismodel provide a high coverage of SAF or physical defects.However, a formal and uniform high-level fault model fortesting of processors is still missing.

In the design abstraction, higher-level descriptions havefewer implementation details, but more explicit functionalinformation than lower level descriptions. High-level faultmodels are categorized by the level at which the testsare generated. Usually, the methods for high-level testgeneration are divided into structural Register-TransferLevel(RTL) based methods [7, 35], or behavioral testgeneration methods [9, 20]. A high-level fault model canbe explicit or implicit [6, 37]. An explicit model identifieseach fault individually, and every fault in this model will bea target for test generation. Implicit models are based on theassumption that all gate-level faults may not be representedat the RT level, and this motivated to develop dedicated RTLfault models with dependence on implementation details.

High-level fault models are used widely in the fieldof Software-Based Self-Test [2, 8, 13, 18, 33, 42]. Theseapproaches can be divided into two major groups - structuraland functional. Structural approaches, such as [18, 42],are based on test generation using information from lowerlevel of design (gate-level or RTL-level description) ofprocessor under test. Functional approaches on the otherhand use instruction set architecture (ISA) information ofthe processor under test [2, 8, 13, 33].

The main and general problem of high-level faults is thedifficulty of proving that the model covers all low-leveldetectable (non-redundant) faults. In existence of such ahigh-level proof, it would be possible to identify the redun-dancy of gate-level faults exclusively by only gate-level

fault simulation, which has a cheaper cost than low-levelfault redundancy proof by conventional gate-level ATPG-s.

We have made such an attempt for the class of circuitswith well-defined high-level functionality in [25], and theresults are extended in the present paper. We propose a novelmethod for implementation-independent test generationfor modules of RISC type microprocessors. The methoddiffers from known methods by giving the tests capabilityof detecting larger class of faults than the traditionalsingle stuck-at faults (SAF). The new method providestests which are capable of detecting single and multipleSAFs, conditional SAFs, shorts, unknown cell defects, andfunctional decoder faults (similar to that of address decoderfaults considered in memory test). Delay faults and thefaults which convert combinational circuits into sequentialones are not considered in this paper.

The implementation independence of tests and thecapability of detecting a larger class of faults are achievedby separate testing of control and data parts of the module,by applying pseudo-exhaustive test patterns to the data part,and by using the novel data constraints based functionalcontrol fault model, which allows to prove the correctnessof the control part. The test generation details for the datapart are not discussed, but in the experimental research werelied on our previous research results [26, 27].

We demonstrate the universality of the method bygenerating tests for different processor modules, such asALU, Execute module, Register bank, Forwarding unit inpipelines, and Coprocessor unit. Based on the proposedhigh-level control fault model, we propose also a method ofmixed-level identification of redundant low-level structuralfaults, which is faster than the traditional ATPG-basedmethods for redundancy proof.

The rest of the paper is organized as follows. In Section 2,we describe the main concept of the implementation-independent high-level functional testing, and in Section 3,we present a method of high-level modeling of modulesunder test. Section 4 is devoted to development of anovel high-level control fault model as the basis of theproposed approach, while Section 5 deals with High-levelImplementation-independent Control Test. In Sections 6and 7 we describe a novel mixed level method ofidentification of redundant faults for the high and lowlevel control fault classes, respectively. Section 8 presentsa case study for demonstrating how the method canbe used in other types of modules, in particular, forPipeline Forwarding Unit, and Section 9 presents the overallautomated test program generation scheme and showsthe test organization architecture. Section 10 discussesexperimental results. Section 11 concludes the paper.Appendices A and B provide theoretical foundations for theproposed high-level control fault model and identificationof not-detectable low-level faults in control circuits.

J Electron Test (2020) 36:87–10388

2 TheProposed Implementation-Independent Concept of High-LevelTesting Of RISC Processors

The objective of this research is to propose a novelmethod for high-level testing of the modules of RISCmicroprocessors in a functional way and without resortingto the knowledge of low-level implementation details. Themain concept of the proposed method is based on theabstract presentation of the module under test (MUT) asa model which consists of two parts: the control part andthe data part. For both, we generate separate high-levelimplementation-independent test programs.

The main novelty of the approach is to give the gener-ated tests the property of detecting larger class of structuralfaults in the implementation, compared with the knownapproaches, such as not redundant single and multiplestuck-at faults, shorts, unknown cell defects and functionaldecoder faults. The faults, which convert combinationalcircuits into sequential ones, and delay faults are not consid-ered. The detection of that larger fault class is achieved bythe following strategies. The data part is tested by pseudo-exhaustive test pattern sequences, which according todefinition, are capable of detecting all not redundant struc-tural faults in sub-circuits tested exhaustively, indepen-dently of implementation, assuming the fault is not convert-ing the circuit into a sequential one.

For the control part, which is the main objective of thepaper, we have developed a novel data constraints basedfunctional control fault model, which will serve as a proofthat all functions will be selected correctly in case of the asuccessful result of the control test.

For each high-level module under test we define the set oflogic functions of the processor as the target of testing. Sucha set of functions is defined on the basis of the instructionset, or by examining the architecture of the processor. Fortesting the parts of the processor, not directly described byinstruction set, such as pipeline architecture or forwardingcircuitry, we have to define the set of functions on the basisof the description of the processor architecture given usuallyin manuals.

The full set of functions under test is partitioned intosubsets or groups of functions, for which the results of exe-cuted functions can be observed in comparable way at thesame node of the high-level structure. For example, onegroup of functions may consist of logic and arithmetic oper-ations derived from the instruction set and another groupof functions may be defined for the forwarding function-ality of pipeline, derived from the architectural descriptionof the processor. In both cases, the observable node will bethe output of ALU unit. Another group of functions maybe the branch functionality, which differs from the pre-viously mentioned groups in having the observable node

in the ALU 1-bit flag, which determines the branch directionof the instructions flow.

For all the functions of a particular group, the sametest template (sequence of instructions) will be constructed,which consists of the data initialization sequence applyingthe pattern which executes the particular function under test,and the observation sequence. The latter is needed for obser-vation of the results of the test at the same node in the circuit,determined for the whole group of functions under test.

A big picture of the processor’s high-level test organiza-tion for a particular module is depicted in Fig. 1. The modulewill have a single or several test templates for compilingassembler test routines, to be executed in embedded loopsusing the subset of instructions and related data sets.

The proposed new concept of high-level implementation-independent functional control test approach is illustratedin Fig. 2. Consider MUT as a functional unit as a set F

of functions y = fi (s, d), fi ∈ F , represented at high-level in a vector form Y = F (S, D).S = {si} is the set ofcontrol states, si → fi , activating the related functions fi ,D = {d} is the set of data operands generated for testingthe functions fi , and Y is the set of output responses yi

of MUT at given values of si ∈ S and d ∈ D. Since thelow-level structure of the MUT is unknown, the decodingdetails of the operation code C into the control signals isalso unknown. For that reason, we ignore these mappingdetails and introduce direct one-to-one mapping betweenthe control states si ∈ S and the functions fi ∈ S. Thismapping is sufficient for distinguishing the behaviors ofall functions, independently of how the control signals arecoded by the operation code in the instruction format. Thepossible faults in the mapping C → S, will be indirectlytaken into account when generating tests for the set offunctions Y = F (S, D). It will be shown in Section 7.

Since the internal logic structure of theMUT is unknown,traditional methods of path activation from the fault site

Fig. 1 Overview of the proposed high-level test concept of a processormodule

J Electron Test (2020) 36:87–103 89

Fig. 2 Illustration of theproposed test concept

up to an observable node cannot be used. For example, afault at some location inside the circuit of MUT cannot bepropagated to the observable point to produce there a faultyvalue y∗ instead of the expected value y �= y∗, y ∈ Y .

We introduce a novel concept of detecting the faults byreplacing the idea of traditional fault propagation throughthe structure of the circuit with comparing the expectedvalues y with possible erroneous values y∗ produced byfaults inside the MUT directly at the observable point Y ,without the need of fault propagation along the structure ofthe circuit. In such a way, we map the structural problem offault propagation into the functional problem of comparingthe expected responses of the test with faulty responses.

We reformulate the target of testing the correctness ofthe control part of MUT as the target to distinguish eachfunction from all others. This target can be achieved bygenerating a proper set of data D = {d}, which will producefor all functions fi ∈ F the corresponding output valuesY = {yi}, so that they would differ from each other at leastonce in each bit.

Figure 2 illustrates how the upper black-box model ofMUT is replaced with lower constraints based functionalmodel for the control part of ALU. Here yi �= yj meansthat if there are data generated in D, which satisfy thisconstraint for expected results of functions fi and fj , thenthese functions are distinguishable, and opposite, if thisconstraint at least in one bit is not satisfied, some faults canremain not detectable by the test.

In the next Sections, we first, present the high level modelof MUT, and thereafter, we introduce a novel high-levelfunctional control fault model, which is purely data relatedand has no relations to the internal structure of MUT.

3High-levelModeling ofModulesUnder Test

Consider ALU of a processor as a module under test(MUT) of a digital system, composed of data and control

parts as shown in Fig. 3. We present it in implementation-independent generic way as an equivalent circuit, where thecontrol part is highlighted as AND-OR multiplexer, whichextracts the results yi ∈ Y of the functions fi ∈ F . Thefunctions fi are executed by instructions, which produce therespective control state signals si ∈ S.

Let us ignore possible optimizations of the MUT circuit,and expand it in the presented way to separate the data andcontrol parts. This is similar to the procedure of expandinga given optimized Boolean expression by opening theparentheses and producing DNF with different appearancesof the same variable. Hence, the circuit in Fig. 3 can bepresented as DNF:

y = (s1&y1) ∨ (s2&y2) ∨ . . . ∨ (sn&yn) (1)

where for Boolean control variables we have constraints∀si , sj ∈ S: si&sj = 0, and yi = fi (d) are the Booleanfunctions executed in the data part, which are represented aswell as separate DNFs.

We call the formula (1), after having substituted thevariables yi with respective Boolean expressions andopened all parentheses, as equivalent disjunctive normalform (EDNF), similarly to [34], to stress that to eachappearance of the literal in EDNF, a different path in theoriginal circuit corresponds. As shown in [34], a test for aliteral appearance sensitizes the path in the original circuitassociated with that literal appearance. It was also shownthat if the generated test will detect all irredundant faults inthe expanded EDNF, it will detect also all irredundant faultsin the original optimized version of the original circuit.

From that it follows that the test generated for all irredun-dant faults in the EDNF representing the expanded modelof MUT will test also all irredundant faults in the originaloptimized version of the implemented circuit of MUT.

Consider the following example. Let the formula (2)represent an EDNF for a MUT represented as the model inFig. 3, which executes 4 functions y1 = d1d2, y2 = d1, y3 =d2, y4 = d1d2, where d1, d2 ∈ D represent data operands,

J Electron Test (2020) 36:87–10390

Fig. 3 Implementationindependent ALU model

under the control of variables s1, s2, s3, s4, respectively, andlet the formula (3) represent the optimized implementationof the same MUT:

y = s1d11d21 ∨ s2d12 ∨ s3d22 ∨ s4d13d23 (2)

y = d1 (s1d2 ∨ s2) ∨ d2(s3 ∨ s4d1

)(3)

The test for all SAF of the literal appearances in EDNF(2) will have the length of 10 patterns, and it will detectall SAF of the variables in the optimized formula (3).The disadvantage of the approach is that the optimizedimplementation (3) can be tested by a shorter test consistingof 8 patterns. However, the test for (2) is more general,because it is implementation independent, and as it will beseen, it will cover using proposed method of test generation,larger fault class than SAF. On the other hand, if applicationwill be given, the general test for the expanded model canbe always minimized for the given class of faults.

We introduced the example to explain the idea of makingtest generation implementation independent. In fact, theproposed method does not need to descend to the EDNFlevel. We will stay at the higher level described by thegeneric formula (1), generate a separate test for the controlvariables si ∈ S of the control part (to test the instructiondecoder and the multiplexer in Fig. 3), and then applythe pseudo-exhaustive test sequences one-by-one for thefunctions yi = fi (d) of the data part. The values (testresponses) of yi will propagate to the output Y correctly, incondition if the test for the control part has passed.

4 High-level Implementation-independentControl Fault Model

To test the control part we propose a new high-levelfunctional control fault model. We will show also, that

if the tests, generated for the high-level function Y =F (S, D) of the MUT, using the proposed control faultmodel, will produce correct expected responses for thegiven implementation Y ∗ = F ∗ (C, D), then the faults inthe control part of the implementation are missing.

Denote by yi the data word considered as the result ofexecution of the function fi of data operand(s) d ∈ Di asyi = fi (d). Let the number of bits in the data words be p,and let yi/k (d) denote the value of the kth bit of the dataword calculated as yi = fi (d). Let Di ⊆ D be the subset oftest data operands generated for executing the function fi .

Definition 1 Introduce for the function fi ∈ F , thefollowing high-level control fault model M (fi) as a set ofdata constraints:

∀k ∈ (1, m)∃d ∈ Di

(yi/k(d) �= 0

)(4)

∀fij �=1 ∈ F∀k ∈ (1, m)∃d ∈ Di

(yi/k(d) < yj/k(d)

)(5)

to be satisfied by a set of data operands Di , at least by onepattern {Di} for each bit k of the data word yi . The full high-level control fault model M(F) for a set of functions F , canbe considered as a joint set of constraints (4) and (5) in aform

M(F) =⋃

i

M (fi) , i : fi ∈ F

to be satisfied by a set of data operands D, at least by onedata pattern d ∈ D for each bit k of the data word yi ,whereas

D =⋃

i

Di i : fi ∈ F

Note; depending on the technology implemented inthe microprocessor, the constant 0 in formula (4) can be

J Electron Test (2020) 36:87–103 91

changed into 1, and instead of the relation “<” in formula(5), there can be “>” in case of the true value “1” isrepresented by low voltage, and “0” by high voltage.

Definition 2 Let us introduce the list of high-levelfunctional control faults as the list of all constraints (5):

L = {ri,j/k : (

yi/k < yj/k

)}

We say that ri,j/k = 1, if the constraint (yi/k < yj/k) issatisfied at least once, by one of the test data d ∈ D. Thisis equivalent of saying, that the fault ri,j/k is covered by thetest generated for the set of functions F .

Definition 3 Let us introduce the matrix R =‖ ri,j/k ‖to be called high-level functional control fault table. Therows and columns of this matrix will represent the functionsfi and fj , respectively, whereas the entries represent p-bitBoolean vectors. The procedure, which calculates the valuesof ri,j/k for the given test set is called high-level functionalcontrol fault simulation.

We have developed an automated test data generationtool as implementation of the method [25] for solving theconstraints in Definition 1. The high-level fault simulatorfor producing the fault table R =‖ ri,j/k ‖, and forcalculating the high-level functional fault coverage ofgenerated test, implements the procedure that was presentedin [28] and a theoretical foundation of the proposed high-level control fault model was presented in Appendix A.

5 High-Level Implementation-IndependentControl Test

Definition 4 Let us introduce a control test T (fi) as asequence of the repeatedly executed subroutine for testingthe function fi ∈ F in a loop for all test data di ∈ Di

generated using the fault model M (fi). The subroutineis constructed using a template, dedicated for the set offunctions F , which includes initialization of test data di ∈Di , execution of the instruction under test, and observationsequence. Denote the full control test for F as T (F ), whichrepresents the sequence of T (fi).

The high-level functional control fault test, whichsatisfies the constraints (4) and (5) will cover the followingfault classes (for each control word bit):

1. For MUX (Fig. 3): SAF/0 due to constraints (4), andSAF/1 (due to constraints (5) on the inputs and relatedpaths to outputs; conditional SAF, shorts, and multipleSAF on the inputs of AND-gates (due to applyingexhaustive patterns)

2. Functional faults in the instruction decoder: no functionaccessed, multiple functions simultaneously accessed –similar to address decoder faults of memory test (due toconstraints (5)) [40]

3. Functional microprocessor faults: instead of functionfi , another function fj accessed, or multiple functionssimultaneously accessed (due to constraints (5)) [36].

Note, the proposed idea of data constraints basedfunctional testing of decoders (4) and (5) is close to thatused in memory testing. In Fig. 4, the proposed methodis compared with the fragment of memory test. In case ofmemory the initialization of constraints (writing 1s (w1 ↑)

into cells) can be done once for all cells in a single cycle.Then, having these constraints stored, the following testcycle (r/w0 ↓) and observation cycle (r1) can be carriedout. In the proposed method, the constraints cannot bestored, rather they have to be produced “on-line” at eachtest pattern. In Fig. 4, a test pattern is illustrated by showingthe values it produces for functions. All functions arepartitioned into two groups Y 1, with values yj = 1, andY 0, with values yj = 0. The selected function fi under testproduces value yi = 0. We see that the constraint (5) aresatisfied only for the functions related to the group Y 1. Forother functions, the test for fi has to be repeated with otherdata until the constraint (5) will be satisfied for all bits ofthe data word. In the examples on Fig. 4, only 1-bit cells ofall memory locations and 1-bit data words for all functionsfi , fj ∈ F are considered.

This comparison of the data constraints based test T (F )

with March test reveals the possibility of applying theproposed approach to other modules, for which the data pathstate initialization task for executing the functions fi ∈ F

and sensitization of faults needs to load with data d ∈ D

more than two registers, as in case of ALU. An exampleis the pipeline forwarding unit to be discussed in Section8. Another example is the register bank, where our methodcan be directly compared with March test, however, with thedifference in the number of destinations to be observed (incase of the register bank test, a single register was used).

6 Identification of Redundant High-levelControl Faults

Consider as an example Table 1, which illustrates a high-level control fault table R = ∥

∥ri,j/k

∥∥ for a test T (F ),

generated for 5 functions f1 (OR), f2 (ADD), f3 (SUB),f4 (XOR), and f5 (AND). Assume the length of the datawords is k = 6 bit. The entries 0 (highlighted in red) inTable 1 refer to faults ri,j/k ∈ R, not detectable by thetest T (F ), as the constraints yik < yjk (5) have not beensatisfied by generating test data for T. For these faults, either

J Electron Test (2020) 36:87–10392

Fig. 4 Comparison of Marchtest and the proposed dataconstraints

the test T (F ) has to be improved, or it should be proventhat the not detected faults are functionally redundant.

In the following, we propose a method of identification ofthe high-level control fault redundancy, which in most casesis not difficult to perform due to the quite understandablehigh-level functional fault universe.

Example 1 For example, in most cases of ALU operations,it is very easy to identify this type of redundancy. Forexample, if a 1-bit function yi = fi (d1, d2) refers toAND operation and yj = fj (d1, d2) refers to OR, it isstraightforward that the constraint yi < yj , i.e. (d1 ∨ d2) <

(d1 ∧ d2) cannot be satisfied as it was shown in Fig. 13.

In cases where there is an entry rijk = 0 in a single bitk of the vector rij , or only in few bits of it, we can suggestfor the proof a method which can be called as “partial truthtable method”. The idea of the method stands in showingthe equivalence of partial truth tables (or to prove the impos-sibility of solving the related constraints) for the functionsinvolved in the constraint relation, so that as few as possibleresponsible bits should be selected for the need of the proof.

In Fig. 5, examples are shown for 1-bit partial truthtables for the functions SUB, ADD, OR, AND, for the leastsignificant bit. The pairs 00, 01, 10, 11 in Fig. 5a representthe values of the data variables (as arguments) for the bitunder analysis, and the 1-bit values in the columns show theresults of the related. From comparison of the columns 3-6in the table of Fig. 5a, straightforwardly the entries into thefault table in Fig. 5b result.

In some cases the partial truth table method will notwork, because the results of operations may substan-tially depend on all bits of the word like for increment(INC) or decrement (DEC) operations. When this happens,specific corner cases should be analyzed to prove the redun-dancy. For example, to prove the equivalence of incrementand decrement operations in the least significant bit, theoperand 1 . . . 110 has to be used, where both instructionsINC and DEC produce the same result “all 1s”, whichproves the functional redundancy of both functions in thisbit.

7 Identification of Redundant Low-LevelFaults in the Control Part of UUT

Let us consider in the following, how the gate-level faultredundancies in the control part of ALU can be identifiedby mixed level fault reasoning. To reduce the complexityof the problem, we propose, instead of exploiting slowconventional gate-level ATPGs for SAF redundancy proof,to use the combination of faster high-level test generation,and faster than ATPG low level fault simulation to achievethe same result – identification of the redundant low-levelfaults.

In Appendix B, we gave a theoretical foundationsfor identification of not-detectable low-level faults in thecontrol circuits. A test that covers all non-redundant high-level faults was shown to also cover all gate-level testableSAF in the microprocessor’s control part.

Table 1 Example of ahigh-level fault table

J Electron Test (2020) 36:87–103 93

Fig. 5 Example of redundancyproofs with 1-bit truth table

We will illustrate with Example 2, the identification ofredundant low-level faults in the control part of a simplifiedALU.

Example 2 Consider a simplified ALU unit with the setof three functions f1,f2, f3, activated by a set of controlsignals c2c1, c2c1, c2c1 respectively. The ALU can berepresented by the EDNF:

y = c2c1y1 ∨ c2c1y2 ∨ c2c1y3

The test data D = {d1, d2, d3} generated for the controlpart of ALU that satisfies the constraints (2) is depictedin Table 2. In the column 6, it is also shown, takinginto account the values of yi in column 2, that all 1-bitconstraints (5) needed for high-level test of the MUT, aresatisfied.

The table contains the test patterns in column 2, thefault table in columns 3-5, and the high-level constraints (5)satisfied by generating test data in column 6. The detectedgate-level faults in the fault table are highlighted by redcolour: 0 means the value of a signal which activates thefault SAF/1. For example, in case of the fault c2 ≡ 1 incolumn 5, the value of the output signal y = y1 = 0(selected by the control signals c2c1 = 11) will changefrom 0 to y = y1 ∨ y3 = 1 (both functions f1 and f3,are simultaneously selected). For detecting the faults SAF/0,more 3 test patterns are needed (not shown in the table).We see in the fault table that the faults c1 ≡ 1 in column3 and c2 ≡ 1 in column 4 are not detected, because ofthe control code c2c1 = 00 is illegal (not usable in thisMUT). According to Corollary 1, these gate-level faultsare redundant (in case if the control circuit is implemented

as DNF). As the example shows, the redundancy of thegate-level faults can be derived by simple low-level SAFsimulation.

Note, Theorem 2 and Corollary 4 in appendix 2 wereformulated and the proofs were given, considering only thesingle SAF model. In fact, the power of the proposed high-level control fault model stretches far beyond the fault classof single SAF, as it was shown in Section 4.

In the following, the general procedure of the mixed levelidentification of redundant gate-level SAF is shown, wherethe test is generated at the high-level using the proposedhigh-level control fault model, and the low-level redundancy

Procedure 1

1. Generation of the high-level test T (F ) for the givenset F of functions (instructions), with finding the datawhich satisfy the constraints (4) and (5).

2. Generation of the high-level fault coverage tableR = ‖rijk‖ by high-level fault simulation of the testT (F )[26].

3. High-level fault redundancy identification. For all notcovered high-level faults, the redundancy of the high-level control faults is identified.

4. If the high-level redundancy cannot be proven for someof high-level faults, the test T (F ) must be extended tosatisfy the constraints (4) and (5), and to achieve 100%high-level fault coverage. This is the prerequisite for thenext step of redundant SAF identification.

5. Gate-level fault simulation of the test T (F ). The notdetected SAF are identified as redundant low levelfaults in the control circuit of the MUT.

Table 2 Example of ahigh-level control test

J Electron Test (2020) 36:87–10394

Fig. 6 Example of testing thepipeline forwarding unit

8 Case Study of the Control Part Test forForwarding Unit in MiniMIPS RISC Processor

The proposed high-level functional control part testingapproach was discussed on the example of the group offunctions related to the execute unit and ALU example. Inthis case, the set of function F was derived directly from thesubset of instructions of the processor. Consider now a case,where the set of functions /(F/) to be tested is representingnot the main functional properties of the processor describedby the instruction set, but other non-functional propertieslike performance, for which for example the forwarding unitis responsible.

Consider the forwarding unit as the high-level circuitin Fig. 6, which consists of the pipeline registers ID/EX,EX/MEM and MEM/WB [24], forwarding control unit,multiplexer for selecting the data from pipeline registers,and ALU with observable output node. The role of thecontrol unit is to compare the addresses rs used in thecurrent instruction with addresses rd(EX), rd(MEM)

stored in the respective pipeline registers, and to produce thecontrol signals c1, c2 and c∗ for selecting the data D1, D2,and D3, respectively, from different pipeline registers. The

data Di represent the values of the functions fi ∈ F , whereF represents the functionality of the forwarding unit.

The test patterns, generated for testing the forwardingfunction in Fig. 6 are depicted in Table 3. The test consistsof 3 groups of patterns (in each 2 patterns, framed in bold):forward from EX/MEM (c1, D1), MEM/WB (c2, D2), andno forward (c∗, D3). Each of the 6 test patterns in Table 4are applied in a cycle for as many test data needed to solvethe constraints (5).

For solving the constraints (5) like rd(EX) <

rd(MEM), the data for the register numbers to produceor not to produce hazards, is generated using pseudo-exhaustive test data for comparators. To organize paralleltesting (solving the constraints (5)) for all the bits of thedata words, the patterns “all 1s” and “all 0s” are used.Differently, from testing the execute unit (in the previoussections), where the constraints were solved by data of thesame time-frame (for all of instructions), in case of forward-ing unit the constraints are solved by data from differenttime frames, and locating in different pipeline registers. Forthis purposes, relevant test templates were produced.

As an example, Fig. 7 demonstrates two test programsgenerated for testing the hazard detection and data

Table 3 Test generation forpipeline forwarding unit

J Electron Test (2020) 36:87–103 95

Fig. 7 Examples of testing thepipeline forwarding unit

forwarding functions. In case of hazards in addresses ofregisters (ra = cb), the data from the register rb is forwardedfrom EX/MEM stage (for Fig. 7a), and from MEM/WB (forFig. 7b). The cases correspond to test patterns 1-2, and 3-4, respectively, in Table 3. For the 1st patterns the values“all 0s” are forwarded, and for the 2nd patterns “all 1s” areforwarded. Two tests are needed for satisfying mutually theconstraints (5): rd(EX) < rd(MEM) and rd(MEM) <

rd(EX).The red entries in Table 3 correspond to the signals where

the SAF faults are sensitized and can be detected. The testpatterns 1,3 and 5 are created for testing the control faultswhere the constraint (5) is satisfied. These patterns also testthe SAF/1 faults in the data part. The test patterns 2,4,6,satisfying the constraint (4), are testing the SAF/0 faults inboth of the control and data parts.

9 Generation and Organizationof the Complete Test Program

Our test program generation is divided into two parts. Thefirst part involves automated high-level test data generation.While the second part uses the data generated by thefirst step together with manually created test template toautomatically generate the test programs. The flow of bothparts is described in Figs. 8 and 9. The high-level ATPGworks according to the two algorithms (random and greedy)developed in [25]

In accordance with the described method of generatingtest data for testing processor modules, we organize the test

Fig. 8 High-level Test Data Generation

according to the architecture shown in Fig. 10. The full testis divided into sections, where the target of each section isto test a subset of functions F , and for testing each functionfi ∈ F , the same test template is used.

The full test has a structure of three embedded loops.The first outer loop consists of execution of the test sectionsusing the same template. The number of loops is equal tothe number of different test templates, which represent asubroutine with a uniform structure consisting of three parts:initialization of the processor, execution of the instructionunder test which targets a function fi ∈ F , and propagatingthe response to the node of observation. The second middleloop consists of repeating the selected test template for allfunctions fi ∈ F over a list of related instructions Ii to beinserted into the current template. Each instruction patternIi = (

opcodei , A1, A2)refers to the data operands d1, d2

according to addresses A1, A2, respectively (the numberof data operands is optional and is determined by the testtemplate).

For each instruction Ii ∈ F under test, two consecutiveinner loops will be carried out: for testing the control partand for testing the data part. The number of test data d =(d1, d2) ∈ D∗

i for testing the control part is found by themethod described in this paper, whereas the number of testpatterns for testing the data part is determined by the lengthof the pseudo-random test sequence, derived, for exampleby the methods considered in [25, 26].

The originality of the proposed test strategy stands in on-line test generation based on unrolling on the fly the storedin compact way of all needed test information in the formof the sets of test program templates, test instructions andrelated test data lists.

Fig. 9 High-level Test Generation

J Electron Test (2020) 36:87–10396

Fig. 10 Architecture of the testprogram

10 Experimental Results

We carried out experiments on Intel Core i7 processor at3.4GHz and 8GB of RAM. The target was to investigatethe efficiency of the new high-level implementation-independent SBST generation method for microprocessorsby measuring gate-level SAF coverage (FC) for comparisonpurposes with other methods. The objectives of experimentswere ALU unit of VLIW [34] and different units ofMiniMIPS [24], like execute, forwarding and branch controlsub-circuits.

Using the subset of 16 VLIW instructions [34], weinvestigated the speed of random search of test data fortesting the control part of the execute unit. We investigatedtwo search algorithms pure random and optimized greedyrandom approach. The results are depicted in Table 4.

The execute unit of MiniMIPS [24] consists of Adder and2 multiplication modules MULT0 and MULT1 (Table 5).We targeted 25 instructions out of MiniMIPS 51 instruc-tions, as the basis of the set of functions F = {fi} tobe tested. The high-level test was simulated by commer-cial tool to grade the gate-level SAF coverage. To evaluatethe efficiency of the high-level ATPG, we also used com-mercial gate-level ATPG for comparison. The time cost forhigh-level ATPG is about two orders of magnitude less thanthat of the commercial ATPG. The gate-level SAF coverage

Table 4 Comparison of control test algorithms

Method Test-length, Fault Coverage Time (s)

#instructions

High-level faults SAF

RANDOM 204 100% 99.34% 2.00

GREEDY 139 100% 99.34% 7.85

achieved by the proposed ATPG for the whole moduleunder test, is better than that achieved by the commercialtool.

Figure 11 shows the distribution of faults in themicroprocessor according to modules. For example, theexecute unit takes 70% of the total number of faults inthe processor. It consists of the adder, two multiplicationmodules(MULT0 and MULT1) and interconnections. Notethat the modules correspond here to column 2 in Table 8

In Table 6, FC and simulation times are given for the for-warding unit (FU). First, when applying only the ALU test,then the dedicated test for only FU, and thereafter, com-bining both tests. The tests for FU were generated withoutknowing gate-level implementation detail. We relied onlyon general information of the MiniMIPS pipeline architec-ture, which includes the number of stages and forwardingpaths.

In Table 7, we compare our results for 3 differentMiniMIPS modules (ALU, PPS EX(Execute Unit), andForwarding Unit) with 3 other test generators. Our approachis similar to [13] in sense that gate-level implementationdetails are not required, but it shows almost 5% improve-ment in FC compared to [13].

Although the method in [43] shows 1% improvementover the proposed method, it requires implementationdetails. Method in [31] requires enforcing set of constraintsduring ATPG test generation, requiring also gate-levelinformation. Here, the result of our method shown forthe forwarding unit and the system co-processor doesn’tconsider the untestable faults in the modules. In Table 8, weshow the results of these units when the proven untestablefaults have been removed from the fault list.

One of the goals of the experiment in Table 5 was todemonstrate the feasibility of identification of the gate-level SAF redundancies by high-level test generation. Wedemonstrated it on the basis of ALU test for MiniMIPS

J Electron Test (2020) 36:87–103 97

Table 5 Execute unit testMethod Experiments #Faults FC(%) Stored Executed ATPG

patterns patterns time

Proposed High-level ATPG 756 100 166 4818 47s

high-level

method

Gate-level Adder 2516 99.92

simulation MULT0 95188 99.52

MULT1 91810 99.16

Commercial Adder 2516 99.96 957 957 8h 27min

gate-level MULT0 95188 97.40

ATPG MULT1 91810 97.71

Fig. 11 Fault Distribution in theminiMIPS processor

Table 6 Fault coverage offorwarding unit by differenttests

Module/Unit ALU Test(%) Forwarding Test(%) Combined(%) Improvement(%)

Forwarding Unit 89.71 97.84 98.03 8.32

Time(s) 808 48 460

Table 7 Targeted modulescomparison with other methods Module/unit #faults Gate-level implementation Gate-level implementation

details are exploited independent

ATIG [43] SBST [31] SBST [13] Proposed

ALU 203576 98.67% n.a 97.85% 99.06%

PPS EX 211136 97.62% 96.20% 84.12% 98.37%

Forwarding Module 3738 99.00% 99.68% 93.64% 98.03%

Register Banc 43584 99.90% 100% 99.98% 99.99%

Syscop 6930 93.60% 98.04% 87.90% 87.65%

J Electron Test (2020) 36:87–10398

Table 8 Fault coverage ofwhole processor by differenttests

Module/Unit ATIG(%) SBST(%) SBST(%) Proposed

[43] [31] [13] Method(%)

Without prediction U1 pf 98.32 91.97 86.32 70.00

U2 ei 99.71 96.82 90.86 85.50

U3 di 95.28 92.45 90.24 89.70

U4 ex 97.62 96.20 97.85 98.68

U5 mem 83.41 71.29 81.87 90.63

U6 renvoi 99.00 99.68 93.64 98.50

U7 banc 99.90 100 99.98 99.99

U8 syscop 93.60 98.04 87.90 93.53

U9 bus ctrl 92.62 92.20 93.95 89.78

Total 97.52 97.46 95.08 98.03

WithPrediction

U10 predict − − − 59.19

Total 97.31 97.46 95.08 95.30

processor. The SAF coverage 99.92%, achieved by 100%high-level fault coverage test means that 2 faults in ALUremained not detected, and are qualified according toCorollary 4 as redundant. Thus, establishing 100% faultefficiency. Since by fault simulation of the test for ALU(without its local control part) we found 100% SAFcoverage, we can conclude that the 2 faults belong to theALU control part. On the other hand, since low-level ATPGfound 1 undetected fault in the ALU joint data/controlcircuit, we can conclude that this redundant fault belongs tothe ALU local control part, and the second redundant faultbelongs to the ALU global control part (see Fig. 12).

In the MULT block, fault coverage of 99.09% refers to835 not covered faults, which should be qualified accordingto Corollary 4 as redundant. By gate-level ATPG we foundthat from the 1256 not covered by ATPG faults, 865 wereATPG untestable, 105 were classified as redundant, and286 remained not detected. From the latter it follows, thatthe 444 faults (the difference 1256 – 835), not covered by

Fig. 12 Simplified structure of the Execute Unit of MiniMIPS RISCProcessor

gate-level ATPG, however, were covered by the high-levelATPG. These faults should belong to the class of gate-levelATPG untestable faults.

It is important to mention that as opposed to the com-pared state-of-the-art methods, where only single SAF cov-erage has been the measurable target, the proposed methodcovers extended classes of low-level faults, including condi-tional and multiple SAF. This was proved theoretically withregards to the control faults in this paper. For the faults inthe data parts, the same broader fault coverage results fromthe nature of exhaustiveness of test patterns.

In Table 8, we compared our approach with state-of-the-arts methods in terms of test for the full processor.Using the information about untestable faults in [31], weremoved the identified and proven untestable faults fromthe fault list. The result shows that our approach coversmore faults in the processor with no knowledge of theimplementation details. However, we still have some faultsundetected in the modules. For example, the fault coveragefor the forwarding unit(U6 renvoi) with respect to thetestable faults in the module stood at about 98.50%. Thereason for the undetected 1.50% faults is due to signalssuch as the interrupt signal and exceptions that can not beactivated using the particular functional method, where onlyforwarding functions were taken into account. [4] identified39 of the total fault list for the forwarding unit to belong tothis category of undetectable faults.

Our approach doesn’t target the branch prediction unit,since faults in the unit do not lead to any functional incor-rectness but performance cost which is usually two or moreclock cycles depending on the architecture [3]. Therefore,branch prediction units are hard to test by functionalmethods without having dedicated observation points andthe same applies to our approach. The approach used fortesting the branch prediction unit in [31] is based on usingthe algorithm mostly used in memory testing. We can easily

J Electron Test (2020) 36:87–103 99

adopt this to our test as it was explained in Section 4.To have a fair comparison, we have decided to excludein Table 8, the faults related to the branch prediction unitsince the result in [13] is also based on implementation ofminiMIPS without this unit.

11 Conclusion

A new high-level and implementation-independent testprogram generation method for modules of RISC processorsis proposed with improved quality compared to the knownmethods. The higher quality is achieved through wideningthe fault class covered.

The proposed method is based on introducing a novelhigh-level functional control fault model for testing thecontrol parts of the functional modules of processors, andcombining it with implementation-independent and faultmodel free testing of data parts of the modules undertest (MUT) with pseudo-exhaustive test patterns. The highquality of test programs was proven theoretically, and theproof was supported by experimental results where thequality of tests was measured regarding the SAF class.It was proven that the proposed high-level control faultmodel covers as added value on one hand a larger class ofstructural faults, including conditional SAF, shorts, multipleSAF without the need of listing these faults explicitly,and on the other hand also functional faults of decodingcircuits. A similarity was shown between the sequentialMarch test used for memory testing, and combinational testfor decoding circuits in logic modules of processors.

A high-level fault coverage metric and a method forhigh-level fault simulation were developed to support theproposed test generation approach, which made it possibleto develop a novel mixed-level method for identificationof high-level functional redundancy of faults, and low-levelstructural redundancy of gate-level faults.

The novelties of the proposed approach are based ontwo new ideas. We introduced a method for modelingof MUT by symbolic EDNF, to be able to partition thecircuit into the control and data parts without knowing itsimplementation details. We also translated the classical low-level fault propagation task into the functional problem ofsolving high-level data constraints, to achieve independenceof implementation details for high-level test generation.

There are two side-effects of the discussed novelties ofthe paper as follows. First, due to EDNF based controlmodel, the generated test may be over dimensioned. Second,the novel idea of data constraints based test generation maytend to produce more test patterns than it would be neededfor only single SAF detection. However, both aspects, whichcan be considered as a negative factors regarding the class

of SAF, on the other hand, will help to cover larger faultclasses, including multiple faults. Therefore, the proposedmethod is more powerful than traditional ATPGs, whichtarget single SAF.

Another added value of the proposed approach was dis-covered during experimental research in test data generationfor RISC processors. The test programs generated explic-itly for testing only the control parts of modules achieve aswell very high fault coverage for data part. This is due to thepower of novel data constraints proposed for selecting dataoperands.

To sum up, the proposed method is an important stepahead compared to state-of-the-art for providing trustworthyand safe information about the quality of test programsgenerated. The future work will be in extending theproposed method for using it for other types of morecomplex processors, including investigations on differenttest optimization ideas.

Acknowledgements The work has been supported by EU’s H2020project RESCUE, Estonian research grant IUT 19-1, and funded byExcellence Centre EXCITE in Estonia.

Appendix A: Theoretical Foundationof The Proposed High-level Control FaultModel

Consider a set F = {fi} of functions, selected as a groupof functions to be tested using the fault model of constraints(4) and (5).

Let us define for each function a set of patterns

D0 {fi/k

} = {d|fi/k(d) = 0

}

for which the function fi produces the value yi/k = 0 inthe bit k. Let us call the set of patterns D0

(fi/k

)as the

0-domain of the function fi for the bit k.

Theorem 1 If for two functions fi/k and fj/k the followingD0

{fi/k

} − D0{fj/k

} = ∅ is valid, then the fault ri,j/k isfunctionally redundant.

Proof From D0{fi/k

} − D0{fj/k

} = ∅ it follows thatD0

{fi/k

} ⊂ D0{fj/k

}. This means that for each data

pattern d ∈ D0(fi/k

), we have yi/k (d) = 0, but also

yj/k (d) = 0. Hence, there exists no data which cansatisfy the constraint (5), and the functional fault ri,j/k

according to Definition 2 is not testable, and is functionallyredundant.

From Theorem 1, the following corollaries straightfor-wardly result.

J Electron Test (2020) 36:87–103100

Fig. 13 Three functions selectedfor testing as MUT

Corollary 1 If D0{fi/k

} − D0{fj/k

} = ∅then thedifferenceD0

{fi/k

} = D0{fj/k

}is the set of data patterns

which can be used for testing the fault ri,j/k .

Corollary 2 If for all bits k, D0(fi/k

) − ⋃j,j �=i D0

(fj/k

)

�= ∅ is valid, then the function fi/k has unique patterns,which produce yi/k = 0 for only the function fi/k and forno one else fj/k , fj ∈ F . Each of these patterns servesas test data for detecting the faults ri,j/k for all fj ∈ F ,j �= i.

Corollary 3 If for all bits k D0{fi/k

} − D0{fj/k

} = ∅ isvalid, then the function fi is fully distinguishable from thefunction fj in accordance with the constraints (5), and thefunctional faults ri,j/k are testable for all bits of k. If allfunctions fj ∈ F are mutually distinguishable then the setall high-level control faults in M (F) are testable.

In Example 3, we will demonstrate the testability ofselected ALU functions in a microprocessor using theproposed high-level control fault model.

Example 3 Consider, as an example, a set of three 1-bitfunctions f1(OR), f2(AND), and f3(XOR). The truthtable of these functions fi and the Venn diagrams of the

sets D0 {fi} are illustrated in Fig. 13. According to Venndiagrams, we can notice that there exist the followingdomains D0 (fi): D0 (OR) = {00}, D0 (AND) ={00, 01, 10}, D0 (XOR) = {00, 11}.

Few examples which illustrate the testability of functionsOR, AND, XOR according to Corollaries 1-3, are depictedin Table 1.

Appendix B: Theoretical Foundationsfor Identification of Not-detectableLow-level Faults in ControlCircuits

In the following we provide the main statements and proofs,which justify the identification of the not-detectable (func-tionally redundant) low-level faults in the real implemen-tation of the given control circuit by its low-level faultsimulation using the test T(F) constructed in Section 5.

Theorem 2 The test T (F ), which covers all non-redundanthigh-level faults of the fault model M{F }, covers alsoall gate-level testable SAF in the control part of themicroprocessor, which controls the set of functions F.

Table 9 Examples of relationsbetween 0-domains No Relations for D0 (fi) Patterns Comments

1 D0 (AND) − D0 (XOR) {01, 10} AND is distinguishable from XOR

2 D0 (XOR) − D0 (AND) {11} XOR is distinguishable from AND

3 D0 (OR) − D0 (AND) ∅ OR is not distinguishable

4 D0 (OR) − D0 (XOR) ∅

5 D0 (AND) − (D0 (OR) ∪ D0 (XOR)

) {01, 10} Unique patterns for AND

6 D0 (OR) − (D0 (AND) ∪ D0 (XOR)

)∅ No unique patterns for OR

J Electron Test (2020) 36:87–103 101

Proof Consider the control part of a MUT presented athigh-level in Fig. 3, and described in the real implementedversion expanded as the following EDNF as explained in[1], and also in Section 3::

y = c1,1c1,2 . . . c1,py1 ∨ c2,1c2,2 . . . c2,py2 ∨ . . . ∨ cn,1cn,2

. . . cn,pyn (6)

Here, the high-level control states si ∈ S used inthe formula (1) are mapped into the control signalsci,1ci,2 . . . ci,p of the decoder of the operation code embed-ded in the instruction of the processor. In [1] and Section 3,it was shown that if all non-redundant appearances of the lit-erals in the EDNF will be tested, then all the non-redundantfaults in the original circuit implementation will also betested. Let us show now, that the high-level test gener-ated for the high-level expression (1) will also test allnon-redundant faults in the expression (6).

In the EDNF (6), the variables ci,j for selecting thedata results yi, i = 1, . . . n, represent the global controlsignals ci,j = 1, . . . p, which may be either inverted ornot, and which cover, in general case, exhaustively all 2p

combinations. In the EDNF, due to satisfied constraints (5)of the fault model in Definition 1, when testing the functionyi , at least once the value of yj for each i �= j will beyj = 1. On the other hand, due to the exhaustiveness of all2p combinations of control signals, for each term of EDNFwith yi = 1, there will be a combination of control signalsci,1ci,2 . . . ci,p consisting of a single 0, e.g. ci,p = 0, withall others ci,r = 1,r �= p. This is the case, where in the termci,1ci,2...ci,pyi , the SAF ci,p ≡ 1 is tested. For propagatingthe fault ci,p ≡ 1 to the output y, all other terms in DNFmust have at least one 0 assigned to the variables of theterm. This is guaranteed, because due to the constraints (5),which demand that in the term where all cj,k = 1, the valueof yj must be 0, and in other terms there must be at leastone variable assigned by 0. Hence, all SAF faults of typeci,p ≡ 1 in all variables ci,p can be tested by T (F ). Thefaults ci,p ≡ 0 are tested by test data used in T (F ) wherethe constraint (1) is satisfied. �

Corollary 4 Any gate-level SAF in the control part relatedto F = {fi}, not detectable by the test T (F ) which coversall not redundant high-level control faults of the modelM{F }, is redundant.

Proof In Theorem 2, exhaustiveness of using all thecombinations of the local control signals ci,1ci,2 . . . ci,p wasassumed. If not all combinations are used in the instructionset of the microprocessor, which is the typical practicalcase, then, not all patterns can be generated for activatingall SAF of type ci,p ≡ 1. Usually these cases are used

for optimization of the gate-level structure of the controlpart of ALU. If however the optimization process has notremoved all hardware redundancy, then as the result, thecontrol part may consequently contain also redundant faults.These redundant faults can be identified by simple andfast gate-level fault simulation of the high-level generatedtest T .

References

1. Armstrong DB (1966) On Finding a Nearly Minimal Set of FaultDetection Tests for Combinational Logic Nets. IEEE Trans ElectrComput EC-15(1):66–73

2. Bernardi P et al (2014) On the in-field functional testing ofdecode units in pipelined RISC processors. Proceedings of2014 IEEE International Symposium on Defect and Fault Toler-ance in VLSI and Nanotechnology Systems (DFT), Amsterdam,pp 299–304

3. Bernardi P, Ciganda L, Grosso M, Sanchez E, Sonza ReordaM (2012) A SBST strategy to test microprocessors’ BranchTarget Buffer. Proceedings of 2012 IEEE 15th InternationalSymposium on Design and Diagnostics of Electronic CircuitsSystems (DDECS), pp 306–311

4. Bernardi P, Cantoro R, Ciganda L, Du B, Sanchez E, Reorda MS,Grosso M, Ballan O (2013) On the functional test of the registerforwarding and pipeline interlocking unit in pipelined processors.Proceedings of 14th International Workshop on MicroprocessorTest and Verification, pp 52–57

5. Blanton RD, Hayes JP (2003) On the properties of the inputpattern fault model. ACM Trans Des Autom Electron Syst8(1):108–124

6. Bushnell M, Agrawal V (2013) Essentials of electronic testing fordigital, memory andMixed-Signal VLSI circuits. Springer, Berlin,p 690

7. Corno F, Cumani G, Sonza Reorda M, Squillero G (2000) AnRT-level fault model with high gate level correlation. Proceedingsof IEEE International High-Level Design Validation and TestWorkshop (Cat. No.PR00786), Berkeley, pp 3–8

8. Corno F, Sanchez E, Reorda MS, Squillero G (2004) Automatictest program generation: a case study. IEEE Des Test Comput21(2):102–109

9. Cho CH, Armstrong JR (1994) B-algorithm: a behavioraltest generation algorithm. Proceedings of International TestConference, Washington, pp 968–979

10. Cho KY, Mitra S, McCluskey EJ (2005) Gate exhaustive testing.Proceedings of IEEE International Conference on Test, Austin,pp 7–777

11. Dwarakanath KN, Blanton RD (2000) Universal fault simulationusing fault tuples. Proceedings of 37th Design AutomationConference, Los Angeles, pp 786–789

12. Georgiou P, Kavousianos X, Cantoro R, Reorda MS (2018) Fault-Independent Test-Generation For Software-Based Self-Testing.Proceedings of 2018 IEEE 24th International Symposium on On-Line Testing And Robust System Design (IOLTS), Platja d’Aro,pp 79–84

13. Gizopoulos D et al (2008) Systematic Software-Based Self-Testfor Pipelined Processors. IEEE Trans Very Large Scale Integr(VLSI) Syst 16(11):1441–1453

14. Hapke F, Redemund W, Glowatz A, Rajski J, Reese M, HustavaM, Keim M, Schloeffel J, Fast A (2014) Cell-Aware Test. IEEETrans Comput-Aided Des Integr Circ Syst 33(9):1396–1409

J Electron Test (2020) 36:87–103102

15. Holst S, Wunderlich H (2007) Adaptive debug and diagnosiswithout fault dictionaries. Proceedings of 12th IEEE EuropeanTest Symposium (ETS’07), Freiburg, pp 7–12

16. Jas A, Natarajan S, Patil S (2007) The Region-Exhaustive faultmodel. Proceedings of 16th Asian Test Symposium (ATS 2007),Beijing, pp 13–18

17. Keller KB (1994) Hierarchical Pattern Faults for Describing LogicCircuit Failure Mechanisms. US Patent 5546408

18. Kranitis N, Paschalis A, Gizopoulos D, Xenoulis G (2005)Software-based self-testing of embedded processors. IEEE TransComput 54(4):461–475

19. Kristic A, Cheng KT (1998) Delay Fault Testing for VLSICircuits. Kluwer Academic Publishers, Dordrecht

20. Kumar V et al (2012) Employing functional analysis to study faultmodels in VHDL. Int J Sci Eng Technol 1(5):2017–208

21. Lee HK, Ha DS (1990) SOPRANO: An efficient automatic testpattern generator for stuck-open faults in CMOS combinationalcircuits. Proceedings of 27th ACM/IEEE Design AutomationConference, Orlando, pp 660–666

22. Li Z, Lu X, Qiu W, Shi W, Walker DMH (2003) A circuit levelfault model for resistive opens and bridges. Proceedings of 21stVLSI Test Symposium, Napa, pp 379–384

23. Mahlstedt U, Alt J, Hollenbeck I (1995) Deterministic testgeneration for non-classical faults on the gate level. Proceedingsof Fourth Asian Test Symposium, Bangalore, pp 244–251

24. OpenCores, “MiniMIPS ISA”25. Oyeniran AS, Ubar R, Azad SP, Raik J (2017) High-level test gen-

eration for processing elements in many-core systems. Proceed-ings of 2017 12th International Symposium on ReconfigurableCommunication-centric Systems-on-Chip (ReCoSoC), Madrid,pp 1–8

26. Oyeniran AS, Azad SP, Ubar R (2018) Parallel Pseudo-Exhaustivetesting of array multipliers with Data-Controlled segmentation.Proceedings of 2018 IEEE International Symposium on Circuitsand Systems (ISCAS), Florence, pp 1–5

27. Oyeniran AS, Ubar R, Jenihhin M, Gursoy CC, Raik J (2019)Mixed-level identification of fault redundancy in microprocessors.Proceedings of 2019 IEEE Latin American Test Symposium(LATS), Santiago, pp 1–6

28. Oyeniran AS, Ubar R, Jenihhin M, Gursoy CC, Raik J (2019)High-Level Combined Deterministic and Pseudo-exhuastive TestGeneration for RISC Processors. 2019 IEEE European TestSymposium (ETS), Baden-Baden, pp 1–6

29. Psarakis M, Gizopoulos D, Paschalis A, Zorian Y (2000)Sequential fault modeling and test pattern generation for CMOSiterative logic arrays. IEEE Trans Comput 49(10):1083–1099

30. Raik J, Ubar R, Sudbrock J, Kuzmicz W, Pleskacz W (2005)DOT: New deterministic defect-oriented ATPG tool. Proceedingsof European Test Symposium (ETS’05), Tallinn, pp 96–101

31. Riefert A, Cantoro R, Sauer M, Reorda MS, Becker B (2015)On the automatic generation of SBST test programs for in-fieldtest. Proceedings of 2015 Design, Automation & Test in EuropeConference & Exhibition (DATE), Grenoble, pp 1186–1191

32. Roth JP (1966) Diagnosis of Automata Failures: A Calculus and amethod. IBM J Res Dev 10(4):278–291

33. Sanchez E, Reorda MS (2015) On the Functional Test of BranchPrediction Units. IEEE Trans Very Large Scale Integr (VLSI) Syst23(9):1675–1688

34. Scholzel M (2015) Self-Testing and Self-Repairing EmbeddedProcessors: Techniques for statically scheduled superscalararchitectures. Habilitation thesis. Brandenburg University ofTechnology Cottbus-Seftenberg

35. Shen L, Su S (1988) A Functional Testing Method for Micropro-cessors. IEEE Trans Comput 37(10):1288–1293

36. Thatte SM, Abraham JA (1980) Test Generation for Microproces-sors. IEEE Trans Comput C-29(6):429–441

37. Thaker PA, Agrawal VD, Zaghloul ME (2000) Register-transferlevel fault modeling and test evaluation techniques for VLSIcircuits. Proceedings of International Test Conference 2000 (IEEECat. No.00CH37159), Atlantic City, pp 940–949

38. Ubar R (1980) Fault Diagnosis in Combinational Circuits bySolving Boolean Differential Equations. Autom Remote Control40(11):part 2. Plenum publishing corporation, USA, pp 1693–1703

39. Ubar R, Kostin S, Raik J (2012) How to prove that a circuit isFault-Free?. Proceedings of 2012 15th Euromicro Conference onDigital System Design, Izmir, pp 427–430

40. van de Goor AJ (1991) Testing Semiconductor memories. Theoryand practice. Wiley, New York, p 512

41. Wang L.-T., Wu Ch.-W., Wen X (2006) VLSI Test Principles andArchitectures. Design for testability. Elsevier, pp 777

42. Wen CH, Wang LC, Cheng K-T (2005) Simulation-basedfunctional test generation for embedded processors. Proceedingsof Tenth IEEE International High-Level Design Validation andTest Workshop, Napa Valley, pp 3–10

43. Zhang Y, Li H, Li X (2013) Automatic Test Program GenerationUsing Executing-Trace-Based Constraint Extraction for Embed-ded Processors. IEEE Trans Very Large Scale Integr (VLSI) Syst21(7):1220–1233

Publisher’s Note Springer Nature remains neutral with regard tojurisdictional claims in published maps and institutional affiliations.

Raimund Ubar is a professor at Tallinn University of Technology. Hereceived PhD degree in 1971 from the Bauman Technical Universityin Moscow, and DSc degree in 1987 from the Latvian Academy ofSciences. His scientific interests include computer science, design fortestability and diagnostics of technical systems. Ubar is a memberof Estonian Academy of Sciences, life senior member of IEEE, andGolden Core member of IEEE Computer Society. He was awardedby the Estonian Government the White Cross Order of III Class, andreceived two Meritorious Service Awards from the IEEE ComputerSociety.

Adeboye Stephen Oyeniran is currently a PhD student at TallinnUniversity of Technology. He received his MSc degree in computersystems engineering from Tallinn University of Technology in 2015.His research interest include design for testability, microprocessortesting, verification of dependable systems and hardware security.

Maksim Jenihhin is a professor of Computing Systems Reliability atthe Department of Computer Systems of Tallinn UT. He holds M.Sc.and Ph.D. degrees in Computer Engineering from Tallinn UT (2004and 2008 respectively). His research interests include methodologiesand EDA tools for hardware design, verification and debug as well asnanoelectronics reliability and manufacturing test topics. Maksim is aproject coordinator for H2020 RESCUE - Interdependent Challengesof Reliability, Security and Quality in Nanoelectronic Systems Design.

Jaan Raik is a full professor at Tallinn University of Technology,where he defended his MSc and PhD degrees in 1997 and2001, respectively. His research interest include test, verification ofdependable computing systems. He has co-authored more than 200scientific papers. He is a member of IEEE.

J Electron Test (2020) 36:87–103 103