Scan Bench

One page per topic in silicon design-for-test, each with a short summary, drawn schematics and timing diagrams, the common pitfalls, and questions with worked answers. The core pages cover scan, test access, ATPG and silicon debug; one more covers scan physical design, DFT timing and SDC. The deep dives go further on EDT, test-mode timing and SSN.

Topics

How to use this

1. Mark where you stand. Each page has a "Familiarity" row (Confident, Comfortable, Review, New). The dots in the sidebar and on the cards above follow your choice. It stays in this browser only.
2. Start with what's new to you. Read the summary, study the figures until you could redraw them, then try the questions before opening the answers.
3. Redraw the core figures. The ones worth knowing cold: mux-D cell, lockup latch and its timing, OCC and capture waveform, LOC vs LOS, EDT architecture, wrapper cell, TAP state machine, SIB, chain-test signatures.
4. Skim what you know. For familiar topics, the pitfalls and the "in practice" boxes are the quickest way to check the details.

Scripting exercises

Practical Python for DFT work (flists, RTL and netlist parsing, chain tracing, fail logs), with hints and partial solutions, is on the Scripting exercises page. Try each one before opening the hints.

About

Scan Bench is written and maintained by Tyler Peller. Tool names appear only as examples; the concepts are vendor-neutral.

Scan architecture and clocking

How a scan cell works, how shift and capture are sequenced, and how clocks are controlled for stuck-at and at-speed test: lockup latches, OCCs, LOC and LOS.

The scan cell

Mux-D is the industry default: one standard cell (e.g. SDFF) with pins D, SI, SE, CK, Q, sometimes a separate SO. It costs a mux delay on the functional D path (the scan mux sits in the setup path) and a little area. Two other styles you should be able to name:

• LSSD (level-sensitive scan design, IBM): two latches with non-overlapping clocks. Master latch takes either system data (clock C) or scan data (clock A); slave latch clocked by B. Race-free by construction and robust to hold problems, but needs extra clock routing. Rare in modern SoCs.
• Clocked scan: separate scan clock selects the scan input instead of a mux. Avoids the mux delay in the functional path.

Chains and the shift/capture protocol

Everything a chain touches is shared: SE and the shift clock go to every cell, so a single defect in the SE tree or the clock tree can break every chain at once. That is the first thing you rule out in silicon bring-up.

Stuck-at pattern sequence

1. Load (SE=1): shift L cycles; the chain now holds the pattern. The previous response comes out on scan_out at the same time.
2. Force PIs, then measure POs (SE=0). PO strobe is before the capture pulse, because capture changes flop state.
3. Capture: one clock pulse; every flop samples its functional D.
4. Unload overlapped with the next load.

Example: 10,000 patterns, longest chain 2,000 cells, 50 MHz shift → ~20.0 M cycles ≈ 0.4 s. Halve the longest chain and test time roughly halves. That's the case for balanced chains and compression. Only the longest chain matters, because all chains shift in parallel.

Mixed clocks in a chain: lockup latches and edge ordering

Chains often cross clock domains or clock-tree branches with large skew between them. In shift mode all of these are driven from one shift clock, but the insertion delays differ. If the capture flop's clock is later than the launch flop's clock by more than the Q→SI delay, the capture flop takes the new bit: a hold violation in shift. The chain loses a bit.

• Rule: for positive-edge flops, the lockup latch is a negative-level (active-low) latch clocked by the launching domain's clock. Tools insert them automatically at domain boundaries in a chain (set_scan_configuration -add_lockup style options, or Tessent's lockup cell insertion when stitching across clocks).
• A lockup latch does not add a cell to the chain; it retimes the transfer by half a cycle. A lockup flop would add a bit, which also works but changes the chain length.
• Mixed edges: put negative-edge flops before positive-edge flops in a chain (or keep them on separate chains). A pos→neg hop inside one cycle lets a bit move through two cells in one shift cycle; neg→pos is a clean half-cycle transfer.
• If the launch clock is the late one, you have a setup issue instead, and it's harmless at slow shift frequency.

Clock control: why an OCC

For at-speed test the capture pulses have to be at functional frequency (hundreds of MHz to GHz). Testers can't drive that cleanly through package pins, and the real functional clock comes from an on-chip PLL anyway. An on-chip clock controller sits between the PLL output and each clock domain's root. It chooses between the slow shift clock and a precise burst of PLL pulses.

Clock-chain bits

A short shift register inside the OCC, stitched into a scan chain. ATPG loads it per pattern, so each pattern chooses how many pulses (e.g. 1 for stuck-at, 2 for LOC) and which domains pulse. This is what lets the ATPG tool model the OCC as a programmable clock source (Tessent handles this through clock control definitions for the OCC).

SE synchronizer

SE comes from the tester, asynchronous to the PLL. It's synchronized into the fast domain so the pulse burst starts cleanly and at a fixed cycle count.

Glitch-free gating

Gating uses a latch-based ICG, and the slow/fast switch is a glitch-free clock mux. Any glitch on a clock root corrupts the whole domain.

Slow capture

Stuck-at patterns can capture with a single shift-clock pulse routed through the OCC (the "slow" path), useful for debug and for domains with no PLL.

Inter-domain at-speed

Launch in domain A, capture in domain B, at speed, is only meaningful if the two OCCs are synchronous and aligned. Otherwise ATPG pulses one domain per pattern (or compatible groups) and masks cross-domain paths.

At-speed launch: LOC vs LOS

Questions

Expand all answers

Further reading: EDN, launch-off-shift at-speed test · Siemens, navigating Tessent OCCs · VLSI Tutorials, on-chip clock controller

Scan insertion and compression

What has to be true of a netlist before it can be scanned, how chains are built and balanced, and how compression cuts test data and time by one to two orders of magnitude.

Where insertion sits

Scannability rules (the stuff that breaks ATPG)

Stitching and balancing

Chain construction rules, roughly in order of priority:

• Clock domain and edge: keep one domain per chain where possible. Where not, order and add lockup latches (see scan clocking). Negedge before posedge.
• Power domain: a chain should not cross a switchable domain, or the chain breaks when that domain is off (and needs isolation/level shifters when it's on).
• Hierarchy / partition: wrapper chains and internal chains per core; keep physical partitions together.
• Balance: equal length within each compression unit or channel group.
• Physical: reorder after placement using the scan DEF, within those constraints (see Scan PD & timing).

Compression

A pattern typically has only 1–5% care bits. Compression exploits that: the tester supplies a small compressed stream, and on-chip hardware expands it. Test data volume and test time drop by roughly the chain-to-channel ratio, until either encoding capacity or X density limits it.

Decompressor

Continuous-flow linear decompressor: ring generator (a compact LFSR) + phase shifter. Each internal chain bit is a linear (XOR) function of the channel bits injected so far. ATPG solves a system of linear equations over GF(2) per pattern to find channel data that produces the care bits. If the care bits don't fit, that fault moves to a different pattern.

Compactor

Spatial XOR trees combine many chain outputs per channel each shift cycle. Aliasing (two errors canceling) is possible but rare and accounted for by fault simulation.

Masking

Per-pattern (or per-shift) mask bits, delivered with the compressed data, block chains carrying X. Masking also reduces observability, so heavy X sources cost coverage and patterns.

Ratio

Compression ratio ≈ internal chains / scan channels, adjusted by pattern inflation. Past a point, more chains means more patterns (encoding limits) and more routing congestion around the decompressor and compactor, so the effective gain flattens.

Bypass

A bypass mode concatenates internal chains into long uncompressed chains. It's the first thing you use in silicon debug because failures map directly to cells.

Low-pin-count

Channel counts can be tiny (a few pins) for package test or for hierarchical cores sharing top-level pins through broadcast or channel sharing.

X handling

Where X comes from, and what to do:

• Uninitialized state (non-scan flops, memories, register files): initialize in test setup, use memory bypass, or constrain.
• Black boxes / analog: model outputs as X, add observe/control logic around them.
• Timing exceptions in at-speed capture: false and multicycle paths can't be trusted at speed, so ATPG masks their endpoints (captures X). That's why SDC exceptions get imported into ATPG.
• Cross-domain captures with asynchronous clocks: mask or don't pulse both domains in one pattern.
• Bus contention / floating: ATPG resolves to X.

Questions

Expand all answers

Further reading: Siemens Tessent blog, hierarchical coverage reports

Core wrapping and hierarchical DFT

Isolating a core with wrapper cells so it can be tested on its own, generating patterns once at core level, and reusing them at the top. This is how every large SoC gets through ATPG.

Why wrap

• ATPG capacity: flat ATPG on a 10⁸-gate SoC is slow and memory-hungry. Per-core runs parallelize and finish early in the schedule.
• Reuse: the same core instantiated 16 times gets one pattern set, broadcast to all instances.
• Schedule: core DFT signs off before the top is ready. Late top changes don't force re-ATPG of cores.
• Test scheduling and power: cores can be tested in groups to fit channel and power budgets.
• Diagnosis: failures localize to a core.

Wrapper cells

Ports that don't need a wrapper cell: clocks, resets handled separately, test control pins, and ports whose logic is covered another way. Wrapper cells for a port feeding many flops through logic save a lot versus making every flop a shared cell. Tools apply a threshold on fan-in/fan-out cone size to choose.

Internal and external modes

The hierarchical flow

1. Core level: insert wrapper cells, core EDT, OCC if needed, IJTAG-controlled mode signals. Run internal-mode ATPG, sign off coverage. Write a graybox (interface) model.
2. Top level, internal: retarget core patterns to top-level pins. The tool maps core scan ports through top-level connections (channel sharing, broadcast, pipelines) and merges patterns of cores tested together.
3. Top level, external: load grayboxes of all cores plus top logic; run ATPG with every core in external mode. Tests top glue and wiring.
4. Coverage roll-up: sum core internal + top external fault lists to report the chip number (Tessent can merge flat fault lists across the hierarchy).

IEEE 1500 in one picture

Summary only; the full treatment (serial control timing, every instruction, TAP/IJTAG control, CTL) is on the IEEE 1500 page.

WSP

Wrapper Serial Port: WSI, WSO plus the WSC control signals WRCK, WRSTN, SelectWIR, ShiftWR, CaptureWR, UpdateWR (TransferDR is optional in the standard).

WIR

Wrapper instruction register: selects mode and which register sits between WSI and WSO.

WBY

1-bit bypass register, so you can shift through many wrapped cores quickly.

WBR

Wrapper boundary register: the chain of wrapper cells.

Instructions

WS_BYPASS and WS_EXTEST are mandatory, plus at least one internal-test instruction. Others include WS_INTEST_SCAN, WS_INTEST_RING, WS_PRELOAD, WS_CLAMP, WS_SAFE, and parallel-port (WP_) variants.

vs 1149.1

1500 has no TAP state machine: the control signals are the decoded states (shift/capture/update). It's usually driven from a TAP or IJTAG network. Many teams now skip a full 1500 WIR and control wrappers directly with IJTAG TDR bits. Describing it as "1500-style wrapper, IJTAG-controlled" is accurate for most modern flows.

Questions

Expand all answers

Further reading: Tsiatouhas, IEEE 1500 SECT lecture notes · Let's talk about wrappers (IEEE 1500)

Test point insertion

Adding a small amount of logic to make hard-to-control or hard-to-observe nets easy. It's essential for LBIST and increasingly used to cut deterministic pattern counts.

Random-pattern resistance

Test point types

• Control-0 / control-1: force a net low/high. The TP scan cell supplies the value (random in LBIST, chosen by ATPG in deterministic mode). Gated by a global test-point enable so functional mode is unaffected.
• Inversion (XOR) control point: flips a net instead of forcing it. Less biasing of the signal distribution.
• Observe point: net → dedicated scan cell or XOR tree into a scan cell. No gate in the functional path, only a load on the net. Cheapest in timing.
• Sharing: one TP scan cell can drive several control points, and XOR trees compress many observe points into one cell.

Testability metrics (SCOAP)

SCOAP gives each net a combinational 0-controllability (CC0), 1-controllability (CC1) and observability (CO), counting roughly how many assignments are needed. Higher is harder. PIs and scan cell outputs start at 1; POs and scan cell inputs have CO = 0.

For the 16-input AND built from 4-input ANDs, CC1 at Z = 4×(4×1+1)+1 = 21, while CC0 = 1+1+1 = 3. That asymmetry is what flags it for a control-1 point. Commercial tools use probabilistic (COP-like) estimates plus fault simulation to rank candidate locations by expected coverage gain.

Where test points are used, and what they cost

• Timing: control points add a gate on a functional path. Tools exclude critical paths (read SDC/timing slack) and prefer observe points.
• Area: each TP costs a gate + share of a scan cell. Typically 1–2% of flops.
• Power: control points change toggle activity in test; enable only in test mode.
• Verification: equivalence check with TP enable = 0 must pass against the pre-TP netlist.

Questions

Expand all answers

Low-power scan

Scan toggles far more logic than functional operation. Shift power heats the die and drops the supply; capture power causes IR-drop that slows paths and fails good parts at speed. How to control both.

Why test power is different

Shift power

• Lower shift frequency: power ∝ f. Simplest, but test time goes up proportionally.
• Clock gating in shift: shift only part of the design at a time (per core or per chain group), holding the other groups' clocks off. Costs test time.
• Q-gating: blocks the combinational logic from seeing shift toggles. Very effective on logic power, costs area and functional timing.
• Low-power EDT: the decompressor can hold values for chains that have no care bits in a given shift window, which mimics adjacent fill.
• Scan chain ordering: grouping flops so adjacent cells tend to hold equal values reduces toggles a bit. Minor compared to fill.

Capture power

• Power-aware ATPG: set a budget (e.g. maximum % of flops that change state at capture, or weighted switching activity). ATPG respects it using fill choices and by turning off clock gates it doesn't need (enables = 0) for that pattern. More patterns result.
• Clock-gating aware: requires TE tied to SE, not test_mode, so ATPG controls the functional enables during capture (see figure).
• Staggered capture: domains pulse at different times in the capture window rather than together. The OCC per domain supports this.
• Core scheduling: in hierarchical test, choose which cores capture together to meet the peak budget.
• Validation: run vector-based IR-drop (e.g. RedHawk/Voltus with the actual patterns' switching) on worst patterns before tapeout; correlate with silicon.

Power domains and scan

• Chains don't cross switchable domains. If a domain is off, any chain passing through it breaks. Build chains per domain (tools read UPF during insertion).
• Isolation cells clamp outputs of an off domain. Test their clamp behavior with the domain in the off state, and that they're transparent when on.
• Level shifters between voltage domains may sit on scan paths; they add delay and need timing in shift mode across voltages.
• Retention flops: need save/restore testing, often a dedicated retention test sequence (save, power down, power up, restore, unload).
• Power states in test: patterns run with a defined power-state table (which domains on, which voltages). Test all valid states that matter, not just all-on.
• Power switch control must be controllable in test mode and not toggle during shift.

Questions

Expand all answers

JTAG (IEEE 1149.1)

The Test Access Port: five pins, a 16-state controller, an instruction register and a set of data registers. It's the front door for boundary scan, IJTAG networks, MBIST, test-mode entry and silicon debug.

The TAP controller

Reset

TMS=1 for 5 TCKs reaches Test-Logic-Reset from any state (or assert TRST*). In TLR the IR holds IDCODE if the device has an ID register, else BYPASS, and test logic is inactive.

Capture-xR

Parallel load into the shift stage on the rising edge leaving the state. IR capture loads …01 into the two LSBs (the other bits are design-specific), which lets software check the chain.

Shift-xR

One bit per rising edge, LSB first out of TDO. The edge that moves from Shift to Exit1 also shifts, so an n-bit register needs TMS=0 for n−1 edges in Shift and TMS=1 on the last one.

Pause-xR

Hold shifting without losing state, e.g. while the tester reloads buffers.

Update-xR

Shift stage copied to the parallel hold stage on the falling edge of TCK.

Run-Test/Idle

Idle state, and where self-tests run (RUNBIST, MBIST started via a TDR and left running for N TCKs).

Architecture and instructions

Timing

Boundary-scan cell

The two-stage structure (capture/shift + update) is the idea to remember. 1500 wrapper cells and 1687 TDRs reuse it: shifting never disturbs parallel outputs, and everything updates at once.

Questions

Expand all answers

Further reading: Corelis JTAG technical primer · Electronic Design, JTAG vs IJTAG

IJTAG (IEEE 1687)

A standard way to describe and access hundreds of on-chip instruments through a reconfigurable scan network, and to write their test procedures once at the instrument level and have a tool retarget them to the chip's pins.

Why 1687 exists

• Scale: one flat user DR per instrument doesn't scale; one long chain containing everything is slow and fragile.
• Reuse: an instrument's access procedure (PDL) is written against its own ports and registers, not against a specific chip.
• Hierarchy: a core's network plugs into the parent's network; procedures stay valid.
• Automation: the tool, not a person, figures out SIB states, path lengths and the order of scans.

The network

TDR

Test data register: a shift stage and (usually) an update stage, like a 1149.1 DR. Its parallel outputs drive instrument inputs; its capture inputs read instrument status.

SIB

Segment insertion bit: 1-bit register that inserts or bypasses a hosted segment. Builds hierarchical, variable-length networks.

ScanMux

Selects between scan segments, controlled by bits elsewhere in the network (e.g. a TDR field). More general than a SIB.

AccessLink

ICL construct connecting the network to the 1149.1 TAP (which instruction opens it). The network can in principle be reached through other ports too.

Instrument

The thing being controlled (MBIST, sensor, PLL). It sees only parallel data ports, never TCK/TMS.

The SIB in detail

ICL and PDL

ICL describes structure: modules, scan in/out ports, scan registers, muxes, data ports and how they connect. PDL describes operation at the instrument's level.

// ICL (simplified): a TDR driving a PLL's controls and capturing its lock status
Module pll_ctrl_tdr {
  ScanInPort si;  ScanOutPort so { Source ST[0]; }
  ShiftEnPort se; CaptureEnPort ce; UpdateEnPort ue;
  SelectPort sel; TCKPort tck;
  DataOutPort div_o[3:0] { Source R[7:4]; }
  DataOutPort byp_o     { Source R[1]; }
  DataInPort  lock;
  ScanRegister R[7:0]  { ScanInSource si;   ResetValue 8'h00; }
  ScanRegister ST[0:0] { ScanInSource R[0]; CaptureSource lock; }
  Alias div[3:0] = R[7:4];
  Alias bypass   = R[1];
}

# PDL (Tcl-based, Level-1): configure the PLL and check lock
iProcsForModule pll_ctrl_tdr
iProc set_div {ratio} {
  iWrite div $ratio          ;# queue writes
  iWrite bypass 0
  iApply                     ;# one retargeted scan (or more)
  iRunLoop 2000 -tck         ;# wait for lock
  iRead ST 1                 ;# expect captured lock = 1
  iApply
}

iWrite / iRead

Queue a write, or an expected read (compare value), on a register field or data port.

iApply

Execute everything queued. The tool may merge operations on different instruments into one scan.

iScan

Raw scan of a register with given data (less common).

iRunLoop

Wait N clock cycles (TCK or a named system clock), e.g. for MBIST to run.

iProc / iCall

Define and invoke reusable procedures, scoped to a module. Calls are hierarchical: iCall coreA.pll.set_div 4.

iClock

Declare that a system clock must be running for the following operations.

iMerge

Allow operations from parallel threads to share scans.

Retargeting

Given ICL for the whole chip and PDL at instrument level, the tool:

1. Finds the path from the TAP to each target register in the ICL graph.
2. Computes the SIB/ScanMux settings needed and the sequence of scans to reach them (opening outer SIBs first).
3. Assembles each scan's bit vector with the right length, placing writes and expected reads at the right offsets. Other bits keep their values.
4. Emits TAP-level patterns (TMS/TDI/expected TDO) for the tester or a testbench, or drives them through a DFT test-setup procedure before scan ATPG.

Questions

Expand all answers

Further reading: ASSET InterTech, ICL and PDL explained · Electronic Design, scan ATPG vs IJTAG retargeting · Nordic Test Forum, IEEE 1687 slides

IEEE 1500 core wrapper

The standard for isolating an embedded core so it can be tested on its own: a boundary register around the core, an instruction register that sets the wrapper's mode, and a serial port that looks like a TAP without the state machine.

What problem 1500 solves

• Isolation: the core can be tested without knowing what surrounds it, and the surroundings (glue logic, other cores) can be tested without the core.
• Reuse: the core provider ships the wrapper plus patterns and a CTL description; the SoC integrator retargets the patterns to chip pins.
• Plug-and-play access: a standard serial control interface, so a chip-level controller can manage dozens of wrappers the same way.
• Scalability: serial access for control and low-bandwidth test, parallel ports for real scan bandwidth.

1500 standardizes the wrapper and its interface. It deliberately does not standardize the chip-level access mechanism (TAM): how WPI/WPO and the WSP reach the pins is the integrator's choice.

Architecture

WSP

Wrapper Serial Port: WSI, WSO, and the WSC control signals WRCK, WRSTN, SelectWIR, ShiftWR, CaptureWR, UpdateWR. TransferDR is an optional extra control, and the standard also allows auxiliary clocks (AUXCK).

WPP

Wrapper Parallel Port (optional): WPI, WPO and WPC (parallel control). This is how real scan data reaches the core: many channels into core chains or EDT.

WIR

Instruction register, with a shift stage and an update stage. Its decoded value sets every WBR cell's mode and picks the register between WSI and WSO. WRSTN resets it asynchronously so the wrapper is transparent (functional mode).

WBY

1-bit bypass, so a chain of many wrapped cores stays short when you only want one.

WBR

Boundary register made of wrapper boundary cells, one per functional port bit (clocks, resets and test pins are typically excluded).

Core data registers

Scan chains, MBIST or other core registers that instructions can put on the serial or parallel path.

Serial control timing

Instructions

Naming: WS_ instructions use the serial port for test data, WP_ the parallel port. The standard mandates WS_BYPASS and WS_EXTEST plus at least one core-test (INTEST-type) instruction. The rest are optional or user-defined.

Wrapper boundary cells

• Events a cell supports: shift (along the WBR), capture (from its functional input), update (copy the shift stage to a hold stage, if the cell has one), and apply (drive its functional output from the stored value).
• Dedicated vs shared: a dedicated cell is a new flop added on the port. A shared cell reuses an existing functional boundary flop. Shared saves area and a mux on the path, but its capture behavior is constrained in each mode. See core wrapping.
• With or without update stage: an update stage keeps outputs steady while the WBR shifts (needed if downstream logic must not see rippling values, e.g. when driving other cores' inputs). Without it, the cell is smaller but outputs ripple during shift.
• Safe values: cells used by WS_SAFE need a way to force a fixed output value independent of the shift data.
• Naming: the standard defines a naming scheme for cell types (names like WC_SD1_CII) that encodes the storage elements and where capture and update happen. It's worth recognizing; you won't be asked to decode it.

Driving wrappers from a TAP or an IJTAG network

• From a TAP: the TAP state machine produces ShiftWR/CaptureWR/UpdateWR, TCK becomes WRCK, and a TAP instruction asserts SelectWIR. Wrappers are daisy-chained; untested cores sit in WS_BYPASS.
• From IJTAG: each wrapper's WIR (or just its mode bits) is a TDR behind a SIB. Only the wrappers you open are in the path. This is how most modern flows do it. Tessent's hierarchical flow, for example, uses 1500-style wrapper cells whose internal/external mode enables are TDR bits in the core's IJTAG network.
• Parallel port at chip level: WPI/WPO connect to chip scan pins or to a shared test bus, often through muxes or channel broadcast, so several cores can be scanned at once.

CTL (IEEE 1450.6)

Core Test Language, an extension of STIL. It describes the core's test modes, wrapper structure, scan chains and pattern references, so the integrator's tools can connect and retarget without reading the core's netlist.

Compliance

The standard distinguishes a wrapped compliant core (wrapper included, described in CTL) from an unwrapped compliant core (no wrapper yet, but with CTL so a compliant wrapper can be added later). You'll also hear "1500-ready" used informally for the second.

1149.1 vs 1500 vs 1687

Questions

Expand all answers

Further reading: Tsiatouhas, IEEE 1500 SECT lecture notes · Arm, IEEE 1500 compliant wrapper boundary register cell · Marinissen et al., Overview of the IEEE P1500 standard · Da Silva, McLaurin, Waayers, The Core Test Wrapper Handbook

Fault models and ATPG

What defects we model, how ATPG finds a pattern for each fault, how faults are classified, and how coverage is computed and debugged.

Fault models

Fault collapsing

An n-input AND has 2n+2 stuck-at faults on its pins. Any input SA0 is equivalent to output SA0 (same tests detect them), so they collapse to n+2 classes. Dominance: output SA1 of an AND is detected by any test for an input SA1, so it can be dropped when targeting. Checkpoint theorem: tests for stuck-at faults on PIs and fanout branches detect all single stuck-at faults in a fanout-free structure. Tools report both collapsed and uncollapsed counts; know which one a coverage number uses.

ATPG algorithms

D-algorithm (Roth)

5-valued algebra (0, 1, X, D, D̄). Propagates the D-frontier forward, justifies the J-frontier backward; decisions on internal nodes.

PODEM (Goel)

Decides only on primary inputs (and scan cells), backtraces objectives to an input, then simulates. Smaller search space and far fewer backtracks than D-alg.

FAN

PODEM plus decisions at headlines and fanout stems, multiple backtrace. Modern tools add learning (static and dynamic implications) and SAT solvers for hard faults.

Backtrack limit

Give up on a fault after N backtracks: it's aborted. Raise the limit or add effort in a second pass to resolve aborts.

Fault simulation

After each pattern, simulate all remaining faults (bit-parallel or concurrent) and drop the ones detected fortuitously. Most faults are detected this way, not by being targeted.

Compaction

Dynamic: after generating a test for one fault, fill remaining don't-cares to detect more targeted faults in the same pattern. Static: afterward, merge compatible patterns and drop redundant ones (reverse-order fault sim).

N-detect

Detect each fault N times through different patterns; improves unmodeled defect coverage at the cost of more patterns.

Transition faults

Why transition coverage is lower than stuck-at: a pattern needs a legal launch (LOC can only launch transitions the logic produces from V1), both launch and capture domains must be pulsed with a known relationship, paths through false/multicycle exceptions must be masked, and non-scan or X sources hit twice. Two-cycle sequential depth also makes ATPG harder. Typical numbers: SA ~99%, TDF ~90–97% depending on design and clocking.

Fault classes and coverage

Test coverage is what you sign off. It's the fraction of faults that can be tested that are tested. Fault coverage penalizes redundant/tied logic you can't do anything about. Always state which one, collapsed or not, and at which level of hierarchy.

Coverage debug: from AU to action

Questions

Expand all answers

Further reading: Fault classes, Mentor terminology · VLSI Space, test vs fault coverage · Wikipedia, fault coverage

Gate-level simulation and SDF

Simulating ATPG patterns on the real netlist, with and without back-annotated timing, to prove they'll pass on good silicon. Also the systematic way to debug a mismatch back to its root cause.

What GLS catches that ATPG and STA don't

• Test setup: IJTAG/TDR programming, test-mode entry sequence, PLL lock time, OCC configuration. ATPG often assumes these (via test procedures); simulation proves them.
• Constraint gaps: a path STA didn't time in the right mode (missing case analysis, over-broad false path), or a clock mux STA assumed static.
• X and initialization: non-reset flops, memories, analog models that go X in simulation.
• Library issues: Verilog model vs Liberty vs ATPG library disagreeing (e.g. scan cell pin function, ICG behavior).
• Glitches on clocks or async resets from muxing or gating in test mode.

SDF annotation

// SDF excerpt
(CELL (CELLTYPE "SDFFRQX1") (INSTANCE u_core/r_state_reg_3_)
  (DELAY (ABSOLUTE
    (IOPATH (posedge CK) Q (0.061:0.078:0.102) (0.058:0.074:0.097))))
  (TIMINGCHECK
    (SETUPHOLD (posedge D) (posedge CK) (0.031:0.040:0.055) (-0.012:-0.008:-0.004))
    (SETUPHOLD (posedge SE) (posedge CK) (0.045:0.058:0.079) (-0.010:-0.006:-0.002))
    (RECREM (posedge RN) (posedge CK) (0.020::0.035) (0.015::0.028))))
(CELL (CELLTYPE "top") (INSTANCE)
  (DELAY (ABSOLUTE (INTERCONNECT u_a/Q u_b/SI (0.004:0.006:0.009)))))

// testbench
initial $sdf_annotate("top_ffg.sdf", dut, , "sdf.log", "MINIMUM");

Triples

(min:typ:max). Pick one with the annotate call or simulator switch. Use the SDF written for the corner you care about: max delays from a slow corner for setup-type checks, min delays from a fast corner for hold.

IOPATH / INTERCONNECT

Cell arc delays and net delays. They fill the specify path delays in the cell models.

TIMINGCHECK

SETUP, HOLD, SETUPHOLD, RECOVERY, REMOVAL, RECREM, WIDTH, PERIOD. They fill $setuphold, $recrem, $width etc.

Negative checks

Negative setup or hold values (common in modern libraries, as above) need the simulator to create delayed internal copies of the signals. Enable negative timing check support (e.g. VCS +neg_tchk; check your simulator's equivalent) or the checks get clamped to 0 and you see false violations.

Annotation log

Read it every time. Instance-name mismatches (escaped names, hierarchy separators, a netlist that doesn't match the SDF) leave cells unannotated and silently fast.

Timing checks, notifiers and X

• Legitimate violations: synchronizer first stages and async CDC flops violate by design. Disable checks on those instances with the simulator's timing-check control file, not globally.
• +notimingcheck disables all checks: fine for zero-delay functional runs, wrong for timing sign-off runs.
• X-pessimism: gate-level X propagation can be pessimistic (reconvergent X), or optimistic in RTL-style models. If a mismatch is X in simulation but ATPG expected a value, check whether the X is real (uninitialized) or a model artifact.

Serial vs parallel-load simulation

Parallel load bypasses the shift path. Chain problems (broken stitching, lockup latches missing, shift hold races) are invisible until you run serial patterns. Always run the chain test pattern set serially with SDF at the fast corner.

A repeatable mismatch debug method

1. Classify: how many patterns fail, which chains/cells, is it every pattern from pattern 0, from pattern N, or scattered? Pattern 0 (or chain test) failing = setup or chain problem. All cells on one chain = shift path. Scattered cells in capture = timing or logic.
2. Zero-delay first: does it fail without SDF? If yes, it's functional (setup sequence, model, X), not timing.
3. Map the mismatch: pattern + cycle + scan-out pin → chain + cell → instance. (Parallel testbenches usually print the instance directly.)
4. Go to the capture of that pattern: dump waves around the capture window, look at the failing cell's D at the capture edge, and compare to ATPG's expected (Tessent can report simulated values per pattern for comparison).
5. Trace back the cone to the first node that differs from ATPG's value or goes X. Check its clock: right number of pulses? Glitch? Check timing check messages at that time.
6. Decide: real timing violation (STA gap → fix constraints/design), setup/procedure mismatch (fix test procedure or ATPG setup), model mismatch (fix library), or known issue (mask).

Questions

Expand all answers

Post-silicon scan debug

Bringing scan up on first silicon, reading chain-test signatures, localizing chain and logic failures, and reading voltage/frequency behavior. This is the part where your day-to-day bring-up experience is the answer.

Bring-up order

• Before silicon: have the chain test, a small stuck-at set and IJTAG setup vectors simulated with SDF at fast and slow corners, in the exact tester format (STIL/WGL), including test-mode entry. Prepare bypass-mode patterns and per-chain patterns.
• Tester setup is a real failure source: timing sets (strobe too early), levels, pin mapping, pattern conversion. Loopback/golden-unit checks rule it out.
• Keep a "known-good" reference die once one passes: compare failing parts against it on the same tester and program.

Chain integrity test

Chain test = load a pattern with SE held at 1 the whole time (no capture), and compare what comes out. It tests the shift path, SE and the scan clocks. Run per chain (bypass mode) to isolate. Also run at different shift frequencies and voltages: a failure that disappears at slow shift is setup/IR-drop; one that persists at any frequency is hold/race or a hard defect.

Chain diagnosis: where is the break?

Consider a chain with a stuck-at-0 at cell k (counting from scan-in). Anything that must shift through cell k reads 0. Now use a capture pattern:

1. Load (the values upstream of k are destroyed by the defect, so ATPG uses patterns whose care values don't depend on those cells, or accepts X for them).
2. Pulse capture: every cell captures from logic, including cells downstream of k (between k and scan-out).
3. Unload: cells downstream of k reach scan-out without passing through k, so their captured values come out correctly. Cells upstream of k all pass through k and come out 0.

The boundary between "matches expected" and "all 0" in the unload stream locates k. Diagnosis tools automate this with dedicated chain diagnosis patterns, handle intermittent and timing (hold/setup) chain faults, and report a ranked list of suspect cells. Hardware assists: chain test at different frequencies and voltages, reading cell values through alternate paths (e.g. other modes), and on the bench laser voltage probing / LVI to see the toggling stop.

Logic failures and diagnosis

Fail log

The tester records failing cycles (vector number + pin), usually limited by fail memory depth. Convert cycle → pattern → shift position → chain → cell using the pattern file and chain map. With compression, a fail is on a compactor output: use compression-aware diagnosis or rerun in bypass.

Diagnosis

Tool (e.g. Tessent Diagnosis) fault-simulates candidate faults and scores how well each explains the failing and passing patterns. Output: suspects (net/cell/pin, fault type like stuck, bridge, open, cell-internal) with scores.

Layout-aware

Adds physical info: bridges only between neighbors, opens on specific via/segments. Narrows the area for PFA.

Volume diagnosis

Diagnose many failing dies and look for systematic patterns (same cell type, same layer, same layout pattern). Feeds yield learning.

PFA

Physical failure analysis at the suspect: delayering, SEM/TEM. Expensive, so diagnosis resolution matters.

Shmoo and voltage corners

• Vmin / LVCC: the lowest voltage that passes at a given frequency. Read it on the wall of the speed-limited plot.
• HVCC: high-voltage stress and screening; also where hold races can get worse (fast data vs clock skew) and where leakage-sensitive defects appear.
• Frequency independence is the key diagnostic: slowing the clock fixes setup problems but not hold problems.
• Temperature: with temperature inversion at advanced nodes, low temperature can be the slow corner at low voltage. Check both hot and cold.
• Guardband: production test limits sit inside the characterized pass region (voltage and frequency margin) to cover tester accuracy, aging and variation.

Triage table

Questions

Expand all answers

Further reading: Advantest, An Introduction to Scan Test for Test Engineers, part 2 · Adolfsson, On Scan Chain Diagnosis for Intermittent Faults

Scan physical design, DFT timing and SDC

What DFT does to placement, routing, clock trees and timing closure, and how test modes are constrained. The basics here (shift hold, modes, case analysis) matter on every page.

Physical aspects

Timing modes

SDC by mode

# ---- shift mode ------------------------------------------------
set_case_analysis 1 [get_ports test_mode]
set_case_analysis 1 [get_ports scan_en]
create_clock -name shift_clk -period 20 [get_ports shift_clk]      ;# 50 MHz
set_input_delay  -clock shift_clk 5 [get_ports scan_in*]
set_output_delay -clock shift_clk 5 [get_ports scan_out*]
set_false_path -from [get_ports scan_en]    ;# static in this mode (it's a case value)

# ---- at-speed capture mode -------------------------------------
set_case_analysis 1 [get_ports test_mode]
set_case_analysis 0 [get_ports scan_en]
create_clock -name pll_clk -period 1.0 [get_pins u_pll/CLKOUT]
create_generated_clock -name occ_core_clk -source [get_pins u_pll/CLKOUT] \
    -divide_by 1 [get_pins u_occ_core/clk_out]
# reuse functional exceptions (false paths, multicycles) for this domain
set_multicycle_path 2 -setup -from [get_clocks occ_core_clk] -to [get_clocks occ_core_clk] -through [get_pins u_div/*]
# SE is quasi-static in LOC: it changes only outside the capture window
set_false_path -from [get_ports scan_en]

# ---- JTAG ------------------------------------------------------
create_clock -name tck -period 50 [get_ports tck]
set_input_delay  -clock tck 10 [get_ports {tms tdi}]
set_output_delay -clock tck 10 -clock_fall [get_ports tdo]   ;# TDO launched on falling TCK
set_clock_groups -asynchronous -group tck -group [get_clocks pll_clk]

Mode merging

MMMC setups often merge compatible modes to cut run time: at-speed capture is close to functional mode, but shift must stay separate (SE=1 case changes which paths exist, and clocks differ). If you merge, use set_clock_groups -physically_exclusive or -logically_exclusive for clocks sharing a net.

Case analysis correctness

One wrong set_case_analysis can hide a whole class of paths. Review test-mode case values against the actual DFT setup (IJTAG TDR values, OCC settings) that ATPG and GLS use.

Handoff

Timing exceptions from SDC should feed ATPG (so it masks false/MCP endpoints at speed) and ATPG's clocking assumptions should match STA's test modes. Mismatches here are what cause "passes STA, fails tester at speed".

DFT timing convergence: the usual problems

1. Shift hold: thousands of small violations after CTS. Reorder clock-aware, fix with hold buffers at SI pins, and review large-skew crossings for lockup latches.
2. Test clock mux / OCC paths: glitch-free mux internal timing, clock-chain flop timing, and paths between slow and fast clocks inside OCC need proper exceptions, not blanket false paths.
3. SE: transition/fanout violations on the SE tree; for LOS, real setup/hold at speed.
4. Scan IO: scan-in/out through pads at shift frequency, with pad delays at corners.
5. Test-mode-only paths: bypass muxes (memory bypass, clock bypass), test points, wrapper cells. These exist only in test and are easy to leave unconstrained.
6. Signoff coverage: make sure every test mode is in the signoff MMMC matrix at every corner where it's hold/setup critical.

Questions

Expand all answers

EDT deep dive: signals, interface and behavior

What the EDT block looks like from the outside, what each control signal does cycle by cycle, how a compressed pattern is actually applied, and what breaks when any of it is wrong. Tessent names are used because they're the common vocabulary; the concepts carry over to other compression schemes.

The interface

A compressed pattern, cycle by cycle

1. Update cycle. SE is high, edt_update is high, one edt_clock pulse, chain clocks off. The ring generator resets to a known state and the mask bits collected during the previous load move into the mask hold register.
2. Initialization cycles. ⌈decompressor size ÷ channels⌉ cycles of channel data fill the ring generator before its outputs mean anything (e.g. a 64-bit ring with 8 channels → 8 cycles). The chains shift during these cycles too; the data that enters them falls off the far end by the time the load finishes.
3. Shift cycles. L cycles, L = the longest internal chain. The EDT clock and the chain clocks pulse together. Each cycle, the decompressor turns n channel bits into one bit per internal chain; the compactor XORs the masked chain outputs into n channel outputs.
4. Capture. SE falls, the EDT clock stays off, one or more capture pulses (OCC). EDT state is preserved.
5. Repeat. The next update pulse starts pattern k+1, whose shift cycles also unload pattern k's response.

How ATPG uses this: each care bit in the chains is a linear (XOR) combination of channel bits injected so far. ATPG builds those equations for the care bits of a pattern and solves them; if they can't all be satisfied, some target faults move to another pattern. That's why dense patterns and high compression ratios cost pattern count.

Masking

• Why mask: an X in any chain feeding a compactor XOR makes that output X for that cycle, hiding every other chain on it. Masking forces the X chain's output to 0 for the pattern.
• How: mask bits are part of the compressed data. They're shifted into the mask shift register during the load, transferred to the mask hold register by the next update pulse, decoded (typically one chain, a group, or none masked), and applied at the compactor inputs during the next unload.
• Cost: a masked chain is unobservable for that whole pattern, so heavy masking means more patterns and coverage loss. Fix X at the source when you can.
• Debug use: "one-hot" masking (observe one chain at a time) turns the compactor into a transparent path for one chain. Useful for diagnosis without going to bypass.

Clocking and timing inside EDT

• Two clock domains that must behave as one in shift: the EDT clock (decompressor, masks, pipelines) and the chain clocks. They're pulsed together, but they reach flops through different trees. Where the EDT logic hands off to a chain, or a chain hands off to the compactor, lockup cells absorb the skew, exactly like domain crossings inside a chain.
• EDT logic is shift-mode logic: timed at shift frequency with SE=1 case analysis. Hold dominates, like chains. The decompressor and compactor have real XOR depth, so at high shift frequency setup can matter too.
• Channel pipelines: long routes between pins and EDT blocks get pipeline flops on both the input and output channels. They add latency; ATPG and the pattern files must know the count. Identical broadcast destinations need equal pipeline depth.
• edt_update timing: it's quasi-static (it changes only between cycles with no conflicting clock), so it's usually constrained like SE: case analysis per mode, plus a check that it settles before the update pulse.
• Capture: the EDT clock must be off. If the EDT clock is derived from a shared clock source, the gating must guarantee no pulse in the capture window.

Bypass and configurations

What actually breaks, and how you'd see it

Questions

Expand all answers

Sources: EDT compressor and controller (mask registers, edt_update) · EDT decompressor (ring generator, phase shifter) · EDT user manual excerpts (EDT clock off in capture, initialization cycles, lockups, pipelines) · EDN, test compression

Test-mode timing: pins, scan enable and capture

The timing questions that come up once you've explained scan: how a scan bit gets from a GPIO pin into the first cell safely, why scan-out is a tester strobe problem, how you guarantee capture only happens after scan enable has settled everywhere, and which checks belong to which mode.

Scan-in from a pin

Put numbers on it. Tester period T, data driven at the start of the cycle, clock edge at the pin at T/2. The first cell sees data after t_in and the clock after t_clk:

• Insertion delay eats hold margin. Every ns of clock tree between the pin and the first cell comes straight out of the margin. Scan clocks through an OCC and a big tree can have several ns.
• Tester edge placement matters. The T/2 in the formula is the tester's choice. Moving the clock edge earlier relative to data drive (or driving data later) changes the margin. That's why test engineers and DFT agree on a timing set per pattern type.
• Slowing shift helps hold here, unlike on-chip hold, because the margin contains T/2. It's still the wrong first fix; fix the path.
• Fixes: hold buffers on the scan-in route (the setup side has lots of room), a retiming flop right after the pad clocked from a low-insertion point or on the opposite edge, or a pipeline stage between pad and EDT inputs, which ATPG then has to know about.

# shift mode, T = 20 ns. Tester drives SI at 0, pulses scan_clk rising at 10.
create_clock -name scan_clk -period 20 -waveform {10 15} [get_ports scan_clk]
# virtual clock = the tester's drive/strobe reference
create_clock -name ate -period 20 -waveform {0 10}
set_input_delay  -clock ate 1.0 [get_ports {scan_in*}]    ;# tester + board skew
set_output_delay -clock ate 3.0 [get_ports {scan_out*}]   ;# strobe setup + board
set_case_analysis 1 [get_ports scan_en]
set_case_analysis 1 [get_ports test_mode]
set_propagated_clock [all_clocks]

Scan-out to the tester

• It's a window, not a single number. Early strobes see the previous bit, late strobes see the next one. At slow shift the window is wide and centered wherever you like. As shift speeds up the window shrinks and moves relative to the tester edge.
• Fixes: strobe later or in the following cycle (the tester program then accounts for the one-cycle offset), a retiming flop or lockup latch near the output pad to hold the data longer, better pad drive, or lower shift frequency.
• Pipelines change the pattern, not just timing. Any retiming flop in the scan-in or scan-out path adds a cycle of latency. The pattern generation setup has to include it, otherwise every compare is shifted by one.

GPIO pad details that come up

Making sure capture happens after SE has settled

Scan enable is a very high-fanout net that has to change twice per pattern: fall before capture, rise before the next shift. Two conditions per transition:

1. Falling edge, early side (hold): SE must not reach any cell before the last shift edge plus hold, or that cell captures functional data instead of its shift neighbor. Because SE is launched from the tester or a flop clocked by the same shift clock, this is an ordinary hold check.
2. Falling edge, late side (setup): SE must reach the farthest cell and settle before the capture edge minus setup. In LOC there's plenty of time if the protocol adds dead cycles or if the OCC takes a few cycles to synchronize SE before it releases capture pulses. In LOS the launch happens on the last shift edge, so SE has only one at-speed period to fall everywhere.
3. Rising edge: after capture, SE must reach every cell before the first shift edge of the next load. Usually easy at shift speed, but check it.

Which checks belong to which mode

Questions

Expand all answers

SSN: Streaming Scan Network

SSN is how Tessent delivers scan data to many cores through a fixed-width, packetized bus instead of wiring each core's EDT channels to chip pins. Below: the problem it solves, how the bus and packets work, how it's configured, what it changes for timing and debug, and how to answer if "SSN" turns out to mean simultaneous switching noise.

The problem it solves

• Pins don't scale with cores. A chip with dozens of cores, each with several EDT channels, can't bring every channel to a pin. Pin-muxed schemes test cores in groups, and the grouping is frozen in hardware.
• Padding waste. When cores tested together have different chain lengths or pattern counts, the shorter ones wait. The tester is busy but those cores aren't getting useful data.
• Late changes are expensive. If a core's pattern count grows late in the project, the best grouping changes, but the top-level muxing is already built.
• Scan enable and capture must be coordinated globally when many cores share pins, which makes top-level timing harder.

The bus and the hosts

Packets

• Packet size = sum of the channel bits every active host needs for one internal shift cycle. It's independent of bus width.
• No wasted bus bits. Packets don't need to align with bus cycles, so an odd total doesn't leave idle lanes.
• Independent shift. A core with a shorter chain can finish its load and wait, or be given fewer bits per packet; hosts manage their own shift and capture timing within the pattern.
• Shift rate per core ≈ bus bits per second ÷ packet size. Adding active cores makes packets bigger, so each core shifts slower, but the tester pins are always fully used.

SSN vs. pin-muxed channels

Published results from Siemens and users report large test time reductions (Siemens cites up to several times on some designs, and Intel has reported double-digit percentage cycle reductions). Treat these as published results, not guarantees.

Timing and debug implications

• The bus is a timing path like any other. Hop to hop between hosts at the bus frequency; long hops get pipeline stages. Identical cores that share broadcast data should see equal pipeline depth.
• Local scan enable. Because each host generates its own core's SE and EDT controls, the huge chip-wide SE tree goes away. The SE timing problem from the timing page becomes a per-core problem, clocked locally.
• Clock crossing at the host. The host bridges the bus clock and the core's shift clock. Treat it like any other domain crossing in shift mode: lockups or designed handshakes, and constraints from the tool's generated SDC.
• Debug path. Bring up the IJTAG network first, then the SSN bus in a simple configuration (one host active, known data), then each core's EDT in bypass through its host, then compressed patterns. Same ladder as always, one layer more.
• Diagnosis. Fails come back as bus positions and cycles; the tool maps them back to core, channel and pattern. With on-chip compare you get pass/fail per host, and you rerun the failing core in a streaming (not compare) setup for full fail data.

If they meant simultaneous switching noise

SSN is also the old abbreviation for simultaneous switching noise, and it's relevant to test. It's fine to ask "streaming scan network or switching noise?" and then answer. The short version:

• Core side: during shift, many flops toggle every cycle; during capture, a large fraction of the logic switches at once. That draws current spikes and causes IR drop and ground bounce, which slow paths (false at-speed fails) or corrupt shift. Mitigations: low-power fill (fill don't-care bits to reduce toggling), shift at lower frequency, Q-gating, staggered or partitioned capture clocks, capture power limits in ATPG. See the low-power scan page.
• IO side: many output pads switching together (scan-out pins, boundary scan EXTEST) cause bounce on the IO supply. Mitigations: limit simultaneous outputs, stagger, proper power/ground pad ratios.

Questions

Expand all answers

Sources: Siemens white paper, Tessent Streaming Scan Network · SemiEngineering, SSN: an efficient packetized data network · 2020 ITC paper (Siemens blog) · On-chip compare and diagnosis with SSN

Scripting exercises

The scripts a DFT engineer actually writes: read a file line by line, pull out what you need with a regex, count or group it in a dictionary, print a clean report. No computer-science tricks needed. Each problem opens to plain-language steps, then a hint, pseudo-code and a short tested Python solution.

The Python you actually need

Almost every problem below uses only these pieces.

for line in open("run.log"):
    line = line.strip()          # remove spaces and the newline at the end
    if not line or line.startswith("#"):
        continue                 # skip blank lines and comments

for line_no, line in enumerate(open("run.log"), start=1):
    ...

parts = "chain1  u_core/a_reg_0_".split()   # ['chain1', 'u_core/a_reg_0_']
chain, cell = parts

import re
m = re.search(r"pattern=(\d+)\s+chain=(\S+)", line)
if m:
    pattern = int(m.group(1))    # first ( ) group
    chain = m.group(2)           # second ( ) group
# \d digit   \w letter/digit/_   \S non-space   \s space   + one or more   * zero or more   . any char

counts = {}
for word in ["C4", "S1", "C4"]:
    counts[word] = counts.get(word, 0) + 1   # .get returns 0 the first time
# counts == {"C4": 2, "S1": 1}

files_of = {}
files_of.setdefault("core", []).append("rtl/core.v")   # creates the list the first time

for name in sorted(counts):                                  # by name
    ...
for name in sorted(counts, key=lambda k: counts[k], reverse=True):   # biggest count first
    ...

before = {"a", "b", "c"}
after  = {"b", "c", "d"}
before - after    # {'a'}   removed
after - before    # {'d'}   added
before & after    # {'b', 'c'} in both

import os
for folder, subfolders, files in os.walk("rtl"):
    for name in files:
        if name.endswith(".v"):
            path = os.path.join(folder, name)

print(f"{name:12s} {count:4d}  {slack:+.3f}")   # padded name, 4-wide int, signed 3 decimals

import sys
log_path = sys.argv[1]           # python3 summary.py run.log

def read_flist(path, files):
    for line in open(path):
        if line.startswith("-f"):
            read_flist(line.split()[1], files)   # a nested list: handle it exactly the same way
        else:
            files.append(line.strip())
# Use it when the data nests inside itself: file lists that include file lists,
# modules that contain modules. Each call handles one level.

File formats you'll be handed

Simulator file list (flist)

// top.f
+incdir+rtl/include           // where `include files live
+define+SYNTH                 // a macro
rtl/top.v                     // a source file
rtl/core.v
-f rtl/sub/sub.f              // another file list, read it too
-v $LIBDIR/cells.v            // library file
rtl/top.v                     // duplicate: keep the first one

-f means "read this other list too". Lines starting with + or - are options, not files. Comments are // or # depending on the tool.

RTL vs post-synthesis netlist

module core #(parameter W = 8) (   // RTL: directions inside ( )
  input          clk,
  input  [W-1:0] a,
  output [W-1:0] y
);
  alu #(.W(W)) u_alu (.a(a), .y(y));   // instance: TYPE #(params) NAME ( ... );
  always @(posedge clk) ...            // behavior, no gates yet
endmodule

module core_W8_0 ( clk, a, y, si, se );      // netlist: names only in ( )
  input clk, si, se;                             // directions declared below
  input [7:0] a;
  output [7:0] y;
  wire n12, n13;
  alu_W8_1 u_alu ( .a(a), .y({n12, n13}) );      // child module, renamed by synthesis
  SDFFRQX1 \y_reg[0]  ( .D(n12), .SI(si), .SE(se), .CK(clk), .Q(y[0]) );
  AOI22X1 U137 ( .A0(a[2]), .A1(n12), .B0(n13), .B1(y[0]), .Y(n14) );
endmodule

Warm-ups

Expand all problems

// Tessent-style log excerpt (made up)
Info: Reading netlist top.v
Warning: Clock 'clk_div' is gated by non-test logic. (C4)
Warning: Clock 'clk_aux' is gated by non-test logic. (C4)
Error: Scan cell u_core/r_reg_3_ has uncontrollable reset. (S1)
Warning: Clock 'clk_div' is gated by non-test logic. (C4)
Info: 12,480 scan cells found
Error: Scan cell u_core/q_reg_7_ has uncontrollable reset. (S1)
Warning: Non-scan cell u_pll/lock_q is an X source. (D5)

for each line (with its number):
    if it looks like "Error: ... (ID)" or "Warning: ... (ID)":
        key = kind + ID
        counts[key] += 1
        if key not seen before: first_line[key] = line number
print each key, its count and first line

import re

def log_summary(path):
    """Count errors and warnings by message ID, remember where each first appeared."""
    counts = {}          # "Warning C4" -> how many times
    first_line = {}      # "Warning C4" -> first line number where it appeared
    for line_no, line in enumerate(open(path), start=1):
        m = re.match(r"(Error|Warning):.*\((\w+)\)\s*$", line)
        if not m:
            continue
        key = m.group(1) + " " + m.group(2)          # e.g. "Warning C4"
        counts[key] = counts.get(key, 0) + 1
        if key not in first_line:
            first_line[key] = line_no
    for key in sorted(counts):
        print(f"{key:12s} x{counts[key]:<3d} first at line {first_line[key]}")
    return counts

Error S1     x2   first at line 5
Warning C4   x3   first at line 3
Warning D5   x1   first at line 9

rtl/
  top.v
  core.v
  sub/alu.v
search word: DFFX1

for each folder, files under root:
    for each file ending in .v or .sv:
        for each line (with number):
            if word in line: print path:number: line

import os

def grep(root, word, exts=(".v", ".sv")):
    """Print file:line: text for every line that contains word, in all Verilog files under root."""
    hits = 0
    for folder, subfolders, files in os.walk(root):
        for name in sorted(files):
            if not name.endswith(exts):
                continue
            path = os.path.join(folder, name)
            for line_no, line in enumerate(open(path), start=1):
                if word in line:
                    print(f"{path}:{line_no}: {line.strip()}")
                    hits += 1
    return hits

rtl/core.v:3: DFFX1 r0 (.D(a[0]), .CK(clk), .Q(y[0]));
rtl/sub/alu.v:2: DFFX1 f0 (.D(a[0]));
rtl/sub/alu.v:3: DFFX1 f1 (.D(a[1]));

File lists and Verilog

// top.f
+incdir+rtl/include           // where `include files live
+define+SYNTH                 // a macro
rtl/top.v                     // a source file
rtl/core.v
-f rtl/sub/sub.f              // another file list, read it too
-v $LIBDIR/cells.v            // library file
rtl/top.v                     // duplicate: keep the first one

function read_flist(path, files):
    for each line in path:
        remove comments; skip if empty
        if line starts with "-f": read_flist(nested path, files)
        else if line starts with + or -: skip (option)
        else if line not in files: add it
    return files

import os

def read_flist(path, files=None):
    """Return the list of source files in a file list, following nested -f files.
    Paths are taken relative to where the script runs (the -f convention)."""
    if files is None:
        files = []                                   # first call: start an empty list
    for line in open(path):
        line = line.split("//")[0].split("#")[0].strip()   # drop comments
        if not line:
            continue
        parts = line.split()
        if parts[0] == "-f":                         # nested file list: read it the same way
            read_flist(parts[1], files)              # <- the function calls itself
        elif line.startswith("+") or line.startswith("-"):
            continue                                 # +incdir+, +define+, -v, -y ... skipped here
        elif line not in files:                      # keep first occurrence only
            files.append(line)
    return files

['rtl/top.v', 'rtl/core.v', 'rtl/sub/alu.v']

rtl/top.v:      module top ( ... ); ... endmodule
rtl/core.v:     module core ( ... ); ... endmodule
rtl/core_old.v: module core ( ... ); ... endmodule    <- duplicate

for each file:
    text = file contents without comments
    for each "module NAME" in text:
        where[NAME].append(file)
for each NAME: print NAME and its files, flag if more than one

import re

def remove_comments(text):
    text = re.sub(r"/\*.*?\*/", "", text, flags=re.S)   # /* ... */ blocks, can span lines
    return re.sub(r"//.*", "", text)                     # // to end of line

def module_map(paths):
    """Return {module_name: [files that define it]}."""
    where = {}
    for path in paths:
        text = remove_comments(open(path).read())
        for name in re.findall(r"\bmodule\s+(\w+)", text):
            where.setdefault(name, []).append(path)
    return where

def print_report(where):
    for name in sorted(where):
        files = where[name]
        flag = "   <-- defined more than once!" if len(files) > 1 else ""
        print(f"{name:12s} {', '.join(files)}{flag}")

alu          rtl/sub/alu.v
core         rtl/core.v, rtl/core_copy.v   <-- defined more than once!
pll          ip/pll/pll.v
top          rtl/top.v

module top(...);  core u_core (...);  core u_core2 (...);  pll u_pll (...);  endmodule
module core(...); alu u_alu (...);    DFFX1 r0 (...);                       endmodule
module alu(...);  DFFX1 f0 (...);     DFFX1 f1 (...);                       endmodule

table = {module: [(child_type, inst_name), ...]}      # step 1

function find(module, path):                          # step 2
    for each (child_type, inst_name) in table[module]:
        child_path = path + "/" + inst_name
        if child_type == X: record child_path
        if child_type is in table: find(child_type, child_path)

find("top", "top")

import re

KEYWORDS = {"module", "input", "output", "inout", "wire", "reg", "assign", "always",
            "if", "else", "begin", "end", "for", "case", "parameter", "localparam"}

def remove_comments(text):
    text = re.sub(r"/\*.*?\*/", "", text, flags=re.S)
    return re.sub(r"//.*", "", text)

def read_modules(paths):
    """Return {module_name: [(child_type, instance_name), ...]} from Verilog files.
    Handles 'type name (' and 'type #(params) name (' on one statement."""
    modules = {}
    for path in paths:
        text = remove_comments(open(path).read())
        for m in re.finditer(r"\bmodule\s+(\w+)(.*?)\bendmodule", text, flags=re.S):
            name, body = m.group(1), m.group(2)
            children = []
            for statement in body.split(";"):
                inst = re.match(r"\s*(\w+)\s*(?:#\s*\(.*\))?\s*(\\\S+|\w+)\s*(\[[^\]]*\])?\s*\(",
                                statement, flags=re.S)
                if inst and inst.group(1) not in KEYWORDS:
                    children.append((inst.group(1), inst.group(2).lstrip("\\")))
            modules[name] = children
    return modules

def find_instances(modules, top, target, path=None, found=None):
    """Every hierarchical path under top whose instance type is target."""
    if path is None:
        path, found = top, []
    for child_type, inst_name in modules.get(top, []):
        child_path = path + "/" + inst_name
        if child_type == target:
            found.append(child_path)
        if child_type in modules:                 # it's one of our modules: look inside it too
            find_instances(modules, child_type, target, child_path, found)
    return found

top/u_core/u_alu/f0
top/u_core/u_alu/f1
top/u_core/r0
top/u_core2/u_alu/f0
top/u_core2/u_alu/f1
top/u_core2/r0

// RTL style
module m (input wire [3:0] a, b, output reg y);

// netlist style
module alu_W8_0 ( clk, a, y );
  input clk;
  input [7:0] a;
  output [7:0] y;

name, header, body = regex on the module
if header has "input"/"output":
    for each comma-separated item: take direction/range if present, else reuse previous
else:
    for each statement in body: if it starts with input/output, record direction/range for each name
    print ports in header order

import re

def port_list(text):
    """Return (module_name, [(port, direction, range)]) for the first module in text.
    Works for ANSI headers (RTL) and non-ANSI headers (netlists)."""
    text = re.sub(r"/\*.*?\*/", "", text, flags=re.S)
    text = re.sub(r"//.*", "", text)
    m = re.search(r"\bmodule\s+(\w+)\s*(?:#\s*\(.*?\)\s*)?\((.*?)\)\s*;(.*?)\bendmodule", text, flags=re.S)
    name, header, body = m.group(1), m.group(2), m.group(3)
    decl = r"(input|output|inout)\s+(?:wire\s+|reg\s+|logic\s+)?(\[[^\]]*\])?\s*(.*)"

    ports = []
    if re.search(r"\b(input|output|inout)\b", header):        # ANSI: directions are in the header
        direction, rng = None, ""
        for item in header.split(","):
            d = re.match(decl, item.strip(), flags=re.S)
            if d:                                              # new direction on this item
                direction, rng, pname = d.group(1), d.group(2) or "", d.group(3)
            else:                                              # same direction as the item before
                pname = item
            ports.append((pname.strip(), direction, rng))
    else:                                                      # non-ANSI: names only in the header
        info = {}
        for statement in body.split(";"):
            d = re.match(decl, statement.strip(), flags=re.S)
            if d:
                for pname in d.group(3).split(","):
                    info[pname.strip()] = (d.group(1), d.group(2) or "")
        for pname in header.split(","):
            pname = pname.strip()
            if pname:
                ports.append((pname,) + info.get(pname, ("?", "")))
    return name, ports

('core', [('clk', 'input', ''), ('a', 'input', '[W-1:0]'), ('y', 'output', '[W-1:0]')])
('alu_W8_0', [('clk', 'input', ''), ('rst_n', 'input', ''), ('a', 'input', '[7:0]'), ...])

Netlists

  SDFFRQX1 \y_reg[0]  ( .D(n1), .SI(si), .SE(scan_en), .CK(clk), .RN(rst_n), .Q(y[0]) );
  DFFRQX1 cnt_reg ( .D(n3), .CK(clk), .RN(rst_n), .Q(n4) );
  AND2X1 U12 ( .A(a[0]), .B(b[0]), .Y(n1) );

for each statement in netlist split on ";":
    skip declarations
    type, name, pins = parse it
    counts[type] += 1
    if pins has CK and D but no SI: non_scan.append(name)

import re

def read_cells(path):
    """Return a list of (cell_type, instance_name, {pin: net}) for every instance in a netlist."""
    text = open(path).read()
    text = re.sub(r"//.*", "", text)
    cells = []
    for statement in text.split(";"):                  # one statement can span many lines
        words = statement.split()
        if not words or words[0] in ("module", "endmodule", "input", "output", "inout",
                                      "wire", "assign", "reg"):
            continue
        m = re.match(r"\s*(\w+)\s+(\\\S+|\w+)\s*\((.*)\)\s*$", statement, flags=re.S)
        if not m:
            continue
        cell_type, inst = m.group(1), m.group(2).lstrip("\\")
        pins = dict(re.findall(r"\.(\w+)\s*\(\s*([^()]*?)\s*\)", m.group(3)))
        cells.append((cell_type, inst, pins))
    return cells

def cell_counts(cells):
    counts = {}
    for cell_type, inst, pins in cells:
        counts[cell_type] = counts.get(cell_type, 0) + 1
    return counts

def non_scan_flops(cells):
    """Flops without a scan-in pin. Checking the SI pin is more reliable than the cell name."""
    result = []
    for cell_type, inst, pins in cells:
        is_flop = "CK" in pins and "D" in pins
        if is_flop and "SI" not in pins:
            result.append(inst)
    return result

{'SDFFRQX1': 2, 'DFFRQX1': 1, 'AND2X1': 1, 'XOR2X1': 1, 'INVX1': 1, 'BUFX2': 1, 'alu_W8_0': 1, 'LATNQX1': 1}
['cnt_reg']

  SDFFRQX1 \y_reg[0]  ( ..., .SI(si),   ..., .Q(y[0]) );
  SDFFRQX1 \y_reg[1]  ( ..., .SI(y[0]), ..., .Q(y[1]) );
  BUFX2 U15 ( .A(y[1]), .Y(so) );

si_of = {net: flop whose SI is on net}
net = scan_in
while True:
    if net in si_of: record the flop; net = its Q
    elif a buffer reads net: net = buffer output
    else: stop
print the order and the final net (should be a scan-out port)

def trace_chain(cells, scan_in_net):
    """Follow a scan chain: find the cell whose SI is on the current net, move to its Q, repeat.
    cells: list of (cell_type, instance, {pin: net}) as returned by read_cells()."""
    si_of = {}        # net -> scan cell whose SI pin is on that net
    buf_in = {}       # net -> buffer whose input is on that net (chains often pass through buffers)
    for cell_type, inst, pins in cells:
        if "SI" in pins:
            si_of[pins["SI"]] = (inst, pins)
        elif cell_type.startswith("BUF"):
            buf_in[pins.get("A")] = (inst, pins)

    order = []
    net = scan_in_net
    while True:
        if net in si_of:
            inst, pins = si_of[net]
            order.append(inst)
            net = pins["Q"]
        elif net in buf_in:
            inst, pins = buf_in[net]
            net = pins["Y"]                  # step through the buffer, don't count it
        else:
            break                            # nothing continues: this net is the chain's end
        if len(order) > 1_000_000:
            raise RuntimeError("chain loops back on itself?")
    return order, net

(['y_reg[0]', 'y_reg[1]'], 'so')

Tester logs and reports

# tester: pattern=... lines
pattern=12 chain=c3 cell=40 expected=1 actual=0
pattern=13 chain=c3 cell=40 expected=1 actual=0
pattern=13 chain=c1 cell=7 expected=0 actual=1
pattern=20 chain=c3 cell=40 expected=1 actual=0

# chain map: <chain> <cell> <instance>
c3 40 top/u_core/u_alu_2/f1
c1 7 top/u_pll/lock_q

cmap = {(chain, cell): instance}  from the chain map
for each fail line: fails[(chain, cell)] += 1
for key in fails, biggest first: print count, key, cmap.get(key, "missing")

import re

def read_chain_map(path):
    """chain map lines: '<chain> <cell_index> <instance>'  ->  {(chain, index): instance}"""
    cmap = {}
    for line in open(path):
        parts = line.split()
        if len(parts) == 3 and not line.startswith("#"):
            cmap[(parts[0], int(parts[1]))] = parts[2]
    return cmap

def fail_summary(log_path, cmap):
    """Count fails per (chain, cell); print worst first with the instance name."""
    fails = {}
    for line in open(log_path):
        m = re.search(r"pattern=(\d+)\s+chain=(\S+)\s+cell=(\d+)\s+expected=(\d)\s+actual=(\d)", line)
        if not m:
            continue
        key = (m.group(2), int(m.group(3)))
        fails[key] = fails.get(key, 0) + 1
    for key in sorted(fails, key=lambda k: fails[k], reverse=True):
        inst = cmap.get(key, "<not in chain map>")
        print(f"{fails[key]:4d} fails  {key[0]}[{key[1]}]  {inst}")
    return fails

   3 fails  c3[40]  top/u_core/u_alu_2/f1
   1 fails  c1[7]  top/u_pll/lock_q

  Startpoint: u_core/reg_a (rising edge-triggered flip-flop clocked by clk_core)
  Endpoint: u_core/reg_b (rising edge-triggered flip-flop clocked by clk_core)
  Path Group: clk_core
  Path Type: max
  slack (VIOLATED)   -0.042
  Startpoint: u_core/reg_c (rising edge-triggered flip-flop clocked by clk_core)
  Endpoint: u_core/reg_d (rising edge-triggered flip-flop clocked by clk_core)
  Path Group: clk_core
  Path Type: min
  slack (MET)   0.013
  Startpoint: tck_in (input port clocked by tck)
  Endpoint: u_tap/ir_reg_0 (rising edge-triggered flip-flop clocked by tck)
  Path Group: tck
  Path Type: max
  slack (VIOLATED)   -0.200

group = None
for each line:
    if "Path Group:" in line: group = the name
    if it's a slack line:
        slack = number
        if slack < 0: wns[group] = min(...); tns[group] += slack; count[group] += 1
print per group

import re

def timing_summary(path):
    """Worst slack (WNS), total negative slack (TNS) and number of failing paths per path group."""
    results = {}                  # group -> [wns, tns, count]
    group = None
    for line in open(path):
        m = re.search(r"Path Group:\s*(\S+)", line)
        if m:
            group = m.group(1)                         # remember which group this path belongs to
        m = re.search(r"slack\s*\(\w+\)\s*(-?[\d.]+)", line)
        if m and group:
            slack = float(m.group(1))
            if group not in results:
                results[group] = [0.0, 0.0, 0]
            if slack < 0:
                results[group][0] = min(results[group][0], slack)
                results[group][1] += slack
                results[group][2] += 1
    for group, (wns, tns, n) in results.items():
        print(f"{group:10s} WNS {wns:+.3f}  TNS {tns:+.3f}  failing {n}")
    return results

clk_core   WNS -0.042  TNS -0.042  failing 1
tck        WNS -0.200  TNS -0.200  failing 1

before:                         after:
chain1  u_core/a_reg_0_           chain1  u_core/a_reg_0_
chain1  u_core/a_reg_1_           chain1  u_core/b_reg_0_
chain1  u_core/a_reg_2_           chain1  u_core/a_reg_2_
chain2  u_core/b_reg_0_           chain2  u_core/a_reg_1_
chain2  u_core/b_reg_1_           chain2  u_core/b_reg_1_
chain2  u_core/spare_reg          chain2  u_core/new_reg

before = {cell: chain}, after = {cell: chain}
for cell in before:
    if cell not in after: removed
    elif chains differ: moved
for cell in after not in before: added

def read_chains(path):
    """'<chain> <cell>' per line, in scan order  ->  {cell: (chain, position)}"""
    where = {}
    position = {}
    for line in open(path):
        parts = line.split()
        if len(parts) != 2:
            continue
        chain, cell = parts
        position[chain] = position.get(chain, -1) + 1
        where[cell] = (chain, position[chain])
    return where

def chain_diff(before_path, after_path):
    before, after = read_chains(before_path), read_chains(after_path)
    for cell in sorted(before):
        if cell not in after:
            print(f"removed : {cell} (was {before[cell][0]})")
        elif before[cell][0] != after[cell][0]:
            print(f"moved   : {cell} {before[cell][0]} -> {after[cell][0]}")
    for cell in sorted(after):
        if cell not in before:
            print(f"added   : {cell} ({after[cell][0]})")

moved   : u_core/a_reg_1_ chain1 -> chain2
moved   : u_core/b_reg_0_ chain2 -> chain1
removed : u_core/spare_reg (was chain2)
added   : u_core/new_reg (chain2)

Bits and numbers

count_ones(0b1011) -> 3
reverse_bits(0b0011, 4) -> 0b1100 (12)
hex_to_bits('0x3A', 8) -> '00111010'
cycle_to_cell(1202, setup=1000, chain_length=100) -> (2, 99)

count_ones(x): count "1" characters in bin(x)
get_bit(x, n): (x >> n) & 1
set_bit(x, n): x | (1 << n)
clear_bit(x, n): x & ~(1 << n)
cycle_to_cell: offset = cycle - setup
               pattern = offset // (L + capture)
               position = offset % (L + capture)
               cell = L - 1 - position

def count_ones(value):
    """Number of 1 bits, e.g. to count toggles or check parity."""
    return bin(value).count("1")

def parity(value):
    return count_ones(value) % 2              # 1 = odd number of ones

def get_bit(value, n):
    return (value >> n) & 1

def set_bit(value, n):
    return value | (1 << n)

def clear_bit(value, n):
    return value & ~(1 << n)

def reverse_bits(value, width):
    result = 0
    for i in range(width):
        if get_bit(value, i):
            result = set_bit(result, width - 1 - i)
    return result

def hex_to_bits(hex_string, width):
    """'0x3A', 8 -> '00111010' (MSB first)"""
    return format(int(hex_string, 16), f"0{width}b")

def cycle_to_cell(cycle, setup_cycles, chain_length, capture_cycles=1):
    """Tester fail cycle -> (pattern, cell index). Assumes each pattern = shift of chain_length + capture.
    The first bit out of the chain comes from the cell nearest scan-out."""
    offset = cycle - setup_cycles
    per_pattern = chain_length + capture_cycles
    pattern = offset // per_pattern
    shift_pos = offset % per_pattern
    cell = chain_length - 1 - shift_pos
    return pattern, cell

3 1 12 00111010
(2, 99)
(2, 0)

Stretch: only if you have time

These come up less often. Knowing the idea in plain words is enough; you'd write them the same way as the problems above.

Fan-in cone

"Which flops and inputs feed this flop's D pin?" Build a dictionary net → the cell that drives it (P7 parsing, using output pin names like Q, Y). Start at the D pin's net, look up its driver, then look at that driver's input nets, and keep going backwards. Stop at flops and module inputs. Keep a list of nets already visited so you don't repeat.

Balancing scan chains

"Split these blocks into N chains so the longest is as short as possible." Simple approach: sort blocks biggest first, and give each one to whichever chain is currently shortest. It's not always perfect, but it's close and it's what you'd do by hand.

Combinational loop check

"Is there a loop of gates with no flop in it?" Follow gate outputs to gate inputs, skipping flops; if you ever get back to a gate you're currently in the middle of exploring, there's a loop. Mention it; it's rarely asked to be coded in full.