On Test Generation for Microprocessors for Extended Class of Functional Faults

,


Introduction
The growing density of integration in the semiconductor industry make today's chips more sensitive to faults while the mechanisms of the latter become more complex.New types of defects need to be considered in test generation to achieve high test quality.Similar to memory testing, broader classes of faults dependent on the neighboring logic, should be used as test targets in case of general logic circuits.To make the tests less independent on particular implementation details, functional fault models and functional test approaches provide a good perspective to make the test development more efficient and to achieve higher test quality.
The quality of SBST is mainly affected by test data used in test programs.One of the ways to obtain test data is executing an Automated Test Pattern Generator (ATPG) [17,18].In [17] it was shown that the processor can be divided into Modules under Test (MUT) to ease the task of ATPG.The difficulties arise from the need of guiding ATPGs by functional constraints to produce functionally feasible test patterns.The method [18] requires enforcing constraints during ATPG test generation.The run-time for generating test using the complete set of SBST constraints is, however, high.An alternative is to use random test patterns for MUTs [3].However, these approaches need the knowledge about implementation.
SBST can be structural and functional.Structural approaches [4][5][6] use information from lower level of design, whereas functional approaches use mainly information of instruction set architecture (ISA).Hybrid SBST was proposed for combining deterministic structural SBST with verification-based test [4,5,19,20].In addition to Hybrid SBST [7,21], there are methods that achieve comparable results and improved scalability when generating SBST using only RTL [4][5][6].The structural approach cannot be used when structural information about the processor is not available.In [7], for high-level generation of SBST, the implementation details are not required, however, the low-level fault cover is not sufficiently high.
One of the first ISA based methods, using pseudo-random test sequences was proposed in [22].Another solution, FRITS (Functional Random Instruction Testing at Speed) [23], was based on test generation using random instruction sequences with pseudo-random data.Alternative cache-resident method for production testing [24,25] using random generation mechanism proves that high cost functional testers can be replaced by low-cost SBST without significant loss in fault coverage.Another approach, based on evolutionary technique was proposed in [26].Test is being composed of the most effective code snippets with good Stuck-at-fault (SAF) coverage, which were distinguished by constant reevaluation.The method needs structural information.Later research has been concentrated on developing dedicated test approaches for specific processor parts like pipeline, branch prediction mechanism [11,21], caches [22,23].
The drawbacks of the known methods vary in the need of knowledge about implementation details, fault coverage is measured traditionally only with re-spect to SAF, without considering broader fault classes, and no attempts have been made to evaluate the test coverage regarding multiple faults.
In this paper, to cope with the complexity of gate or RT level representations of microprocessors (MP), we consider the SBST generation with focus on modeling functional faults fully at the behavioral-level using only high-level information.We propose a deterministic high-level test generation method for SBST of processor cores, based on a novel implementation-independent highlevel functional fault model.To compare the results with state-of-the-art, the quality of tests is measured by single SAF cover, however, at the same time, we target broader class of faults than single SAF, considering structural logic level faults such as conditional SAF [27,28], bridging and multiple faults, as well as the functional fault classes used traditionally in memory testing.For formal high-level functional fault modeling and test generation we use the idea of representing the instruction set and architecture of the microprocessor in form of High-Level Decision-Diagrams (HLDD) [29,30].The HLDDs can be used as well for trading off different test characteristics such as test length, test generation time and fault coverage.
We generate tests separately for MUTs and in each MUT separately for its control and data parts [31].The main contribution in the paper is related to test generation for the control parts, whereas for testing the data parts independently of the implementation details, we use the known pseudo-exhaustive test approach [32], not considered here in details.
The rest of the paper is organized as follows.In Section 2, we propose a novel concept of considering the control parts of the modules under test as generic abstract multiplexers, and in Section 3 we elaborate a concept of the novel high-level test generation for the control parts of processor modules.In Section 4, we develop a new general high-level functional fault model for control parts of modules.Section 5 describes a general scheme of test execution flow for the control parts of MUT.In Section 6, we compare the test flow with traditional memory March test, and introduce relationships between the proposed fault model with known functional and structural fault classes.In Section 7, we introduce High-Level Decision Diagrams for formalization of test generation and test optimization.Sections 8 is devoted to demonstrating of experimental results, and Section 9 completes the paper with conclusions.

High-Level Representation of Microprocessors
The main concept of the proposed method is based on partitioning the processor under test into functional entities -MUT, representing them as disjoint control and data parts.In this paper, we focus on the executing module and the pipeline forwarding unit as such entities, however showing that the approach is more general, and can be used always, when the MUT can be functionally represented as a set of well-defined functions.
In Fig. 1, a part of the pipelined structure of the miniMIPS microprocessor [33] is depicted.In yellow colour, the executing unit is highlighted, whereas the rest on the figure shows the main components of the pipeline architecture -pipeline registers, hazard detection circuitry, and the forwarding unit shown in grey colour.We consider the selected modules as consisting of disjoint control (decoder with MUX-s) and data parts, presented as hypothetical structures without knowing their implementation details.The comparators C5 and C6 are used for hazard detection in case of "load-use" situations in pipeline circuits [34].
Note, the high-level functionality of the ALU/MULT module (the set of executable functions) is derived from the instruction set of the microprocessor, whereas the high-level functionality of the forwarding unit is derived from the description of the architecture of the microprocessor -a set of executable functions, which will be selected by the multiplexers MUX A and MUX B .In this paper, we concentrate on the ALU/MULT module.
We classify two types of high-level functional faults for the modules: control faults (for control part), and data faults (for data part).We do not consider data faults explicitly, rather we apply for data manipulation functions bit-wise pseudo-exhausting tests, which guarantee high fault coverage of a broad class of faults, whereas knowledge of implementation details is not needed.
For the high-level control faults, we introduce a novel functional fault model, as a general model, which covers a broad set of possible low-level structural faults, and also a set of traditional high-level functional fault models used in memory testing.For developing the high-level functional control fault model, we introduce a generic representation of the control part in a form of high-level multiplexer.Consider the executing unit, shown in yellow in Fig. 1, and in detailed view in Fig. 2, where implementation details are abstract.
Assume, the data part in Fig. 2  The control part consists of the multiplexer MUX, p control lines controlling the MUX, and an unknown circuit for mapping the instruction operation codes into the functional signals p.The high-level n AND blocks in MUX have each p control and a single m-bit data input, whereas the OR block in MUX has n data inputs from the outputs of AND blocks.Each AND block consists of m AND gates with p control inputs, and a single 1-bit data input.Hence, the described control module, represented in a form of a high-level multiplexer, consists of m different 1-bit logic level AND-OR multiplexers, used for decoding the instructions, and for extracting the results of executed instructions.
As it can be seen from Fig. 2, the border between the control part and the data part is determined by the AND gates, where the 1-bit control signals and 1-bit data signals are joining.The number of the AND gates on this border is By introducing the described hypothetical MUX-based executing module, we have functionally separated the data and control parts by the border of n × m × p gates, and transformed the function of the control block from "active" controlling of the manipulations in the data part to "passive" selection of the results of data manipulations in the data part.In other words, we have neglected all possible optimizations, which may have been carried out during the design of the execution unit.
Let us introduce now the following abstraction, in accordance to Fig. 2, as a set of m equivalent disjunctive normal forms (EDNF) representing an implementation independent design of the MUT at the expense of possible overdimensioning the real logic design.The disjoint presentation of the control and data parts allows to create an implementation-independent high-level functional control fault model.
The justification of the proposed abstraction results from the fact that a test T EDN F developed for detecting all non-redundant faults in the EDNF, will detect also all faults in the real optimized circuit of the executing unit [35].On the other hand, if the implementation details of the real circuit equivalent to EDNF were known, then the test T RC of the real circuit, in general case, may have shorter length than T EDN F .
The second abstraction will concern the control signal decoding, which, in general, is highly depending on the details of implementation.To allow the test generation for the control part be implementation independent, and as simple as possible, we introduce the one-to-one coding between the control signals and instruction, so that to each functions f i ∈ F the control signal c i will correspond, and C = {c i }, where |F | = |C|, will represent the full set of control signals.In this case, each control signal c i ∈ C selects the related function f i ∈ F .In other words, by this way, we have introduced a hypothetical and simple coding scheme of int ructions, where p = n, which represents, according to (1) the higher bound of the value p.On the other hand, it provides the minimal length n × m for the border between the control and data parts of the MUT, determined by (2).
This second abstraction allows to overcome the problem of illegal instruction codes and to make easier the identification of redundant faults in any of the further real implementations of the control part.
The justification of the proposed abstractions will be given in the next section, where we introduce the new control fault model.

Basic Concepts of Generating High-Level Tests
Consider a simplified MUT in Fig. 3a, derived using the two described above abstractions, and consisting of the data and control parts.Fig. 3a presents a k − th bit slice of the m-bit control module, where m is the width of the data word carrying the value of f i .The data manipulation block (e.g.ALU) executes n different functions f i , selected by the control codes c denoted by symbolic integers c i , i = 0, 1, . . .n.
Each bit-slice of the control part consists of MUX with n control lines (control inputs to each AND).The 1 − bit data lines from the data manipulation module (ALU) are the data inputs to each AND.The OR gate has n data inputs.
Consider testing of the MUX in Fig. 3. Let us concentrate on testing the control code for the k−th bit slice, which selects from ALU the result of the highlevel defined operation f i,k , producing the expected output value y k = f i,k, (D).Consider the high-level symbolic (pseudo) control signals c i,k , which may be applied (c i,k = 1) or not applied (c i,k = 0) as Boolean variables.From c i,k = 1, it follows c j,k = 0 for all j = i due to the mutual exclusion of each other.
, for a single bit test, in accordance to Fig. 3.
, which targets the detection of stuck-at-0 faults c i,k ≡ 0 and f i,k ≡ 0, in other words, the test is proving that the function f i ∈ F is controllable by c i,k = 1, in the k − th bit.However, this test is targeting the detection of single faults only, and the test may fail in proving the controllability of f i,k , if there exists any multiple fault of type {c i,k ≡ 0, c j,k ≡ 1}, j = i, because of mutual masking of these two faults.This masking situation is illustrated in Fig. 3a.Lemma 1.There will be no masking of the fault c i,k ≡ 0 by any other fault c j,k ≡ 1, j = i, if the test T * i,k = {c i,k = 1, f i,k = 1} will be applied under the constraints f j,k = 0, for all j = i.
Proof.The expected value of y k for the test T * i,k in case of no faults will be y k = 1.In case of a single fault c i,k ≡ 0, the value of f i,k = 1 will not propagate to the output y k , due to c i,k ≡ 0 and all c j,k = 0, j = i, causing in such a way response y k = 0, which means that the fault c i,k ≡ 0 is detected.The response y k = 1 would be the proof, that the function f i,k is controllable.However, this proof will be valid only for the case of assuming the single fault c i,k ≡ 0. In case of any double fault {c i,k ≡ 0, c j,k ≡ 1}, j = i, instead of f i,k = 1, which is blocked by c i,k ≡ 0, the value of another function f j,k = 1 is propagated by c j,k ≡ 1 to the output y k .Hence, as the response to the test, we will get the same value y k = 1 as expected, which means that the fault c i,k ≡ 0 is masked by c j,k ≡ 1, and we still will not know if the function f i,k is controllable by the signal c i,k or not.
Let us introduce a notation for multiple faults of type {c i,k ≡ 0, c j,k ≡ 1}, where j = i, and {c j,k ≡ 1} represents any subset of faults c j,k ≡ 1 for different combinations of j = i.Lemma 2. To detect any multiple fault of type {c i,k ≡ 0, {c j,k ≡ 1}} in the MUT represented by a set of functions F , a test T * i must be generated, so that the constraint f j,k = 0 were satisfied for each f j ∈ F , j = i, by at least one pattern d ∈ D i in T * i .
Proof.Since from c i,k = 1 the value c j,k = 0 follows for all j = i due to the mutual exclusion of control signals, we have satisfied automatically the conditions of sensitizing the faults c j,k ≡ 1 on the lines j ∈ i.On the other hand, the constraint f j,k = 1 for all j = i will serve as the condition of propagating the faults c j,k ≡ 1, j = i, to the output y k , to make all control faults c j,k ≡ 1 detectable. .
There may be two border cases in generating the test T * i .First, a single data operand d ∈ D i may be generated, which allows detection of all possible multiple faults of type {c i,k ≡ 0, {c j,k ≡ 1}} in the same time by the same data d ∈ D i .In this case, the pattern d has to satisfy the constraints f j,k = 0 simultaneously for all j = i, which may be a seldom case.Second, as a general case, a set of data D i must be generated, so that each constraint f j,k = 0, j = i, was satisfied at least by one pattern d in the set of data D i .
From Lemma 1 the following corollary directly results.
Corollary 1.The test T * i generated in accordance with conditions of Theorem 1 for all bits k, detects the control faults c i,k ≡ 0, and the data faults f i,k ≡ 0, which both belong to the fault class of SAF.The functional high-level meaning of the test T * i is that it proves that the function f i , is controllable by the control signals c i,k in all bits k without masking due to possible additional faults c j,k ≡ 1 on other control lines j = i.
The added value of test T * i,k = {c i,k = 1, f i,k = 0} that, a lot of data part faults, causing the change of the value of f i,k , 1 → 0, will also be detected.
From Lemma 2 the following corollary directly results.
, which targets the detection of the data fault f i,k ≡ 1, will detect simultaneously also all control faults c j,k = 1, j = i, if the constraints f j,k = 1 for all j = i, will be satisfied at least by one The added value of the test , which has the goal of detecting the SAF c j,k ≡ 1 on other control lines j = i, detects also a lot of data part SAF, which cause the change of the value of f i,k , 0 → 1.From the previous discussion, it follows, that it would be very easy to test the control part of MUT if it would be implemented according to the proposed abstract model, represented by EDNF and using direct mapping c i → f i .By the proposed two methods, the both types of SAF faults can be detected: c i,k ≡ 0, using Corollary 1, and c i,k ≡ 1, using Corollary 2. This result is illustrated also in Table 1.
In the following, in Sections IV -VI, we show that Corollary 2 can be extended for a very broad class of faults and used as the basis for developing an implementation-independent test generation method for the control part of MUT.

A New High-Level Functional Control Fault Model
From Lemmas 1-2 and Corollaries 1-2, a strategy of testing follows.When applying the test , it is recommended to generate data operands for applying the values f j,k = 0 for as many j = i as possible, to avoid mutual masking of c i,k ≡ 0 by multiple faults c j,k ≡ 1.On the other hand, when applying the test , it is recommended to apply the values f j,k = 1 for all j = i to increase the efficiency of testing the faults c j,k ≡ 1.
In functional testing, if two arguments or functions in the MUT model will due to physical defects interfere, then the resultant value of the interference can be calculated either by AND or OR function, depending on the technology.
Assume for the further discussion that we have OR-technology.
Definition 3. Introduce a high-level functional control fault f i,k → (f i,k , f j,k ), which means that instead of the function f i , in the k − th bit of the data word, both functions f i,k and f j,k will be selected and executed simultaneously.In case of the OR -technology, the result of activation of the function f i in the presence of the fault Proof.The proof results directly from Definition 3, because only if f i,k (d) = 0, and f j,k (d) = 1, the expected result f i,k (d) = 0 and the faulty result f i,k (d) ∨ f j,k (d) = 1 will be distinguishable.Definition 4. Introduce modifications of the high-level functional fault introduced in Definition 3, such as , where instead of a function f i,k another function f j,k , j = i, will be selected and executed, and 2. f i,k → {f j,k }, where instead of a function f i,k , a group of functions f j,k will be selected and executed.
From Lemma 3 and Definitions 3 and 4, the following corollaries result: Corollary 3. To detect the fault f i,k → (f j,k ), a test pattern T * i (c i = 1, d) must be applied with constraint f i,k (d) < f j,k (d), where d ∈ D i .
Corollary 4. To detect the fault f i,k → {f j,k }, a set of test patterns T * i (c i = 1, d), d ∈ D i must be applied, so that for each f j,k → {f j,k }, a data pattern d ∈ D i exists, where f i,k (d) < f j,k (d).
Definition 5. Let us call the set of all high-level functional control faults CF = {f i,k → (f i,k , f j,k )}, for all pairs of f i,k , f j,k ∈ F , as functional control fault model of the MUT, represented as mapping Theorem 1.To detect all functional faults introduced in Definitions 3 and 4, for each function f i ∈ F , a set of data operands must be generated, which satisfy the constraints: The proof of theorem results from Lemma 3 and Corollaries 4 and 5.
Definition 6. Introduce a high-level control fault table R = r i,j/k as a 3dimensional array for a given set of data patterns D, where the entries r i,j/k represent k-bit vectors and r i,j/k = 1, if there exists a pattern d ∈ D i , which satisfies the constraint f i,k (d) < f j,k (d), otherwise r i,j/k = 0.The size of the fault model R is equal to the size |CF | = (n − 1) 2 × m.
The high-level control fault coverage is measured by the ratio of 1-s in the array to the size of R.
Calculation of the high-level fault coverage can be carried out by high-level fault simulation with the goal of checking if the constraints (3) are satisfied or not.

Test Structure and Test Execution
Denote by D i the test data generated for detection the fault model CF (f i ).Based on the data D i , and according to Lemma 1, the following test structure results, as shown in Algorithm.1.

Algorithm 1: Test Execution Structure
According to Algorithm 1, all tests for exercising the functions f i ∈ F , are executed one by one, each of the tests in a loop using one by one the data d ∈ D i which satisfy the constraints (3).A test is a subroutine which initializes the data d ∈ D i , executes an instruction (or a sequence of instructions) responsible for realizing the function f i (d), and performs the observation of the test result y = f i (d).
From the algorithm in Algorithm 1, the following structure of test execution can be derived: the full test T consists of a sequence of test modules T i , i = 1, 2, . . .n, where each i-th module consists of test patterns T i,t , where each pattern T i,t ∈ T i,t satisfies, a subset of constraints (3).
For each test pattern T i,t ∈ T i , including the data operand d ∈ D i , and for each data bit k of the functions f i ∈ F , the set F = {f i } can be partitioned for each k into two parts F 0 k and F 1 k , so that Such a test pattern covers all the constraints f i,k (d) < f j,k (d), according to (3), where f i,k ∈ F 0 k and f j,k ∈ F 1 k .Such a test execution according to Algorithm 1 is depicted in Fig. 4. The unrolled test sequence consists of n test modules T i , each of them consisting of a sequence of test patterns T i,t for testing a function f i ∈ F .The behaviour of the MUT is highlighted for the k − th bit of the test pattern T i,t , showing the

Extension of the Fault Class Beyond SAF
The ideas of the proposed fault model in Section IV, and the test concept in Section V are adopted from the known methods of memory testing, particularly from March test [36].The motivation was driven by the purpose to extend the fault class, to be covered by test, to that of used in case of memories.Let us consider an example of the March test depicted in Fig. 5, and compare it with the test flow developed for a logic MUT shown in Fig. 4. The analogy between the memory test and logic test is in similar handling of addressing the cells in the memory and controlling the functions of f i ∈ F in logic MUTs.In case of memories, testing of cells (data part) and the addressing logic (control part) can be easily joined in the same test, whereas in the proposed approach, testing of data part and control part proceeds separately.
In case of memory, the initialization of constraints (writing 1s (W 1 ↑) into cells) can be done once for all cells in a single cycle.Then, having these constraints stored, the following test cycle (r/w0 ↓) and observation cycle (r1) can be carried out.
In the proposed method, the constraints cannot be stored, rather they have to be produced "on-line" at each test pattern.In Fig. 4, a  The comparison of the proposed data constraints based test method with March test for memories reveals the possibility of applying the proposed approach, not only for the combinational MUTs like ALU, but also for sequential MUTs.If in sequential MUTs, a part of data d ∈ D belongs to the registers or memory, the test must include proper initialization sequence.
Consider a MUT, represented by a set of mappings: where C is a set of mutually exclusive control signals (instructions) produced by the control part of MUT, and F is the set of operations (data manipulations) taking place in the data part of MUT.By test data generation, used in the March test for memories and in the proposed test method for logic MUTs, the coverage of the following functional fault classes by the proposed method results [36]: CL-1: With a certain instruction (c i ∈ C), no activity f i in F will happen.
CL-2: There is no instruction (c i ), which can activate a function f i ∈ F .A certain function is never accessed.
CL-4: A certain function f i ∈ F can be activated with multiple instructions {f i , f j , . ..} ∈ F .
The fault classes CL-1 -CL-4 are illustrated in Fig. 7 [36]: It is easy to realize that these high-level functional fault classes cover also SAF (CL-5) and bridging (CL-6) fault classes, i.e. these faults can be collapsed, and do not need to take into account any more, except when the fault coverage of these faults for given implementations is under interest.
As shown in [37], address decoders built out of CMOS gates can exhibit CMOS stuck-open faults .The effect of such faults is that the combinational instruction decoder will behave as a sequential circuit for certain control signals.The consequence of such a fault is that another instruction will be decoded and executed.However, this fault can be also collapsed, because it will be covered by the faults of CL-4.
Any multiple low-level structural fault CL-8 (SAF or shorts), in the particular implementation, will cause a change of an instruction c i → c j , which in turn can be considered as the fault from class CL-4, and hence, be collapsed.
Regarding other general fault classes, such as conditional SAF (CL-9) [28], called also as functional faults [38], pattern faults [39], fault tuples [40] or cellinternal defects (CL-10) [41], will manifest themselves as a change of instruction code c i → c j , and are covered by the fault class CL 4.
We have shown, that the structural fault classes CL-5 -CL-10 are collapsed by the implementation-independent high-level functional fault classes CL-1 -CL-4, which are used in memory testing and are covered by the March test [36].On the other hand, in Section V, we have shown, that the test for microprocessor MUT, which satisfies the constraints (3), and is executed in accordance with the test flow in Algorithm.1,will cover the same fault classes CL-1 -CL-4 used in memory testing.Finally, from Theorem 1, it follows, that the fault classes CL-1 -CL-4 can be represented by a single fault class CF = {f i,k → (f i,k , f j,k )}, as stated in Theorem 1.
The relationships between iterative fault collapsing are shown in Fig. 7: first, collapsing of structural faults (CL-5 -Cl-9) by functional faults used in memory Fig. 7. Fault collapsing relationships testing (CL1 -CL-4) [36], and thereafter, collapsing of the faults (CL1 -CL4) by the general high-level control fault CF, developed in the paper.
In this paper, we do not consider testing of the faults in data part, however, we propose to use here testing of all instructions separately by using pseudoexhaustive test (PET) data operands [32].It is well-known that PET provides also a good fault coverage for a broad fault class.

High-Level Decision Diagrams and Functional Test
The problem with the proposed functional fault model is a low scalability, because when the size n of the set of functions F is growing, the number of high-level faults |CF | = (n − 1) 2 × mis growing very fast.This is actually the same problem as with memory testing: the broader class of faults is desired the longer test is needed.
From that a question follows, which is how to cope with the complexity explosion by looking for tradeoffs between some test characteristics like fault coverage, test length, test generation time etc.One possibilities is to partition the sets of F into smaller subsets, and consider high-level test generation for subsets of F separately.
High-level Decision Diagrams (HLDDs) [29,30] can be used as a uniform approach for extracting and solving the constraints (3) in test generation for the modules of microprocessors.
Consider in Fig. 8, a HLDD for a subset of 20 instruction of the MiniMIPS microprocessor [33] which represents a subset of function of the ALU.The single non-terminal decision node of the HLDD is labelled by the control variable c (denoted by the operation code of the instructions) having n control values  Depending on different partitioning of the set of control functions, HLDDs may have more than one non-terminal nodes.If the HLDD has more than one internal nodes, then for each non-terminal node m, the test is generated separately, where the subset of functions F (m) ⊂ F related to the node m under test is set up from the HLDD, so that to each output edge of the node m, a terminal node m T in HLDD (having a path from m to m T ) with related function f j is mapped and included into F(m).
To reduce the complexity of the model of the MUT, we can partition iteratively the set of functions by adding internal nodes into the HLDD.
Consider now another version of the HLDD in Fig. 9, which represents the same subset of 20 instructions of the MiniMIPS, but has now 10 decision nodes.
Each decision node represents a partitioning, and the number of edges of the decision node corresponds to the size of the related subset of functions F .
We have generated tests for these three versions of HLDD models with the following results Using these results, we see opportunities for optimization of the test, trading off different parameters like test length (number of test patterns), achieved SAF fault coverage and test pattern generation time.We see that the result of the minimization of the complexity of the fault model due to the partitioning of the set of functions under test, the number of functional faults taken into account reduces dramatically from 12160 to 2112 (7 times), which has of course impact of the quality of testing the extended class of functional faults.In the same time, the SAF coverage does not change significantly, it decreases only from 99.03% to 99.61%, despite of the reduction of the test length from 143 to 79 (nearly 2 times).As the complexity of the fault module decreases, then the test generation time as well decrease.

Experimental Results
We have carried out test generation experiment with two goals, first, to investigate the possible tradeoffs between the complexity of the high-level fault model, and the characteristics of generated tests such as test length, SAF coverage, and test generation time, and second, to compare the SAF coverage of gate-level, achieved by the proposed method with state-of-the-art methods.However, it should be mentioned, that in the latter case, the proposed method has additional advantage regarding the coverage of the extended functional fault class, that has not been taken into account in the state-of-the-art methods.
We carried out experiments on Intel Core i7 processor at 3.4GHz and 8GB of RAM.The target was to investigate the efficiency of the new high-level implementation independent SBST generation method for microprocessors by measuring both the high-level functional fault coverage, and the gate-level fault coverage (FC).As research objectives of the experiments, the executing and forwarding units of MiniMIPS [33] were chosen.
For investigating the possibilities of tradeoffs between the complexity of the high-level functional control fault model and the characteristics of generated tests the executing unit was used.It consists of adder and 2 multiplication modules MULT0 and MULT1.We targeted 28 instructions out of MiniMIPS 51, as the basis for the set of functions F = {f i } to be tested.The results are depicted in Table 4 and in Table 5.In Table 4 we show the SAF simulation results for only the control test, whereas in Table 5, we show the results of SAF simulation of the integrated control and data part tests.The latter experiment was needed to demonstrate the additional impact of the data part test to the control test, for the special case of SAF coverage.In Tables 3 and 4 we see, that the SAF coverage is very little depending on the size of the set of high-level functional faults used.We see also increase of the SAF coverage, if we simulate the full test including both control and data part tests.This is natural, because the control test is not targeting at all the data part.On the other hand, we see that the control test indirectly covers a huge amount of SAF faults in the data part (as added value of using the proposed high-level functional control fault model).
The reasons of not covering of all SAF in the gate-level simulated circuits may be twofold: (1) the faults are not detectable, or (2) the set of functions, used as the target for test generation, may not cover the full circuit, which was selected for SAF simulation (the circuit may be responsible for other functions, not included into the set of functions, which was used for high-level test generation).
The second part of experiments consisted in comparing the results with stateof-the art methods, using for comparison only the gate-level SAF coverage, which however was not the target of the proposed method, which had the target to generate an implementation-independent test.
In Table 5, we compare our high-level approach with a commercial ATPG, where we showed that the latter had to use huge time when struggling with test generation for a sequential part of the circuit (8h), whereas the high-level approach for solving the combinational data constraints used less than a minute.
In Table 6, the fault coverage fault coverage and simulation times are given for the forwarding unit (FU), first, when applying only the ALU test, and then the dedicated test for only FU, and thereafter, combining both tests.The tests for FU were generated without knowing gate-level implementation detail, we relied only on general information of the MiniMIPS pipeline architecture, which includes the number of stages and forwarding paths.
In Table 7, we compare our results for 3 different MiniMIPS modules with 3 other test generators.Our approach is similar to [7] in the sense that the gate-level implementation details are not required, but it shows almost 5% improvement in FC compared to [7].Although the method in [19] shows 1% improvement over the proposed method, it is based on requiring of structural information.Method in [18] requires enforcing set of constraints during ATPG test generation, requiring also gate-level information.Differently from state-of-theart methods, where single SAF cover is the target, the proposed method targets extended class of faults including conditional and multiple SAF.

Conclusions
In this paper, we propose a novel implementation independent SBST generation method for the modules of RISC type microprocessors, which produces high gate-level single fault coverage, comparable with the methods which use the knowledge of implementation details.However the main target of the paper is to propose a method which covers an extended class of structural faults including high-level functional faults used in memory testing.
The main idea of the method is to generate tests separately for modules under test (MUT) and in each MUT separately for its control and data parts.The main contribution in the paper is related to test generation for the control parts, whereas for testing the data parts independently of the implementation details, we use the well-known pseudo-exhaustive test approach, not considered here in detail.
A generic high-level functional fault model was developed, represented as a set of constraints to be satisfied by data operands, for the control parts of MUT.The fault model covers a broad set of low-level structural faults, and differently from state-of-the-art, a set of traditional functional fault models used in memory testing.We showed the possibility of focusing a large number of structural and functional fault classes into a single measurable high-level functional fault model.
Based on this representative fault model, a novel measure of high-level control fault coverage is proposed, and a method of evaluating the test quality using this measure, which can indirectly assess the capability of the test to cover a large class of faults beyond SAF.
The data constraints based fault model, and the introduced analogy of testing with March test flow for memories revealed the possibility of applying the proposed approach, not only for the combinational MUTs, but also for sequential ones.We introduced High-Level Decision Diagrams, as a means to be used for formalization of high-level test generation and optimization of test programs by trading off different test characteristics, such as the fault model complexity versus test length, test generation time and well measurable SAF coverage.
For comparison of our results with state-of-the-art we used the measure of SAF coverage.Experimental results demonstrate higher SAF coverage compared to other existing implementation-independent test generation methods for microprocessors.The added value of the proposed approach, compared with stateof-the-art, is the proof of covering extended fault class beyond SAF.

Fig. 1 .
Fig. 1.A part of a RISC type microprocessor with executing unit in the pipeline and data forwarding environment

Fig. 2 .
Fig. 2. Generic DNF based control structure of the executing unit executes n different functions y i = f i (D i ) controlled by a set F = {F i } of instructions (functions), where D is the set of given data operands to be manipulated with f i ∈ F .The length of data word is m, and the number of control signals p must satisfy the constraint log 2 n ≤ p ≤ n (1) and hence, depends on how the instructions are coded.However, the number of 1 − bit control signals p and the mapping of control vector signals to n instructions, where n = |F |, is considered as unknown.Let us keep for a while the coding of the control signals and the value of p in the model of MUTopen.

Fig. 3 .Definition 2 .
Fig. 3.A module consisting of data and control parts and its HLDD

Fig. 5 .
Fig. 5. Illustration of the March test for memories In case of memory, in each step of the test cycle (r/w0 ↓), when reading the Cell i, all constraints [Cell i] < [Cell j] are covered by a single run through all the cells.Here, [Cell i] means the value stored in the Cell i.In case of the proposed method of testing a logic MUT, the test for f i ∈ F , has to be repeated with other data d till all the constraints (3) have been satisfied for all pairs of functions {f i,k , f j,k }.The comparison of the proposed data constraints based test method with March test for memories reveals the possibility of applying the proposed approach, not only for the combinational MUTs like ALU, but also for sequential MUTs.If in sequential MUTs, a part of data d ∈ D belongs to the registers or memory, the test must include proper initialization sequence.Consider a MUT, represented by a set of mappings:

Table 1 .
SAF faults detection of 1-bit control signals

Table 2 .
Example of scalabilities for three versions of HLDDs

Table 3 .
Test generation for different fault model complexities (only control part test is SAF simulated)

Table 4 .
Test generation for different fault model complexities (both control and data part tests are SAF simulated)

Table 5 .
Execute Unit Test

Table 6 .
Fault coverage of forwarding unit by different tests

Table 7 .
Comparison with other methods