SAT-генерация тестовых векторов на elaborate-представлении RTL без этапа логического синтеза: экспериментальное обоснование маршрута и перспективы ранней характеризации блоков

Design for testability (DFT) is integral to integrated-circuit design. Among DFT tasks, automatic test-pattern generation (ATPG) for stuck-at faults is one of the most computationally demanding stages of the verification flow

For a DFT engineer iterating on the RTL to improve testability — adding test points, restructuring scan chains, modifying control logic — the dependence on a full synthesis cycle creates a long feedback loop: a single RTL modification cannot be evaluated for testability without re-running synthesis. The cumulative cost of these iterations dominates the early stages of DFT exploration.

The present work investigates whether the ATPG problem can be formulated and solved directly on the Boolean representation produced by the elaborate stage of RTL, prior to logic synthesis. The hypothesis is that test vectors found by a SAT solver on the AIG of elaborated RTL are sufficient to detect stuck-at faults in the synthesized netlist, provided the two representations are proven logically equivalent.

Existing work on RTL-level testability addresses a related but distinct question. P.A. Thaker, V.D. Agrawal and M.E. Zaghloul

The contributions of this paper are: (i) a methodological flow combining Yosys and MiniSAT in a Larrabee-style SAT-ATPG pipeline operating on elaborated RTL; (ii) an experimental cross-validation protocol that quantifies vector transferability between the two representations independently of LEC; (iii) an outline of early-stage block-characterization use cases enabled by the validated flow.

Tool flow

Two parallel flows are considered (Fig. 1). Route A (reference) processes the RTL through full Yosys synthesis (synth -flatten), maps the netlist to AIG via abc -g AND, and feeds the result into the SAT-ATPG engine. Route B (proposed) processes the RTL through proc; flatten; opt only, then maps the result to AIG via the same abc -g AND step, and feeds it into the same SAT-ATPG engine. Sequential designs use the clk2fflogic pass to encode flip-flops as AIGER state elements. The full tool stack is open-source: Yosys 0.45+42, MiniSAT 2.2.0, Python 3.12; experiments run on x86_64 Ubuntu 24.04, Intel Core i5, 16 GB RAM. A 30-second per-fault timeout is imposed on the SAT solver. Test-vector compaction is not applied: one vector per fault.

Tool flow: Route A (full synthesis) versus Route B (elaborate only)

DOI:10.60797/itech.2026.11.8.1

Открыть в полном размереСкачать рисунок

Fault model and miter construction

The classical stuck-at fault model is applied to every variable in the AIG: primary inputs, AND-node outputs, primary outputs. For each conductor, both stuck-at-0 and stuck-at-1 faults are considered. The Larrabee miter is constructed in conjunctive normal form (CNF) for each fault (Fig. 2): two copies of the circuit (good and faulty) are encoded by Tseitin transformation; in the faulty copy the driving AND clauses for the faulted conductor are cut (omitted) and the conductor is forced to the stuck value; corresponding primary inputs of the two copies are joined by equality clauses (skipped for the faulted primary input itself); outputs are compared by an XOR network with at least one mismatch demanded. The CNF is solved by MiniSAT. SAT returns a vector that activates and propagates the fault; UNSAT certifies the fault as untestable (redundant).

Larrabee miter construction for stuck-at fault detection

DOI:10.60797/itech.2026.11.8.2

Открыть в полном размереСкачать рисунок

LEC and cross-validation

Logical equivalence between Route A and Route B is established by Yosys via equiv_make, equiv_simple, equiv_induct and equiv_status. Equivalence implies transferability of test vectors for functional faults (stuck-at on primary inputs and primary outputs): for any input vector the two functions agree, hence a vector that activates a functional fault in one representation activates the corresponding fault in the other. For internal faults — stuck-at on intermediate AND-node outputs — transferability does not follow from LEC because the fault universes differ structurally: the two AIGs realize the same Boolean function with different internal wiring. The cross-validation protocol fills this gap empirically: each Route B test vector is applied to Route A's AIG by topological simulation against a faulted copy, and the fraction of Route A's testable faults thereby detected is recorded; the dual measurement is performed in the opposite direction. A separate restricted measurement is reported for the PI/PO subset, where LEC theoretically guarantees 100% transferability.

Benchmarks

Six benchmarks of increasing complexity are used. bench_xor_a and bench_xor_b are two textually different yet semantically identical implementations of the XOR function (operator form (a|b)&~(a&b) versus the ^ operator) — a sanity probe for invariance of the SAT result under equivalent RTL spellings. bench_alu is a 16-bit arithmetic-logic unit; bench_shifter is a 22-bit barrel shifter; bench_redundant is a majority-of-three function with one logically redundant product term; bench_counter is a synchronous 8-bit counter with comparator — the only sequential benchmark in the set.

Fault coverage

Table 1 reports stuck-at fault coverage for both flows. Fault coverage is defined as FC = det / (total − unt) × 100%, where det is the number of detected faults, total is the size of the fault universe, and unt is the number of provably untestable (redundant) faults. All six benchmarks reach 100% coverage of the testable subset on both flows.

bench_xor_a and bench_xor_b, despite their different RTL spellings, produce byte-identical AIGER files after the elaborate stage (verified by SHA-256 hash equality), confirming the textual-form invariance of the SAT formulation. The differences in the total number of faults between flows on bench_alu, bench_shifter and bench_redundant reflect the different number of internal AND nodes; the testable coverage is identical. bench_redundant is the only benchmark where the unt counts diverge in a non-trivial direction: Route B reports two untestable faults — the stuck-at faults on the redundant majority term t4 = a & b & c, masked by the remaining terms; Route A reports zero, because synthesis collapses the redundant logic before ATPG sees it.

Timing

Table 2 reports per-benchmark wall-clock time. The Yosys preparation time of Route B is 20–65% of Route A's. On the present small benchmarks the SAT-solver time dominates the end-to-end flow, and the absolute speed-up is modest. On industrial designs where synthesis takes hours, the reduction in preparation time is expected to translate into a substantially shorter feedback loop.

Cross-validation

Table 3 reports cross-validation results. For all five combinational benchmarks, vectors obtained on Route B detect 100% of testable faults of Route A and vice versa. The single deviation is bench_redundant in the A→B direction (90.91%): vectors from the synthesized flow cannot detect Route B's two redundant faults, which by definition have no input vector activating them. Restricted to the PI/PO subset, transferability is 100% in all directions, in agreement with the LEC-backed theoretical claim. bench_counter is excluded because the latch encoding of state in AIGER is not preserved under the two flows; aligning latch correspondences across representations is left as future work.

AIG structure

Table 4 reports AIG-level metrics. The two flows produce structurally distinct AIGs of comparable size; for bench_counter the two AIGs are byte-identical because the increment-and-compare logic is already in canonical form and abc introduces no structural change. bench_redundant exhibits the largest structural divergence (5 vs 8 AND nodes), reflecting the redundancy collapsed by synthesis.

Legend: I — primary inputs; O — primary outputs; R — registers (D-flip-flops, encoded as AIGER state elements via clk2fflogic); AND — AIG AND-node count; depth — longest path from primary inputs to primary outputs; v/c — CNF variable / clause counts.

LEC

For all six benchmarks equiv_status -assert returns PROVEN. The combinational benches use a single equiv_simple invocation; bench_counter requires async2sync followed by equiv_induct -seq 10 for the sequential proof.

The experimental evidence supports the central hypothesis: SAT-ATPG operating on the AIG produced by elaborated RTL — without logic synthesis — yields test vectors that detect stuck-at faults in the synthesized netlist with no measurable degradation in fault coverage of the testable subset. Logical equivalence is formally proven; cross-validation independently confirms vector transferability. The position relative to Strauch's GIF model

The validated infrastructure shifts where DFT evaluation lives within the design loop — from a post-synthesis verification step to an early RTL-exploration step. Three classes of use cases follow directly. They are outlined here as enabled possibilities; concrete optimization algorithms for any of them are left as separate future contributions.

(i) Test-count reduction by RTL-stage redundancy detection. The bench_redundant result shows that elaborate-stage SAT-ATPG identifies untestable redundant logic that synthesis would silently collapse. Surfacing this signal early lets the engineer either accept the redundancy intentionally (for hazard immunity, glitch suppression) or rewrite the RTL to expose the optimization explicitly to a downstream tool flow.

(ii) Block-level effort estimation for built-in self-test (BIST) planning. The cardinality of the resulting test-vector set is a direct effort metric: which RTL block needs more BIST bandwidth, which fits within a tight pattern budget. Today this metric is available only after synthesis; the present flow makes it available at the elaborate stage.

(iii) Comparative pre-synthesis evaluation of competing RTL implementations. The bench_xor_a versus bench_xor_b probe demonstrates that semantically identical RTL written in different operator forms produces byte-identical AIGER output, hence identical SAT-ATPG outcomes. Applied to non-trivially different RTL implementations of the same function, the same probe directly reveals which variant has the smaller AIG, smaller fault universe, or fewer redundant nodes — properties that until now could only be assessed after synthesis.

The common pattern across (i)–(iii) is a re-positioning of testability evaluation within the design flow: tasks traditionally performed at the end (after synthesis) become accessible at the start (after elaborate). The expectation, supported by the present results, is that performing these evaluations early — when an RTL change can still be made cheaply — yields substantively different design decisions than performing them late, when the same change demands a full re-synthesis.

Limitations are explicit. First, the LEC-backed transferability claim is rigorous for functional faults (PI/PO) and empirical for structural-internal faults; for designs with substantially different AIG topologies the empirical claim should be re-verified per design. Second, fault models requiring structural information (transition delay, cell-aware, bridging) remain the prerogative of gate-level ATPG. Third, the present sequential treatment via clk2fflogic covers full-scan-equivalent topologies; partial-scan, multi-clock-domain and BIST-instrumented designs require additional handling. Fourth, scalability to industrial-size projects requires confirmation on benchmarks of order 10⁵–10⁶ gates, where SAT-solver time may dominate even when synthesis cost is removed.

A SAT-based stuck-at ATPG flow operating on elaborated RTL — without logic synthesis — has been experimentally validated on six benchmarks using a fully open-source toolchain. All benchmarks reached 100% fault coverage of the testable subset on both the synthesis-based reference flow and the synthesis-free proposed flow; logical equivalence between the two representations was formally proven by Yosys for every case; cross-validation confirmed full transferability of test vectors between the two representations on all combinational benchmarks. A discriminating exception on the redundant-logic benchmark demonstrated that the synthesis-free flow exposes redundancy signals that are otherwise collapsed by synthesis.

The validated infrastructure shifts testability evaluation from a post-synthesis verification step to an early RTL-exploration step, and outlines a direct path to early-stage block characterization use cases — test-count reduction, BIST effort estimation, and comparative RTL-variant evaluation — that until now required a full synthesis cycle to access. Concrete optimization algorithms enabled by this re-positioning are the subject of subsequent work in the series.