Coverage of Node Shorts Using Internal Access and Equivalence Classes

A method is presented that determines the coverage of shorts (bridging failures) in digital logic circuits by internal access test techniques. These are test techniques that provide observability of circuit nodes, such as CMOS power supply current monitoring (including IDDQ), CrossCheck, and voltage contrast. Only fault-free circuit simulation is used to obtain node states. Two versions of the algorithm are presented: a simple algorithm that is suitable for use with two-state logic (0 and 1), and a more general algorithm for four-state logic (0, 1, X, and Z). The result is a set of sets of nodes, where a list of all potential shorts that could exist in the circuit yet be undetected after testing is obtained easily from the power sets of these sets; unlike other approaches the full universe of potential shorts is not generated. Experiments show that short, randomly generated sequences of test vectors detect essentially all detectable shorts of multiplicity 2 for both combinational and sequential circuits.

t is known that shorts, or bridging failures, are a common type of failure in VLSI circuits.A short is an unwanted conducting path between nodes of a circuit.A study that performed failure analysis of integrated circuits (MOS 4-bit microprocessors) found that 55% of the failures involved a short [1].Ferguson and Shen studied the effects of CMOS in- tegrated circuit defects such as pinholes, extra metal, and extra polysilicon.For one circuit, a 4 4 mul- tiplier, they found that 48% of the defects caused shorts to occur [2].
In this paper, logic lines are the connections be- tween logic gates through which signals flow.A set of (intentionally) connected logic lines constitutes a logic node.Electrical nodes include both logic nodes and connections made inside logic gates.The mul- tiplicity of a short is defined to be the number of nodes that are shorted together.A single bridging failure is a single instance of shorted nodes; many nodes may be involved.The shorting of two nodes, a and b, is denoted by "ab," and the shorting of three nodes a, b, and c, is denoted by "abc." The exact behavior of a short is difficult to predict.
Williams and Angell [3], in the same paper that in- troduced scan design, proposed that shorts involving two nodes could be modeled as having either wired- AND behavior (where a node in the 0 state would dominate a node in the 1 state) or wired-OR behavior (where a node in the 1 state would dominate a node in the 0 state).This is a valid assumption for low- resistance shorts in some circuit technologies and most published work so far is based on the "wired" behavior model for shorts.CMOS is currently the dominant digital circuit technology due to its low power, high speed, and high levels of integration, but the "wired" behavior model is not valid for CMOS bridging failures.Soden and Hawkins have shown that the variable number of active pullup and pulldown transistors cause the behavior of a CMOS bridging failure not to be predictable by the "wired" model [4].Therefore, most of the bridging failure analyses published to date are not applicable to CMOS.The method of this paper, however, based as it is on "internal access" test techniques, is ap- plicable to CMOS testing.
Because of the importance of shorts as a failure mode in integrated circuits a great deal of work has been done in determining how to detect shorts.Just as for the detection of stuck-at (i.e., stuck-at-zero and stuck-at-one) faults, detection of a short requires

INTERNAL ACCESS VS. EXTERNAL ACCESS TEST TECHNIQUES
It is important to understand the costs associated with any fault detection problem.There are three broad categories of test-related costs involved in test- ing a microcircuit" Test generation: the development of the test stimuli and responses; a non-recurring cost.Test grading: the determination of the coverage or quality of the tests; a non-recurring cost.Test application: the process of testing an in- dividual microcircuit; a recurring cost.
Test generation has been shown to be an NP-Hard problem [7].While the problem of simply activating a fault (either a stuck-at fault or a short) is itself NP- Hard, in practice it is the propagation of the fault's effects to the primary outputs that is the more dif- ficult task in test generation [8].
Similarly, the high computational costs of grading the fault coverage of a test (usually by means of fault simulation) are due in large part to the propagation of fault effects through the model of the logic circuit.It has been shown that the computational effort in- volved in fault simulation, under what amount to favorable circumstances, grows at most as the square of the size of the circuit [9].Unfortunately, this   bound is easily achievable when fault grading a cir- cuit that uses test compaction (such as signature anal- ysis) where a single signature is read only at the end of the test.On the other hand, fault simulation can execute at nearly the speed of good circuit simulation if there is good observability of internal logic signals and "fault dropping" is used.
When a large number of circuits are involved, test application cost is the most important from the point of view of life-cycle cost.For digital circuits, test application cost is frequently measured in terms of the number of test vectors or number of bits of in- formation that must.be stored and applied/measured.These quantities can then be related directly to time and data storage requirements.
Most work in logic circuit fault detection is based on the assumption that the "normal" primary outputs of the circuit are the only points where the effects of a fault can be observed.Test points (additional primary inputs and/or outputs) are often introduced into a design in order to improve controllability and observability.Scan design can be thought of as providing control and observation points at other than the usual primary inputs and outputsspecifically, the inputs and outputs of the combinational logic in a full-scan design can be considered to be "virtual" primary inputs and outputs for the purpose of testing.However, this simply reduces the complexity of test- ing a sequential logic circuit to that of testing a com- binational circuit (plus some overhead), which is the starting point for most fault detection studies and proofs of computational complexity, particularly in the case of detection of shorts.
Techniques have been developed that provide vis- ibility, either virtually or directly, to the logic node or electrical node level.In this paper, such tech- niques are referred to as internal access; "traditional" techniques that use only the ordinary primary out- puts to observe fault effects are referred to as external access.Four internal access techniques are discussed here.Levi [10] proposed an internal access method for detecting faults in CMOS circuits where the power supply current (Ioo) is monitored during test appli- cation.Levi discussed the classes of CMOS failures that are detectable by this approach (some of which are detectable by no other procedure).In particular, if a short is activated in a CMOS circuit, then there is a low-resistance path from Voo to Vss, resulting in a large Ioo.A short may be detectable even if con- tention does not cause an incorrect logic value to occur.The power supply terminals can be considered to be additional primary outputs, where fault effects from every electrical node are "directly" observable.Measurement of Ioo, particularly the quiescent cur- rent, is becoming a standard procedure [11]; this method is often referred to as "IDDQ" testing.Some Automatic Test Equipment (ATE) vendors have in- troduced features that assist in applying this tech- nique.
CrossCheck Technology, Inc. has developed an internal access method that consists of adding a test point to the output of every gate in a CMOS logic circuit [12].It allows "random access" of any ad- dressable node in a circuit.The voltage at a node is sensed, compared to a threshold, and reported.Reporting is done either on a node-by-node basis or by means of a compressed output response produced by a linear-feedback shift register.This approach provides "virtual" observability of every logic node through a four-wire IEEE l149.1-1iketest bus inter- face.
A third internal access technique uses electron- beam voltage contrast.The CADET system [13], developed by Rockwell International for US Army LABCOM, performs direct node-by-node voltage sampling by means of beam positioning and com- parison to waveforms generated by circuit,level sim- ulation.
The three techniques mentioned to this point provide observability to either the logic node or electrical node level in a circuit; they are capable of detecting an activated bridging failure even when it does not exhibit "wired" behavior.
In this paper two measures of cost are used' num- ber of steps and number of node tests required for bridging failure detection.These terms, as they are used in this paper, are defined as follows: A step is defined to be a test vector on which a measurement is made.
A node test, or more briefly a test, is defined to be where a measurement is made of the state of a node.
A measurement is not necessarily made on each test vector (i.e., not every test vector is designated as a step).However, if the circuit is sequential it may not be possible to delete test vectors that are not steps because they may be required to effect state changes.
When detecting bridging failures by means of measurement the cost of fault detection is related to the number of steps.Nodes are not tested individ- ually by Ioo measurement because the effects of all activated bridging failures are observable at a single point: a power supply line.When using the CrossCheck approach or CADET the cost is related to the number of individual node tests made.
The three internal access test techniques discussed so far apply to the problem of testing individual mi- crocircuits.When testing a circuit board (such as a printed circuit or wire-wrap board) many intercon- nections between microcircuits are accessible.Tech- niques such as bed-of-nails and guided-probe testing constitute a fourth type of internal access testing and the methods presented here can be used to grade the coverage of bridging failures involving nodes acces- sible at the board level and higher levels of assembly.
In this paper it is assumed that the circuit is quies- cent during the time that a measurement is made.It is also assumed that some form of "traditional" ex- ternal access testing is performed, in addition to in- ternal access testing, to verify at least the gross be- havior of the circuit and to detect stuck-at faults.This paper does not consider the possible invalida- tion of a measurement due to the introduction of feedback causing oscillations or by reaching an in- correct quiescent "machine state." ON THE NECESSITY TO CONSIDER SHORTS OF MULTIPLICITIES GREATER THAN 2 A short may involve more than two nodes, as when closely spaced bus lines are involved [14,15], but most of the literature that addresses the detection of shorts (by means of traditional external access test- ing) generally explicitly states or implicitly assumes that it is sufficient to consider only bridging failures of multiplicity 2. This assumption would be valid only if the following conjecture were true: Conjecture (It is sufficient to consider bridging fail- ures if only multiplicity 2): If bridging failure f is detected, then bridging failure f' is also detected, where f is any single bridging failure of multiplicity 2 and f' is any single bridging failure of multiplicity greater than 2 such that both nodes shorted in the presence of f are also shorted in the presence of f'.
Counterexample: Consider the logic circuit shown in Figure 1.Table I lists the logic states present on each node of the logic circuit in the following three cases: No short exists.Nodes a, b, and c are shorted (bridging failure Assume that both bridging failures exhibit wired- AND behavior.Because neither ab nor abc intro- duces feedback and the good circuit is strictly com- binational, we need consider only the eight possible vectors that can be applied to the primary inputs: a', b', and c'.Note that if fault detection is based only on errors observable at the primary outputs, x and y, then both ab and abc are detectable by at least one vector each.
If the conjecture were true, then any test vector that detects ab would detect abc as well.However, inspection of Table I reveals that vector 011 detects the multiplicity 2 bridging failure ab yet does not detect the multiplicity 3 bridging failure abc.Thus, at least for external access test techniques, this coun- terexample contradicts the general statement that it is sufficient to consider only multiplicity 2 bridging failures.
On the other hand, for each of the three internal access test techniques considered in this paper it is "0" means that a state is 0 in the good circuit and in the presence of ab and abc "1/1/0" means that the good state is 1, the state in the presence of ab also is 1, and the state in the presence of abc is 0 easy to show (at least in the absence of feedback) that if any bridging failure f of multiplicity 2 is de- tected, then, afortiori, any other bridging failure of multiplicity greater than 2 in which both nodes shorted in f also are shorted, would also be detected.
The number of potential bridging failures in a logic circuit is vastly larger than the number of stuck-at faults.For a model of a logic circuit, let L be the number of logic lines, N be the number of nodes, and rn be the multiplicity of a single bridging failure.Then the number of single bridging failures of mul- tiplicity rn is given by (raN).For large N and small m, E=2 (/N) as a function of N is O(Nm).In contrast, the number of single stuck-at faults is only 2L, without employing any fault collapsing.(Although L >-N, usually L is not much greater than N.) Thus, even if bridging failures of only multiplicity 2 are consid- ered the number of bridging failures is far larger than the number of stuck-at faults.Because it is not suf- ficient in general to consider only bridging failures of multiplicity 2, as proved by the counterexample above, it is impractical to use any technique that relies on explicit listing, much less simulation, of the universe of bridging failures.
Example 1: Consider the 54LS181 four-bit arith- metic logic unit (ALU).The 54LS181 logic model used in this example is composed of 112 logic gates.There are 126 distinct nodes and 261 logic lines in the 54LS181.Using the stuck-at fault model, the 261 logic lines correspond to 522 stuck-at faults that must be considered for fault grading or test generation.The number of bridging failures of multiplicity 2 is 7,875.Considering bridging failures of small multi- plicities greater than or equal to 2, say 2-5, there   are 2.55 108 potential bridging failures.Sinha and Bhattacharya [15] have considered the problem of counting the number of multiple bridging failures, of given multiplicities >-2, that can occur in a circuit.They defined the quantity "Nmg(k)" to be the number of multiple bridging failures of multi- plicities 2, 3,... k that can exist in a circuit with k nodes.Some values of Nmg(k) are as follows" Nmg (5)  51, Nmg(lO) 115,974, and Nmg(.15) 1,382,958,544.These examples demonstrate that, considering only single bridging failures of multiplicity 2, and assuming that simple "wired" behavior is an accurate fault model, it is impractical to simulate the effects of every bridging failure in a logic circuit of "useful" size.Even if one assumes that shorts occur only be- tween physically adjacent nodes, the number of potential bridging failures is still astronomical, and in any case such information is not known before layout is complete (for example, [16]).It is futile, therefore, to attempt to grade a test vector sequence for cov- erage of shorts by simulating the effect of every po- tential short.
One alternative to full fault simulation is to use fault sampling to estimate a lower bound on bridging failure coverage, or to establish that the coverage is greater than some specified value [17].Another al- ternative, proposed by Abramovici and Menon [6], uses fault simulation for stuck-at faults to determine bridging failure detection.For example, in the ab- sence of feedback introduced by a short in a com- binational circuit and assuming wired-AND behav- ior, bridging failure ab is detected by a test vector if and only if a has the state 0 and b stuck-at-zero is detected, or b has the state 0 and a stuck-at-zero is detected ([6, Theorem 1]).Using Abramovici and   Menon's technique it is unnecessary to explicitly sim- ulate the effect of each bridging failure, but it is still necessary to list every potential bridging failure and analyze each one by applying the requisite relations to the results of stuck-at fault simulation.

ALGORITHM FOR TWO-STATE LOGIC
A technique is presented in this section that deter- mines the coverage of shorts by internal access meth- ods.This technique requires only fault-free circuit simulation, instead of fault simulation, and requires no explicit listing of the universe of potential bridging failures.This technique reveals the sets of nodes that may be shorted together, in any multiplicity, that would be undetected by a test vector sequence.
The principle used is to establish sets of logic nodes that share some property.The notation used here is based on that of Preparata and Yeh [18].
Assume that nodes can have only two states: 0 and 1.For any two nodes a and b in a model of a logic circuit C, and a test sequence consisting of n or more vectors applied to C, define a relation e such that nodes within each set, and en is false for every pair of nodes that are not in the same set, then each such set forms an equivalence class.(When nodes are par- titioned into classes, each node appears in exactly one class only.) Consider two nodes a and b.Define a single difference to be fault activation where a 0 and b 1, or a 1 and b 0, on some vector; a difference is needed to occur on only one vector.Define both differences to be fault activation where a 0 and b 1 on some vector, and a 1 and b 0 on another vector; both conditions must occur.In this paper, it is assumed that a "single difference" is necessary and sufficient for the detection of a short, if all nodes involved are tested on the appropriate step.The problem where "both differences" are necessary and sufficient has also been solved, but is not addressed in this paper.
Assuming internal access and "single difference," this paper shows how sets of nodes are refined and interpreted on each vector.Lower and upper bounds are obtained for both the number of steps and the number of tests required, with respect to a given test vector sequence, and a coverage metric based on multiplicity 2 bridging failures is presented.
The equivalence classes have a direct interpreta- tion in terms of bridging failure detection.An equiv- alence class containing exactly one node name, a, means that node a has been shown to have had a different state from every other node at some point during the application of the test vector sequence; therefore, any short involving a would have been activated and thus detected.An equivalence class containing more than one node, say three nodes a, b, and c, means that: Potential shorts that could exist without being detected include: ab, bc, ac, and abc, and Neither a nor b nor c can be shorted to any node in any other equivalence class without that con- dition being detected.
denotes the statement "a has the same logic value as b for every test vector 1,2,... ,n" It is easily shown that is reflexive, symmetric, and transitive, and so it is an equivalence relation.On any vector n, if all nodes of C are partitioned into sets of nodes such that n is true for every pair of Thus, an equivalence class containing N nodes im- plies that there are 2 N 1 (i.e., the number of sets of cardinality 2 or greater in the power set of the equivalence class) potential shorts that would be undetected.
In this paper shorts are considered only between logic signals.All stuck-at-zero and stuck-at-one faults can be accounted for as well by adding two more nodes, Voo and Vss, to the set of nodes con- sidered.However, this is not done in the algorithms or examples presented here.procedure SHORT_GRADE2 /, S is a matriz of sets of node names, such that S[ij] is the jth set of node names on the th test vector ,/ /, initialize: ,/ S[0,1] ,--{the set of all node names}/, a priori, any node could be shorted to any other, so the initial equivalence class before the 1 st test vector is applied contains all node names ,/ s ,--1/, initially, there is one equivalence class ,/ steps ,--0 tests ,--0 v --{number of test vectors in the test vector sequence} forn-ltovdo /, refine the equivalence classes, list nodes to be tested, and update counts of steps and tests ,/ REFINE2(n, steps, tests, s) repeat/, i ,/ {Print number of steps and tests} /, s is the number of sets generated on the last test vector, v ,/ forj ltosdo {Print the node names in set S[vxi]} /, potential undetected shorts can exist only between nodes in the same set, not between nodes in different sets ,/ repeat/, j ,/ end SHORT_GRADE2 Procedure SHORT_GRADE2 (Figure 2) and its subprocedure REFINE2 (Figure 3) grade a test sequence for bridging failure coverage.SHORT_ GRADE2 generates the equivalence classes for two- state logic, with respect to , and assumes that "single difference" fault activation is sufficient for bridging failure detection.A more general algorithm that applies to four-state logic (where 0, 1, X, and Z are permitted) is introduced in the section on Al- gorithm for Four-State Logic.The notation used to document these algorithms is based on SPARKS [19].In the version of the notation used here, op- erations that are better described in terms of English language descriptions, rather than in terms of SPARKS operations, are set off in braces({...}).
In this version of the algorithm all sets from pre- vious steps are retained.A more efficient imple- mentation would perform set operations in situ and eliminate the need to perform superfluous operations such as explicit set copies and deletions.Other data structures and operations may be more applicable, depending on the language of implementation, and on speed/storage tradeoffs.
It is now shown that SHORT_GRADE2 is an al- gorithm in that it produces a correct result in a finite number of steps.
Outline of lroof: Both the number of nodes N and the number of test vectors are finite.Subprocedure REFINE2 is called once for each test vector.The number of sets manipulated by REFINE2 on any test vector is bounded above by N because each set contains no more than one instance of a node name and no two sets contain the same node name.Sim- ilarly, any single "set operation" involves manipu- lating no more than N node names.Therefore, the algorithm terminates in a finite number of steps.
Correctness of the refinement into equivalence subprocedure REFINE2(n, steps, tests, s) /, n current test vector number steps total number of steps so far on which IDD must be measured tests total number of nodes that must be tested so far using CrossCheck or CADET s : entering the number of sets generated on the previous step; exiting, the number of sets generated on the current step T the set of "nodes to be tested" on this test vector (if any) did_split_set TRUE if and only if at least one set was split on this test vector ,/ T --/, initially the set of "nodes to be tested" is the empty set ,/ did_split_set --FALSE/, no split yet ,/ old_s s s ---0 for 1 to old_s do /, logic states on test vector n are known for all nodes; apply the equivalence relation e in order to refine the equivalence classes from those of the previous test vector ,/ if {Some node in S[n-l,i] has the state 0 and another node has the state 1 on test vector n} then did_split_set TRUE S[n,s+l] {all nodes in S[n-l,i] that have the state 0} Sin,s+2] --{all nodes in S[n-l,i] that have the state 1} /, no node can simultaneously have the state 0 and 1, so no two sets can contain the same node name on test vector n ,/ s -s q-2/, two new sets were created ,/ {Add all nodes that are in S[n,s+l] to set T} {Add all nodes that are in Sin,s+2] to set T} else/, i.e., all nodes in S[n-l,i] have the same state (all zeros or all ones) on test vector n ,/ S[n,s+l] S[n-l,i]/, just copy ,/ s s + 1/, only one new set was created (which is merely a copy of a set from the previous test vector); no nodes are added to set T in this case ,/ endif repeat/, i ,/ classes on each step can be shown by a trivial in- ductive proof based on the properties of the equiv- alence relation e,.
A step contributes to bridging failure detection if and only if at least one equivalence class is "split" on that step.Similarly, the only nodes that need to be tested on any step are those contained in an equiv- alence class that is "split" on that step.
Example 2: Table II demonstrates a case where a logic circuit contains five nodes (a, b, c, d, e) and SHORT_GRADE2 is used to determine the bridging if did_split_set = TRUE then steps -steps + 1 tests tests + {number of node names in T} {Print n}/, test vector n is a necessary step ,/ {Print the names of the nodes in T}/, these are the only nodes that need to be tested on this step the state (0 or 1) being tested is assumed to be known by the tester ,/ endif return end REFINE2 FIGURE 3 Subprocedure REFINE2 (continued).
failure coverage in response to some test vector se- quence.The set refinements, counts of steps, and counts of tests are those obtained after the applica- tion of each test vector.Sets of nodes that were "split" are flagged by an asterisk (*); the union of these sets is the set of "nodes to be tested," T.

COVERAGE METRIC FOR TWO STATES
Consider only single bridging failures of multiplicity 2. For a logic circuit with N nodes there is a universe of (v) bridging failures of multiplicity 2 that must be considered, and an equivalence class containing N' node names implies that there are (2 N') potential shorts that would not be detected.This observation leads to the following theorem: Theorem 1: Following the application of a test vec- tor sequence to a logic circuit with N nodes, denote by s the number of equivalence classes produced by SHORT_GRADE2.Denote by Ni the number of node names in the ith equivalence class.The fraction of single bridging failures of multiplicity 2 that are detected by internal access by the test vector se- quence is given by where () L 0 for x < y.
(It is convenient to define (.) 0 for x < y, as is done for the boundary conditions in the construction of Pascal's Triangle.)Extension of Theorem 1 to the case of bridging failures of multiplicity greater than 2 is straightforward.
Example 3: Applying Theorem 1 to the data provided in Example 2, the coverage of bridging failures of multiplicity 2 on each test vector is shown in Table III.

BOUNDS ON STEPS AND TESTS FOR TWO STATES
SHORT_GRADE2 results in a minimum of both steps and tests when all sets are "split" into equal   halves on each test vector.(Note that this is not necessarily the only case where the minima occur, particularly when the number of node names in a set is not an integral power of 2.) SHORT_GRADE2 results in a maximum of both steps and tests when only one node is "split" from any equivalence class on any test vector.Based on these two cases, lower and upper bounds on steps and tests can be derived.
Proof that these conditions result in the actual min- ima and maxima is rather involved and is omitted.These bounds are not necessarily achievable when SHORT_GRADE2 is applied to any given logic cir- cuit, but they are achievable when the requisite node states are available.SHORT_GRADE2 always takes the first "opportunity" to derive bridging failure detection infor- mation from the given test vector sequence.The number of steps and tests can be reduced in many cases by applying SHORT_GRADE2 to a permutation of the initial test vector sequence.That is to say, the test information contained in the node states is independent of the actual order of application of the test vectors, and some orderings result in fewer tests or steps being required to achieve the same result.

EXPERIMENTAL RESULTS FOR COMBINATIONAL CIRCUITS
In this section results of experiments on combina- tional circuits are presented.The circuits are taken from Advanced Micro Devices, Brglez and Fujiwara,   and Texas Instruments [20][21][22].It is irrelevant that many of these devices are implemented in bipolar ("TTL") circuit technology.The determination of bridging failure coverage based on the method of this paper relies only on the gate-level logic sche- matic and is independent of the circuit technology.
One hundred randomly generated test vector se- quences were applied to the logic models of the cir- cuits-under-test and evaluated for shorts coverage.Only two-state good circuit simulation was used in order to gather node states.For the ISCAS circuits the 100 test vector sequences were drawn from lim- ited "pools" of 5,000 test vectors.For the non- ISCAS circuits, the sequences were chosen to be long enough to guarantee that each of the 100 sequences detected every detectable bridging failure; the value stated for the coverage is the best that any test vector sequence could achieve by measuring every node on every test vector.For the ISCAS circuits the cov- erage is the minimum obtained from 100 sequences of 200 test vectors each.
Table IV summarizes the results of the experi- ments.For each circuit the minimum, maximum, and average, for the 100 sequences, are reported for steps and tests.The average is also expressed as a percentage of the LB stated in Theorem 2. The "cov- erage" is for bridging failures of multiplicity 2 cal- culated on the basis of the sizes of the final equivalence classes in accordance with Theorem 1.
Coverage is less than 100% in most cases because of logic constraints in the circuits--if two nodes always have the same logic state (such as is the case with the input and output nodes associated with a non- inverting buffer), then it is not possible to detect a short between those nodes based on the fault acti- vation assumption of this paper.
Observe that the maximum values for steps and tests are relatively close to the theoretical lower bounds stated in Theorem 2. The average values for steps range from 2.11 to 4.76 times the theoretical LB.For tests, the average values range from 1.05 to 1.39 times the theoretical LB.
For C2670 (the largest combinational circuit tested here) the averages are only 3.39% and 1.55% of the theoretical upper bounds for steps and tests, respectively.
The number of steps is always less than or equal to the number of test vectors, because not every vector necessarily contributes to bridging failure de- tection.The number of tests is always less than or equal to the product of the number of steps and the number of nodes, because not every node must be tested on every step.For the 54LS181, the first of the 100 test vector sequences graded by SHORT_ GRADE2 resulted in 22 steps.The 22 nd step occured on the 70 th test vector.That is, no further bridging failure detection was achieved beyond test vector 70 (out of a possible 2 TM 16,384 vectors).Multiplying 22 steps by 126 nodes yields 2,142 possible node tests, but less than half that number of tests were required (only 899 tests).

ALGORITHM FOR FOUR-STATE LOGIC
In this section an extension is made to the two-state coverage algorithm that allows the use of four-state (0, 1, X, and Z) logic simulation.This permits the application of the principles of this paper to sequential logic.
For any two nodes a and b in a model of a logic circuit C, and a test vector sequence consisting of n or more vectors applied to C, define a relation y such that "ay.b" denotes the statement "a is not 0 when b is 1, and.a is not 1 when b is 0, on any test vector 1, 2,... n" It is easy to show that y is reflexive and symmetric.
However, ,/ is not transitive (that is, av,b and byc do not imply ayc).Therefore, 7n is only a compat- ibility relation [18].On any vector n, if all nodes of C are distributed into sets of nodes such that 3' is true for every pair of nodes within each set, then each such set forms a compatibility class.Of course, if nodes take only the states 0 and 1, then y and e yield the same result, and the compatibility classes are thus also equivalence classes.
It is important to distinguish between partitioning and distributing nodes into classes.When nodes are partitioned each node appears in exactly one class; when nodes are distributed a node can appear in more than one class.
Procedure SHORT_GRADE4 generates the com- patibility classes for four-state logic and assumes that "single difference" fault activation is sufficient for bridging failure detection.The text of the top-level procedure is identical to that of SHORT_GRADE2, except that subprocedure REFINE4 is called instead of REFINE2, so it is not reiterated here.The text of REFINE4 is shown in Figure 4.
It can be shown that SHORT_GRADE4 is an al- gorithm in the sense that it produces a correct result (based on the properties of the compatibility relation 7) and that it terminates in a finite number of steps, but the proof is omitted here.
Because the transitive property is lacking in this case, a node may appear in more than one compat- ibility class.Therefore, the interpretation of the com- patibility classes that result from SHORT_GRADE4 is more complex than the interpretation of the equivalence classes that result from SHORT_GRADE2.
Define the set U to be the union of all compatibility classes in which node name a appears.Then  Node a may be shorted to any other node in U without that condition being detected, and Node a cannot be shorted to any node that is not in U, without that condition being detected.Example 4: Table V demonstrates a case where a logic circuit contains five nodes (a, b, c, d, e) and SHORT_GRADE4 is used to determine the bridging failure coverage in response to some test vector se- quence.The set refinements and counts of steps and tests shown are those that are obtained after the ap- plication of each test vector.Because some nodes have the state X, for convenience the set of "nodes {c, e} to be tested, vector.
T, is shown explicitly on each test COVERAGE METRIC AND BOUNDS FOR FOUR STATES Because SHORT_GRADE4 does not necessarily partition nodes into classes, strictly speaking the sim- ple coverage metric presented in Theorem 1 cannot be applied in the four-state case unless it happens that no node name appears in more than one com- patibility class.Fortunately, as is demonstrated in the section on Experimental Results for Sequential Circuits, this appears to be the rule rather than the exception when SHORT_GRADE4 is applied to se- quential circuits.When a node name appears in more than one com- patibility class, it is still possible to calculate a cov- erage metric but it is then necessary to list the re- maining potential bridging failures in order to avoid counting any bridging failure more than once in enumerating the undetected bridging failures.However, even if it is necessary to calculate coverage by listing the potential bridging failures, in practice this set generally becomes fairly small after the applica- tion of only a few test vectors.This is best explained by means of an example.implies that bridging failures bd, be, and de would be undetected.Compatibility class {c, d, e} implies that bridging failures cd, ce, and de would be un- detected.Bridging failure de appears twice, so there are only six unique potential bridging failures that would be undetected after applying test vectors 1-4   in Example 4. Thus, coverage of single bridging fail- ures of multiplicity 2 in this case is 1 6/(5) 1 6/10 0.4.
An alternative is to simply avoid considering X and Z states.In many cases, it is possible to avoid the need to list the bridging failures by allowing SHORT_GRADE4 to use only test vectors for which all nodes have only 0 and 1 states.
A third alternative for determining the numerical coverage is to "blindly" apply Theorem 1 to the compatibility classes that result from SHORT_ GRADE4.If any node names appear in more than one compatibility class, then the resulting value will at worst underestimate the actual coverage.One risk in relying on this method is that the coverage may be reported as being less than zero!However, this simple approach is the one used in the section on Experimental Results for Sequential Circuits and no problems were encountered in its application.
The LBs for both steps and tests that result from SHORT_GRADE4 coincide with those obtained from SHORT_GRADE2.The minima are achieved when all sets are "split" into equal halves on each test vector.For the UBs it appears that the worst case is where only two nodes are tested on each step.A five-node example is shown in Table VI.While this paradigm can be shown by exhaustion in small cases to provide the maxima for steps and tests, it has not actually been proven to provide the maxima for all cases.Therefore, although the following as- sertion is stated as a theorem, the expressions for the UBs are only conjectures" Theorem 3: Let N denote the number of nodes in a logic circuit.Define M [log: N].The lower bounds (LBs) and upper bounds (UBs) on steps and tests that result from the application of SHORT_ GRADE4 are: LB on steps: M LB on tests: (M + 1)N-2 u Table VII summarizes the results of applying SHORT_GRADE4 to sequential circuits.Circuit USFX contains structures used in a study of fault simulators [23].PRSR is a linear-feedback shift reg- ister structure used to investigate how logic simula- tors propagate uninitialized logic signal values.The other test cases are ISCAS sequential circuits [24] where the d-flip-flops are implemented as 10-NAND gate-equivalent circuits.
For each circuit, a test vector sequence was applied and node states were obtained.The sequences ap- plied to USFX and PRSR were quite short and ex- ercised the circuits only minimally.The sequences applied to the ISCAS circuits consisted of 5,000 pairs of vectors, where each pair of vectors applied ran- dom data with the clock low and then high.Next, 100 sequences of 200 vector pairs each were selected at random and graded by SHORT_GRADE4.The "random ordering" is only with respect to the order in which SHORT_GRADE4 considers the test vec- tors, because the calculated node states would be invalid if the vectors were applied in a different or- der.The external access stuck-at fault coverages ranged from approximately 60% down to nearly 0. However, as is shown in Table VII, bridging failure coverage is extremely high in every case.
The types of statistics listed in Table VII are the same as those for the combinational circuit data presented in the section on Experimental Results for Combinational Circuits.Only in the case of PRSR did any node name appear in more than one final compatibility class.Coverage was calculated using Theorem 1 in every case, so the coverage stated for PRSR underestimates the actual coverage.The cov- erage is the minimum obtained from the 100 se- quences considered for each circuit.As was the case with the combinational circuits, the maximum values for steps and tests for the se- quential circuits are fairly close to the theoretical lower bounds stated in Theorem 3. The average val- ues for steps range from 2.22 to 7.60 times the the- oretical LB.For tests, the average values range from 1.06 to 1.76 times the theoretical LB.For S1238 (the largest sequential circuit tested here) the averages are only 0.03% and 2.40% of the theoretical upper bounds for steps and tests, respectively.

CONCLUSION
This paper has presented a technique for determining the coverage of bridging failures by internal access test techniques.The technique involves partitioning nodes into equivalence classes (for two-state logic) or distributing nodes into compatibility ,classes (for four-state logic).In either case, the possibility of an undetected short exists only between nodes in the same equivalence class or compatibility class.For two-state logic, a simple multiplicity 2 bridging fail- ure coverage metric is presented based on the sizes of the equivalence classes.For four-state logic, the coverage metric may require listing the set of poten- tial bridging failures, but this set quickly becomes very small.
Experimental data are presented that demonstrate that the average number of steps or tests required for bridging failure detection, based on internal ac- cess, is not much greater than the theoretical mini- mum.
Experiments showed also that the coverage of bridging failures, even by short randomly generated test vector sequences, is extremely high for both combinational and sequential circuits.This suggests that internal access test techniques make explicit test vector generation for bridging failures unnecessary.
Nodes a and b are shorted (bridging failure f).

FIGURE
FIGURE Sample circuit with bridging failures ab (multiplicity2) and abc (multiplicity 3).

Theorem 2 :
Let N denote the number of nodes in a logic circuit.Define M [log2 N]. (Ix] denotes the ceiling function: the smallest integer greater than or equal to x. M satisfies the inequalities 2 2M.)The lower bounds (LBs) and upper bounds (UBs) on steps and tests that result from the appli- cation of SHORT_GRADE2 are: LB on steps: M LB on tests: (M + 1)N 2 u UB on steps: N 1 UB on tests: (N + N 2)/2

Example 5 :
Referring to

TABLE Node States
for Circuit Shown in Figure1, in the Presence of Bridging Failures ab and abc.Assuming Wired-AND Behavior, Test Vector 011 Detects ab Yet Does Not Detect abc

TABLE IV Results
of Applying SHORT_GRADE2 to Combinational Circuits.Averages are Rounded to Three Decimal Digits of Precision.Coverages are Rounded to Five Decimal Digits of Precision Ave Ave

TABLE V
Example of Application of SHORT_GRADE4.T is the Set of "Nodes to Be Tested" on Each Step Test TableV, generated in Ex- ample 4, consider the compatibility classes that result on test vector 4: {a, e}, {b, d, e}, and {c, d, e}.Com- patibility class {a, e} implies that bridging failure ae would be undetected.Compatibility class {b, d, e}

TABLE VII Results
of Applying SHORT_GRADE4 to Sequential Circuits.Averages are Rounded to Three Decimal Digits of Precision.Coverages are Rounded to Five Decimal Digits of Precision Ave Min Max Ave as % Min Max Circuit Nodes Steps Steps Steps of LB Tests Tests