New Self-dual Circuits for Error Detection and Testing

In this paper new methods for the transformation of a given combinational circuit into
a self-dual circuit based on the notion of a self-dual complement are investigated. The
large variety of self-dual complements can be utilized to optimize the transformed self-dual
circuit. Self-dual duplication and self-dual parity prediction are considered in
detail. As a method for the reduction of self-dual outputs, output space compaction of
self-dual outputs is considered. For the first time we also describe in this paper how a
self-dual circuit can be modified into a self-dual fault-secure circuit.


INTRODUCTION
Self-checking and self-testing circuits are becom- ing more and more important as the complexity of VLSI continues to increase.For the design of self-checking or self-testing circuits very often cod- ing techniques as described, for example in [1 -8] with additional control bits and additional check- ers are used.On the other hand, time redundancy is also utilized for error detection.
Especially for arithmetic operations with sim- ple functional equations the method of pseudoduplication is of interest [4, 9-11].The data are processed twice in succession but along different data paths, latched and compared.
The method of alternating inputs, introduced in [12] and further developed in [13] may be consid- ered as an interesting general method for the com- bination of time-and hardware-redundancy also for random logic.According to [12, 13] a given com- binational circuit is transformed into a self-dual circuit.For a large percentage of the considered benchmark circuits the necessary area overhead is very small.Since always the corresponding al- ternating inputs x (original input vector) and (inverted input vector) are successively submitted to the self-dual circuit time redundancy is 100% and the method is mainly applicable for the design of control systems for which time is not a critical issue.A great advantage of the method of alter- nating inputs is that stuck-at faults at the input lines of the monitored circuit are also detected by this method.Self-dual circuits can be used in different modes of operation.
In on-line mode the original functional inputs x and their inverted values 2 are subsequently submitted to the self-dual circuit.For these al- ternating inputs the corresponding outputs are alternating as long as no error occurs.
In test mode it is not necessary to store the test outputs of the circuit under test.The elements xt of the test set T and their inverted values 2t are applied to the self-dual circuit.A fault is detected if the corresponding outputs are not alternating.
In fast mode, without error detection, only the functional inputs are applied to the circuit.
Thus, the application of self-dual circuits and the combination of their different modes of operation allows one to achieve different levels of error detection and fault tolerance.
In this paper new methods for the transforma- tion of a given combinational circuit into a selfdual circuit are investigated.These methods are based on the concept of a self-dual complement of a Boolean function.Thereby a Boolean func- tion 6f(x) is called a self-dual complement of the Boolean function f(x) if the modulo-2-sum f(x) 6f (x) off(x) and 6f(x) is self-dual.To modi- fy a given combinational circuit f into a self- dual circuit fd the original circuit is completed by a circuit Sfe(x) implementing the self-dual com- plement f(X).For x-xl,... ,Xm there exist 2 2m-I different self-dual m-ary Boolean functions.Thus for a given Boolean function f(x) there also exist 2 2"-1 different self-dual complements.This variety of self-dual complements can be utilized to opti- mize the modified self-dual circuit.An optimiza- tion of the self-dual circuit with such a variety of choices is possible even if the original circuit is com- pletely specified and no don't-care conditions of the original circuit are available.The original circuit and the carefully chosen self-dual complement can be jointly or separately implemented and optimized.
First, self-dual duplication is described.To re- duce the number of self-dual outputs, self-dual parity prediction is investigated.As a further method for the reduction of self-dual outputs, output space compaction of self-dual outputs is considered.
A fault 4 of a self-dual circuit is detected, if, for alternating inputs the outputs of the erroneous circuit are not alternating.Faults of the primary input lines are also detected in test mode and in on-line mode with a high probability.A fault will not be detected if the outputs are erroneous but alternating.For safety-critical applications such a situation can not be tolerated.For the first time, we also describe in this paper how a self-dual cir- cuit can be modified into a self-dual fault-secure circuit, i.e., into a self-dual circuit for which every single gate fault will immediately be detected by not being alternating if the fault, for the first time, forces a circuit output to be erroneous.
In general, it is demonstrated in this paper that the method of modifying a given combina- tional circuit into a self-dual circuit by use of a self-dual complement is an effective method for error detection and testing with low area over- head and a high fault coverage.The paper is orga- nized as follows.
The next chapter contains the basic notions and notations which are applied in the follow- ing chapters for the design of different types of self-dual circuits.First, the notion of a self-dual complement of a Boolean function is introduced and self-dual complements with both a minimal number of ones and a maximal number of ones are described.These types of self-dual complements are especially useful for the design of self-dual cir- cuits.Self-dual testability is formally defined and it is shown how a self-dual complement can be used for error detection.Self-dual fault secureness is defined both at a functional and at a structural level.
In third chapter self-dual duplication is investi- gated.For every circuit output of the original cir- cuit a self-dual complement is determined.Separate and joint implementations of the self-dual com- plements and the functional circuit are consid- ered in detail.Experimental results for the area overhead and fault coverage in test mode and for the probability of not detecting an error in on-line mode are obtained for benchmark circuits.
The fourth chapter deals with self-dual parity.Only the ordinary parity prediction function is replaced by a self-dual complement of this func- tion.As in the third chapter, the separate imple- mentations of the self-dual complement and the functional circuit are compared with the corre- sponding joint implementation of these func- tions.The experimental results compare area overhead, fault coverage in test mode, and error detection probability in on-line mode for ordin- ary parity prediction with the results obtained for self-dual parity.
Linear output space compaction of alternating signals is described briefly in the fifth chapter.
The transformation of an arbitrary self-dual cir- cuit into a fault-secure self-dual circuit is presented in the sixth chapter.
The last chapter contains conclusions.

BASIC NOTIONS AND NOTATIONS
In this chapter, we introduce the notion of a self- dual complement of a Boolean function and we describe basic properties of self-dual complements which are useful for error detection and testing.
Let g: X---+ Y, X--{O, 1}m,X=Xl,...,Xm be an m-ary Boolean function.Then gd(x)=-g(2), 21,...,2m is called the dual function of g.The Boolean function g is called self-dual if g(x)= gd(x) (2) for x E X. Till now the only meth- od for the transformation of a given combina- tional circuit into a self-dual circuit is based on the fact [12], that an arbitrary Boolean function g(x) can easily be transformed into a self-dual Boolean function G(a, x) a(a, x) -g(x) V a-g (2)  (1) with G(0, x) g(x) and G(1,2) (x).Thereby a E {0, 1} is an additional Boolean variable.In [12] the original Boolean function g(x) and its dual function ga(x) (2) are combined to form the self-dual Boolean function G(a,x).In [13] it was shown how this method can be applied to the transformation of a combinational circuit which is given as a netlist of ANDand OR-gates and INVERTERS.If in the original circuit all the AND-gates are replaced by OR-gates and if all the OR-gates of the original circuit are replaced by AND-gates the modified (dual) circuit imple- ments the corresponding dual function of the ori- ginal circuit at its outputs.Now the outputs of the original circuit and the corresponding outputs of the modified dual circuit are connected as it shown in Figure 1, and the resulting circuitry implements at its outputs the desired self-dual functions.
To reduc6 the necessary hardware overhead the original circuit and the modified dual circuit can be jointly implemented and optimized.The result- ing average area overhead is 70% of the original circuit [13].
A Boolean function can also be transformed into a self-dual function by use of a self-dual complement which is introduced now.By use of this method the necessary area overhead can be reduced.

DEFINITION
Let g be a Boolean function.Then 6f is said to be a self-dual complement of g if h g 6f is self-dual.
It is easy to prove that for =l,...,m the Boolean function 6i(X) xi(g(x) @-g(2)) (2) is a self-dual complement of g(x).xi is one of the m components of the input vector x (x1,..., Xm) of the m-ary Boolean function g(x).For these functions 6i(x) xi(g(x) ()), i= 1,..., m the X Connection of the original and modified circuits before circuit optimization.number of values x for which 6i(X is minimal [14]. Another interesting class of self-dual complements of the function g(x) are the functions 6i(X) Xi W (g(x) g()), i= 1,... ,m, (3) for which the number of values with i(x) is maximal [14].
Now we describe how a self-dual complement of a Boolean function can be utilized for error detection.The set of technical faults considered is denoted by {050, 051,..., bk}, where b0 de- notes the absence of a fault.In this paper we suppose that a technical fault bE can always be expressed at a gate level in such a way that in the presence of the fault b a fault free gate gq implementing the Boolean function Gq(x) is transformed into a faulty gate gq implementing the erroneous Boolean function Gq(4,x).We are only interested in unidirectional gate faults which are now described.
A fault b is called a unidirectional gate fault of gate gq ifeither the correct output 0 for some inputs x E 7 c_ X is changed into an erroneous output and the correct output remains correct or the correct output for some inputs x .C_ X is changed into an erroneous output 0 and the correct output 0 remains correct.For an unidirectional gate fault only one of the two possible output values of a faulty gate may be erroneous.For single and multiple stuck-at-0/1 faults at the input-and output-lines these condi- tions are always satisfied for AND-, OR-, NAND- and NOR-gates, and INVERTERS.A bridging fault between lines of different gates, an intermittent value of a CMOS-gate, the replacement of an AND-gate by a NAND-gate, or a stuck-at fault at an input line of an XORgate if, because of a fanout, this fault is not equivalent to a stuck-at fault at the output of the preceding gate, are examples of faults which are not unidirectional gate faults.
If a fault OSi is present, the output yj of the circuit fc under input x is denoted by Yj,i-'fj (i, X).Thus, in the absence of a fault, we have the correct output Y,0 =fj (40, x) =fj. (x).
For error detection in a circuit implementing a Boolean function g(x), a self-dual complement 6(x), is determined and g, 6, and h(x)= g(x)@ 6(x) are implemented as shown in Figure 2.  We assume that the input x x1,... x m of the considered circuit is alternating.Since h(x) is self- dual with h(x) h(2) the output y h(x) is also al- ternating as long as no error occurs.
A fault is detected under the alternating inputs x and 2 if the outputs h(x) and h(2) are not alter- nating.The testability of a fault is now defined more precisely.DEFINITION 2 A fault changing g(x) into g(, x) is called self-dual testable if there exists an input x for which we have g(, x) 6(x) g(, 2) 6 (2).
Thus in the case of a testable fault for the al- ternating inputs x and 2, the output y is not al- ternating.A fault changing g(x) into g(, x) is self-dual testable if there exists an input x' such that we have g(x'):/:g(,x') and g(2')= g(,2').A fault can not be detected under the alternat- ing inputs x and 2 if the outputs of the erroneous circuit are alternating.This situation occurs if eith- er the alternating outputs of the erroneous circuit are both correct or both erroneous.In the later case erroneous circuit outputs are not detected as erroneous by alternating inputs.Especially in on- line mode for safety-critical applications such a situation should be avoided.If every error due to a technical fault E is immediately detected the circuit is called fault-secure.Now let us consider a self-dual combinational circuit fc implementing at its outputs Yl,..., Yn the self-dual Boolean functions yl=fl(x),...,y,, f,(x).
Then the output yj, j6 {1,...,n}, is self-dual fault-secure with respect to the fault E if, in the presence of this fault, for every x X the out- put yj is never simultaneously erroneous under the alternating inputs x and 2. If, due to the fault , an output signal is erroneous the signal-is not alternating.
We say: A self-dual circuit is completely fault- secure with respect to a fault I, if every output yj, j { 1,... ,n} is a self-dual fault-secure with re- spect to the fault.
The self-dual circuit fi is self-dual fault-secure with respect to the set of faults if every output yj, j {1,... ,n} is self-dual fault-secure with respect to every fault E .
As an example let us consider the circuit of The truth tables of the correct circuit (column A), the faulty circuit with a stuck-at-0 fault ql at the output of gate 4 (column A1), and the faulty circuit with a stuck-at-1 fault 2 at the output of gate 4 (column A2) are given in Table I.
In the presence of the fault 1 the output yl is erroneous under the alternating pairs of inputs 010, 101 and 011, 100.Thus the output Yl is not self-dual fault-secure with respect to the stuck-at-0 fault 1.On the other hand the output Y2 is erro- neous under input 011 but not under input 100 and erroneous under input 101 but not under input 010.Therefore Y2 is self-dual fault-secure with respect to the stuck-at-0 fault 1.Both the outputs, Yl and Y2 are self-dual fault-secure with respect to the single stuck-at-0 fault   In the following we are interested in the redesign of self-dual circuits into self-dual fault-secure cir- cuit with respect to all single gate faults.Since gates are the elementary units of the design pro- cess we introduce the notion of a self-dual faultsecure gate.
DEFINITION 3 A gate g of a self-dual circuit fc is called self-dual fault secure with respect to an output yj of fc if the output yj of fc is self-dual fault-secure with respect to all the considered sin- gle gate faults of g.
A gate g of a self-dual circuit fc is called self- dual fault-secure if g is self-dual fault-secure with respect to every output yy, j E 1,..., n, offc.
In Theorem 1, the necessary and sufficient conditions for a circuit output to be self-dual fault-secure with respect to a single gate fault are given.

THEOREM
Let fc be a self-dual combinational cir- cuit.Let be a single gate fault of g offc chang- ing the correct output Gj(x) ofgj into the erroneous output Gj(,x) and let zj denote the output of gj.Then the circuit output yj of fc is (functionally) self-dual fault-secure with respect to if and only if we have dye The proof is omitted here.Now we mention the following simple observation.

OBSERVATION
A unidirectional gate fault can- not be detected at the output yj of f under the alternating input pair x, Y if the fault is simulta- neously stimulated by x and Yc and if, from the location of the fault, two different paths to the output y of the circuit with a different parity of the number of inverters are sensitized by x and 2 respectively (see [12] for a preliminary formulation of this observation).
The transformation of a self-dual circuit into a self-dual fault-secure circuit relies very much on the following theorem.
THEOREM 2 Let fc be a self-dual combinational circuit with n binary outputs Yl,...,Yn.Iffor every gate g offc the parity of the number of inverters of every path from g to the output yj is equal then fc is self-dualfault-secure with respect to the output yj.Proof A unidirectional gate fault G(c,x)can be propagated to a circuit output yj under the al- ternating inputs x and 2 only along paths with the same parity of inverters.If only the input x (but not 2, or vice versa) stimulates the fault q5 at most yj(d,x) (but not y(q, )) is erroneous.Eith- er the fault q5 will be detected or both the output values will be correct.
Let us assume now that both x and 2 stimu- late a unidirectional gate fault b resulting, for ex- ample, in an erroneous value instead of a correct 0. Such a situation is usually described [15] by use of the D-calculus as D. Then we have G(dp, x) G(dp, 2) 7/= G(x) G(2) 0. Let us further assume that both x and 2 sensitized paths p and p2 from the location of the fault q5 to the output y.These paths must have the same, for instance, an even parity of inverters.Then the stimulated erroneous D will be propagated under both the inputs x and 2 as an erroneous D to the output y changing both the correct values y(x) y(2) 0 into the erroneous value y(ck, x) =yj(qS,2)= 1.This is a contradiction since fc is self-dual with y(x) yj(2).
A similar result was already obtained in [12].
According to Theorem 2, a unidirectional gate fault of a gate g can not be propagated to a circuit output y if all the paths from g to this circuit output have either an even or an odd number of inverters.If Theorem 2 is true for every output yj, j= 1,..., n, then the corresponding self-dual circuit is self-dual fault-secure.
By use the Theorem 2 the transformation of a self-dual circuit into a self-dual fault-secure circuit can be simplified if fault secureness is considered at a structural level only.DEFINITION 4 A gate g of the circuit fc is called structurally self-dual fault-secure with respect to a circuit output yj if all the paths from gate g to the output yj have either an even or an odd number of inverters.
A gate g of the circuit f is called completely structurally self-dual fault-secure if all the paths from the gate g to all the outputs yj, j-1,... ,n, have either an even or an odd number of inverters.
These notions, definitions and theorems will be applied in the following chapters for the design of self-dual circuits for error detection and testing.

SELF-DUAL DUPLICATION
In this section we describe the method of self- dual duplication [16].To each of the functional cir- cuit outputs of the original circuit a corresponding self-dual output is determined.The self-dual out- puts are implemented by use of self-dual comple- ments of the corresponding outputs of the original circuit.The self-dual complements and the moni- tored circuit itself can be separately or jointly im- plemented.A joint implementation and a careful selection of the appropriate self-dual complements of the circuit outputs significantly reduces the necessary area overhead for the proposed meth- od of error detection.The proposed approach is different from "normal" duplication and comparison where both the original circuit and its duplicate have to be separately implemented.
For j= 1,...,n the Boolean function h#(x) fj(x) (3 6#(x) is self-dual.The original circuit and the self-dual complements are separately or jointly implemented.
We choose, from this set of 2m self-dual com- plements of the output y#, the minimal self-dual complement Sj,min of this output with A(6i,j) >_ a(Sj,min), a(Ji,j) >_ a(Sj,min).
In a first approach the minimal complements l,min,...,n,min are jointly implemented as a combinational circuit 6.Then the circuit 6 and the original circuit fc are jointly implement- ed and optimized.

Y3
In a second approach the minimal self- dual complements 61,min,... 6n,min of the outputs Yl,...,Yn and the original circuit fi are jointly optimized in one step.Finally, the minimal circuit obtained in both approaches is chosen.
To model the error detection capability of the circuit in on-line detection mode pseudorandom inputs are used.A sequence of 1000 pseudoran- dom m-bit inputs is generated.From this sequence a sequence of 2000 inputs consisting of 1000 alternating pairs of inputs is determined.Now the probability not to detect an error at the outputs of the original circuit due to a single stuck-at fault is determined.For every single stuck-at fault the sequence of 1000 alternating pairs of inputs is sub- mitted to the faulty circuit f().Let N() be the number of input pairs for which at least one of the outputs fy() off(C) is erroneous under input x or respectively.
Let n() be the number of input pairs of the sequence of pseudorandom input pairs for which the fault will be detected by the considered method.Then #() N() n().100% N() is the probability (in percentage), in on-line mode, not to detect an error due to the fault .
For a given circuit for all single stuck-at faults , j= 1,..., k, the average value #, is experimentally determined.
The experimental results for fault coverage for a deterministic test are described now.A test set T for all single stuck-at-0/1 faults is determined by use of the atpg-script of SIS [17].For every input x E T also the alternating input 2 is submitted to the circuit under test.A fault is detected if, at least FIGURE 6 Joint implementation of the original circuit and the self-dual complements.

Y2
h2 hi Y3 for one of the n circuit outputs yj, j= 1,..., n, the value of hy is not alternating.
For 19 benchmark circuits experimental results are given in Table II.The columns 1, 2 and 3 de- scribe the name of the circuit, the number of in- puts and outputs and the area of the optimized original circuit.
For a separate implementation of the original cir- cuit and the corresponding self-dual complements the columns 4 through 8 contain the area over- head for the implementation of the self-dual com- plements in % of the original optimized circuit, the fault coverage for internal stuck-at faults in %, the probability # not to detect an erroneous output due to an internal single stuck-at fault, the fault coverage for stuck-at faults of the input lines and the probability/2 not to detect an erroneous out- put caused by a stuck-at fault at the input lines.
The corresponding values for a joint implementation of the original circuit and its self-dual com- plements are given in column 9 to 13.
The average area overhead, in percentage of the area of the optimized functional circuit, is about 64% for a separate implementation and about 49% for a joint implementation.In the case of a joint implementation, about half of the circuits have an area overhead less than 20% of the opti- mized area of the original circuits.The average value for the area overhead for these 50% of the circuits is only 7%.Since the circuits cm82a, rd73, b and z4ml are self-dual no self-dual com- plement has to be added to the original circuits.For internal stuck-at faults the average fault coverage in test mode is 99.5% for a separate implementation and 97.5% for a joint imple- mentation.For stuck-at faults at the input lines the average fault coverage is 97.3% for a sepa- rate implementation and 97.5% for a joint implementation.
In On-line mode the average probability /2 not to detect an error due to an arbitrary internal stuck-at fault is 1.59% for a separate implemen- tation and 12.1% for a joint implementation.
For stuck-at faults at the input lines the cor- responding average values for/2 are 10.2% for a separate implementation and 9.38% for a joint implementation.

SELF-DUAL PARITY PREDICTION
Self-dual parity checking is a modification of ordinary parity checking.The parity prediction function f of ordinary parity checking is replaced by the self-dual complement 6p of this function such that the modulo-2 sum of the outputs of the monitored circuit and of 6p is an arbitrary self-dual Boolean function h.
We suppose that the monitored combination- al circuit f implements the n Boolean functions Yl =fl(x), y2=f2(x),... ,Yn--fn(X).The parity pre- diction function f,(x) is defined by fp(x) =fl (x) ...fn(X).(7) To check the correct behavior of the combi- national circuit f by usual parity prediction, the functional outputs yl,... ,Yn are added modulo 2 and compared with the predicted parity fp(x).If the predicted parity f(x) and the modulo 2 sum of the outputs disagree, an error is indicated.
(For details and modifications see for instance [151.) The implementation costs for the parity predic- tion function are relatively high.Recently, the area overhead for a joint and a separate implementa- tion was determined in [18,19] for some bench- mark circuits.Although only one additional parity bit fp(x) is added to the functional circuit f, the additional average area overhead for ordinary parity checking is 44% (29%) of the not optimized original circuit for a separate (joint) implementa- tion off and fp(x).The optimization was done by use of the tool SIS [17].The mentioned results, however, are only achievable for such benchmarks for which an interim representation as a two le- vel expression could be derived by the SIS tool [17].For other circuits, the area overhead for the implementation of a parity bit may be significantly higher.This large area overhead partially results from the fact that, for a given completely defined circuit f, the parity prediction function fp(x) is completely determined by Eq. ( 7); therefore, no don't-care conditions can be utilized to optimize To reduce the area overhead of the parity bit, we replace the parity prediction function fp(X) by the self-dual complement 8p of the parity prediction function fp(X).8p is easier to implement than fp(X).
Instead of checking the circuit by comparing the parity of the outputs with the predicted parity, we substitute the parity prediction function with a self-dual complement of this function.The parity of the outputs and the self-dual complement of the parity prediction function are added modulo 2 to form an arbitrary self-dual Boolean function.The self-duality of this function is constantly monitored by applying alternating inputs.Since we suppose the input variables to be alternating, the output y k(x) is also alternating as long as no error occurs.
It is easy to see that 6(x)=fp(x)(9 xi for i-- l,..., m is always a self-dual complement offp(x), since fp(x) 6(x) xi is self-dual.Thus, the overhead for the optimal self-dual complement 6(x) is, at most, as large as the necessary overhead for the parity prediction function fp(x).Figure 7 shows an example circuit with 5 cir- cuit outputs which is monitored by self-dual parity prediction.
The complexity of the self-dual complement p(x), consisting only of 2 two-input gates, is very small.A fault will be detected if, in the presence of the fault, the parity is erroneous for some input x but correct under input 2. The experimental results show that the overhead for the self-dual complement p(x) is much smaller than the necessary over- head for the parity prediction function f(x).
Experimental results are presented in Tab- le III.As in Table II columns 1, 2 and 3 of Table III describe the name of the circuit, the number of inputs and outputs and the area of the optimized original circuit.The area overhead in percentage of the original optimized circuit, the fault cover- age (in percentage) for internal single stuck-at faults in test mode, the probability # (in percent- age) not to detect in normal operation mode an erroneous circuit output due to an internal single stuck-at fault, the fault coverage (in percentage) for single stuck-at faults at the input lines and the probability/2 (in percentage) not to detect in normal operation mode an erroneous circuit out- put due to a single stuck-at fault at the input lines are given in columns 4 through 8 for a separate implementation of the original circuit and the self- dual complement of the parity function.For a joint implementation the corresponding results are presented in columns 9 to 12 of Tab- le III.The average value for the area overhead for the implementation of self-dual parity is 27% of the optimized circuit for a separate implementation and 18% for a joint implementation.For the considered benchmark circuit the corresponding values for ordinary parity prediction are 62% for a separate implementation and 28.9% for a joint implementation.(In the literature the area overhead for parity prediction is sometimes given in percentage of the area of the not optimized circuits.)For self-dual parity in test mode the average values for fault coverage with respect to internal single stuck-at faults are 93.3% for a separate implementation and 87.2% for a joint im- plementation.For ordinary parity prediction the corresponding values are 96.1% for a separate implementation and 83.5% for a joint implemen- tation.For a separate implementation fault cover- age for self-dual parity is only 2% less than for ordinary parity prediction, and the area overhead is only 43% of the area overhead for ordinary parity prediction.For a joint implementation the fault coverage is even higher for self-dual parity.For self-dual parity the average probability /2 not to detect an error due to an internal single stuck-at fault is 22.7% for a separate implemen- tation and 33.1% for a joint implementation.For ordinary parity prediction the corresponding values are 22.4% and 42.6%.These probabilities are relatively high for both ordinary parity prediction and self-dual parity.For single stuck-at faults at the input lines the average fault co- verage is 73.4% for a separate implementation and 73.9% for a joint implementation.For the circuits cm82a, decod, rd73, z4ml and b the parity function is self-dual and no self-dual complement has to be added.
The probability/2 in on-line mode not to detect a functional error due to a single stuck-at fault at the input lines is 56% for both realizations.
If an error due to a permanent fault occurs at the circuit outputs n times, it will not be detected with a probability of only #n which already is a very small quantity for relatively small values of n.
But the probability to miss an error resulting from a transient fault remains relatively high.

LINEAR OUTPUT SPACE COMPACTION OF ALTERNATING SIGNALS
In this section linear space compaction of alter- nating signals will be considered.The alternating outputs gl,... ,gn of the self-dual circuit fa are compacted by a linear compaction circuit LCC into q alternating signals Vl,..., Vq, < q < n.Only the compacted signals Vl,..., Vq are to be mon- itored, whether they are alternating or not.In [12] the alternating output signals are transform- ed into two-rail signals by use of D-flip-flops and then monitored by a two rail checker with 2n in- puts and 2 outputs.The linear output space com- paction for alternating signals as described in this section reduces the necessary area overhead for output checking by a factor of 2.5 to 3.
The linear compaction circuit LCC has to be self-dual and self-testing with respect to every single stuck-at-0/1 fault.Self-testing here means that every single stuck-at-0/1 fault is detectable by a non-alternating signal of at least one of the outputs of the LCC if the appropriate alternating signals are applied to its inputs.
The linear compaction circuit LCC can be realized by use of a linear self-dual module M(gl,g2, g3) with the three inputs g, g2, g3 and one output implementing the linear function M(gl, g2, g3) gl @ g2 @ g3, in GF(2).This func- tion is self-dual.A direct implementation of the complete disjunctive normal form of M, M(gl,g2, g3) glg2g3 V 1g23 V g123 V glgEg3, is self-testing, whereas an implementation of M by two XOR-gates is not.
As an example the linear compaction circuit LCC for the compaction of ten alternating sig- nals gl,.-.,gl0 into one alternating signal v ac- cording to a parity code is shown in Figure 8.
The linear compaction circuit LCC is imple- mented as a linear chain of 5 linear self-dual modules M1,...,Ms.Every module Mi, 1,...,5, compacts three alternating signals into one alternating signal.Since 10 is an even num- ber, the binary periodic signal a (the clock signal) is utilized as an additional alternating input for the module Ms in Figure 8.The compacted sig- nal v represents the self-dual parity signal v= gl @g2 )"" )gl0 a of the alternating outputs gl,... ,gl0 of the original self-dual circuit f and the additional periodic signal a.The compact- ed signal v is determined by a single chain of Mmodules.
To improve the fault coverage it is sometimes useful linearly to compact the alternating output signals of the CUT into several different alternat- ing signals.A very high fault coverage is achieved if the outputs are linearly compacted according to a Hamming-code.
As an example the compaction of ten alternat- ing signals gl,... ,gl0 into four alternating signals Vl, rE, v3, v4 according to a Hamming code is illus- trated in Figure 9. Every alternating output vi, i-1,...,4, is determined by a linear chain of 3 M-modules.For each of the four alternating output signals the binary periodic signal a is used as an additional alternating input signal to guaranty the necessary three alternating inputs for every module M. The monitored outputs vi, i-1,...,4 with vl gl g2 ) g4 g5 @ g7 g9 a, v2 gl @ g3 g4 g6 g7 glo ) a, V3 g2 g3 g4 g8 @ g9 gl0 ) a, Vl g5 g6 ) g7 g8 3 g9 ) gl0 ) a are chosen to be the self-dual group parities of a corresponding Hamming code with ten infor- mation bits gl,...,gl0 and four control bits Vl, v2, v3, v4 and with the parity matrix 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 1 00 1 0 0 0 0 0 0 0 0 In general, the self-dual and self-testable LCC with q outputs consists of q linear chains of Mmodules.In test mode the average value of not detected internal stuck-at faults is 8.4%, and in normal operation mode the average probability not to detect an error due to an internal stuck- at fault is 22.1% if the self-dual circuit outputs are compacted by a parity code.Output compaction by a Hamming code results only in a negligible deterioration of the fault-coverage in test mode and the error detection probability in normal operation mode.The additional area overhead for the described linear output data compaction is determined by the number of outputs.Thus the percentage of the additional area overhead is determined by the area A (the number of literals) of the self-dual cir- cuit and by the number [out[ of its outputs.
The average area area, area (A/lout[), for the implementation of a single circuit output of the considered self-dual circuit is a good estimate for the additional area overhead (in percentage of the area of the original circuit).The average values of the additional area overhead AAp(%) for a parity code and AA%) for a Hamming- code in percentage of the area of the original cir- cuit are presented in Table IV.For area > 40 for a parity code AAp is less than 20% of the area of the original circuit.The corresponding value AAH for a Hamming code is less than 50% of the area of the original circuit.For area < 20 the corresponding values are 50% for a parity code and 100% for a Hamming code respectively.In this chapter we describe how a self-dual circuit rid can be transformed into a self-dual fault-secure circuitfidf.The transformed circuit will be self-dual fault-secure with respect to all sin- gle unidirectional gate faults.If the self-dual circuit is implemented by use of self-dual complements of its functional outputs the original circuit is only fault secure if the original circuit outputs and the self-dual complements of these outputs are separately implemented.
The original self-dual circuit fc is supposed to be given as a net list of gates, where G {gl, ,gN} denotes the set of gates.As we have already point- ed out the gates are supposed to be AND-, OR-, NANDand NOR-gates and inverters.First we determine the gates of the original circuit which are not functionally fault secure with respect to some of the circuit outputs according to Theo- rem 2. Then we duplicate all the gates which are on paths from these not fault-secure gates to the corresponding outputs.These gates are connected in such a way that all the paths from a non fault- secure gate to the corresponding circuit outputs have the same parity of inverters.Gates which are not connected to any circuit output are deleted.According to Theorem 2 the circuit is self-dual fault-secure.
The algorithm for the transformation of self- dual circuit fd into a self-dual fault-secure circuit fdf is described now in more detail.ALGORITHM 1.We determine the set G {g,...,g} of self-dual fault-secure gates of f. 2. We compute the set G, G\G of not self-dual fault-secure gates of f. 3.If G then STOP. 4. For every gate gg G we determine the set of outputs Y(gi) for which g is not self-dual fault- secure. 5.For every gate ggG,,, we determine the transitive fanout T(gi)\ Y(gi) of gg with respect to Y(gg).This transitive fanout is the set of gates which is connected by a path from gi to one of the outputs Y(gg) of f. gg is considered to be an element of T(gi)\ Y(gg).
6.We compute the transitive fanout T(G,,) of all not self-dual fault-secure gates with respect to their not self-dual fault-secure outputs r(G,) U r(g)\r(g).giEGn 7.All the gates g, g ET(Gn), are initially duplicated into gO and gl with an even (0) and odd (1) superscript.
8. The duplicated gates will be connected accord- ing to the following rules: 8.1.If for g E T (Gn) the output of the gate g in fc is directly connected (via an inverter) to a circuit output Yi, then g0(gl) in fdf is directly connected (via an inverter) to the output Yi.
8.2.If for g, h E T(Gn) the output of the gate g is connected to an input of gate h via an even (odd) number of inverters, then in fdf the gate gk(gk@l) is connected via the same number of inverters to the corre- sponding input of hk, for k-0, 1. 8.3.If for gEG\T(G,,) and hE T(G,,) inf the output of g is connected (via an even or odd number of inverters) to an input of h, then in fdf the output of g is connected to the corresponding inputs of both the gates h and h1. 8.4.If for g E G \ T(Gn) and h E T(Gn) in fc the output of h is connected (via an even or odd number of inverters) to an input of g, then in fdf either the output of h or the output of h is connected via the same number of inverters to the corresponding input of g. 8.5.If a primary input inf is connected to an input of a gate g, g E T(G) then in fsdf the primary input is connected to the corres- ponding inputs of both the gates gO and gl.
9. Gates that are not connected to at least one of the circuit outputs are removed.
10. Redundant gates are identified by an ATPGtool such as HANNIBAL [20] and removed from the circuit.
11. GOTO 1.There was only one example for which the loop of the Algorithm was passed twice.This was the case where a gate of the original circuit was func- tionally self-dual fault-secure with respect to an output Yk since one of its stuck-at faults could not be sensitized to this output (but to another output).After the circuit transformation, all the stuck-at faults of this gate could be sensitized to the output Yk and the gate became not self-dual fault-secure with respect to yk.In all other cases the Algorithm stopped after the first pass.
The transformation of a given self-dual circuit into a fault-secure self-dual circuit is demonstrated now for the example of Figure 3 described in the second chapter.
The gates 2,3,5-10 are structurally fault secure.Since there is a path (1, 2, 7, 8) with an even (0) number of inverters as well as a path (1, 3, 5, 7, 8) with an odd (1) number of inverters from gate to the circuit output yl this gate is not structural- ly self-dual fault-secure with respect to the output benchmark circuits the average area overhead is only 8.81%.

CONCLUSIONS
In this paper new methods for the design of self- dual circuits with alternating inputs and their ap- plication for error detection and testing were presented.These methods are based on the new concept of a self-dual complement of a Boolean function.The proposed synthesis methods utilize the different self-dual complements either with a minimal number of ones or with a maximal num- ber of ones.Self-dual duplication and self-dual parity prediction were considered in detail.Contrary to ordinary duplication and comparison the functional circuit and the corresponding self- dual complement can be jointly implemented.The differences between joint and separate implementations for self-dual duplication and self-dual parity prediction were experimentally investi- gated.In general, a joint implementation instead of a separate one results in a large reduction of the necessary area overhead, a small decrease of the fault coverage in test mode, and a somewhat more significant increase of the probability not to detect an error in on-line mode.Linear self-testing space compaction of alternating signals can be used to reduce the number of alternating outputs which are to be monitored.For safety-critical applica- tion the concept of self-dual fault-secureness was introduced.It was shown how a given self-dual circuit can be easily transformed into a self-dual fault-secure circuit.
In on-line mode the original functional inputs x and the corresponding inverted inputs are aIways subsequently submitted to the self-dual circuit and a 100% time redundancy is necessary in this mode.Therefore the proposed method is mainly useful for control systems for which time is not a critical issue.In On-line mode also stuck-at faults of the input lines are detected with a high probability.In test mode the elements x of a test set T and their inverted values 2t are applied to the circuit under test.A fault is detected if the corresponding test responses are not alternating.For that reason it is not necessary to store the test responses.In fast mode without error detection only the functional inputs are applied to the circuit.
It was demonstrated that the design of self- dual circuits by use of self-dual complements is useful for error detection and testing.The com- bination of the different modes of operation al- lows to achieve different levels of error detection and fault tolerance.

FIGURE 2
FIGURE 2 Error detection by use of self-dual complement.
FIGURE 3 A self-dual circuit.

FIGURE 4
FIGURE 4 General principle of self-dual duplication.
are opti- mized by the tool SIS script.rugged[17].The circuit of Figure6consists of 18 gates.The area overhead is about 4.4% of the original circuit.

FIGURE 7
FIGURE 7 Monitoring by self-dual parity prediction.

TABLE Truth table
of the circuit of Figure3

TABLE II Self
-dual duplication.Area overhead, fault coverage and/2 for the internal and input faults

TABLE III
Experimental results for parity and self-dual parity