NASA Office of Logic Design

NASA Office of Logic Design

A scientific study of the problems of digital engineering for space flight systems,
with a view to their practical solution.


The NASA ASIC Guide: Assuring ASICs for SPACE

Chapter One: Part Acceptance Approach

Objective:

To describe to part specialists, and those responsible for generating ASIC contracts, the fundamental concepts and methods governing ASIC part acceptance.

ASIC part acceptance requires activities beyond those required for off-the-shelf devices. These additional activities will be new to most readers. Those who write ASIC test and screen specifications must understand both off-the-shelf part acceptance and the variations unique to ASICs.

The part acceptance methodology in this guide is consistent with the Qualified Manufacturers List (QML) and the Qualified Products List (QPL). QML and QPL both require vendors to apply similar screening and quality conformance inspection (QCI) to their ASICs, (see the following chapter, "Flight Part Screening").

The design cycle sometimes includes a fabrication step, used for design verification. These prototypes, or "proof-of-design" parts, undergo minimal part acceptance since the vendor fabricates them only to allow the designer to functionally verify the ASIC during the design cycle (see Section Three: "Design"). As CAD tools become more accurate, these prototypes become less important.

After completing the design cycle, the vendor fabricates one or more wafer lots and separates them into two groups: engineering parts and flight parts. These groups should be identical in form, fit, and function. Then characterization information about engineering parts can be assumed to accurately describe flight parts and lower the risk of flight part anomalies.

As the first parts built, engineering parts provide the first and last chance to verify the combination of vendor process and user design that makes up an ASIC. Unlike off-the-shelf devices, which usually see a long characterization cycle, many mask revisions, and part builds related to design changes (often called "prototyping in silicon"), the tight schedules of most ASIC programs dictate building engineering parts first. The thoroughness of an engineering characterization proves an excellent way to obtain information to verify the combination.

Engineering parts are not considered QML or QPL parts as the vendor does not take the time to screen them for flight but instead makes them available for characterization. Typically, the user (or the vendor, if contracted) begins device and system characterization on these parts immediately after assembly and a minimum electrical test.

Vendor and user test engineers may use what they have learned from engineering part characterization to modify the flight part screening program. If engineering part characterization shows enough problems, engineers may decide to halt the flight part screening, assuming the parts would probably fail during the screening or in use. After halting the flight part screening, the vendor fabricates a new lot of parts that may or may not go through another engineering characterization, depending upon the nature of the first lot's problems.

The number of each type of ASIC part the vendor begins to fabricate will vary according to: the part volume needs of the project; the most economical lot size for the vendor to run; the expected yields for this part; and the number of parts used for engineering parts and flight part lot destructive tests and screening. Section Four: Chapters 3 and 4, discuss both engineering and flight parts in greater detail.

The following discussions outline the core ideas of ASIC part acceptance.

Device Tests and Screens

The flow-chart, Figure 4.1.1, illustrates the procedure for the 15 topics listed below.

  1. Qualified Vendor: We strongly recommend that the ASIC team accept parts only from a QML or QPL qualified vendor. See the appendix "Government Qualification Programs."
  2. Screening Specification: When using a QML or QPL vendor, we encourage the ASIC team to write or approve a test and screening specification with technical requirements based on Mil-M-38510 or Mil-I-38535, appendix A for engineering part acceptance and flight part acceptance. This is usually not an independent specification, but a list of exceptions to the test and screening specification established by the vendor.
  3. Contract Support: To assure proper part acceptance, the ASIC team must explicitly state or unambiguously reference all methodologies to be used for part acceptance in the contract cosigned with the vendor. For more information on this subject, see the appendix "Procurement Support."
  4. Quality Assurance: A quality assurance organization, independent of the design team, is responsible for ensuring that accepted parts meet all specifications.

    Engineering Parts: Note: More about topics 5 -10 will be explained in the following chapter, "Engineering Part Verification."

  5. Same Process: For effective use of engineering parts, the vendor must fabricate engineering parts and flight parts on the same process line. If quantities allow, the parts should be from the same lot to assure a similar form, fit, and function. All process variables must be tightly controlled so that they do not shift significantly from the fabrication of engineering parts to the fabrication of flight parts. For more information, see section 2, "Vendor Evaluation."
  6. Test Vectors: We recommend that the vendor apply all test vector sets to each engineering part over specified temperature and voltage extremes.
  7. Characterization: Typically the ASIC design team performs an engineering part electrical characterization to determine performance limits under all anticipated stresses. Sometimes, the vendor may be contracted to do this work.
  8. System Performance Checks: The ASIC team should test engineering parts in the target system.
  9. Specification Checks: It is essential that the ASIC team, the vendor, or both resolve problems associated with meeting part requirements based on engineering part verification results.
  10. Failure Analysis: We recommend that the ASIC team, the vendor, and/or a third party perform failure analysis in the event of an engineering part failure. For more information on this topic, see the appendix "Failure Analysis."

    Flight Parts: More about topics 11-15 will be explained in the "Flight Part Verification" chapter.

  11. Test Vectors: We recommend that the vendor apply all completed test vector sets to each flight part over complete temperature extremes and specified voltage extremes and before and after any other part stresses as contracted.
  12. Screening: A QML or QPL vendor must perform MIL-STD-883 screening on all flight parts, including delta measurements where specified.
  13. Quality Conformance Inspection (QCI): The vendor should perform MIL-STD-883 QCI for QPL, or technology conformance inspection (TCI), for QML tests.
  14. Failure Analysis: We recommend that the ASIC team, the vendor, or a third party perform failure analysis in the event of a flight part failure. For more information on this topic, see the appendix "Failure Analysis."
  15. Other Tests: The ASIC team, the vendor, or both, are obligated to perform other tests on the flight parts, as stated in the test specification.


Figure 4.1.1 Part Acceptance flow

ASIC specifications must state clearly how ASICs will undergo tests and screens to assure continued quality and reliability considerations throughout an ASIC program. The ASIC designer must generate the detailed tests that the vendor will use for part acceptance before finalizing the ASIC contracts with the vendor.

After fabricating the devices, the vendor first tests the wafers to determine if each wafer has enough good dice to warrant more work. If so, slice the wafers into individual part die, package the parts, and run further tests on the packaged parts.

TEST VECTORS

Test vectors verify the ASIC during several part acceptance activities: characterization, tests, screens, and QCI. Section Three: "ASIC Design," addresses creating test vectors. Here, we discuss how to apply these tests during the various phases of part acceptance.

Test vectors distinguish between correct and incorrect functional and parametric ASIC performance. Once testable ASICs have been designed based on fault models, designers must develop test vectors to facilitate functional debugging and part acceptance. See Section Three: Chapter 3: "Design For Test" and Section Three: Chapter 2: "Test Generation."

We recommend that ASIC developers create four sets of vectors for part acceptance: functional, structural, AC parametric, and DC parametric test vectors.

Functional vectors define input pin signals and functionally predicted output pin signals; designers and test engineers use them to verify functional accuracy. Given the range of states and data, 100 percent functional coverage is normally impossible. However, the designer needs to attempt to show:

Structural vectors usually test the ASIC for stuck-at faults. Ninety-nine percent stuck-at fault coverage represents a reasonable minimum coverage for a set of stuck-at fault vectors. You can usually achieve this with the aid of automatic test pattern generation (ATPG). However, stuck-at fault testing does not detect all possible defects, as shown in Section Three and in "User-Developed Tests in Part Acceptance" discussed below.

AC parametric vectors verify timing requirements such as propagation delays and maximum operating speeds. Test engineers often need several vectors to test a single AC value--some to set up output pins and others to create the signal changes being measured.

DC parametric vectors test for adherence to input and output voltage and current requirements. To test a single DC value often requires a number of vectors--some to set up output pins; others to create the signal value being measured.

Tester Limitations
When developing test vectors, ASIC developers must fully understand the capabilities and limitations of the vendor's production tester so that test vectors can be successfully applied to devices as they are produced. Different testers can have different limitations, such as speed of applying vectors, speed of reading values, and quantity of I/O pins.

The vendor's tester may also differ from the one used for engineering part characterization. Though in some cases it may be possible to translate test vectors from one tester format to another, it can involve significant engineering time and expensive tools. Thus, translation requires advanced planning and a detailed understanding of formats to be successful. For more information on this subject, see the appendix "Modeling and Translation."

Designer Support of ASIC Part Testing
During test vector application, it is not always easy to determine the cause of the errors the vectors reveal. Because they are most familiar with the design and the test vectors, designers perform a key diagnostic role during ASIC testing.

An error supposedly represents an ASIC defect. When this is the case, the ASIC is simply discarded. However, tester malfunctions or parametric incompatibilities between test vectors and the tester frequently cause errors that do not represent problems with the actual part. Furthermore, an error may represent a problem with the ASIC design.

Although design and design verification tools are designed to protect against such errors, simulators do not always perfectly represent what will happen in reality. Thus designers must be available when the vendor does the initial testing of their ASIC so they can work with vendor test engineers in diagnosing the cause of errors and determining whether to discard an ASIC, fix the tester, fix the test vectors, or redesign the ASIC.

Contracting for ASIC Part Acceptance

The user details ASIC tests and screens in three levels of specification: the statement of work (SOW); the general specification; and the detailed specification. We cannot overemphasize the importance of writing the part acceptance methodology in clear, unambiguous language. What you write is what you get.

The part acceptance portion of the SOW reflects the schedule, costs, and formal deliverables pertaining to test vector generation and application, characterization and final screening and delivery.

The ASIC's general specification describes the vendor's applicable test and screening flow and may pertain to a series of ASICs to be built with a vendor. For fundamental testing and screening, if the vendor is QPL-qualified, then the general specification should reference MIL-M-38510. If the vendor is QML qualified, then the reference should be MIL-I-38535. The specification may also provide a list of "reasonable" exceptions to these documents, founded on sound engineering judgment.

We recommend the user direct the vendor to apply all four sets of vectors (functional, structural, AC parametric, and DC parametric) to all engineering parts and flight parts at the extremes of the specified voltage and temperature ranges. For space part procurements, voltage usually ranges between 4.5 to 5.5 volts and temperatures between -55 to 125oC. At these extremes, test vectors provide essential verification that at the time the vectors were applied, the ASIC performed as specified in the anticipated environment. Each ASIC's detailed specification contains the quantity, general description, and generation methodology of its test vectors.

Each ASIC's detailed specification (called the Altered Item Drawing in MIL-M-38510/605/606/607/608) contains the generation methodology, quantity, and general description of test vectors, as well as a description of burn-in circuitry.

For an example of such specifications relating to part acceptance, see the appendix "Case Study of a Technical Specification."

ASIC Designer-Developed Tests in ASIC Part Acceptance

Two major types of tests have been developed for ASICs: functional, and structural. Because both tests depend, to some extent, on ASIC design, designers should create them.

Clearly, ASIC designers should create functional tests. Most designers recognize functionality as their major deliverable. Both stand-alone and system ASIC functional tests are the major ways to demonstrate satisfaction of that deliverable. In addition, a thorough functional test can be an important part of ASIC part acceptance.

The need for ASIC designers to create structural tests is not so clear. You may feel, quite logically, that it is the ASIC vendor's responsibility to prove to you that what they give you is a faithful rendition of your design in silicon. ASIC vendors have become very clever over the years, however. Now, virtually all ASIC vendors agree to contract for a set of ASIC parts that pass any tests you give them, not ones that exactly duplicate your netlist.

Theoretically, any number of structures can deliver your ASIC's functionality. Therefore, if you care about receiving parts that reflect the structure you've designed, you must create a set of tests that verify that structure. As the original creator of the structure, you are in the best position to determine if the requirements are clearly spelled out and to ensure that useful tools for test generation are available. As it turns out, this structural verification also proves to be an excellent part verification tool for the discovery of manufacturing defects.

To make ASIC structure test generation affordable, a designer may incorporate test-support features into an ASIC's design. Section Three: "ASIC Design" and Section Three: Chapter 3: "Design for Test," present material on the nature of these test-support features. Here, we will discuss some of the defects those tests should find in the fabricated devices. We introduce the concept of fault models and show which defects are manifested at which faults.

THE NEED FOR FAULT MODELS

Fault models provide insights that help detect defects that visual inspection would miss. Defects can be both macroscopic (e.g., cracks in the glassivation layer) and microscopic (e.g., holes in the oxide layer).

Although visual inspection proves useful for detecting macroscopic mechanical defects, it has proven not only impractical but also insufficient for detecting microscopic defects. To visually inspect today's ASICs for microscopic defects would require hundreds of tedious hours of labor and yield insufficient net results for two reasons.

First, the eye cannot detect many defects, such as doping profiles, and many defects lie beneath opaque layers; second, test engineers have difficulty predicting whether a defect will cause electrical or mechanical failure merely from visual information.

TYPES OF DEFECTS

"We cannot overemphasize the importance of writing the part acceptance methodology in clear, unambiguous language. What you write is what you get."

The most common defects are gate oxide shorts, bridged interconnects, and open interconnects. Less common defects include leaky reverse-bias pn junctions; punchthrough (drain-to-source leakage due to drain substrate depletion reaching the MOS transistor source); parasitic transistor leakage (drain-to-source leakage due to inadvertent channel inversion); and degradations.

Degradations, also called latent defects, are imperfections that tend to worsen over time and eventually become shorts or opens. These include time-dependent dielectric breakdown (TDDB), electromigration, hot carriers, metal stress voiding, and interconnect imperfections. Interconnect imperfections include protrusions, intrusions, pinholes, poor step coverage, and resistive contacts. Degradations are assessed mainly by using test structures.

TYPES OF FAULT MODELS

Different fault models exist because they serve different purposes. Some are expensive both to create and develop tests for, and others are expensive to run. Some are relatively easy to create tests for and others require specialized equipment. All fault models help find manufacturing defects that would affect the success of your ASIC. See table 4.1.1.


Table 4.1.1 Fault Models and Defects

Stuck-at faults
Stuck-at faults are voltage faults, i.e., they are all based on detecting defect-caused signal changes measured as logic-level voltages. Although stuck-at fault testing has become standard, it has proven insufficient for detecting defects thoroughly. The fault model for stuck-at fault testing is a zero-delay, logic-level representation of a circuit at the primitive cell or gate level. This conflicts with the voltage weakening or delay fault properties of most CMOS defects.

Using stuck-at fault models, the test approach calls for running a set of vectors that drive each circuit node high and low, and drive any stuck-at signals to output pins (or scan elements). These output signals are then compared to the expected "good" signals to detect defects.

Advantages and limitations to stuck-at fault tests:

Points to remember about these tests:

At-Speed Functional Faults
At-speed functional testing is the most common test approach because it is typically done on circuits with no deliberate design-for-test features. The majority of commercial ASICs fall in this category. At-speed functional faults provide excellent defect detection for any circuit.

The fault model for this testing is a logic-level representation of a circuit with each circuit element operating with its correct delay.

The test approach using this fault model is to run a set of functional vectors at operational speed. Known good output vectors (from simulation) are compared with actual output vectors to detect faults.

Advantages and limitations to at-speed functional testing:

IDDQ Current Faults
IDDQ testing measures current faults. Because this test method requires low quiescent current, IDDQ testing is restricted to complementary metal-oxide semiconductor (CMOS) testing. Current faults are observed when the low quiescent current abruptly increases due to an undesired conducting path between power and ground.

The fault model for CMOS testing is a gate-, cell-, or transistor-level model of a circuit with each circuit element operating with the proper quiescent current (after all logic transitions have completed).

One test approach using this fault model runs a set of vectors that drive each circuit node high and low. After applying each vector, the current at the VDD pin(s) is measured after a delay to allow logic transitions to complete. These currents are measured against limits to detect faults.

Advantages and limitation to IDDQ testing:

THE NEED FOR MORE THAN ONE TYPE OF TEST

At-speed functional and IDDQ testing have some advantages over conventional stuck-at fault testing. For example, they can detect certain defects and degradations that cause parametric failures but not functional failures. If stuck-at fault vectors are run at speed, they too can pick up some parametric failures, but this is not common.

Current testing offers a greater chance of detecting small open interconnects than voltage testing. For instance, if the short is small enough, electron tunneling may occur, which still allows functionality and thereby escapes stuck-at fault test detection. However, that same tunneling mechanism may cause paired p and n CMOS transistors to conduct simultaneously, increasing quiescent current and consequently being detectable by IDDQ testing.

Some defects escape detection even with a 100 percent fault coverage stuck-at fault test vector set. As Table 4.1.1 shows, other fault models, such as "at speed" functional testing and IDDQ testing, offer alternative testing strategies that can detect many additional defects and drop defect levels by two orders of magnitude.

Stuck-at or other voltage tests best detect some defects, while IDDQ testing best detects other defects. Current tests usually prove best for detecting bridged interconnects and small opens. Voltage tests usually detect large opens best.

Voltage tests often miss bridged interconnects for two reasons. First, they do not always force a node to a logical "0" or "1." Second, bridged interconnects may have enough resistance to avoid a functional problem and consequently avoid detection. IDDQ testing catches bridging faults much better, since it is sensitive to high or low resistance bridges and is not dependent on functional failure.

Large opens, however, often prevent current elevation and thereby bypass IDDQ test detection but cause a stuck node and thus can be detected by voltage testing.

TEST STRUCTURES FOR DETECTING DEFECTS

Test structures also have the potential for detecting most defects, but they require extensive development time. By setting up configurations on a chip to test for specific defects, essentially all defects have the potential for detection. The challenge is to come up with an economical subset of possible configurations that maximize defect detection.

Wafer Acceptance

Wafer acceptance provides an economic step for both the vendor and the customer to separate wafers that are likely to yield good parts from those that are not.

During vendor evaluation, the user should evaluate the vendor's capabilities for wafer acceptance, which is the first testing step following fabrication. (See Section Two). Meeting wafer acceptance requirements may take too long to rectify after wafer fabrication. Such requirements may include at- speed testing, precision current measurements, etc.

QPL and QML vendors perform wafer acceptance by screening several simultaneously fabricated wafers, called a wafer lot, as a group. This screening predicts whether the wafer lot will yield an acceptable percentage of good dice. The theory here is that if fewer than a given number of wafers are good, then enough "hidden" or "latent" defects remain in the wafers that pass to justify scrapping them for reliability reasons.

HOW QML AND QPL DIFFER IN WAFER ACCEPTANCE

The way QPL and QML address wafer acceptance procedures exemplifies how they differ: QPL mandates how to accomplish a procedure, whereas QML mandates only what needs to be accomplished, leaving the vendor to determine how. To demonstrate this difference, we distinguish between the QPL and QML standard for wafer acceptance.

QPL demands the vendor follow standard procedures. All QPL Class S devices must undergo wafer lot acceptance according to MIL-STD-883, method 5007. Method 5007 requires a scanning electron microscope test (defined in MIL-STD-883), and several other tests defined in MIL-STD-977 ("Test Methods and Procedures for Microcircuit Line Certification"). These tests check for wafer, metallization, glassivation, and gold-backing thicknesses as well as thermal stability.

In contrast to QPL, QML does not define rigid procedures. Instead, QML demands that vendor-developed procedures achieve standard results. QML does not require adherence to MIL-STD-977 wafer lot acceptance criteria, but instead states: "the technology review board (TRB) shall develop and demonstrate a wafer acceptance plan based on electrical and radiation (if applicable) measurement of PM's [process monitors]" The vendor develops these process monitors--QML verifies the process monitors' effectiveness.

Bare Die Part Acceptance

Building hybrid or multi-chip module (MCM) devices often requires an ASIC vendor to verify that individual dice can meet test and screening requirements before they are built into their final package. This verification ensures that only "good" dice go into these devices, which helps to reduce expensive reworking or rejection.

The military standard for hybrid microcircuits, MIL-H-38534, calls this process element evaluation. MIL-I-38535 also has provisions for base die part acceptance. Depending upon requirements, die tests and screens are performed in one or more of the following ways.

WAFER TESTS

Dice are tested on a wafer, diced and shipped directly to the hybrid or MCM manufacturer.

BARE DIE TESTS

Dice are placed on a vacuum chuck and probed with a wafer-type probe. Sometimes a "hot chuck" can be used to test these parts at temperature.

SACRIFICIAL PACKAGE TESTS

Dice are temporarily packaged like single-chip devices, excepting the use of temporary die-attach material. This packaging allows devices to go through the same tests and screens as single-chip devices. Dice are then carefully removed from these temporary packages and shipped to the hybrid manufacturer.

Sacrificial package tests offer the most complete and the most expensive kind of die evaluation. Besides cost drawbacks, the increased handling with this method reduces reliability.

DIE HOLDER TESTS

Recently, IC socket vendors have developed sockets for temporarily holding bare die in a fashion similar to the zero-insertion socket approach. With this technique, a lever in one position allows a device to be inserted with no force. Moving the lever to its other position applies a controlled force to the device, establishing electrical contact.

Packaged Part Acceptance-Engineering and Flight Parts

Chapters 2 and 3 of this section address engineering and flight part acceptance in detail.

Summary


Now you may jump to:


Home - NASA Office of Logic Design
Last Revised: February 03, 2010
Digital Engineering Institute
Web Grunt: Richard Katz
NACA Seal