NASA Office of Logic Design

NASA Office of Logic Design

A scientific study of the problems of digital engineering for space flight systems,
with a view to their practical solution.

The NASA ASIC Guide: Assuring ASICs for SPACE

Chapter Three: Flight Part Verification


To present to ASIC designers and others responsible for flight system integrity, a means to assure that each flight part meets all test specifications.

All processes produce defects and vary due to imperfect controls and human error. Thus, the responsibility for flight system integrity requires that the vendor verify flight parts through end-of-line screening.

Any time a process varies, parts may contain anomalous defects as a result. Random events outside of controlled process elements can also introduce anomalous defects. Vendors use screening programs to detect defects. Process controls attempt to keep processes consistent and minimize defects, so that all lots produce an economical number of working parts and data from one lot of parts applies to all other lots of the same parts. Over the last several years, ASIC library and ASIC process engineers have developed controls that can repeatedly satisfy these goals for many different designs built on the same line. However, these controls are not perfect. Each part remains susceptible to defects. Engineers must have a way to understand and locate these defects in order to determine their impact and screen out parts, if necessary. Thus, screening programs are developed by analyzing the vendor's process and controls to:

Screening program development involves analyzing actual devices and test structures fabricated on the intended process line. Typically, engineers design screening tests to determine which parts are likely to last through the infant mortality period, and thus reject those that are not. For more on this, see "Quality and Reliability" in the introduction of this section.

QML and QPL Screening

Table 4.3.1 QPL and QML Quality Levels

As a minimum, QML and QPL requires the vendor to apply a set of screens to every part, and perform quality conformance inspection (QCI) on specified samples of parts. (See Table 4.3.1). For the QML program QCI is called "technology conformance inspection" (TCI). The user needs to understand these programs since some screens are negotiable. To assure proper screening, the user should explicitly state all screening to be performed on flight parts in the test and screening specifications, which is usually part of the detailed and general specifications portions of an ASIC contract.

Since the contracted tests take precedence over MIL-STD-883 tests, the customer must exercise sound engineering judgment when writing the test and screening specification. However, the customer must always negotiate deviations from the standards with the vendor to make sure the vendor can support the changes; to understand the costs involved; to make sure that the changes do not alter the QPL or QML status of the parts; and, most important to make sure that the changes do not negatively impact the ASIC's performance or reliability requirements.


Table 4.3.2 QML and QPL Screening

QML and QPL both have two classes of parts. These classes differ in degree of qualification and, therefore, have different procedures for part acceptance (see Tables 4.3.1 and 4.3.2). QML Class Q parts differ from Class V parts only in that Class V parts go through more end-of-line screening, such as requiring TCI to be performed on every lot. Under the QML program, QML vendors qualified for both Class Q and Class V parts can upgrade a Class Q part to a Class V part by simply performing the additional screens. Q and V processes are identical.

Unlike QML parts, QPL Class B parts can differ significantly from QPL Class S parts. Class B parts may have fewer design constraints and may come from lines that are not qualified for Class S. Processes only qualified for Class B do not have reliability data to support Class S standards. Thus, Class B parts do not become true Class S parts simply by performing the additional Class S screens, unless they come from lines that fabricate Class B and Class S parts identically.


"The sources for screening procedures are MIL-STD-883, method 5004 for QPL and MIL-I- 38535 for QML; the procedures are almost identical"

The sources for screening procedures are MIL-STD-883, method 5004 for QPL and MIL-I-38535 for QML; the procedures are almost identical. Table 4.3.2 gives a list of these tests, comparing QPL to QML. It is important to understand the intent behind these tests by reading the standards and communicating with the vendor. Doing so helps determine whether the QPL or QML set of tests is appropriate, or if the test set should be amplified or diminished.

With space ASICs, we generally consider the QPL and QML test sets a minimum set. However, in many cases some of these tests should be left out or made less rigorous due to practical concerns. For instance, the internal visual test specifies a level of magnification such that some details of the chip cannot be resolved for feature sizes less than 1.5 microns. Also, this test calls for 100 percent visual inspection, which becomes prohibitively labor-intensive as the number of transistors grows beyond 10,000.

As another example, the non- destructive bond pull test can be impossible for high pin counts if they are too close together for a machine to grab each pin individually. Statistical process control is becoming sophisticated enough to render some tests unnecessary, such as constant acceleration.

In some cases it makes sense to augment screens. For small numbers of ASICs, it is common to augment the life cycle test (see MIL-STD- 883) from 1000 to 2000 hours to allow the use of half the normal sample size and still have the same number of device-hours under test. State all such exceptions in the test and screening specification.


If the vendor screens out the defects that cause infant mortality, which is the observed tendency for many devices to fail in the first few months of operation, then parts are statistically likely to last much longer. QML and QPL screens (most significantly burn-in) identify parts that would fail in a short period of time due to defects. These defects quickly lead to an electrical or mechanical failure, thus causing infant mortality.

QML requires that the vendor's statistical control program include fabricating test structures on qualified process lines, known as technology characterization vehicles (TCVs). The vendor uses these test structures to assess the susceptibility of parts to end-of-life effects. End-of-life effects are physical mechanisms that degrade a device after long periods of time, usually several years. Such effects include:

Since infant mortality failures happen early in a part's life and end- of-life effects theoretically become dominant after several years of operation, graphing part failures as a function of time produces a curve known as the "bathtub curve" as shown in Figure 4.3.1. The curve starts high, due to large infant mortality failure rates; it then stabilizes at a low rate for the majority of the part's normal life expectancy; the curve then increases again toward the end of the graph due to the large failure rates from end-of-life effects.

Figure 4.3.1 The "Bathtub Curve"


Since MIL-STD-883 explains the tests used for QML and QPL, we will not explain them here, except for the burn-in test. We emphasize the burn-in test because of its particular importance in extracting parts that would fail during the infant mortality period.

The concept behind burn-in is simple: stress the part at high voltage (usually the maximum rated operating voltage) and temperature (usually around 125oC) to accelerate failure mechanisms enough so that the effects of infant mortality can be screened out within a practical amount of time (160 hours for QML Class Q, 240 hours for QML Class V or QPL Class S).

The vendor should compile statistics to calculate the percent defective allowable (PDA) for a lot to pass the burn-in test. The PDA represents the percentage of the lot allowed to fail during burn-in without forcing the lot to be rejected; this is judged by part failure versus time statistics, which should look something like the first half of the bathtub curve. Problems resulting in a number of failures tend to affect an entire lot, since they are not the random defects associated with normal distribution, but systemic problems such as contamination or process parameter drift.

Burn-in usually consists of three stages:

Static burn-in involves holding all inputs at constant voltage in a given configuration of highs and lows. Two static tests (Static I & Static II) are normally used to allow opposite configurations of high and low input voltages. However, for ASICs with more than a few thousand transistors, defining two static conditions that exercise a significant portion of the circuit can prove difficult or impossible.

Dynamic burn-in involves applying test vectors or another stimulus set during burn-in to toggle as many nodes as possible, thereby resembling actual operation. If scan circuitry is incorporated into an ASIC design, test engineers often use this circuitry for dynamic burn-in to minimize test fixture pins.


The test and screening specification must include electrical test requirements for electrical parameter tests done before the burn-in process, after each burn-in test, and at any other time during screening when an electrical test is specified. The specification must also include the AC and DC parameter limits, as determined by simulation or characterization, to be used for criteria of acceptance or rejection for each electrical test. The burn-in voltage must be specified, as well as the test vectors or electrical testing strategy for dynamic burn-in. The test and screening specification must include all tests and appropriate test conditions from MIL-STD-883 as well as any additional tests beyond the requirements of QML or QPL deemed necessary for the specific needs of each ASIC.


Finally, if screening causes a failure, we advise performing failure analysis on that part to determine the mode of failure and to recommend corrective actions. (See the appendix "Failure Analysis"). Failures are considered outside of the infant mortality margin if the number of failures exceed the PDA or the lot tolerance percent defective (LTPD) stated in the part's test and screening specification.

Quality Conformance Inspection (QCI)

QCI is a set of destructive and non-destructive tests that the vendor performs on a sample of parts from a given inspection lot. The sources are MIL-I-38535 for QML and MIL-STD-883, method 5005 for QPL. QPL slash sheets may also list further options and exceptions to method 5005. QCI is divided into five groups of tests, A through E, which are further divided into subgroups. QCI requires many parts in addition to those built for an application, since several of the destructive tests involved prohibit the tested part to be used for subsequent tests or in an application.

Like part-by-part screening, QPL and QML versions of QCI are similar, but QML Class V and QPL/608 require somewhat less testing than does standard QPL, and QML Class Q requires significantly less testing than QPL. QML largely relies on the TCI approach (see below) to measure quality conformance.


Group A tests are the same for QPL or QML. This test group applies specified static, dynamic, functional, and switching electrical tests (test vectors) each at 25oC, maximum, and minimum rated operating temperature. However, QML normally does not repeat these tests throughout QCI as often as QPL does.

Group B tests are mechanical tests. These tests, common to both QML and QPL, cover solvent resistance, bond strength, die shear test (or die pull), and solderability. QPL also requires internal water-vapor content, internal visual and mechanical, lead integrity, seal, lid torque, steady-state life, temperature cycling (more stressful than the flight part screening equivalent), and constant acceleration tests. In many cases the sequence of tests within groups is significant. For example, a part must pass the constant acceleration test after the temperature cycling test.

Group C is the steady-state life test required for QML. Though similar to burn-in, this test lasts for an extended period of time (usually 1000 hours). In QPL, the steady-state life test is part of group B. Parts used only for this test are often later used for application because the life test does not use up a large enough amount of a device's life to cause concern users.

Group D tests are package-related tests. For both QPL and QML, these include physical dimensions, lead integrity, seal, mechanical shock, variable frequency vibration, constant acceleration, visual examination, salt atmosphere, internal water-vapor content, adhesion of lead finish, and lid torque tests. In addition, QPL requires thermal shock, temperature cycling and moisture resistance. QML Class Q parts may require group D testing only on intermittent inspection lots.

Group E tests is the steady-state total dose irradiation test required for all QML and QPL rad-hard inspection lots. In some cases, neutron testing is also required. QML Class V and QPL also require transient ionizing irradiation testing.


Sometimes, the same test is performed in more than one subgroup to verify the same test case after differing stresses. For example, in group D, one subgroup requires the seal test to be performed after the lead integrity test; another subgroup requires the same seal test after mechanical shock, variable frequency vibration, and constant acceleration tests.


QPL's QCI program applies each test group to die samples at different intervals. Vendors perform Group A and B tests on a sample of every inspection lot to be qualified. They perform Group E tests, which are radiation tests, on a sample of every rad-hard inspection lot. Group C and D tests are performed on a sample lot every three and six months of process operation respectively to verify that the process remains at QPL-level standards. Vendors also perform QCI whenever there is a new process line or a process change.


As with part-by-part screening, state all QCI tests and test parameters to be used for flight part qualification in the test and screening specification. Failure analysis should be performed on all part failures (see Appendix Four: "Failure Analysis").

We recommend that you specify all five groups of QCI testing for a sample of the flight parts. If this proves prohibitively expensive, or if the parts are QML Class Q, perform the life test on at least one design from each inspection lot.


Since most QCI tests are destructive, flight parts that undergo QCI are not generally eligible for flight. However, some argue that flight parts that undergo the non-destructive life test should be flown, since they have more reliability assurance, and the life test only shortens a part's lifetime by about one year (1000 hours at 125oC translates to one year at 25oC).


QML has an analogous program called TCI, which allows for two options. Option 1, or standard QCI testing, requires all groups, A through E, to be performed at the same frequencies as in QPL. Option 2, called in-line control testing, incorporates groups A, B, C and D (and perhaps part of group E) testing into the process control program in a manner approved by the TRB and documented in the vendor's QM plan. Vendors normally perform Group E on every lot, even when testing according to option 2. For both options, the vendor may choose to test standard evaluation circuits (SECs) in place of the customer's devices. Class Q programs can use SECs during groups A,B,C, and D testing. Class programs can only use SECs during group C testing.


Now you may jump to:

Home - NASA Office of Logic Design
Last Revised: February 03, 2010
Digital Engineering Institute
Web Grunt: Richard Katz