Fault and Error Models for VLSl
JACOBA. ABRAHAM, FELLOW,IEEE, AND W. KENT FUCHS, MEMBER, IEEE
Invited Paper
This paper describes a variety of fault and error models which are
used as the basis for designing fault-tolerant VeryLargeScale
integrated ( V M ) systems.The fault models describe physical d e
fects and failures and the input patterns which will expose them,
and are suitable for testing, while error models describe the effects
on the functional outputs ofdefects and are useful for on-line error
detection. The models are described at various levels of abstraction.
The differences between fault and error models for identical func-
tional modules are also illustrated.
INTRODUCTION
Advances i n Very Large Scale Integration (VLSI) technol-
ogyresult i n complex chips which, in turn, lead to lower
cost for extremelycomplex systems. As suchsystems are
increasingly used i n critical applications, there is a need to
ensure thatthe computationsproduced by thesesystems
are dependable. The discipline of fault-tolerant computing
deals withthe designof systems which are tolerant to
failures and, hence, result in a higher level of dependability.
Laprie [I] has proposed a service-oriented definition of
system failurewhere a system failure is defined to occur
whenthedelivered service deviates from thespecified
service. The failure occurs because the system was erro-
neous; an error is that part of the systemstate which is
liable to failure, i.e., to the delivery of a service not comply-
ing with the specified service. The cause of an error is said
t o be a fault. Thus impairments to dependableoperation
are the faults in the system, which could be either due to
incorrect design or specification ofthe system, or faults
duringthemanufacturing process,or a fault-free system
could subsequentlybecomefaultydue to physical or en-
vironmental causes. This paper will discuss faults and errors
due to improper manufacturing or subsequent wearout of
systems in the field. The area of design and specification
faults, althoughimportant, is beyond the scope ofthis
paper.
Faulty VLSI chips could be produced during manufacture
ManuscriptreceivedOctober 25,1985;revisedDecember 15,
1985.Thisresearchwassupported in partbytheSemiconductor
Research Corporation under Contract SRCRSCH84-06-049and in
partbythe Joint ServicesElectronicsProgram (US. Army,U.S.
Navy, and US. Air Force) under Contract NOOOl4-84-C-0149.
The authors are with the Computer Systems Group, Coordinated
ScienceLaboratory,University of Illinois atUrbana-Champaign,
Urbana, IL 61801, USA.
~18-9219/86/0500-0639501.00
P R O C E E D I N G S OF T H E IEEE, V O L 74, NO 5, M A Y 1986
because of photolithography errors, deficiencies in process
quality, improper design, etc. These can result in contam-
ination,
improper contacts, electromigration,
corrosion,
oxide defects, etc. [2]-[6]. Even if achip is manufactured
perfectly, it could subsequently wear out in the field due to
electromigration,hot-electroninjection, spreading charge
loss, etc. [2], [7]-[IO]. Environmental effects, such as alpha
particles, cosmic radiation, etc., canalsocause a circuit to
produce erroneous data [Ill-[14].
Afault-tolerant systemhas mechanisms for detecting
erroneous data produced by the system, techniquesfor
correction of the error and recovery from it, isolating the
faulty part of the circuit which caused the error, and recon-
figuring the system so that the faulty portion of the system
is no longer used. In most cases, the error detection mecha-
nisms are designed(for cost effectiveness) with the as-
sumption that only a limited number of faults are present in
the system. This assumption is valid if the system is periodi-
cally exercised to flush out any latent faults.
Thus fault-tolerant operation requires that:
1) manufactured chips and systems be initially tested to
reject faulty units;
2) the system be tested periodically in the field to flush
out latent faults;
3) error detection mechanisms be available to detect
errors during operation;
4) error correction, recovery, and reconfiguration mech-
anisms be available to isolate the faulty units.
The testing and diagnosis process requires the availability
of a sequenceofinput patterns whichwill exposeany
faults in the system. On the other hand, the error detection
mechanismrequires a knowledgeofthe types of errors
which are produced under fault and an appropriate encod-
ing of the outputs of modules so that errorscanbe de-
tected. An externally caused change of a storage value (by a
cosmic ray, for example) could result in an error at the
output of a functional module, but a test which attempts to
detect a fault will not discover any permanent fault in the
module. Thus as increases in density are achieved by smaller
geometries, the likelihood of transient errors typically in-
creases, requiring error detection mechanisms forreliable
operation.
a986 IEEE
639
Fault and Error Models
As systems increase in complexity, it is useful to be able
t o describe faults and errors at various levels of abstraction
in the system. A fault which is described at a very low level,
for example, at the level of transistors, may very accurately
describe the physicalphenomena causing thefaultbut,
because of the extremely large number of transistors in a
VLSl chip, the model may be intractable for the purpose of
deriving tests for the fault. Similarly, an error model, which
is described for a very small functional block, may require
duplication of the block inorder to detect the errors, while
an error model described for a more complex block might
only require the addition of asmall amount of hardware in
order to detect the errors. The two requirements for fault
and errormodels, in some sense,are contradictory. They
are: accuracy (that is, realistic faults and errors should be
modeled); and tractability (that is, very complex systems
should be handled). Recent research, therefore, deals with
deriving realisticmodels at higher levels which can accu-
rately capture the faults and errors at lower levels.
As an example, consider a contact between two conduct-
ing lines in a VLSl circuit. If the contact is faulty, there is a
break between two lines and the fault can be described at
this level. It may also turn out that the break is equivalent
to the input of gatea being permanently set to logic0 or, i n
turn, the input of a complex functional module being per-
manently 0. It would, of course, be simpler for purposes of
analysis to consider the fault at the highest possible level of
abstraction.
N o w suppose that the contact is not permanently open
but is periodically open, dependingon thetemperature,
vibration, or other external causes. This can be described as
an intermittent fault. However,testing for thefault may
never expose i t since the fault may not be active during the
test. If, however, the circuit is designed so that the error
causedby thelinebeingopen can be detected during
normal computation, the goal of dependable operation can
still be achieved. Again, the error can be described at the
output of a very small module or at the output of a much
larger module. If errors at the output of a large module can
bedetectedwith very low overhead, this is clearly the
desirable situation.
A physical failure can also lead to the output ofa module
being at a nonlogical value (for example, midway between
logic 0 and 1, called indeterminate). Such faults are difficult
to describe and detect, but the errors due to the faults may
be detected by error detection techniques.
The remainder of the paper describes a variety of fault
and errormodels which have beenproposed in recent
literature. The applicability of the ,models is discussed with
comparisons and contrasts made for specific VLSl modules.
Faultanderrormodels are presentedfortransistor, gate,
and functional levels of abstraction.
FAULT MODELS
Singlephysical de- faults in Class 0 plusFaults in Class 1 plus
Fault models are a description of the effect of a defect or
failure (which can cause an error at the output) on a circuit.
As discussed earlier, fault models are driven by the require-
ment to derive high-quality tests for complex circuits. Thus defects.open;
a useful fault model will naturally lead to a test generation
procedure for the fault.
640
Transistor-Level Fault Models
Defects and failures in present-day integrated circuits can
be abstracted to shorts and opens in the interconnects and
degradationof devices [2]. Fault models at the transistor
level, therefore, can characterize physical failures quite ac-
curately [15]-[19]. Unfortunately, as the complexity of VLSl
increases, the number of potential faults at the device and
interconnect level increases drastically. Nevertheless, it is
necessary t o study the effects of failures at the transistor
level and develop accurate fault models at this level. The
betterunderstandingof theeffects of failures, thus ob-
tained, can be used to develop accurate faultmodels at
higher levels which can beappliedin complex systems.
This approach is analogous to that used in the hierarchical
design of VLSl systems where complex circuits are built up
from smaller cells.
This sectionwill describe various transistor-levelfault
models. MOS technologies are emphasized since much of
the published research has concentrated on these, and also
since they are one of the current dominant technologies for
VLSl systems.
Fault models proposed at the transistor level incorporate
one or more of the following classes of faults:
1) shorts and opens of transistors or interconnections,
2) delayeffects of failures,
3) coupling or crosstalk between nodes of a circuit,
4) degradations of elements.
Shorts and opens are included in most fault models, while
themore accurate(andmorecomplex)models include
delays. Faults where activity on one node affects the logic
values on another node in the circuit are primarily applied
t o memories. Fault models which incorporate degradations
of elements (for example, transistor parameter changes, or
changes in the value of a resistor) are usually used in analog
circuits [20]. Such fault models are analog in nature, and are
not within the scope of this paper.
Transistor-LevelShortsand Opens: Transistor-levelshorts
and opens model many of the physical failures and defects
in integrated circuits. A study performed by Galiay [21] on
4-bit microprocessor chips revealed that a great majority of
faultswere shortsand opens at the transistor level. A
general fault model for shorts and opens was proposed by
Courtois [22]. The model was derived from electrical con-
siderations and divided the faults into three classes, requir-
ing progressively greater difficultyof .test. The model is
givenin Table 1. There has recentlybeen a significant
amount of work attempting to derive tests for shorts, opens,
stuck line, and transistor faults in MOS circuits [23]-[25].
MOS networks have the property that lines left in a high
impedance state (floating) will retaintheirprevious logic
Table 1 Transistor-Level fault Model for n-MOS Technology
Class 0 Class 1 Class 2
fect: faulty
con-
shorts between shorts between
tact
precon-
or adjacent metal
any
ormetal
or dif-
transistor
tact; diffusion
fusion;
lines.
multiple
stuck on or
metal line open.
PROCEEDINGS O F THEIEEE. VOL. 74. NO. 5. M A Y 1986
valuefor arelativelylongtime,until their chargeleaks shows the class of MOS failures using the additional fault
away. This is due to the inherent capacitance of the lines. transistors. For example, a transistor stuck closed, shown in
This property can be used to design very efficient storage Fig. l(d), is represented by adding a parallel transistor of the
elements, as long as the clock period is much smaller than same strength yl, controlled by line f. When thefault is
the time necessary to drain away the charge. Unfortunately, active, f = 1, the transistor will always be closed logically. A
because of this property, faults in MOS circuits can lead to short between two nodes, rn and n, shown in Fig. l(e), is
situations where stuck-at tests cannot detect some of the represented by the fault transistor connecting rn and n and
transistor-level shorts or opens [26]. The stuck-open fault a strength y p + l (this would be a strength greater than that
[26] caused by a broken line controlling a gate in a CMOS of any normal transistor), so that setting the transistor state
circuit is an example. t o 1 shorts the source and drain nodes together so that they
Another class of faults occurs because of shorts. Chiang act as a single node.
and Vranesic [24] noted that in the presence of a stuck-on Hayes [29], [I91 models faults i n MOS circuits by viewing
transistor (or a short which causes the circuit to look as if them as a network of switches, attenuators, and amplifiers
the transistor is permanently on), both the p and nnet- linked by connectors. Fig. 2 shows the various MOS circuit
works i n a CMOS circuit may conduct, and the fault may or elementsandthe
correspondingconnector-switch-
may not be detectable depending upon the resistance of attenuator (CSA) elements. Fig. 3 shows the CSA model of a
the stuck-on device. Baschiera and Courtois [27]have out- NOR gate withthefaultwhere the transistor S3 is not
lined some of the problems of testing for stuck-on faults. connected to ground. The wells, Wp and Wn, are added to
They have shown that, depending upon the resistances of
the transistors, some potential vectors may not detect
Electronic Correspondin
stuck-on faults while others will, andthat care must be Functlon element CSA elernen?
taken in deriving the test patterns. They also conclude that
if a test vector tests for stuck-on faults, it also tests for the Interconnection
P -
Bidirectional
conductor logic connector
corresponding stuck-open faults, while the converse is not
true.
Bryant[28] has developed a concurrentfault simulation
_L
system which can model MOS faults. These are represented n
nMOS transistor Positive switch
as though extra fault transistors were added to the network; Switching
the gate nodes of the fault transistors are considered to be
extra fault inputs t o the network that control the presence 1
or absence of the faults. To model the behavior of ratioed PMOS transistor Negative switch
circuits, each transistor is given a discrete strength. Fig. 1

n
I Load
Attenuator
transistor
I
Fig. 2.Connector-switch-attenuator
(CSA)
elements to
model MOS elements.

1 1

1
B L-GS2Q , I, WP

f f
c
6 C
c I
0
I
0
I Fig. 3. CSA modelof NOR gate with a broken line rnod-
n n m
Y, +I
nl nn2 Yp +1
eled.

(e) (9 model charge storage. Unlike a capacitor,however,the

Fig. 1. Modeling MOSfailuresusingfaulttransistors. (a)
Node n stuck-at-zero. (b) Node n stuck-at-one.(c)Tran- input/output signals of the wells are restricted to a finite
sistor t stuck-open. (d) Transistor t stuck-closed. (e) Short n set of logic values, although the storage capacity or size of
and r n . (f) Open n into n l and n2. the well corresponds to that of the underlying capacitance.

A B R A H A M A N D FUCHS FAULT A N D E R R O R MODELS F O R VLSl 641

The fault where the line to ground is broken is modeled by
breakingtheline CO andrepresenting it as stuck-at the
output value C. When A = 1, 6 = 0 is appliedto this
model, the value C is propagated through the switch 53 to
the output C, thus holding the previous value of the out-
put, and modeling the stuck-open fault. The wells can also
be used to model delays and faults producing changes in
delays i n the circuit, which is discussed in the next section.
The Bryant and Hayes models discussed above suffer
fromtwolimitations. First, both models assume that the
gate terminalof a transistor is decoupledfrom the drain
and the source, that is the states of the drain and source
can never affect the state ofthe gate.This simplifies the
model of a transistor, but is not general enough to model
the effect of physical failures such as a short between the
gate and source of a transistor. Secondly, in MOS logic, itis
known thatinadditiontothe ground and V, levels
(representinglogic levels 0 and I), intermediatevoltage
levels do exist. Banerjee [30] used a multivalued algebra as
the basis of a modelto simulatetheeffects of physical
faults i n MOS circuits. The model allows for five logic levels
and five logic conditions which are related to the strengths
of the logic levels.AnMOScircuit is viewed as a set of
nodesconnected bythree-terminal devices representing
transistors. The state of a node i n a circuit is described by
( a , b ) , where “a“ refers to the condition of the node and
“b” refers to the logic level of the node.
The five logic levels used fordescribingvoltage ranges
are:
0: hard 0
o*: soft 0
I: indeterminate, near the logic threshold
I*: soft 1
1: hard 1 .
Five basic node conditions are also defined:
I: input
node
C: charge-storage
node
5: strongdrivingnode
W : weakdrivingnode
F: faulty
node.
Using results fromcircuit simulation, an ordering was
found among various possiblecircuit states of nodes. (In
fact, it was found that out of the 25 possible combinations,
only 19 node statesare possibleforMOScircuits.) This
model was also used as the basis of a fault simulator.
Delay Effects of Failures: The transistor-level fault mod-
els discussed above treat the transistor as a logical switch.
This will, at best, allowonly a crudeapproximation of
delays inthe circuit,in particular, the delayeffectsof
failures. Since there have beenreportsoffailures which
only result in timingerrors [31]-[33], fault models are needed
which can accurately predict erroneous timing behavior.
In the CSA model developed by Hayes [29], the concept
of time is introduced by making the rate at which a well
changes state dependon thestrength levels ofthe logic
signals applied to i t s terminals.Unfortunately,thismodel
does not provide any indication as to how the delay values
may be determined from circuit parameters.
A circuit-level simulator, such as SPICE, can be used to
obtain accurate delay values underfaults. This, unfor-
642
tunately, is computationally very expensive. A compromise
is t o derive an approximation to circuit delays in less com-
puter time. An MOS fault simulator which can produce the
output waveforms under faults has been developed by Shih
[34]. This simulator uses a table lookup of the transistor I-V
characteristics to simulate both the fault-freecircuit and
many faulty circuits in one pass. The simulator can either
plot voltage waveforms or extract both the logic and delay
values for both the fault-free circuit and the faulty circuits
from the waveforms.Simulation of tests generated under
the assumption of no circuit delays showed that theywould
not detect some of the faults, demonstrating the need for
using delay information in order to derive accurate tests.
Coupling BetweenNodes of a Circuit: As integrated.
circuit densities increase, the interconnection lines carrying
logic signals become physically closer together, increasing
the likelihood that logic signals and signal changes on one
line can affect thelogic values on otherlines. Amore
accurate faultmodelwould, therefore, include such cou-
pling effects under failure. Memory fault models have long
incorporated this effect [35], [36]. The special case of shorts
between two lines is included i n even the simplertran-
sistor-level fault models but the coupling fault is different
from a short fault in that it includes cases where a change
in the logic value on a line (perhaps faster than some given
rate) i s necessary to affect an adjacent line.
Gate-Level Fault Models
Early fault models were developed at the logic gate level.
The popularity of this approach can be attributed to several
reasons. Such models are simple to design and use. Many
faults in discrete technologies can be represented by faults
at thelogic gate level. Use of such faultmodelsallows
manyofthepowerful results in mathematicsrelating to
Boolean algebra to be applied to derivingtests for complex
systems. Finally, a fault model at the logic gate level can be
used t o represent faults in many different technologies if, in
fact, defects and faultsin these technologies can be mapped
to gate faults.
The Stuck-At Fault Model: One of the earliest and still
widely used fault models is the stuck-at model [37]. In this
model, it is assumed thatphysicaldefects and faults will
result in the lines at the logic gate level of the circuit being
permanently (stuck-at) logic 0 or 1. This model has been the
source of a great deal of research. It is still very popular
since it has been shown that many defects at the transistor
and circuit levels can, in fact, be modeled by the stuck-at
fault model at the logic level. In practice, only single stuck
faults are considered in a circuit.
A subset of the stuck fault model is the pin fault model,
where only input/output pins of a module are assumed to
be stuck at 0 or 1 underfailure [38]. This has sometimes
been used when testing a printed circuit board with many
VLSl devices. Unfortunately, this fault model does not even
include a high percentage of gate-level stuck faults within
the module in most cases and is, therefore,inappropriate
for VLSI.
TransistorDefects and Stuck-AtFaults: Animportant
question in the usefulness of a simple model such as the
stuck-at fault model is whether physical faults at the tran-
sistor or circuit levels can be modeled by permanent (stuck-
at) Os or I s at the inputs and outputs of logic gates.The
PROCEEDINGS OF THE IEEE, VOL. 74, NO. 5 , M A Y 1986
results of one study [31] which attempted to answer this
question are quite interesting. Fig. 4 shows the circuit for a
TTL NAND gate. In the study, hard opens and shorts at the
circuit levelweresimulatedusing acircuitsimulator. As
q )-.
C

Fig. 5. Three-input NAND gate.

FaultEquivalenceandDominance: Considerthethree-
Bl< RB2< input NAND gate shown in Fig. 5. This gate has four lines
(three inputs and one output) and would, therefore, have
eight stuck-at faults, each line stuck at 0 or 1. However, the
faults A, B, or C stuck at 0 would result in the output D
beingpermanently 1 and, therefore, it is impossible to
distinguish between an input stuck at 0 from the output
stuck at 1. These faults aresaid to be equivalent. Now
consider the fault A-stuck-at-I. In order to detect this fault,
Tl,T2,T3

-v A
I a 0 has t o be applied on A, and I s at 6 and C so that the
effectofthefault can be propagated to D. The correct
Fig. 4. Circuit for T T L NAND gate. value of D will be a 1 and it will be a 0 under fault. This
test forA-stuck-at-Iwill, therefore, also detectthefault
Dstuck-at-0. Hence, A-stuck-at-I is said to dominate D
each defect was simulated, its effect on the output of the stuck-at-0. Usingthe relations of equivalenceand domi-
circuit was noted. Some of the results are shown in Table 2. nance allowsmany faults tobecombinedinto a single
For example, if resistor RBI were open, the output would class, reducing the number of faults to be considered in a
be permanently logic 0 (s-a-0 in the table). It can be noted complex system. A three-input NAND gate, therefore, will
that many of the opens and shorts will result i n inputs or have fourdifferent fault classes and the tests for these
faults are shown in Table 3. In the table, the fault consisting
Table 2 Defects in TTL NAND Gate Circuit of line d-stuck-at4 is shown as d/O.
~

Physical Defect Effect on Gate

RBI open output s-a-0
RB2. RL, SBDI, SBD2 open, T2, T3 base open undetectable Table 3 Tests for 3-ln~utNAND Gate
TI emitter open, base open input A s-a-I
T 2 emitter open input B s-a-I
T3 emitter open input C s-a-I
TI, r2,r3 collector open output s-a-0
T4 collector open, base-emitter short output s-a-I
TI, r2, r3 collector-emitter short undetectable
T4 collector-emitter short output s - a 4
TI base-emitter short input A s-a-1
T2 base-emitter short input 6 s-a-I
T3 base-emitter short input C s-a-I The notions of equivalenceanddominance can be ap-
T I , T2, T3, T4 collector-base short output s-a-0 plied to more complex circuits. Thus two faults which are
in different parts of a larger circuit could possibly be equiv-
alent. For example, Fig. 6 shows a simple circuit with four
the output being stuck at logic 0 or 1. Some of the defects inputs and one output. Stuck-at-I faults on the two lines
would not be detected by a logic-level test and, hence, are marked a and b are equivalent, that is, the function under
labeled as undetectable in the table. However, they might either of the faults is the same. However, equivalences such
be detected using other information. For example, the cir- as these are more difficult to detect and, in practice, only
cuit simulation showed that RB2 open would not cause a equivalences and dominances around a gateare normally
logic-level failure i n the circuit, but it would increase the considered. Moreinformationon theconceptsoffault
circuit delay from 7 to 4 ns; this would be detectable only equivalence and dominance, as well as the idea of reducing
by what the authors called an AC test, which also checked the number of fault classes by fault collapsing, are found in
for the timing in the circuit. Another study has shown that
many single transistor-level faults in bipolar and MOS tech-
nologies cannot be modeled as single stuck-at faults; how-
ever, they can be accurately modeled as multiple stuck-at W
faults [18].Conversely,there is some evidencethat many X
gate-level stuck-at faults will realistically rarely occur. One
study has correlated mask-level point defects to transistor-
f
level andgate-levelfaultmodels throughsimulation [39].
Initial results for some example circuits indicate that many Y
stuck-at faults are much more likely to occur than others.
z
The implication for test generation is that fault coverage is
dependent on the likelihood of fault occurrence as well as dl a W l

on the potential number offaults detected. Fig. 6. Two faults which are functionallyequivalent.

A B R A H A M A N D FUCHS: FAULT A N D E R R O R MODELS F O R VLSl 643

 VDD
Detection of TransistorFaultsby Stuck-At Tests: When
we considerfaults in MOStechnologies, as has already
been stated, it can be seen that some of these faults cannot
t
be modeled by the stuck-at fault model. For example, Fig. 7
shows an n-MOS NAND gate withtwo faults which are
shorts (shown as dotted lines). Ifthe shortmarked 1 is
VDD !i3

rlc A 4 1

-
-
Fig. 8. n-MOS NOR gate with fourfaults.

Tabie 5 Tests for n-MOS NOR Gate

.""r =

Fig. 7. n-MOS NAND gate with two faults

1
0
0
0
0
1
0
0
0
0
1
0
0
0
0
1
0
0
0
I O
1
0
1
0
0
0
1

Q " 1
0

present, then under the input 111, the output may not be 0 last test) whenit produces an incorrectlogical output.
but may be an indeterminate voltage represented as I. Thus Faults 2 and 4 can be seen to be equivalent (at least under
under this fault and this input combination, the output is this input set). Fault 3 produces a high-impedance output
not permanently stuck at 0 or 1. This example might seem under the combination OOO and, i n n-MOS technology, this
t o demonstrate a majordrawbackofthestuck-atfault is logicallyequivalenttothe previous output(shown as
model.However, if we considerwhether tests generated Q"), at least for a short period of time until any residual
for stuck-atfaults will detectthe transistor faults (even charge leaks away from the output. If the tests are applied
though they cannot be modeled as stuck-at faults), it can in the order shown, this fault will be detected since 0" will
be seen that the stuck fault model is still viable [42]. be a 0 and the correct output should be a 1. It is interesting
Table 4 showsthebehaviorofthen-MOS NAND gate tonotethat i f the OOO combinationwereapplied first,
under the faults when the tests for the stuckfaults in a and the output line happened to have a logic 1 stored on
NAND gate are applied. Outputs are shown for no fault (F,) it, this particular fault would nothave been detected by the
tests.
These examples show that, in general, many faults which
Table 4 Tests for n-MOS NAND Gate cannot be modeled as stuck-at faults, can still be detected
by applying a stuck-at fault test set.
Inputs outputs The Bridging Fault Model: Since many physical faults at
A B C Fo Fl F2
the circuit level will result in shorts between interconnect-
1 1 1 0 I 1
ing lines, the stuck-at fault model was extended to bridging
0 1 1 1 0 1
1 0 1 1 1 1 faults. This fault model treats shorts between two lines in
1 1 0 1 1 1 thelogic gate network and assumes that both lines will
have the wired-AND or wired-OR logic value underfault.
Mei [43] has shown that any singlestuck-atfault testset
will be able to detect any bridging fault between two or
and for the two shorts ( F1 and f 2 ) .Even though the output more input leads of a gate, as well as any bridging fault
under F, forthe first inputcombination is indeterminate which results in feedback such thatthetotalnumber of
(shown as I), it will be seen that the next input combination inversions in the loop is odd. This is a special case of short
will produce a logical output which is different from the faults, at the transistor level, treated in the previous section.
correct output and, thus, the fault will be detected. Similar The Stuck-Open and Stuck-On Fault Models: Wadsack
results hold for an n-MOS NOR gate.Fig. 8 shows such a [26] pointed out a special case of the transistor-level open
gate with four faults: faults 1 and 2 being shorts and faults 3 fault, which he called the stuck-open fault, where an open
and 4 being opens. Table 5 gives the behavior of the gate transistor(or abrokenline) can lead to a CMOS gate
when stuck-fault testsare applied under these four faults. behaving as if it had memory. Consider the CMOSNOR gate
Again, fault 1 produces an indeterminate output for the first shown in Fig. 9. It has two p-channel transistors in series
input combination but will be eventually detected (by the connecting V, to the output C, and two n-channel tran-

644 P R O C E E D I N G S OF THE IEEE, VOL. 74, NO. 5, M A Y 1986

 VDD
2*
Fig. 9. CMOS NOR gate.
sistors in parallel from C to the ground. Now suppose there
is a break in the line shown at 1 in the figure. In order to
detect this break, one would have to attempt to control the
transistor connecting A throughthelinewhich is poten-
tially broken, while at the same time deactivating the other
transistor using B. Thiscan be done by setting A = 1 and
6 = 0. Under this combination of inputs, C will be equal to
0. Unfortunately, if the break has occurred, and if C hap-
penedto have 0 as theprevious output, theconditions,
A = 1, 6 = 0, will result in C floating but this would still be
recognized as 0 by subsequent logic levels, and fault 1 will
not be detected. In order to detect this fault, therefore, we
would have t o set C equal to logic 1 which can be done by
setting A = 0, B = 0, and then applying the test, A = 1,
B = 0. Thus a sequence of inputs is necessary in order to
detect the stuck-open fault.
Since a stuck-open faultcannot be modeled by the
stuck-at model, Wadsack attempted to derive a logic gate
and latch network in which stuck-at faults could be used to
model stuck-open faults in the transistor-level CMOS NOR
gate. This is shown in Fig. IO. The clocked D-type latch CL
simulates the charge-storage property oftheoutputline.
Under fault-free conditions, the CK input is logic 1. Faults
"WC
B
I latch GL
B A O A B 0 A B 0 numberofmodules
Fig. 10. Gates and latch usedto model transistor-level faults
in CMOS NOR gate.
A B R A H A M A N D FUCHS. F A U L T A N D ERROR M O D E L S F O R VLSl
inthe transistor-level CMOS NOR gateare modeled by
stuck faults injected in this network; for example, in order
to model the stuck-open fault shown in the previous figure,
a stuck-at-1 fault is injected at the output of gate G I . When
thecombination A = 1, B = 0 occurs, the inputtothe
clock is 0, thus forcing the output C to retain the previous
value. Even more complexgate-levelnetworks have been
proposed to model a larger set of faults in the CMOS gate
[44].Transistor-level faults, includingbridging, havealso
been modeled by gate-level circuitry for an interesting class
of general array logic structures [45]. The problem with such
approaches which attempt to modeltransistor-levelfaults
with gate-level circuits is that the circuitry can become very
complicated andthere is a necessity toinclude storage
elements; in addition, it can be seen that many of the stuck
faults at the gate-level modeldonot correspond to any
physical fault in the transistor representation.
There has been other work in the area of detection of
stuck-open faults. Test generation algorithms which use the
stuck-attest set as the basis to detectstuck-openfaults
were described in [24], [GI, [47]. It has recently been shown
that a variation of CMOS, Domino CMOS, is easier to test,
because moststuck-openfaults are automaticallytested
during the precharge and evaluation phases of this particu-
lar technology [48].
These methods of generating test sets for a CMOS logic
circuit are based on staticbehavior, in otherwords,they
assume a zero delay through all gates and interconnections.
Under dynamic behavior, when one allows variable delays,
the test sets derived by these methods can be shown to be
invalidated [33]. In this study, Reddy et al. gave examples
whichshowedthat: 1) there exist certainfunctions for
which an irredundant CMOS realization using conventional
design techniques does not have any valid test set under
dynamic behavior;and 2) if an undetectablestuck-open
fault is present, it may invalidate other tests, or the circuit
may malfunction for some other pair of input changes. The
proposed testableCMOScircuits use extra controllable
inputs and additional logic. A novel hybrid CMOS realiza-
tion was proposed by Jha [49]. It was shown that a valid test
set was guaranteed to exist for this realization even under
dynamic behavior for any stuck-open fault. A simulation of
a CMOS microprocessor was also performed by Timoc [50].
Application of 512000 pseudorandompatterns was found
t o detect 98 percent of stuck-at faults but only 85 percent
of stuck-open faults. This also points out the difficulty and
importance of tests for stuck-open faults.
Functional-Level Fault Models
Transistor-level models more accurately represent failure
mechanisms, but involve a much greater degree of com-
plexity, since the number of primitive elements (transistors
and interconnections) which can be faulty is very large. A
VLSl system may consist of many functional modules, each
module being implemented by these primitive elements. In
many cases, it is sufficient to know whether a module is
faulty or not. In this case, a fault model at the functional
module level which accurately includes the effect of faults
in transistors and interconnections is very useful, since the
is much smaller thanthenumber of
transistors, reducing the complexity of treatment. In doing
so, however, one has to be careful about loss of informa-
645
 tion which results in some failures at the transistor level, for
example, notbeingincludedin the functionalmodel.
Another major problem is that different implementations of
the same functionwould have different transistor-level
faults, which would, in turn, result in different functional-
level behavior. Some attempts at describing the effects of
failures at the functional level for a variety of functional
modules are briefly outlined in this section.
GeneralFaultModelsforFunctionalBlocks: Given a
combinational function with N inputs, a very general fault
model is t o assume that this function can be transformed
into any othercombinationalfunctionof N inputs and,
therefore, testingit requires applicationof all 2N input
combinations. Such exhaustive testing is impossiblefor
functionswitha large numberofinputs.However, if a
functionwith a large numberofinputs is implemented
using a regular interconnection of subfunctions, each with
a relatively smallnumberofinputs,the exhaustive fault
model can be used for the subfunctions very effectively. For
example, if an adder is implemented as a cascade of full
adder cells (a ripple-carry adder), each adder cell has three
inputs and the entire adder array can be tested with eight
input combinations which guarantee that each full adder
module is exhaustively tested, assuming at most one mod-
ule is faulty.Techniquesfortesting arrays of relatively
simple cells have been developed by Kautz [51], Friedman
[52], and Cheng [53]. McCluskey [54] has described methods
ofpartitioning circuits so they can be testedunderthe
exhaustive fault model.
The analagous fault model for sequential circuits assumes
that, underfault,thecircuit can be transformed into any
other sequential circuit. A usual restriction is that the num-
ber of states willnot increase underfailure. Checking
experiments [55] for such general faults are quite lengthy
and have not been applied widely toVLSI, except in special
cases [56], [57].
Very complex VLSl systems are most readily implemented
in a regular,cellularfashion in many instances. In these
cases, an exhaustivefault model would be very tractable,
given the regularstructure of
implementation. Unfor-
tunately, most exhaustive fault models assume that a com-
binational circuit does not become sequential under fault;
this is clearly not true for the stuck-open faults described
earlier. Very little work has been done in models which, in
fact, do not make this limiting assumption.
Models for Small Functional Modules: A detailed study
of an n-MOS decoder with shorts and opens was performed
by Banerjee [32]. A decoder can be described functionally as
having N inputs and 2N outputs and, under normal oper-
ation, exactly one output line is activated corresponding to
the input address. It was found that all single transistor-level
faults could be described by the following functional faults:
1) Instead ofthe correctline, an incorrectline is ac-
tivated.
2) In addition to the correct line, an incorrect line is ac-
tivated.
3) No line is activated.
It can be seen that such a description is very simpleand
was shown t o incorporate all ofthe physical shorts and
openspossible in the transistor-leveldescription. If a de-
coder is used as a functional module in a large system, this
646
functional fault description can be used to derive tests for
the decoder or to find the effects of faults in the decoder
on the overall system.
Another study [58] involved a multiplexerfunctional
block. A multiplexer has N inputs and log, N control sig-
nals, and one output, where the output is selected to be
one of the inputsby the address on the control lines. Under
a fault, it was found thatthebehavior of the multiplexer
modulecould be described inthefollowingfunctional
manner:
1) A 0 and a 1 cannot be selected on every input line.
2) When selecting some input, another inputwill be
selectedinsteadof, or inaddition to, the correct input
(producing the AND or OR of these two values).
3) Selection of a value on an input, followed by its com-
plement on the same input, will result in error at the out-
put.
4) Selection of a value on an inputfollowed by the
selectionofthe opposite value on a linewhose address
differs in exactly 1 bit from the first address will result in
error.
It was also pointed out that 3) and 4) were the result of
stuck-open faults, thus showing that stuck-open as well as
stuck-at or transistor-level faults could easily be described
for this functional module at a higher level.
Memory Fault Models: There has been a great deal of
effortinderiving test patterns for memories sincethese
constitute a major portion of large systems. A random-access
memory (RAM) chip consists of an array of memory cells,
an address decoder, address and data registers, and
read/write logic. Faults in a memory chip maycause it to
have changes in some electrical parameters or intiming.
Faults will also cause the memory to be functionally incor-
rect. A widely used set of functional faults for memories is
as follows:
1) One or more cells in the systemare stuck at logic 0
or 1.
2) Twoormore cells are coupled. A pairofmemory
cells, i and j , are said to be coupled for transition from x to
y if one cell of the pair, say cell i, changes the state of the
other cell, cell j , from 0 to 1 or from 1 to 0.
3) The state of a memory cell can be altered as a result of
certain patterns of I s and Os or transitions in other cells.
A fault model which did not assume knowledge of the
memory array structure would allow coupling between any
pairs of cells. If the cells which are adjacent to each other
are known, coupling can be restricted to neighboring cells,
reducing the test complexity. Many testing algorithms have
beenderivedto detect each of these faults in memory
systems [59].
Fault Models forProgrammableLogicArrays(PLAs):
PLAsare widely used in VLSlsystems since they provide a
means of implementing complex functions in a very regular
and structured fashion. A PLA is shown schematically in Fig.
11 with X , to X , as the inputs, four product terms, and two
outputs, F, and F,. The internal fusible links or transistors in
the PLA arrayare shown schematically as dots in this
diagram. Faults in the PLA could include stuck-at, bridging,
or shorts, as well as contact or cross-point faults caused by
the spurious presence or absence of a contact (fusible link
or transistor) between a row and columns of the PLA. It has
been shown in [60] that the contact faults dominate most
single stuck-at,bridging, and shorteddiodefaults. The
PROCEEDINGS OF THE IEEE. VOL. 74, NO. 5 . M A Y 1986
 x1 x2 x3 x4 F1 F2
Q2 Q5 44 43
Fig. 11. Schematicrepresentation of a PLA.
effects of contact faults within the PLA can be represented
functionally as changes in the product terms of the PLA
[61]. A single-input contact fault on a row of a PLAcauses
the growth, shrinkage,or disappearance of the correspond-
ingproductterm. Similarly, a single-output contactfault
causes the appearance of a newimplicant or the disap-
pearance of the corresponding implicant. Fig. 1 2 shows five
faults in the PLA of Fig. 11 and their effects on the corre-
sponding product terms. For example, if the contact at 91
\ x3 x4 \ x3 x4
x1 00 01 11 10
F1
Growth fault at 0 1 Shrinkage fault at 02
\ x3 x4 \ x3 x4
x1
Appearance fauk at b3 Disappearance
fault at 0 4 M 05
Fig. 12. Effect of contact faults on PLA product terms
is faulty (it no longer has an effect), this is equivalent to the
product term growing in size. On the other hand, if there is
a spurious contact at Q2, this has the effect of shrinking the
product term, as shown in Fig. 12. These functional effects
can be used to derive tests for faults within PLAs [62].
Fault Models forMicroprocessors: Microprocessors are
used as building blocks in very complex systems.Even
though these modules are quite complex themselves, fairly
effective functional-level fault models at the register-trans-
fer or architectural level have been derived for them. Thatte
[63] visualizes a microprocessor as a set of functions includ-
ing register decoding, data transfer, data manipulation, and
instruction sequencing. Afunctional faultmodel is devel-
oped foreach of these functions.Improvements in this
modelweremade by Brahme [MI. This faultmodelfor
instruction sequencing usesan extrapolation of the tech-
niques applied t o derive fault models for smaller functions
like decoders. The specific fault model is based on concep-
A B R A H A M A N D F U C H S : F A U L T A N DERROR MODELS F O R VLSl
tual treatment of instructions as consisting of micro-instruc-
tions which, in turn, are comprised of a set of micro-orders.
Under fault, one or all of the following events are assumed
to happen:
1) One or more micro-orders are inactive, therefore, the
instruction is not executed completely.
2) Micro-orders which are normally inactive become ac-
tive.
3) A set of micro-instructions is active in addition to, or
instead of, the normal micro-instructions.
The effect of a fault would be incorrect logic valuesat
the external pins or thedestruction of internallystored
data. This fault model, in conjunction with fault models for
other functions of the microprocessor were used to derive
comprehensive tests for microprocessors using only archi-
tectural level information. If the details of implementation
of the microprocessor are not known, this is probably the
only approach to deriving reasonable tests forfaults (the
details of which are unknown) in microprocessors.
ERROR MODELS
Accurateandtractablefaultmodelsprovide a viable
means ofdetermining the effectof physicalfailures on
individual transistors, gates,or functional modules. How-
ever, fault models do not yield immediate insight into the
problem of determining the nature of errors due to these
physical failures in the information at the output of circuit
modulesduring normal operation. Concerns such as the
extent of information corruption due to a physical failure,
the extent of errorpropagation, and the timebetween
failure inception and possible error detection (error latency),
can be investigated by first developing models of the types
of errorsgeneratedbyphysicalfailures. Error models are
also necessary for the developmentofself-checking VLSl
design, which allows for concurrent detection of errors due
t o physicalfailures during normaloperation. Error models
are a means of classifying the effect of physical failures on
the system during periods of actual computation. Although
there is a considerable bodyof research reported inthe
literature about the development of fault models for VLSI,
there is a distinct lack of similar research concerning accu-
rate and tractable error models. The discussion which fol-
lows presents work performed primarily by researchers
interested in developing techniquesfordesigning self-
checking logic.
Transistor- LevelError Models
The effects of shorts and opens on VLSl transistors and
interconnect result in error models which are dependent on
the circuit design and application. For example, in n-MOS,
a short betweenthe gate and drain of an enhancement
transistor can result in a very different class of errors if the
transistor is employed in a PLA rather than in a bit-serial
multiplier. For this reason, transistor-level error models can-
not be discussed without also discussing their specific ap-
plication. In contrast tofault models, error models at all
levels of abstraction are only meaningful when the discus-
sion is application and implementation specific.
Unidirectional Error Models: There are situations in
which a single physical failure can create an electrical short
or open and all the resulting bit errors at the outputs of a
647

Fig. 13. Buffered PLA faults yieldingunidirectionaloutputerrors.
Clkl
0 0 1
Fig. 14. Equivalentinputerrorfor a PLA fault.
module will be all of the same type, either Os becoming Is,
or I s becoming Os. Such errors are described as unidirec-
tional. An example of this behavior is in PLAs, where single
device and interconnect failures have been shown to result
in unidirectional errors [65], [66]. The erroneous selection or
lack of selection of a product line for certain inputs results
inunidirectional errors i n the output. Fig. 13 illustrates
eleven classes of faults including stuck-at faults (faults I-3),
shorts (faults 4-9), andcrosspointfaults(faults IO, 11)
which result in only unidirectional errors at the output of a
PLA.
Failure t o separately bufferboththeuncomplemented
and complemented bit lines in PLAs as in Fig. 13 has been
shown to yield error models which are equivalent to uni-
directional errors on inputs as well as the outputs [67]. Fig.
14 illustrates the interesting phenomenon of how a short
between the gate and drain of an enhancement transistor
(case 2) or a bit-line stuck-at4 (case 1) i n the AND plane of
the PLA can result in what is equivalent to a 1-bit change
on the input. In Fig.14, a case 1 or case 2 fault causes an
output error equivalent to an input of (MI) rather than the
correct (001). Without input buffering,the unidirectional
error modelforoutputsof PLAs must bemodifiedto
include errors on inputs and outputs. The authors have
shown that a comprehensive error model for PLAs lacking
input buffering can be summarized as followsfor shorts
and stuck-at faults:
648
Clk2
Clk2
1) The output is aunidirectional error inthe correct
output for the correct input.
2) The output is the correct output for an input which is
a unidirectional error in the correct input.
3) The output is aunidirectional error inthe correct
output for an input vector which is a unidirectional error in
the correct input.
Soft-ZrrorModels: Errors dueto environmentally in-
duced transientfailures or intermittent circuit instabilities
are referred t o as soft errors. Disturbances such as the
electron-hole pairs created by the passage of an alpha
particlethroughthe activedeviceregions of an n-MOS
memory are at best difficult to detect by means of classical
testing. Fault models for such phenomena are meaningless.
Concurrent error detection techniques based on a realistic
error model allow forthe detection of such errors. The cost
is a function of the hardware required for codeword check-
ers and redundantinformation bits. Based on measure-
ments and simulation, single-bit error detection/correction
has been shown tobe sufficient for most soft errors in MOS
memories [ I l l , [ l 2 ] . However,models must include infor-
mation concerning not only thetype of errors but also their
frequency, if error detection and correction is t o be com-
prehensive. For example, in memories i f soft errors occur
frequently andmemorywords areaccessed infrequently,
single-bit correction per word may not be sufficient.
Indeterminate Errors: Certain classes of shorts,such as
PROCEEDINGS OF THE IEEE, VOL. 74, NO. 5, M A Y 1986
 directional errors onbothinputs and outputs, modified
I versions of standard encoding have been developed which
afford the use of a single checker, but which still detect
AND
PLANE I
~ j OR
PLANE
errors on inputs and/or outputs [72]. Fig. 15 illustrates such
an implementationof a self-checking PLA. The input
checkbits C, are functions of the input information bits /;,
while the output checkbits C, are a function of both the
output information bits I, and the input information. Meth-
ods of circuit design have yet to be devised which allow for
ease in detectionof indeterminate logic values either
throughtesting or concurrenterror detection. Soft errors
causedby localized upsets, although difficult to test, are
typically easily detectedconcurrentlybysimple encoding
- - - schemes with appropriate codeword checkers.
Designing for Error Avoidanceand Containment: After
an error model has been developed based on a realistic set
of physical failures and a specific circuit design, the design
Fig. 15. Concurrent errordetection for unidirectional er- cycle can be repeated in an attempt to eliminate the likeli-
rors in PLAs. hoodof thosefailures which result indifficult-to-detect
insidious error classes. As an example, theselection of
multiple word select lines in a read-onlymemory (ROM)
thefault F, in Fig. 7, can result inlogic valuesat the dueto a physicalfailure results in a unidirectional error
outputs of transistors which are between 0 and 1, as has model [72].However, by employing design rules, which
previously been stated. These indeterminate values corre- minimize the likelihood of such a failure, e.g., in MOS by
spond to errors when the values are interpreted incorrectly increasing the distance between the buried contacts of the
by the transistors they drive. Indeterminate logic levels are depletion-mode transistors and the V,, contacts, or using a
difficult to detect, just as their corresponding fault models precharging scheme which isolates V,, and the word select
are difficult to test. Several gates driven by the same inde- lines, such troublesome errors can be eliminated from the
terminate value may interpretthelogic value differently model. For ROMs and PLAs, a restricted error model can be
withtheresultant effect of somegates receivingcorrect developedwith these fault-avoiding layout rules, which
information and others erroneous inputs. An error may go includes only potential single-bit errors in the outputs or
undetected i f acodeword checker interpretstheinter- input lines.instead ofemployingunidirectional error de-
mediatevoltage as a correct logic value, whilethe next tecting codes, andtheresultant complexityincodeword
stage of the logic circuit interprets it as an erroneous value. checkers, a simple parity checker scheme can be employed
Applications of the Models: Error detection for unidirec- which detects all errors i n the error model [73]. Fig. 16
tional errors on outputsoffunctionalmodules can be presents the self-checking ROM design employing the error
accomplished by encoding the outputs with unidirectional restrictinglayout rules. P, is the odd parity of each data
errordetecting codes andusingappropriate codeword word(including Pz and 4), pZ is theodd parity ofthe
checkers. Codeword checkers have recentlybeendevel- address of each data word, and 5 is the even parity of the
oped for MOS technologies based on transistor-level fault address of each data word. Noncodewords are detected by
models [@I, [69], which are considerably less costly than a self-testing parity checkerandcomparator. Other fault-
classical gate-level designs [70], [71]. These designs use avoiding designs have beendeveloped for PLAs [74], [75]
mask-level layout and analysis to reduce the size ofthe and for memories to minimize susceptibility to soft errors.
checkers. For instances in which failures can result in uni- The techniquesfor memories have included:foldedbit-

ROM

Fig. 16. A scheme for concurrent error detection in ROMs

A B R A H A M A N D FUCHS- FAULT A N D ERROR MODELS FOR VLSl 649

sense lines (reducing thesensitivity to bit-line and sense
amplifier alpha hits), decreased front-end gate oxides (in-
creasing the charge storage density), and novel cell designs
[I 11.
Gate-Level Error Models
Gate-levelerrormodels have typically followed models
for gate-levelfaults [76]. Single stuck-atlines yield error
models which are single-bit errors on outputs or inputs of
gates. Shorts on input lines or output lines have typically
been assumed to result in thelogical AND or OR of the
constituent logic values, which is again a single-bit error on
the output or input of a gate.
Gate-levelertor models have classically been used in
developing self-checking logic circuits. The self-checking
property of a circuit relates in a formal manner a specific
faultmodelto an error model. A totallyself-checking
combinational circuit possesses the properties that for every
fault from the fault modelthecircuit never produces an
error that is not detectable, i.e., an incorrect codeword
output, and the circuit produces a detectable error, i.e., a
noncodeword output, for at least one codeword input.
The error preserving nature of circuits is also important in
considering the propagation of errors throughout a system
before detection occurs. Combinational circuits that always
propagate detectable errors from the error model are called
code disjoint (i.e., for the fault-free circuit, noncodeword
inputs always mapintononcodeword outputs). Amore
complex model of error propagation has beendeveloped
by Smith and Lam [77]. Theyalso provide necessary and
sufficientconditions fortheplacement of checkers in a
self-checking system.
Functional-Level Error Models
Functional-level error models explicitly state the func-
tional errors due to physical failures in specific modules. In
broad terms, functional error models can be divided into
modelsofinformation transfer and storage (e.g., inter-
connection networks), information manipulation (e.g.,
ALUs), and control (e.g., instruction sequences).Very few
transistor, gate, or functional error models include timing
errors as part of the model. The advantage of functional-level
error models over transistor- and gate-levelequivalents is
that complex systemscan be modeled without the details
involvedinconsideringindividual devices or gates. Also,
functional-level error models are typically amenable to er-
ror detection, without the necessity of a large amount of
error detection hardware and software, as is often inherent
i n error detection techniques at a lowerlevelof imple-
mentation. Finally, errors can be modeled formodules in
which the actual failure mechanism or the details of imple-
mentation are not known. The disadvantage of functional-
level error modeling is that the relationship between realis-
tic failures and modeled errors may be tenuous. Care must
betakentoverifyfunctional error models throughfault
simulation, measurement, and accelerated lifetesting. There
is a distinctneed for research concerning thecorrelation
between proposed functional error models and the classes
of errors produced by actual physical failures.
Information TransferandStorageError Models: Classic
examples ofinformation transfer and storage modules in
VLSlare themultibit bus andreadable/writablememory
chip. Bus and memory error modelshave included single-bit
errors (due t o shorts between two lines, or single broken
lines), random errors, or unidirectional errors. Note should
be made that a failure in the address decoding mechanism
of a memory maycause a read orwriteofthewrong
location, which may be observed as a random error at the
output. If such a failure is permanent,then, as with PLAs
and ROMs [73], coding schemes can be used which force
such a failure into a class of detectable errors by encoding
the address withthe data and usinglayout rules which
avoid the likelihood of multiple activated word lines.
A morecomplex error model is necessary for intercon-
nection networks composed of multiple stages of switches.
Multistage interconnection networks (MINs), as an exam-
ple, are an alternative approach to multiprocessing in envi-
ronmentswhere the cost of a complete crossbar inter-
connectionnetwork is not feasible. Anexample MIN
composed of 2 x 2 switches and connecting eight proces-
sors t o eight memory modules is given in Fig. 17. In devel-
oping an error model for this network, it is convenient to

OOO ooo
001 001

010 010

011 01 1

100 100

101 101

110 110

111 111

Fig. 17. Example multistage interconnection network.

PROCEEDINGS OF THE IEEE, VOL. 74, NO. 5 , M A Y 1936

650
 Valid States
E # # # # # # # #
'8 ' 9 '10 sll s12 s13
Invalid States
Fig. 18. Possible functional states in a 2 X 2 switching ele-
ment.
consider the effect of shorts and opens on the interconnect-
ing links; however, the switches themselves are most easily
consideredfromafunctional perspective. A lower level
model would be limited toa specific design and implemen-
tationtechnology.In this case, an exhaustive functional
error model can be derived from the functional fault model
for the switches. All possible functional states of a single
2 X 2 switch are given in Fig. 18. Some ofthe statesare
invalid in the sense that the switch should never be in that
state during normal use. Other states are possible (or valid),
however, they may be incorrect for a specific switch setting.
In the examplethatfollows, a class ofnetworks,namely
Delta networks, as illustrated in Fig. 17, are examined. If all
the data paths of a single switch are considered to be in the
same state atany given instance then it is not difficult to
show that given the topology of the network and the fault
model for the links and switches, any failure in a switch or
link will result in one of the following errors [78]:
1) a unidirectional error will occur in the information
flowing through the network;
2) theinformationwill be transferred tothewrong
destination where the address of the wrong destina-
tion will be a unidirectional error in the correct ad-
dress;
3) both of the above will occur; or
4) the source processor will fail to receive an acknowl-
edgesignal from a destinationmemory (assuming
circuit-switched operation).
Based on this error model, a simple method of concurrent
error detection utilizing unidirectionalerror detecting codes
over both the destination address and data can be devised
[781.
An alternative error model is necessary if 2 X 2 switches
are employed in the network, a centralized control strategy
is used, andyet the specific interconnectiontopology is
unknown. The error model for such a scenario is as follows
[781:
1) the correct information may arrive at one or more
incorrect destinations, or co destination;
2) there may be unidirectional errors in the information
arriving at the correct destination.
I n order to comprehensively detect the errors in this model
a method of detecting all random destination errors and all
unidirectional errors in the information must be devised. A
novel encoding strategy has been developed which encodes
the complete address with the checkbitsof the data in
ordertodetectthe errors in thismodel [78]. A similar
A B R A H A M A N D FUCHS: FAULT A N D E R R O R M O D E L S FOR
technique has been used in designing a self-checking
microprogram sequencer [79], [MI.
Structure-Based Error Models: Most VLSl systems are
implemented in a highly structured and hierarchical manner.
In developing the error models for these systems the struc-
s ~ d '15 '1.5
ture can often be exploited to yield insights into tractable
and accurate functional error models. The MlNs described
above are examples ofthisapproach.Anotherinteresting
area of investigation is the structure of algorithms that are
implemented by specific VLSl systems.
Certain classes of errors in software structures caused by
physical failures can be modeled from a functional perspec-
tive. Severalresearchershave proposed an error model for
control flow in macro- and micro-code software [81]-[83].
Detectable errors are considered to be invalid branches, i.e.,
any branch that deviates from the flow graph of the original
program. Techniques for detecting errors in this model are
based on the generation and storage of checking signatures
at predetermined points inthe object code. An error model
forlinked data structures has also beendeveloped. The
model has been used forstructural integrity checking of
data structures, and includes missing or erroneous pointers
between nodes (records) [84]. Limits are placed on the
maximum number of total erroneous pointers and the num-
ber of erroneouspointers in each node.Deviations from
the correct structure can be detected by techniques such as
redundantpointers [84], signatures stored in the leaves
(signatured access paths), or the use of code-theoretic tech-
niques (distributed and appended checks) [85].
Designingfor Error Avoidance and Containment: It is
especiallyuseful at the functional level, as it is at the
transistorand gate level, to restrict,throughdesigntech-
niques, the types of undetectable errors that are likely to
occur during normal operation. For failures resulting in the
selection of the wrong source or destination in an informa-
tion transfer or storage operation, the examples above have
shownhowthe destination or source address can be
encoded andstored with the data ina manner allowing
detectionof errors during the information transfer oper-
ation.
Another extremely useful error containment technique is
the distribution of portions of computation or information
transferand storage over several physically separate func-
tionalunits.An errormodel can then be developedthat
allows any single functionalunitto fail in any arbitrary
manner (a random error model).Atitssimplestlevelthis
technique is often used in multichip memory design where
each chip supplies at most 1 bit for any given n-bit word.
The arbitrary failure of a single chip, including the address
decoder, results in at most only a single-biterror. This same
technique has been applied to MlNs in order to limit the
effect of any single control or switch chip failure [%I. The
data paths through the network are divided up intoslices of
bits so that the resulting error model is one inwhich
random errors may be present in the information received
at the correct destination, however, the errors will be con-
fined to a specific region i n the information word (e.g., 1
byte). Amore sophisticated applicationof thistechnique
has beendeveloped forconstrainingtheextentof errors
due to a faulty processor in a multiprocessor environment
[87]. The technique is algorithm-specific and utilizes en-
coded data and algorithm modification to ensure thatall
errors due t o a faulty processor can be detected and, in this
case, corrected.
VLSI 651
A SUMMARYCOMPARISONOF FAULT AND ERROR MODELS REFERENCES

The unique applications of error and fault models have
been noted throughout the text. The following discussion
illustrates this uniqueness with onespecific module. The
previous descriptionsoffaultand error modelsfor PLAs
present an opportunity for drawing some comparisons. If
failures are considered to be thespurious appearance or
disappearance of an active device i n the OR or AND plane of
a PLA (crosspoint failures), thepreviousdiscussion has
shown that from a functional fault model perspective the
resultwillbetheaddition or deletionof a literal in a
product term of at least one output function, or in adding
or deleting a product term(implicant)from at least one
output function. Test algorithms based on this fault model
should,therefore,be derived such thattheyverify that
these situations have not occurred. The growth or shrinkage
of product terms, however, provides little information that
is usefulfordetecting errors at the outputof a PLA. A
useful error model for PLAs based on the appearance or
disappearance of an active device is one which consists of
unidrectional errors on the output lines. Therefore, by sim-
plyencodingtheoutputsofthe PLA inaunidirectional
error detecting code, errors due to the modeledfailures can
be detected. Error detection is based on erroneous output
logic values rather than functional changes within the mod-
ule. Testing, on theother hand, is concerned withthe
functional change of a device, gate, circuit, or module and
the input(s) necessary to detect this malfunction. A similar
comparison can be made for all of the modules discussed
in this paper.
CONCLUSIONS
VLSl systemsare becoming ever morecomplex, with
many new types of failures and failure effects, as technol-
ogy reduces linewidths and increases density. There is a
greatneed for a thorough understandingof how defects
and failures affect these complex systems.The inherent
contradiction in therequirements for fault models has to be
solved; they are required to be very accurate but, at the
same time, applicable to very large systems.The solution
seems tobeto describe accurately the effects of faults
within higher functional modules and thus make complex
systems tractable by reducing the number of primitive ele-
ments. The hierarchical approaches which are used by the
design community must also be exploited in fault and error
modelingand test generation.Powerful CAD tools for
modeling and test generation, which can easily be used by
designers and test engineers, must be developed if we are
to exploit the potential of VLSI. It is clear that an arbitrary
system would be very difficultto modelandtest. It is
imperative that complex systems be designed so that they
are easily testable, and designfortestability will become
one of the primary requirements of very complex systems.
On-line, concurrent error detection can also be made cost-
effectiveformany applications with appropriatedesign
techniques which eliminate the likelihood of insidious er-
rors. Reliable systems of the future will most certainly test
for faults and check for errors which are based on models
derived from an analysis of the effects of realistic physical
failures. Based on accurate and tractablefaultand error
models, efficient and comprehensive approaches to reliable
VLSl system design can be formulated.
J-C. Laprie,”Dependablecomputingandfaulttolerance:
Conceptsandterminology,” in Proc. /€E€ /nt. Symp. on
Fault-Tolerant Computing, pp. 2-11, June 1985.
T. E. Mangir, “Sources of failures and yield improvement for
VLSl and restructurable interconnects for RVLSI and WSI: Part
I-Sources of failures and yield improvement for VLSI,” Proc.
/E€€, vol. 72, pp. 690-708, June1984.
H. R. Bolin, “Processdefectsandeffects on MOSFETgate
reliability,“ in Proc.ReliabilityPhysicsSymp., pp. 252-254,
1980.
E. D. Colbourne, G . P. Coverley, and S. K. Behera, “Reliability
of MOS LSI circuits,”Proc. /€E€, vol. 62, pp. 244-259, Feb.
1974.
J. T.EasterbrookandR. C. Bennetts, ”Failure mechanisms in
logic circuitsandtheirrelatedfaulteffects,” in Proc. /€€E
Conf. on NewDevelopments in Automatic Testing, pp.44-47,
Nov. 1977.
C. 1. Schnable, L. J. Callace, and H. L. Pujol, ”Reliability of
CMOS integrated circuits,’’ /€€E Computer, vol. 11, pp, 6-17,
Oct. 1978.
P. B. Ghate, ”Electromigration-induced failures in VLSl inter-
connects,” in Proc.Reliability PhysicsSymp., pp. 292-299,
Mar. 1982.
P. S. Ho, “Basic problems for electromigration in VLSl appli-
cations,” in Proc. Reliability Physics Symp., pp, 288-291, Mar,
1982.
A. Ito, H. A. Swasey, and E. W. George, ”Hot electron reliabil-
ity modeling in VLSldevices,” in Proc.ReliabilityPhysics
Symp., pp. %-101,1983.
D. S. Peck, “New concerns about integrated circuit reliability,”
in Proc. Reliability Physics Symp., pp. 1-6, 1978.
T.C.May,“Softerrors in VLSI: Presentandfuture,” /€€E
Trans.Comp.,Hybrids, Manuf. Technol.,vol.CHMT-2, pp.
377-387, Dec. 1979.
C. H. Sie, R. A.Youngblood, J. H. Liao,andA.Turk,“Soft
failure modes in MOS RAMS,” in Proc. Reliability Phys Symp.,
pp. 27-32, 1977.
W. T.Anderson, Jr.and S. C.Binari,“Radiationeffects in
CaAs devices and ICs,” in Proc. Reliability Physics Symp., pp.
31 6-319, 1983.
J. W. Peeples and T. J. Every, “Parametric influence on system
softerror
rates,“ in Proc.Reliability
Physics
Symp.,
pp.
255-260,1980.
N. Burgess and R. I. Damper, “The inadequacy of the stuck-at
fault model for testingMOS LSI circuits: A review of MOS
failure mechanisms and some implications for computer-aided
design and test of MOS LSI circuits,” Software Microsyst., vol.
3, pp. 30-36, Apr. 1984.
S. Cai, M. Mezzalama,and P. Prinetto, “A review offault
models for LSI/VLSI devices,” Software Microsyst., vol. 2, pp.
44-53, Apr. 1983.
G. R.Case,“Analysis of actualmechanisms in CMOSlogic
gates,” in Proc. Design Automation Conf., pp. 265-270, 1976.
C.Timoc, M. Buehler,T. Criswold, C. Pina, F. Stott, and 1.
Hess, “Logical models of physical failures,” in Proc. / E € € Int.
Test Conf., pp. 546-553, Nov. 1983.
J. P. Hayes,”Faultmodeling,” /E€€ Design and Test,vol. 2,
pp. 88-95, Apr. 1985.
J. W. BandlerandA. E. Salama,“Faultdiagnosisofanalog
circuits,” Proc. /E€€, vol. 73, pp, 1279-1325, Aug. 1985.
J. Galiay,Y.Crouzet,and M. Vergniault,”Physicalversus
logicalfaultmodels in MOS LSI circuits:Impactonthe
testability,” /€E€ Trans. Comput., vol. C-29, pp. 527-531, June
1980.
6. Courtois,“Failuremechanism,faulthypothesis,andana-
lytical testing of LSI-NMOS (HMOs) circuits,”in Proc. VLS1‘87,
pp. 341 -350, Aug. 1981.
S. K. Jain and V. D. Agrawal, “Modeling and test generation
algorithms for MOS circuits,” /€E€ Trans. Comput., vol. C-34,
pp. 426-433, May 1985.
K. W. Chiangand 2. C. Vranesic, “On faultdetection in
CMOS logicnetworks,” in Proc.20thDesign Automation
Conf., pp. 50-56, June1983.
M. Acken, “Testing for bridging faults in CMOS circuits,” in
Proc. 20th Design Automation Conf., pp. 717-718, June1983.
R. L. Wadsack, “Fault modeling and logic simulationof CMOS

652 PROCEEDINGS OF THE IEEE, V O L 74, N O .5, M A Y 1986

and MOS integrated circuits,”
Bell
Syst.
Tech. J., pp,
1449-1474, May-June 1978.
D. Baschiera and B. Courtois, “Testing CMOS: A challenge,”
VLSI Des., pp. 58-62, Oct. 1984.
M. D. Schuster and R. E. Bryant, “Concurrent fault simulation
of MOS digital circuits,” in Proc. Conf. on AdvancedRe-
search in VLSI, pp. 1-10.1984.
J. P.Hayes,“Faultmodelingfor digitalintegratedcircuits,”
/E€€ Trans. Computer-Aided Design, vol. CAD-3, pp, 202-208,
July,1984.
P.Banerjeeand J. A. Abraham,“A multivaluedalgebrafor
modeling physical failures in MOS VLSI circuits,” /E€€ Trans.
Computer-Aided Design, vol. CAD-3, pp, 312-321, July 1985.
C. C. Beh, K . H. Arya, C. E. Radke, and K. E. Torku, “Do stuck
faultmodelsreflectmanufacturingdefects?” in Proc. /€E€
Semiconductor Test Conf., pp. 35-42, Nov. 1982.
P. Banerjee, “A model for simulating physical failures in MOS
VLSI circuits,”Tech.Rep.CSC-13,CoordinatedSci.Lab.,
Univ. of Illinois at Urbana-Champaign, 1985.
S. M. Reddy, M. K . Reddy, and J. C. Kuhl, ”On testable design
for CMOS logiccirucits,” in Proc. /E€€ Int. TestConf., pp,
435-445, Oct. 1983.
H.-C. Shih, J. T.Rahmeh,and J. A. Abraham, ”An MOS fault
simulator with timinginformation,” in Proc. Int. Conf. on
Computer-Aided Design, pp. 45-47, Nov. 1985.
W.Barraclough,A.C. L. Chiang,andW.Sohl,”Techniques
for testing the microcomputer family,” Proc. IF€€, vol. 64, pp.
943-950, June 1976.
R. Nair, S. M. Thatte, and J. A. Abraham, ”Efficient algorithms
fortestingsemiconductorrandom-accessmemories,” /€E€
Trans. Comput., vol. C-27, pp. 572-576, June 1978.
J. F. Poage, “Derivation of optimum tests to detect faults in
combinational circuits,” in Proc. Symp. on Mathematical The-
ory of Automata, pp. 483-528, 1%3.
M. L. Ketelsen, “An integrated circuit fault model for digital
systems,” Tech. Rep. CSLR-743,CoordinatedSci.Lab.. Univ.
of Illinois at Urbana-Champaign, 1976.
J. P.Shen, W. Maly,and F. J. Ferguson, “Inductivefault
analysis of MOSintegratedcircuits,” /€€E Design and Test.
vol. 2, pp. 13-26, Dec. 1985.
E. J. McCluskeyand F. W.Clegg,”Faultequivalence in
combinationallogic networks,” /FEE Trans.Comput., vol.
C-20, pp. 1286-1293, NOV. 1971.
D. R. Schertz and C. Metze, “A new representation for faults
in combinationaldigitalcircuits,” /E€€ Trans.Comput., vol.
C-21, pp. 858-866, Aug. 1972.
P. Banerjee and J. A. Abraham, “Characterization and testing
ofphysicalfailures in MOS logic circuits,” /E€€ Design and
Test, VOI.1, pp. 76-86, Aug. 1984.
K.C. Y . Mei, “Bridgingandstuck-atfaults,” / € € E Trans.
Comput., vol. C-23, pp. 720-726, July 1974.
S. A.AI-ArianandD. P. Agrawal, ”Modeling andtestingof
CMOS circuits,” in Proc. Int. Conf. on Computer Design, pp.
763-769, Oct. 1984.
S. W. Sievers and A. Aviiienis, “Analysis of a classof totally
self-checkingfunctionsimplemented in a MOS LSI general
logicstructure,” in Proc. 71th Int. Symp. on Fault-Tolerant
Computing, pp. 256-261, June 1981.
Y. M. El-ziq, “Automatic test generation for stuck-open faults
in CMOS VLSI,” in Proc. 18th Design Automation Conf., pp.
347-354, June 1981.
R. Chandramouli, “On testingstuck-openfaults,” in Proc.
73th Int. Symp. on Fault-TolerantComputing, pp. 258-265,
June 1983.
V. C. Oklobdzija and P. C. Kovijanic, “On testabilityof
CMOS domino logic,” in Proc. 74th Int. Symp. on Fault-
Tolerant Computing, pp. 50-55, June 1984.
N. K. Jha and J. A.Abraham,“TestableCMOS logic circuits
underdynamicbehavior,” in Proc. Int. Conf. on Computer-
Aided Design, pp. 131-133, Nov. 1984.
C.Timoc, F. Stott, K. Wickman,and L. Hess,
“Adaptive
self-testfor a microprocessor,” in Proc. /E€€ Semiconductor
Test Conf., pp. 701-703, Oct. 1983.
W. H. Kautz,“Testingforfaults in cellularlogicarrays,” in
Proc. Symp. on Switching and Automata Theory, pp. 161 -174,
1%7.
A. D. Friedman, “Easily testable iterative systems,” /E€€ Trans.
Comput., vol. C-22, pp. 1061-1064, Dec. 1973.
W.-T.Cheng,“Testinganderrordetection in iterativelogic
arrays,”Tech.Rep.CSC-44,CoordinatedSci.Lab., Univ. of
Illinois at Urbana-Champaign, 1985.
E. J. McCluskey and S. Bozorgui-Nesbat, “Design for autono-
mous test,” /E€€ Trans. Comput., vol. C-31, pp. 866-875, Nov.
1981.
F. C. Hennie, Finite-State Models for Logical Machines. New
York: Wiley, 1968.
T. Sridhar and J. P. Hayes, “Design of easily testable bit-sliced
systems,” /€E€ Trans. Comput.,vol.C-30,pp.842-854,Nov.
1981.
T. Davis, R. Kunda,and W. K. Fuchs,“Testingofbit-serial
multipliers,” in Proc. /€E€ Int. Conf. on Computer Design, pp.
430-434,OCt.1985.
J. A . Abrahamand V. K . Agarwal, “Test generationfor digi-
tal systems,” in Fault-Tolerant Computing: Theory and Tech-
niques, D. K. Pradhan,Ed.EnglewoodCliffs,NJ:Prentice-
Hall, 1985.
M. S. AbadirandH. K. Reghbati,“Functionaltestingof
semiconductor random-access memories,” Comput. Surv., vol.
15, pp. 175-198, Sept. 1983.
D. L. Ostapko and S. J. Hong, ”Fault analysis and test genera-
tion for programmable logic arrays,” /E€€ Trans. Comput., vol.
C-28, pp. 617-626, Sept. 1979.
J. E. Smith, “Detection of faults in programmable logic arrays,”
I€€€ Trans. Comput., vol. C-28, pp. 845-853, Nov. 1979.
P. Bose and J. A. Abraham, “Test generation for programma-
ble logic arrays,” in Proc. 79th De-gn Automation CGnf., pp,
574-580, June1982.
S. M. Thatteand J. A.Abraham,”Testgenerationfor mi-
croprocessors,” /E€€ Trans.Comput.,vol.C-29, pp. 429-441,
June1980.
D. S. Brahmeand J. A.Abraham,“Functionaltestingof
microprocessors,” /€€E Trans. Comput.,vol. C-33, pp. 475-485,
June 1984.
C. P. Mak, J. A. Abraham, and E. S. Davidson, “The design of
PLAs with concurrenterrordetection,” in Proc.72th Int.
Symp. on Fault-Tolerant Computing, pp, 303-310, June 1982.
H. Dong and E. J. McCluskey, “Matrix representation of PLAs
and an applicationto characterize errors,” Center for Reliable
ComputingTech.Rep.81-11,StanfordUniv.,Stanford,CA,
Sept. 1981.
P. Banerjee and J. A. Abraham, “Fault characterization of VLSI
MOS circuits,” in Proc. Int. Conf. on Circuitsand Computers,
pp. 564-568, Sept. 1982.
N. K. Jha and J. A. Abraham, “Techniques for efficient MOS
implementation oftotallyself-checkingcheckers,” in Proc.
/€E€ Int. Symp. on FaultTolerantComputing, pp. 430-435,
June 1985.
M. Nicolaidis, I. Jansch,and B. Courtois,“Stronglycode
disjoint checkers,” in Proc. 14th Int. Symp. on Fault-Tolerant
Computing, pp. 16-21, June 1984.
D. A. Anderson and G. Metze, “Design of totally self-check-
ing check circuits for m-out-of-n codes,”/FEE Trans. Comput.,
vol. C-22, pp. 263-269, Mar. 1973.
M. A. Marouf and A. D. Friedman, “Design of self-checking
checkers for Berger codes,” in Proc. 8th Int. Symp. on fault-
Tolerant Computing, pp. 179-184, June 1978.
W. K.Fuchsand J. A.Abraham, “Aunified approach to
concurrent error detection in highly structured logic arrays,”
in Proc.74th Int. Symp. on Fault-TolerantComputing,pp.
4-9, June 1984 (also to appear in /E€€ J. Solid-State Circuits).
C.-Y.Chen,W. K. Fuchs,and j. A.Abraham,“Efficient con-
current error detection in ROMs and PLAs,” in Proc. /€€€ Int.
Conf. on Computer Design, pp. 525-529, Oct. 1985.
Y . Tamir andC.H.Sequin,“Designandapplication of
self-testing comparators implemented with MOSPLAs,” /E€€
Trans. Comput., vol. C-33, pp. 493-506, June 1984.
M. Nicolaidis and B. Courtois, “Design of self-checking sys-
tems based on analytical fault hypotheses,” IMAC Computer
Architecture Croup Res.Rep. 353, Mar. 1983.
J. F. Wakerly,ErrorDetectingCodes,Self-checkingCircuits
and Applications.NewYork,NY:Elsevier-NorthHolland,
1978.
J. E. Smithand P. Lam, “A theory of totallyself-checking
system design,” /€€E Trans. Comput.. vol. C-32, pp. 831-844,
Sept. 1983.
W. K . Fuchs, K. H. Huang,and J. A.Abraham,“Concurrent
 errordetection in VLSl interconnectionnetworks,” in Proc.
70th Int. Symp. on Computer Architecture, pp. 309-315, June
1983.
[79]C. Y. Wong, W. K . Fuchs, J. A. Abraham,and E. S. Davidson,
“The design of a microprogram control unit with concurrent
errordetection,” in Proc. 73th Int. Symp. onfault-Tolerant
Computing, pp. 476-483, June 1983.
[So] M. M. Yen, W. K . Fuchs,and J. A. Abraham,“Designing for
concurrent error detection in VLSI: Application to a micropro-
gram control unit,” I€€€).Solid-State Circuits (to appear).
[81] M. Namjoo, “Design
of
concurrentlytestable
micropro-
grammed control units,” in Proc. 75th Annu.Workshopon
Microprogramming, pp. 173-180, Oct. 1982.
[82] T. Sridhar and S. M. Thatte, “Concurrent checking of program
flow in VLSl processors,” in Proc. /€€E Int. Test Conf., pp.
191-199, NOV.1982.
654
[83] J, P. Shen and M. A. Schuette, “On-line self-monitoring using
signatured instruction streams,” in Proc. /E€€ Int. Test Conf.,
pp. 275-282, NOV.1983.
[W] D. J. Taylor, D. E. Morgan,and J. P. Black,“Redundancy in
datastructures:Improvingsoftwarefaulttolerance,” I€€€
Trans. Software Eng., vol. SE-6, pp. 585-594, Nov. 1980.
[85] W. K . Fuchs,“Concurrenterror detection in VLSl systems
throughstructureencoding,”Tech.Rep. CSC-43, Coordi-
nated Sci. Lab., Univ. of Illinois at Urbana-Champaign, 1985.
[86] J. E. Lilienkamp, D. H. Lawrie, and P.-C. Yew, “A fault-tolerant
interconnectionnetworkusingerror-correcting codes,” in
Proc. Int.Conf.on Parallel Processing, pp.123-125,Aug.
1982.
[87] K . H. Huangand J. A. Abraham,“Algorithm-based fault
toleranceformatrixoperations,” /E€€ Trans. Comput., vol.
C-33, pp. 518-528, June 1984.
P R O C E E D I N G S OF T H E IEEE. VOL. 74, N O . 5, M A Y 1986