Transient Fault Characterization in Dynamic Noisy Environments
Ilia Polian1
1
John P. Hayes2,1
Sandip Kundu3,1
Bernd Becker1
3
Advanced Comp. Architecture Lab
Department of ECE
University of Michigan
University of Massachusetts
Ann Arbor, MI 48109-2122, USA Amherst, MA 01003, USA
[email protected]
[email protected]
{polian|becker}@informatik.uni-freiburg.de
Albert-Ludwigs-University
Georges-Köhler-Allee 51
79110 Freiburg i. Br., Germany
2
Abstract
Technology trends are increasing the frequency of serious
transient (soft) faults in digital systems. For example, ICs
are becoming more susceptible to cosmic radiation, and are
being embedded in applications with dynamic noisy environments. We propose a generic framework for representing
such faults and characterizing them on-line. We formally
define the impact of a transient fault in terms of three basic parameters: frequency, observability and severity. We
distinguish fault modes in systems whose noise environment
changes dynamically. Based on these ideas, the problem of
designing on-line architectures for transient fault characterization is formulated and analyzed for several optimization
goals. Finally, experiments are described that determine
transient fault impact and the corresponding tests for various
simulated fault modes of the ISCAS-89 benchmark circuits.
Keywords: Fault detection, fault modeling, on-line characterization, soft faults, transient faults
1
Introduction
Transient or soft faults in ICs may be broadly defined as
faults that occur at unpredictable times but do not result in
permanent hardware or software damage. They are typically caused by temporary environmental “noise” such as
power-supply spikes or external radiation strikes. If a radiation source is sufficiently strong, or if the affected circuit
elements are sufficiently small, then logic signals may be
flipped causing a system crash. Some rare data-dependent
operating conditions also cause hard-to-identify crashes that
may be placed in the transient fault category. It has long
been observed that transient failures far outnumber permanent ones in computer-based systems, and that the transient
errors they produce are much harder to detect [1]. Furthermore, soft errors induce the highest failure rate of all other
reliability mechanisms combined [2].
Historically, special radiation-hardened ICs were employed in fields with a high exposure to ionizing radiation.
Consequently, much of the prior research on transient faults
Paper 40.1
has focused on specific applications including aircraft [3, 4],
space [5], and medicine (radiotherapy) [6]. However, the
scaling of CMOS technology in accordance with Moore’s
Law into the very deep submicron (VDSM) range appears to
be steadily increasing the susceptibility of “ordinary” ICs to
transient faults. This can be attributed to several factors: (1)
Transistors and their interconnections are shrinking to sizes
that are more readily affected by external radiation [7, 8]. (2)
Supply and threshold voltages, along with signal-to-noise ratios, are also shrinking [9]. (3) Process parameters such as
transistor doping levels are beginning to exhibit variability
that makes circuit behavior fluctuate unpredictably [10]. (4)
ICs are being increasingly embedded in applications such
as automobile engines that have very noisy operating environments. Hence, soft error tolerance is emerging as a new
requirement for ICs in “conventional” applications. On the
other hand, customers from the fields that require radiation
hardness are increasingly shifting to the COTS (commercial
off the shelf) paradigm, i.e. they demand commercial ICs
that are suited for their needs [11]. Since high-volume manufacturing is associated with low margins and cost pressure,
low-cost soft error detection and correction methods are urgently needed. A further new trend is that soft errors in combinational logic are gaining in importance: it is projected in
[8] that they will outnumber their counterparts in memories
employing 65 nm process technology.
Some semiconductor industry commentators have recently speculated that new design methodologies that are
probabilistic and/or fault-tolerant will be required for CMOS
ICs in the near future [12, 13]. Others suggest that novel
nanotechnologies, such as biomolecular or quantum circuits,
will eventually replace CMOS ICs in advanced applications.
Even if this turns out to be the case, soft errors are likely
to remain a major problem for designers and manufacturers.
For example, quantum circuits are inherently fragile to an
extent that may make fault-tolerant design essential [14].
Since soft errors may occur at any time, the conventional
post-manufacturing test approach is not useful for such errors. Characterization testing and On-line testing are employed instead. Table 1 provides details on the methodology, targets and limitations of these two methods and their
INTERNATIONAL TEST CONFERENCE
c IEEE
0-7803-9039-3/$20.00 2005 1
Testing
method
Application
time
Needed
equipment
Primary goals
Limitations
Prop. method
applicable?
Characterization test
Non-accelerated
Accelerated
Apply test vectors to many As in non-accelerated
devices for an extended case, but irradiate deperiod; count number of vices to increase tranobserved transient faults.
sient fault probability.
Before shipment or before start of high-volume manufacturing.
Automatic test equipment ATE and/or on-chip
(ATE) and/or on-chip structures; radiation
structures.
source.
Determine soft error rate Determine accelerated
(SER) of device. Exces- SER (ASER) and estisive SER can be used to mate SER from ASER.
modify device’s design or
manufacturing process.
Very high number of SER–ASER converdevice-hours required for sion inaccurate [15],
statistically
significant poorly understood for
data.
combinational logic.
Yes
On-line test
Concurrent
Non-concurrent
Determine
occurrence Apply vectors to modof transient faults during ules that are idle, e.g.,
operation by consistency waiting for a request.
checks e.g., parity.
During operation (only ac- During operation (only
tive modules).
idle modules).
On-chip structures. Could On-chip structures.
be switchable, e.g., in
high-rad. environment.
Transient fault detection Determine
device’s
and correction of fault ef- SER and detect sudden
fects; detecting permanent changes; characterizafaults occurring after ship- tion of environment in
ment.
which device operates.
Area and power overhead; Area,
power and
possible
performance performance overhead
degradation.
tend to be lower than
for concurrent test.
Yes
No
Yes
Table 1: Test methods for transient faults
sub-classes: non-accelerated and accelerated characterization testing and concurrent and non-concurrent on-line testing.
This paper proposes a built-in self test (BIST) architecture
for non-concurrent on-line test. The focus on non-concurrent
test is explained by the prevalence of blocks which are idle
most (over 99%) of the time in many of today’s systems
(such as sensor networks). If the idle blocks are equipped
with on-line BIST, they can identify sudden increases in soft
error rate (SER) which may be, e.g., due to entry into a highradiation environment. If the blocks which are currently active are equipped with switchable concurrent on-line BIST,
the reported SER increase can be used as a trigger to switch
it on. If the performance of a block deteriorates when its
concurrent BIST is active, this procedure is related to the
graceful degradation strategy.
Although the proposed BIST solution is intended for nonconcurrent on-line test, the blocks can also be used for characterization test, as indicated by the last row of Table 1. In
case of non-accelerated test, billions of device-hours are necessary to get statistically significant data, suggesting massively parallel testing of many thousands chips. This task is
clearly better accomplished by on-line test than by dedicating a tester to each device. It can be used for accelerated
test also, leading to application of test vectors that expose
many faults and thus provide further acceleration. Furthermore, it can gather long-term statistics on soft errors, reducing the need for the expensive characterization testing mentioned above.
Paper 40.1
To support the synthesis of the BIST architecture, we attempt to develop a unified framework for dealing with many
types of transient errors in current and future digital technologies. At issue are how to model such faults and how to
detect them during operation, i.e., on-line, in various noisy
environments. A central concept of the proposed framework
is the notion of a transient fault’s impact. Faults with a higher
impact are more likely to occur, have higher probability of
changing the system state, and induce more severe errors.
Consequently, high-impact faults are primary targets of any
on-line testing strategy. In addition to fault impact, we also
consider the possibility of a system having multiple transient
fault modes, i.e., dynamically changing transient fault profiles.
As a result, we obtain an on-line BIST architecture that
consists of a test pattern generator block that applies a predefined deterministic test set to the block under test and a
comparator of the responses of the block to the expected values. The applied vectors are selected to maximize the detection probability of high-impact faults, and there are further
optimization targets. Experimental results demonstrate that
the number of required vectors is extremely low, and we formally prove that for several important cases the best detection probability is achieved by just one vector.
Note that the proposed architecture cannot be employed
for concurrent on-line testing (in which the block under test
receives functional inputs and cannot process deterministic
test vectors). If all blocks are equipped with switchable
concurrent on-line BIST, non-concurrent BIST functional-
INTERNATIONAL TEST CONFERENCE
2
ity could be mimicked by switching it on and applying some
random data. However, our architecture is superior: First,
it applies highly optimized deterministic vectors, while random data applied to the block would have mediocre fault detection properties. Second, it has no aliasing, in contrast to
most concurrent BIST schemes. Third, the power consumption of the block under test and the concurrent BIST would
be excessive. The power consumption of the proposed architecture is expected to be low, especially in those cases when
a single vector is applied continuously. Last but not least, it
may not be practical to equip each and every block with an
expensive concurrent on-line BIST of sufficient quality; in
contrast, the proposed architecture is a low-cost one.
Soft errors in random logic have been identified as
one of difficult challenges in the International Technology
Roadmap for Semiconductors [16] (p. 33). Its accompanying document on reliability [17] includes a chapter on soft
errors, in which cost-effective soft error detection schemes
for random logic with low performance overhead are cited
as the main challenge. Also the need for both accelerated
and non-accelerated SER estimation methods is highlighted.
The remainder of the paper is organized as follows. The
next section provides an overview of the physics of the transient faults in combinational logic. Section 3 introduces the
generic framework for modeling transient faults. On-line test
architecture and ATPG for it is described in Section 4. The
application of the generic framework to VDSM ICs is examined in Section 5 and several models with different accuracy
and complexity are suggested. Experimental results are reported in Section 6. Section 7 concludes the paper.
2
Transient Faults in VDSM Combinational Logic
The main causes of soft errors due to ionizing radiation are
alpha particles and low-energy neutrons originating from
radioactive impurities in materials used in manufacturing.
High-energy neutrons (from cosmic rays) react with silicon
and oxygen atoms and produce heavy ions [18].1 .
When an alpha particle or a heavy ion strikes on a semiconductor device, its kinetic energy is transferred into charge
described by the linear energy transfer (LET) of the particle
[20]. As a result, a certain amount of free electrons and holes
are created (the number of 1,000,000 electron-hole-pairs is
quoted in [21]). If the particle strike happens in the vicinity
of a p/n junction (a MOS transistor has two p/n junctions),
some of the carriers will end up at the junction. If a significant number of charge carriers arrive at the junction, it
breaks down temporarily, and current flows through it. As a
consequence, there may be a voltage glitch on the line driven
by the transistor.
1 Soft errors may also be triggered by power supply noise. However,
these events are not totally unpredictable as is the case with radiation strikes;
they can be detected by production test if special test patterns are provided
[19]. Hence, our main focus is on radiation.
Paper 40.1
A voltage glitch of sufficient strength, i.e. with a magnitude large enough to exceed (or fall below) the logic threshold of a succeeding gate, can flip a node (introduce a faulty
logic value) for a limited amount of time. Such a glitch is
called a single event transient (SET) [2]. An SET occurs if
the total charge Q deposited by the particle exceeds the critical charge Qcrit of the node in question. The concept of
Qcrit is commonly accepted although it is an approximation
([10] points out the importance of the timing and demonstrates a memory cell that upsets (does not upset) when collecting less (more) charge). There are accepted closed-form
Qcrit equations for memory cells but not for combinational
logic.
The duration of an SET is typically less than or equal to
the logic delay of the gate that drives the node. This is because the charge deposition is normally very quick and the
charge limited, so the time needed to remove it should be
less than the time which the driving gate needs to switch,
i.e. interrupt the connection with VDD (ground) and establish
a connection with ground (VDD ). One exception are deposition processes with a large diffusion component in which
more charge arrives at the node over time.
A single event upset (SEU) occurs if the SET is propagated to a primary output or a latch and critically changes
the output or the state of the system. A soft error is a direct
consequence of an SEU. The propagation of a pulse through
a logic gate can be prevented by a controlling value on a
side-input of the gate. Furthermore, pulse attenuation has
been reported in the literature, i.e. the duration of the pulse
on the gate output is less than on the gate input [22, 23, 8, 7].
All studies observe that no attenuation takes place for pulses
wider than the delay of the gate through which it is propagated, and narrower pulses disappear completely after a few
propagations. A very recent experiment by NAVSEA Crane
[23] compared a SPICE model for attenuation with measured
data for a broad range of heavy ions. The results showed
that SPICE models were off by an order magnitude or more
for narrower transients. Similar effects were reported in an
earlier Boeing experiment [22] (which matched heavy ion
and pulsed laser test data with simulation) and attributed to
charge diffusion.
The SEU frequency, which corresponds to the SER defined earlier, is measured in Failures In Time (FIT), where
1 FIT is one failure per 109 device-hours. The ITRS quotes
1 kFIT as a typical SER of modern products [16], while according to [2] tens of kFITs are possible (100 kFIT is approximately one error per year).
The SER is estimated by either testing a system under
nominal or accelerated conditions, i.e. irradiating it during
test. For a further acceleration, power supply voltage is
sometimes lowered [9]. Accelerated test yields accelerated
ASER from which SER must be derived. There is recent data
that accelerated testing does not yield accurate SER numbers
even for very well controlled experiments. In a Sony experiment [15] ten possible reasons for this mismatch are listed
and a wrong assumption on the neutron flux at sea level used
INTERNATIONAL TEST CONFERENCE
3
in the ASER to SER conversion is identified as the major error source. As a remedy, the authors suggest performing a
test under nominal (non-accelerated) conditions for at least
one reference device, and using SER and ASER values for
this device when converting ASER to SER for other products. Furthermore, converting ASER to SER is poorly understood for combinational logic.
Soft errors due to α particles and low-energy neutrons
can be addressed by optimizing the manufacturing process,
e.g., using boron-free PSG instead of BPSG, adding shielding layers, creating dummy junctions below the active area,
and altering the package design [2, 21]. In contrast, there is
no effective shielding against high-energy neutrons. Thus,
no matter how elaborate a process is, there is no way to prevent SET from happening. Not every SET will cause a soft
error, and not every soft error is critical. However, the remaining soft errors have to be addressed.
3
Fault Modeling Framework
The system of interest is a collection of nodes
{N1 , N2 , · · · , Ns }, where a node is any elementary
logical element, typically a wire or signal net, that is a
potential fault target. Node N is assumed to carry a logic
value 0 or 1. As before, if the disturbance is large enough to
flip N ’s logic value, it is called a SET and any observable
error resulting from it is called an SEU.
3.1
Fault impact
The impact of a transient fault f on node N is defined as
Imp(f ) = F req(f ) · Obs(f ) · Sev(f ).
(1)
Here F req(f ) is the frequency of occurrence of an SET on
N . It is a function of the frequency with which the fault happens, and the SET’s “strength” relative to the fault-free value
on N . Obs(f ) is the probability that the SET propagates to
an observable point where it has an observable effect to the
system, i.e., that it changes the system’s state and becomes
an SEU. Finally, Sev(f ) is the severity of f , and measures
the effect of f on the system as a whole, e.g., the likelihood
of it causing an application to crash. For example, a fault
that changes one pixel in a video frame is less severe than
one that flips an interrupt signal, and a fault occurring in a
floating-point unit when an integer operation is being executed is not severe at all. In general, to assign severity to a
fault requires system-level information.
The three components F req(f ), Obs(f ) and Sev(f ) of
Eq. (1) can be regarded as independent, since their effects
depend primarily on the fault source, the system design, and
the intended application, respectively. It is also convenient
to limit their values to the interval [0, 1], i.e., treat them all
like probabilities.
Imp(f ) and its components reduce to conventional fault
types in limiting cases. For instance, F req(f ) = 1 corresponds to a permanent fault; if Obs(f ) = 0, then the
Paper 40.1
fault is redundant. The impact is highest when F req(f ) =
Obs(f ) = Sev(f ) = 1, i.e., the fault is permanent, affects
the system for every input, and is maximally severe. When
any one of the three parameters is zero, then Imp(f ) = 0,
suggesting that the fault is not worth considering from a logical point of view.
Eq. (1) resembles the expression for soft-error susceptibility used by Mohanram and Touba [24]:
RSEU (N ) · Psensitized (N, l) · Platched (N, l)
F req(f ) corresponds to their RSEU (N ). Our Obs(N ) is
similar to the term Psensitized (N, l) · Platched (N, l), which
is with respect to an individual latch l. Since our model is
generic enough to describe systems without latches or equivalent structures, we use a single parameter for the propagation probability. If the generic model is applied to a specific
system with latches, propagation probability to latches can
be included in the definition of Obs(n). Fault severity is not
considered in [24].
3.2
Fault Modes
SEU rates can vary widely in a noisy environment, giving
rise to several distinct SER ranges which we call fault modes.
We noted in the introduction that aircraft, and even automobiles, experience very different cosmic ray levels at different altitudes. If a heart pacemaker user undergoes radiotherapy, the radiation level affecting the pacemaker’s electronics increases dramatically during treatment and returns
to its original value after treatment [6]. In this case we have
two fault modes: mode 1 for normal operation, and mode
2 for the elevated radiation level due to radiotherapy. Another example is a CMOS IC with multiple power levels
(sleep/standby/normal) for energy conservation. Some of
these modes use design techniques such as duplication of
a block using several transistor threshold voltage levels. In
different modes, different blocks are used, which affects the
occurrence of faults, especially delay faults. Similar multimodal effects can result from process variations during IC
manufacture.
We denote the occurrence probability of an SEU in fault
mode i by F reqi (f ). We assume that environment changes
which manifest themselves as fault mode changes do not
modify the system’s internal structure or its application.
Consequently, neither the observability nor the severity of
a fault are affected by the fault mode. The impact of a
fault f on the node N in a fault mode i then has the form
Impi (f ) = K · F reqi (f ), where K is a constant equal to
Obs(f ) · Sev(f ).
While some environmental changes that affect fault
modes are discrete, such as in the pacemaker example above,
others, like the changes in cosmic radiation that an aircraft
experiences as it changes altitude, are continuous. In order
to limit the complexity of the analysis, we only consider scenarios with a few discrete fault modes.
INTERNATIONAL TEST CONFERENCE
4
(continuously
applies
vectors)
Block
Under
Test
(idle)
Comparator
Test
Pattern
Generator
Figure 1: Generic non-concurrent on-line BIST architecture
In general, whether a system is currently in fault mode 1
or 2 may or may not be known to the system. Also switches
between fault modes may or may not be announced to the
system. If the fault mode changes due to activation of a
different power saving mode, for example, then the system
will possess this information. This cannot be assumed if
the fault mode switch is triggered by a change in environmental noise. In some cases, information about the current
fault mode might be needed to ensure the system’s operation.
Hence, one of the goals in an on-line detection strategy for
transient faults is to determine the current fault mode with
high probability.
In both the pacemaker and the aircraft examples, the difference between fault modes is the intensity of the radiation
while the basic failure mechanism is the same. If the radiation is more intensive for mode 2 than for mode 1, then for
every fault f F req1 (f ) ≤ F req2 (f ) holds. However, the
proposed framework is capable of modeling environments
with fundamentally different SEU mechanisms described by
different fault modes. There may be a fault f1 that occurs
in fault mode 1 but cannot occur in fault mode 2, and a
fault f2 for which the opposite holds: F req1 (f1 ) > 0 =
F req2 (f1 ) = F req1 (f2 ) < F req2 (f2 ).
4
On-line Transient Fault Characterization
Figure 1 shows the generic non-concurrent on-line BIST architecture. The major difference to the “usual” off-line BIST
for permanent faults is that the test vectors are applied continuously and as long as the block under test is in the idle
mode. Our goal is to determine which vectors should be applied in order to optimize the detection of transient faults
(where “detection” will be formalized below. Note, however,
that detection of a transient fault in an idle block serves the
characterization of the device and its environment and does
not expose a functional error). The following example points
out the difference from off-line BIST.
Assume that a block has two transient faults: f1 and f2 .
Suppose that test vector t1 detects f1 , vector t2 detects f2 and
no vector detects both faults simultaneously. Let the overall occurrence probability (F req · Obs) of f1 and f2 be 5%
and 1%, respectively, and let the severity of each fault be 1
(for simplicity). Suppose that we are interested in maximiz-
Paper 40.1
ing the overall detection probability, i.e. the probability that
a fault is detected when it occurs. If f1 and f2 were permanent faults, then applying t1 and t2 by an off-line BIST block
could prove the absence of both faults. In case of transient
faults, if t1 (t2 ) is applied in a clock cycle, there is a chance
that f2 (f1 ) will occur in just that cycle and will not be noticed. Consequently, the detection of 100% of the occurring
faults is impossible.
The result for permanent faults suggests applying t1 in
all odd and t2 in all even cycles (sequence t1 , t2 , t1 , t2 , . . .).
The average probability that a fault is detected by this sequence is (5% + 1%) / 2 = 3%. Now consider the sequence t1 , t1 , t2 , t1 , t1 , t2 , . . . Its average detection probability is (5% + 5% + 1%) / 3 = 3.7%. Since the occurrence
probability of f1 and f2 remained the same, the second sequence detects more faults on average. Finally, consider the
sequence t1 , t1 , t1 , t1 , . . . Its average detection probability is
5%. As a somewhat counterintuitive result, it is optimal not
to apply t2 at all.
The reason for this paradox is that the occurrence (and detection) of f1 in clock cycle 1 does not prevent it from showing up in later clock cycles. The benefit of applying t2 in a
clock cycle (detection of f2 ) is outweighed by the penalty of
not detecting the higher-impact fault f1 in this clock cycle.
In the following, we will formalize the concept of detection
and introduce additional constraints under which an optimal
solution may have multiple vectors.
4.1
On-line test architecture
We assume that the test pattern generator from Figure 1 has
a memory for storing the test set T whose members are continuously applied to the block under test. Each test tj ∈ T is
assigned a usage factor ufj , a real number between 0 and 1,
that indicates how often tj is applied compared to the other
tests. We require that uf1 + uf2 + · · · + uf|T | = 1. In
this paper, we concentrate on test selection for various fault
detection and diagnosis goals, which we consider next.
From the preceding discussion, we can identify the following optimization objectives:
Goal (1) Find the maximum expected value for the overall
detection probability.
Goal (2) For each fault mode i, guarantee some minimal detection probability M inDPi .
Goal (3) Deduce, with high probability, the current fault
mode from the test responses.
Recall that our main target is characterization of the soft
error intensity. This is achieved best if as many of the faults
that occur are detected. Goal (1) minimizes the probability
that a fault is not detected. Goal (2) helps avoid the situation in which a system becomes overly vulnerable in one
rare fault mode. For instance, the radiotherapy mode in the
pacemaker example has very low probability, so going solely
after Goal (1) neglects this mode, which could be fatal. Goals
(1) and (2) can be optimized simultaneously.
INTERNATIONAL TEST CONFERENCE
5
Goal (3) is concerned with diagnosing the current fault
mode. The rationale behind it is as follows: Suppose that
each fault mode has a “hardening” technique that makes the
system less vulnerable to high-impact faults in that mode,
and that this technique can be switched on and off. (An
instance of such a technique is the triple modular redundancy architecture). Furthermore, assume that switching
the hardening technique on incurs overhead such as performance degradation or greater power consumption. Hence, it
is desirable to activate the hardening only when it is really
needed, i.e. only when the system is in the corresponding
fault mode. Again considering the pacemaker example, the
hardening should be switched on automatically in radiotherapy mode. Keeping it on in normal operating mode might
reduce the battery life and become a risk factor on its own.
To control this situation, it is necessary to determine the current fault mode. Goal (3) is most relevant when the fault
mode changes are not communicated to the system control
by other means.
To satisfy Goal (3), test vectors with high test diversity,
i.e. large differences in detection probabilities across the
fault modes, should be applied. Goal (3) should be considered together with either of Goals (1) or (2), because such
tests are not guaranteed to be effective at detecting highimpact faults.
DP2
t3
t2
6
DP1 > 7
Optimum
DP2 > 3
3
t1
2
2
6
7
9
DP1
Figure 2: A graphical solution of Example 1
Now the ATPG problem can be formulated as a linear programming (LP) problem over variables uf1 , . . . , uf|T | :
Maximize
M Pi · DPi (U F )
(3)
i∈M
under the following constraints:
0 ≤ ufj
|T |
ufj
≤ 1,
=
∀1 ≤ j ≤ |T | (4)
1
(5)
j=1
4.2
ATPG for on-line testing
Let us first address Goals (1) and (2). For circuits with few
inputs, a candidate test set T might be all possible input vectors. For larger circuits, T might be a particular sample of
the tests, e.g., a set of n-detection stuck-at tests[25]. We require usage factors U F = {uf1 , uf2 , . . . , uf|T | } for T that
maximize Goal (1) without violating constraints arising from
Goal (2). Note that test tj should not be selected iff ufj = 0.
Let the set of fault modes under consideration be M . If
Det(t) ⊆ F is the set of faults detected by t, the utility of t
in fault mode i is defined by
U tili (tj ) =
1
|F |
Impi (f )
(2)
f ∈Det(tj )
where |F | is the number of faults. Given U F , the fault detection
probability in fault mode i is defined as DPi (U F ) =
tj ∈T U tili (tj ) · ufj . Let the probability that the system
is in fault mode i, i.e., the mode detection probability, be
denoted by M Pi . Goal
(1) is then equivalent to maximizing
the objective function i∈M M Pi ·DPi (U F ). Note that this
function is related to the fault coverage for permanent faults,
however we are not using the term “coverage” to avoid confusion.
Goal (2) imposes for each fault mode i a guaranteed minimum detection probability M inDPi . This can be written
as DPi (U F ) ≥ M inDPi . If no such bound is desired for
some fault mode , M inDPi can simply be set to 0.
Paper 40.1
DPi
DPi
|T |
=
j=1
U tili (tj ) · ufj , ∀1 ≤ i ≤ |M | (6)
≥ M inDPi ,
∀1 ≤ i ≤ |M | (7)
This problem can be solved using any LP solver. Note that
no integer constraints occur.
In order to incorporate Goal (3) into the problem formulation, a concept of “diversity” among tests is required. If
a fault is detected by test tj , the probability that the system
is in fault mode i is given as U tili (tj )/(U til1 (tj ) + · · · +
U til|M | (tj )). Intuitively, test diversity is minimal when this
probability is 1/|M | for every i. Like the definition of the
standard deviation σ 2 , we define the test diversity of a test tj
as
T div(tj ) =
|M | i=1
2
U tili (tj )
1
−
(8)
U til1 (tj )+· · ·+U tilM (tj ) |M |
It is possible to add constraints of the kind
uf1 · T div(t1 ) + · · · + uf|T | · T div(t|T | ) ≥ M inT div
to the LP problem to ensure some minimal level of diversity. Test diversity can also be integrated into the objective
function (3).
Theorem The LP problem with Goals (1) and (2) always
has an optimal solution in which the number of selected tests
is less than or equal to the number of fault modes |M |.
2
(The proof can be found in the Appendix).
INTERNATIONAL TEST CONFERENCE
6
Example Consider two equiprobable fault modes 1 and
2, and three tests t1 , t2 and t3 . Let their respective utilities in these fault modes be U til1 (t1 ) = 9, U til2 (t1 ) =
2, U til1 (t2 ) = 6, U til2 (t2 ) = 6, U til1 (t3 ) = 2, and
U til2 (t3 ) = 8. Then the detection probabilities are DP1 =
9uf1 +6uf2 +2uf3 and DP2 = 2uf1 +6uf2 +8uf3 , and the
objective function is 5.5uf1 +6uf2 +5uf3 . Let the following
constraints hold: DP1 ≥ 7 and DP2 ≥ 3. A graphical solution of the corresponding LP problem is sketched in Fig. 2.
The set of detection probability vectors corresponding to test
stimuli combinations consistent with Eqs. (4 – 6) is the triangle t1 t2 t3 (which we call P ∈ R2 ), and the coordinate axes
correspond to detection probabilities. With no constraints,
the solution space is this triangle, and the optimal solution its
vertex t2 . Both constraints are given by hyperplanes (in this
case vertical and horizontal lines) that reduce the solution
space to the shaded region R. The optimal solution is among
the vertices of R. It can be seen that, although R has more
vertices than P, every vertex of R lies on a face of P (in
this case, either segment t1 t2 or segment t1 t3 ). The optimum
(≈ 5.8) is assumed for uf1 = 1/3, uf2 = 2/3, uf3 = 0. The
number of test vectors required for on-line detection (having non-zero ufi values), which is also the number of fault
modes.
The |T |-dimensional space spanned by the ufi ’s is
mapped to the |M |-dimensional space spanned by the DPi ’s.
The hyperplanes in R|T | corresponding to Goal (2) constraints remain hyperplanes in R|M | after the mapping. This
is not necessarily the case for Goal (3) constraints based on
T div. For the example, T div(t1 ) = 24.5, T div(t2 ) = 0
and T div(t3 ) = 18. If we add the Goal (3) constraint
24.5uf1 + 18uf3 ≥ 22 to the LP, the optimal solution requires all three stimuli (uf1 ≈ 0.81, uf2 ≈ 0.07, uf3 ≈
0.12, with objective function value ≈ 5.5).
2
Corollary For |M | = 1 or in the absence of constraints
Eq. (7), there is an optimal solution with only one test vector
2
for which ufj = 0.
5
Case Study: VDSM ICs
We now demonstrate the application of the generic framework to a particular technology, namely random combinational logic in VDSM ICs. Unlike memory [26], random
logic has received relatively little attention in this respect so
far [24, 27, 28]. Furthermore, the modeling problem is not as
straightforward, which helps to illustrate the possibilities of
our unified framework. Our goal is to create a hierarchy of
models with accuracy vs. complexity tradeoffs. The simplest
models use only information available at the gate level; more
complex models may require further data.
5.1
Frequency of occurrence
For a node N in the circuit that corresponds to an SEUinduced fault f , it is possible to compute the amount of
charge Qcrit (N ) needed to flip the node’s logic value.
F req(f ) is the probability that a particle exceeding this
Paper 40.1
charge threshold shows up on the node. We propose three
models in order of increasing complexity and accuracy.
Model 1: The probability of an SEU is given by the overall
occurrence probability BaseOcc of an ionizing particle and
the probability that the charge it deposits exceeds Qcrit (N ).
Since we are ultimately interested in relative numbers for the
nodes and BaseOcc is the same for all nodes, we can ignore
this constant. Qcrit is higher (and hence F req(f ) is lower)
for nodes driven strongly. This is the case for outputs of a
gate with large fanout. Hence, F req(f ) is set to 1 / (fanout
of the gate driving N ).
Model 2: Qcrit can be calculated more accurately using layout information from the cell library [24, 29]. Note that these
methods are still rough estimates as they use sea-level ambient neutron flux that cannot be determined accurately by
current techniques [15, 9].
Model 3: The most accurate Qcrit estimations are obtained
from 3-D and Monte-Carlo simulations that are computationally expensive and still do not describe all the involved
physical effects properly [20].
5.2
Probability of observation
Obs is the probability that an SET is propagated from the site
N of the strike to a (primary or secondary) output without
being masked. Shivakumar et al. [8] distinguish between logical masking (no sensitized path from N to an output exists),
electrical masking (a pulse was attenuated during propagation and did not arrive) and latching-window masking (the
pulse did arrive, but lasted for less than a clock cycle and did
not coincide with the strobing or latching time). As pointed
out in Section 2, most SETs have duration up to a gate delay.
Electrical masking occurs for narrower SETs, and if a pulse
gets attenuated, it disappears completely after a few gates,
although even SPICE models do not describe narrow pulse
propagation accurately. We suggest the following models:
Model 1: Assume pulse duration of one cycle and no attenuation. This model accounts for logical masking only. Obs
is equal to the detection probability of a stuck-at fault at N .
Model 2: Use the unit delay model, e.g. assume that all gates
in the circuit have a uniform delay 1/K, where K is the
length of the longest path. Assume that all pulses have the
duration of 1/K and do not attenuate. Obs is K times less
than in Model 1, except when there are sensitized paths of
different lengths from N to an output.
Model 3: Like Model 2, but assign the shorter paths from
N to an output a higher probability, in order to account for
narrower pulses that are attenuated but do not disappear completely. The extent of probability increase is unclear, as even
the SPICE models are not accurate.
Model 4: Using static timing analysis, set the initial pulse
duration to the delay of the gate that drives N . When propagating, keep the pulse duration constant for gates with a
smaller delay than the pulse duration, and reduce the pulse
duration for other gates.
Model 5: Perform a SPICE simulation, ideally using technology files based on measured data.
INTERNATIONAL TEST CONFERENCE
7
Circuit
OptObj
p = 5%
p = 10%
p = 15%
p = 20%
p = 25%
p = 30%
p = 31%
p = 32%
p = 33%
p = 34%
p = 35%
p = 36%
p = 37%
p = 38%
s298
0.183092
100.00 (1V)
99.97 (2V)
99.83 (2V)
99.69 (2V)
99.51 (3V)
99.23 (3V)
99.18 (3V)
99.12 (3V)
99.06 (3V)
99.01 (3V)
98.93 (4V)
95.53 (4V)
–
–
s344
s382
s526
s641
s820
s1196
s1423
0.264016
0.210181
0.155802
0.390284 0.0883724 0.0954154
0.173421
100.00 (1V) 100.00 (1V) 100.00 (1V) 100.00 (1V) 100.00 (1V) 100.00 (1V) 100.00 (1V)
100.00 (1V) 100.00 (1V) 100.00 (1V) 100.00 (1V) 99.96 (2V) 100.00 (1V) 100.00 (1V)
100.00 (1V) 100.00 (1V) 100.00 (1V) 100.00 (1V) 99.84 (2V) 100.00 (1V) 100.00 (1V)
100.00 (1V) 99.93 (2V) 99.95 (2V) 100.00 (1V) 99.72 (2V) 99.89 (2V) 99.83 (2V)
100.00 (1V) 99.85 (2V) 99.90 (2V) 100.00 (1V) 99.57 (3V) 99.76 (2V) 99.58 (2V)
100.00 (1V) 99.77 (2V) 99.84 (2V) 100.00 (1V) 99.39 (3V) 99.63 (2V) 99.32 (2V)
100.00 (1V) 99.75 (2V) 99.83 (2V) 96.88 (2V) 99.36 (3V) 99.61 (2V) 99.27 (2V)
100.00 (1V) 99.23 (3V) 95.18 (2V) 92.40 (2V) 99.32 (3V) 99.58 (2V) 99.22 (2V)
87.92 (2V) 97.36 (2V) 76.22 (2V) 87.05 (3V) 99.29 (3V) 99.11 (2V) 99.17 (2V)
– 95.24 (3V)
–
– 99.25 (3V) 98.39 (2V) 98.36 (2V)
– 86.94 (3V)
–
– 98.02 (2V) 97.57 (3V) 95.91 (2V)
– 71.67 (4V)
–
– 96.59 (2V) 96.17 (4V)
–
–
–
–
– 91.56 (3V) 87.85 (2V)
–
–
–
–
–
–
–
–
Table 2: Experimental results for various ISCAS-89 benchmark circuits
5.3
Severity
One obvious severity metric for a block is the portion of the
time it is in use. For example, if a 64-bit pipeline processes
32-bit data 70% of the time, soft errors that impact only the
upper 32 bits of the pipeline have a severity of 0.3 (or less)
[7]. Further instances of the same concept are floating-point
units or pipeline stages used only for some of the instructions. For gated clock designs, the severity of a node can
be calculated as the proportion of time the clock driving the
node is activated [7].
A different severity metric is derived from the concept of
error-tolerance [30], which assumes that some of the errors a
circuit produces are acceptable. One concrete manifestation
of error-tolerance is threshold testing [31], where faults affecting control lines are considered severe while faults with
impact solely on data buses are only regarded as severe if
they result in a change of signal values that exceeds some
given threshold.
While the two approaches above (utilization and threshold testing) have potential to be largely automated, a meaningful severity model should also incorporate some designer
knowledge about system behavior. For example, a cellphone
chip could have two data buses, one to control the display
and the other to transmit billing information. Obviously soft
errors affecting the second bus are very severe, even though
it is a data bus.
5.4
Fault modes
One obvious phenomenon that can be modeled using the
fault mode concept is a shift in environmental radiation level,
e.g., due to a change in altitude. Basically, the number
BaseOcc from the definition of F req(f ) in Section 5.1 becomes larger with increasing altitude, resulting in a uniform
increase in frequency of occurrence of all faults. In order to
Paper 40.1
keep the model simple, faults with very low impact not exceeding some threshold might not be considered at all; their
number can change as a result of an increase in BaseOcc.
VDSM circuits are subject to considerable process variations, which may change the susceptibility of a node to a
transient error. Moreover, active body biasing techniques
used for leakage current reduction in dynamic threshold
logic [32, 33, 34] can impose changes in SEU susceptibility of up to an order of magnitude. A transient fault detection strategy should be robust with respect to that changes.
In order to ensure this, several fault modes can be defined.
In the first mode, fault impact Imp1 can be calculated using models from Sections 5.1 – 5.3. For the other modes,
these calculated numbers can be changed randomly within
one order of magnitude, to account for the above-mentioned
variation mechanisms.
6
Experimental Results
To evaluate the impact concept, we calculated Imp(f )
for transient faults affecting the combinational parts of the
ISCAS-89 benchmark circuits. Our focus was on test generation in presence of various constraints and not on using
the most accurate models for individual components. Consequently we used the simplest discussed models (Model 1)
for both F req and Obs. Stuck-at fault collapsing was performed before running the experiment. Since no system information was available, we set the severity Sev to 1.0 for all
faults. We considered 1,000 randomly generated test vectors
and ten equiprobable fault modes. In the first fault mode, the
utility of a test vector was computed using the impact of the
faults it detects. For the other nine fault modes, utility values were obtained by randomly multiplying the utility for the
first mode by 0.25, 0.5, 2 or 4, in order to model sensitivity
to changes due to process variations.
INTERNATIONAL TEST CONFERENCE
8
p
5
10
15
20
25
30
31
32
33
34
35
36
37
T div = 0
100.00 (1V)
100.00 (1V)
100.00 (1V)
99.89 (2V)
99.76 (2V)
99.63 (2V)
99.61 (2V)
99.58 (2V)
99.11 (2V)
98.39 (2V)
97.57 (3V)
96.17 (4V)
87.85 (2V)
T div=0.05
92.38 (2V)
92.38 (2V)
92.38 (2V)
92.29 (3V)
92.12 (3V)
91.95 (3V)
91.91 (3V)
91.88 (3V)
91.84 (3V)
91.81 (3V)
91.77 (3V)
91.74 (3V)
87.85 (2V)
T div=0.10
72.67 (2V)
72.67 (2V)
72.67 (2V)
72.50 (3V)
72.33 (3V)
72.15 (3V)
72.12 (3V)
72.08 (3V)
72.05 (3V)
72.01 (3V)
71.98 (3V)
71.94 (3V)
67.06 (4V)
T div=0.15
52.97 (2V)
52.97 (2V)
52.88 (3V)
52.71 (3V)
52.53 (3V)
52.36 (3V)
52.32 (3V)
52.29 (3V)
52.25 (3V)
52.22 (3V)
52.18 (3V)
50.21 (6V)
–
T div=0.20
33.27 (2V)
33.26 (3V)
33.08 (3V)
32.40 (9V)
–
–
–
–
–
–
–
–
–
Table 3: Results for s1196 incorporating the test diversity
constraint
on-line. Such faults are of increasing concern as IC technology moves into the VDSM range and will remain relevant in
nanotechnology, suggesting the need for a generic modeling
approach. We have identified a number of useful fault parameters, including fault mode, frequency, observability and
severity, which collectively determine the impact of a transient fault. We have shown that, using these parameters, online architectures for transient fault detection and diagnosis
can be optimized to meet multiple objectives, such as ensuring minimum fault detection probabilities, and identifying
fault modes on the fly. Our experiments, though still preliminary, suggest that the proposed framework can provide
useful, quantitative insights into the complex design issues
and trade-offs associated with transient fault management at
low area, power and delay overhead.
Acknowledgment
We calculated the optimal value of the objective function
OptObj in the absence of constraints (Goal (1)). Recall that
this value is assumed for a test set consisting of one vector.
We added Goal (2) constraints by requiring that the detection
probability in each individual fault mode be at least p% of
OptObj, for different values of p.
The results are reported in Table 2. The benchmark circuits are listed in columns. The second row of the table reports the value of the objective function with no constraints.
Subsequent rows report the values of the objective function
when the detection probability in each fault mode is at least
p% · OptObj. The value is given as a percentage of OptObj,
i.e., 100% corresponds to OptObj. The number of required
test vectors is given in parentheses, thus (2V) means that
two vectors are required. “–” denotes infeasible problem formulations, meaning that it was not possible to achieve the
required detection probability in all fault modes simultaneously.
It can be seen that moderate constraints on individual detection probabilities do not have an overly negative impact
on the overall detection probability. When the constraints are
tightened beyond a certain limit, the overall detection probability drops very quickly, and the problem becomes infeasible. The number of required vectors turns out to be quite low
and, somewhat surprisingly, not monotonic in p.
We also performed an experiment incorporating both the
detection probability (Goal (2)) and the test diversity constraints (Goal (3)). Results for circuit s1196 with various
values of p and test diversity T div (Eq. (8)) from 0 to 0.2 are
reported in Table 3. It can be seen that diagnostic capability
does impact detection probability. Note the high number of
required test vectors for test diversity of 0.20 and p = 20%
and test diversity of 0.15 and p = 36%.
7
Conclusions
We have developed a very general framework for modeling
and analyzing transient (soft) faults and characterizing them
Paper 40.1
John Hayes contributed to this work while visiting the University of Freiburg under an award from the Alexander von
Humboldt Foundation. Sandip Kundu contributed while visiting the University of Freiburg as a guest professor.
8
References
[1] D.P. Siewiorek and R.S. Swarz. Reliable Computer Systems –
Design and Evaluation. Digital Press, 1992.
[2] R. Baumann. Tutorial: Ghosts in the machine: A tutorial on
single-event upsets in advanced commercial silicon technology. In Int’l Test Conf., 2004.
[3] E. Normand. Single-event effects in avionics. IEEE Trans. on
Nuclear Science, 43(2):461–474, 4 1996.
[4] E. Normand. Single event upset at ground level. IEEE Trans.
on Nuclear Science, 43(6):2742–2750, 12 1996.
[5] M.A. Shea, D.F. Smart, J.H. Allen, and D.C. Wilkinson.
Spacecraft problems in association with episodes of intense
solar activity and related terrestrial phenomena during march
1991. IEEE Trans. on Nuclear Sceince, 39(6):1754–1760,
1992.
[6] P.D. Bradley and E. Normand. Single event upsets in implantable cardioverter defibrillators. IEEE Trans. on Nuclear
Science, 45(6):2929–2940, 12 1998.
[7] H.T. Nguyen and Y. Yagil. A systematic approach to SER
estimation and solutions. In Int’l Reiliability Physics Symp.,
pages 60–70, 2003.
[8] P. Shivakumar, M. Kistler, W. Keckler, D. Burger, and
L. Alvisi. Modeling the effect of technology trends on the
soft error rate of combinational logic. In Int’l Conf. on Dependable Systems and Networks, pages 389–398, 2002.
[9] N. Seifert, X. Zhu, and L.W. Massengill. Impact of scaling on
soft-error rates in commercial microprocessors. IEEE Trans.
on Nuclear Science, 49(6):3100–3106, 2002.
[10] P.E. Dodd and F.W. Sexton.
Critical charge concepts
for CMOS SRAMs. IEEE Trans. on Nuclear Sceince,
42(6):1764–1770, 1995.
[11] M. Pignol. How to cope with SEU/SET at system level? In
Int’l On-Line Testing Symp., pages 315–318, 2005.
INTERNATIONAL TEST CONFERENCE
9
[12] K. Driscoll, B. Hall, H. Sivencrona, and P. Zumsteg. Byzantine fault tolerance, from theory to reality. In SAFECOMP
Conf., volume 2788 of LNCS, pages 235–248. Springer, 2003.
[13] P.P. Gelsinger. Gigascale integration for teraops performancechallenges, opportunities, and new frontiers. In Design Automation Conf., page xxv, 2004.
[14] M.A. Nielsen and I.L. Chuang. Quantum Computation and
Quantum Information. Cambridge Univ. Press, 2000.
[15] H. Kobayashi, H. Usuki, K. Shiraishi, H. Hiroo Tsuchiya,
N. Kawamoto, G. Merchant, and J. Kase. Comparison between neutron-induced system-SER and accelerated-SER in
SRAMs. In Int’l Reliability Physics Symp., pages 288–293,
2004.
[16] International Technology Roadmap for Semiconductors
(ITRS) 2003 Edition: Process Integration, Devices, and Structures, 2003.
[17] R. Blish, T. Dellin, S. Huther, M. Johnson, J. Maiz, B. Likins,
N. Lycoudes, J. McPherson, Y. Peng, C. Peridier, A. Preussger, G. Propkop, and L. Tullos. Critical Reliability Challenges
for the International Technology Roadmap for Semiconductors (ITRS), 2003.
[18] R.C. Baumann and E.B. Smith. Neutron-induced boron fission as a major source of soft errors in deep submicron SRAM
devices. In Int’l Reliability Physics Symp., pages 152–157,
2000.
[19] C. Tirumurti, S. Kundu, S. Sur-Kolay, and Y.S. Chang. A
modeling approach for addressing power supply switching
noise related failures of integrated circuits. In Design, Automation and Test in Europe, 2004.
[20] P.E. Dodd and L.W. Massengill. Basic mechanisms and modeling of single-event upset in digital microelectronics. IEEE
Trans. on Nuclear Science, 50(3):583–602, 2003.
[21] M.G. Pecht, R. Radojic, and G. Rao. Managing Silicon Chip
Reliability. CRC Press, 1998.
[22] M.P. Baze and S.P. Buchner. Attenuation of single event induced pulses in CMOS combinational logic. IEEE Trans. on
Nuclear Sceince, 44(6):2217–2223, 1997.
[23] M.J. Gadlage, R.D. Schrimpf, P.H. Eaton, J.M. Benedetto,
and T.L. Turflinger. Modeling and verification of single event
transients in deep submicron technologies. In Int’l Reiliability
Physics Symp., pages 673–674, 2004.
[24] K. Mohanram and N.A. Touba. Cost-effective approach for
reducing soft error failure rate in logic circuits. In Int’l Test
Conf., pages 893–901, 2003.
[25] S.C. Ma, P. Franco, and E.J. McCluskey. An experimental
chip to evaluate test techniques experimental results. In Int’l
Test Conf., pages 663–672, 1995.
[26] T.C. May and M.H. Woods. Alpha-particle-induced soft errors in dynamic memories. IEEE Trans. on Electron Devices,
26(1):2–9, 1 1979.
[27] N.J. Wang, J. Quek, T.M. Rafacz, and S.J. Patel. Characterizing the effects of transient faults on a high-performance
processor pipeline. In Int’l Conf. on Dependable Systems and
Networks, 2004.
[28] E. Dupont, M. Nicolaidis, and P. Rohr. Embedded robustness
IP for transient-error-free ICs. IEEE Design & Test of Comp.,
19(3):56–70, 5 2002.
[29] Y.S. Dhillon, A.U. Diril, A. Chatterjee, and A.D. Singh. Sizing CMOS circuits for increased transient error tolerance. In
Paper 40.1
IEEE Int’l Online Testing Symposium, pages 11–16, 2004.
[30] M. Breuer. Error-tolerance and related test issues. In Asian
Test Symp., page xxi, 2004.
[31] Z. Jiang and S.K. Gupta. An ATPG for threshold testing:
Obtaining acceptable yield in future processes. In Int’l Test
Conf., pages 824–833, 2002.
[32] F. Assaderaghi, D. Sinitsky, S. Parke, J. Bokor, P. K. Ko, and
C. Hu. A dynamic threshold voltage MOSFET (DTMOS) for
ultra-low voltage operation. In Int’l Electron Devices Meeting, pages 809–812, 1994.
[33] H. Kotaki, S. Kakimoto, M. Nakano, T. Matsuoka, K. Adachi,
K. Sugimoto, T. Fukushima, and Y. Sato. Novel bulk dynamic
threshold voltage MOSFET (B-DTMOS) with advanced isolation (STIOS) and gate to shallow-well contact (SSS-C) processes for ultra low power dual gate CMOS. In Int’l Electron
Devices Meeting, pages 459–462, 1996.
[34] N. Lindert, T. Sugii, S. Tang, and C. Hu. Dynamic threshold
pass-transistor logic for improved delay at lower power supply voltages. IEEE Jour. of Solid-State Circ., 34(1):85–89, 1
1999.
Appendix: Proof of Theorem 1
Let us first abstract from the constraints in Eq. (7).
For
−−−−−→
every test stimulus tj , consider the vector U til(tj ) :=
(U til1 (tj ), . . . , U tilM (tj )) ∈ RM . If stimulus tj is assigned
frequency f aj , then the vector of detection probabilities in M
−−−−−→
fault modes is given as (DP1 , DP2 , . . . DPM ) = f a1 U til(t1 ) +
−−−−−→
· · · + f aN U til(tN ). The set of detection probability vectors corresponding to test stimuli combinations consistent with Eqs. (4 –
6) is a polytope P ∈ RM spanned by N M -dimensional vectors
−−−−−→
−−−−−→
U til(t1 ), . . . U til(tN ). The objective function is also defined on
that polytope. The maximal value must be assumed on a vertex of
the polytope P.
However, parts of the polytope P are not consistent with Goal
(2)-constraints from Eq. (7). Accounting for these constraints
corresponds to cutting away parts of the polytope, or more exactly,
intersecting it several times with a half-space (the number of
needed intersections corresponds to the number of constraints).
This results in a new polytope R, which is the actual definition
range of the objective function. Suppose that R is not empty (otherwise the constraints are too tight and there is no solution). The
maximal value of the objective function is assumed on a vertex of
R. Let this vertex be v. Since any vertex of R is either a vertex of
P or results from the intersection of P with a hyperplane, v is guaranteed to be on a face F of P. The facet F is (M − 1)-dimensional
and can be mapped onto a congruent polytope A(F ) ∈ RM −1 by
a linear bijection A. A(F ) ∈ RM −1 is a convex hull of N vectors
A(U til1 (t1 ), . . . U tilM (t1 )), . . . A(U til1 (tN ), . . . U tilM (tN )).
According to Carathéodory’s Fundamental Theorem, each
point in A(F ), including A(v), is in the convex combination of (M − 1) + 1 = M or fewer points of
A(U til1 (t1 ), . . . U tilM (t1 )), . . . A(U til1 (tN ), . . . U tilM (tN )).
Mapping M (or fewer) points such that A(v) is in their convex
combination, back to RM (using A−1 ) yields ≤ M vectors. They
correspond to ≤ M test stimuli with non-zero values of f aj . The
other values of f aj are obtained from the coefficients of the convex
combination of A(v).
2
INTERNATIONAL TEST CONFERENCE
10