Logic BIST (LBIST)

In short: Logic BIST lets a chip test its own random logic by generating pseudo-random stimulus on-chip with an LFSR, capturing responses into a MISR signature, and comparing that signature to a golden value — enabling at-speed, in-field self-test with almost no external tester support.

Why logic needs to test itself

Automatic test pattern generation (ATPG) with scan chains is the workhorse of digital test, but it has two structural problems. First, the patterns and expected responses must be stored on and streamed from an expensive automatic test equipment (ATE) — vector volume for a large SoC can run into gigabits, and ATE channel count and memory are finite. Second, once a chip is soldered onto a board and shipped, the ATE is gone. Safety-critical parts (automotive ISO 26262, aerospace, medical) must re-test themselves every power-on or periodically during operation, long after they leave the factory.

Logic BIST (LBIST) answers both. The test engine lives inside the die: a pattern generator fabricates stimulus, the design's own scan chains apply it, and a compactor crushes millions of response bits into one short signature. The ATE — or, in-field, a tiny controller — only has to start the engine and read one number back.

A pseudo-random LBIST session of 10,000 patterns on a block with 50 scan chains of 300 cells each applies ~150 million scan-cell loads yet needs the tester to compare only a single 32-bit MISR signature.

The LFSR: making randomness cheaply

A Linear Feedback Shift Register is a shift register whose input bit is a linear (XOR) function of selected taps. Seeded with any non-zero value, an n-bit maximal-length LFSR cycles through all 2ⁿ−1 non-zero states before repeating, producing a pseudo-random bit stream that is deterministic and perfectly repeatable — the crucial property for test, because the same seed always yields the same patterns.

The tap positions are described by a primitive polynomial over GF(2). For example the 16-bit polynomial x¹⁶ + x¹⁴ + x¹³ + x¹¹ + 1 gives a period of 65,535. In LBIST the LFSR feeds a phase shifter (an XOR network) that decorrelates its output across many scan-chain inputs, so adjacent chains do not receive shifted copies of the same sequence.

The MISR: crushing responses into a signature

You cannot ship 150 million response bits back to the tester, so LBIST compacts them. A Multiple-Input Signature Register (MISR) is an LFSR extended so that each flip-flop XORs in one scan-chain output every cycle. Over the whole session it performs polynomial division of the response stream, leaving a residue — the signature. A fault-free chip always lands on the same golden signature; any captured error perturbs the division and almost always yields a different residue.

The residual risk is aliasing: a faulty response that happens to divide to the golden signature. For an m-bit MISR the aliasing probability approaches 2^−m, so a 32-bit MISR aliases roughly once in 4.3 billion — negligible against practical defect rates. This is why MISR width, not just chain count, is a real design lever.

A STUMPS session, step by step

The dominant LBIST architecture is STUMPS (Self-Test Using MISR and Parallel Shift-register sequence generator). One session proceeds as:

• Seed & configure — load the LFSR seed and set the scan chains into shift mode.
• Load — shift pseudo-random bits from the LFSR, through the phase shifter, into every scan chain in parallel (length = longest chain).
• Capture — pulse one or more functional clocks so combinational logic produces responses that are latched into the scan cells.
• Unload / overlap — shift responses out into the MISR while simultaneously loading the next pattern.
• Compare — after N patterns, read the MISR and compare to the golden signature.

LBIST runs at the chip's functional clock, so it natively catches at-speed (transition / small-delay) defects that slow, low-cost ATE would miss — one reason automotive parts lean on it heavily.

The random-resistance problem and test points

Pseudo-random patterns are cheap but biased: some faults need a very specific value combination that random stimulus rarely hits (a 10-input AND gate needs all ones, probability 2⁻¹⁰). These random-pattern-resistant faults cap LBIST coverage around 80–90% unless you intervene. Standard remedies:

• Test points — insert control points (force a node toward a hard-to-reach value) and observe points (expose a buried node to a scan cell). A few thousand well-placed test points can lift coverage above 98%.
• Weighted / reseeding schemes — bias the bit stream or reload fresh seeds to reach stubborn faults.
• Hybrid flow — LBIST for in-field and most coverage, topped up with a small deterministic ATPG set (often compressed) for the remaining faults at wafer sort.

Two more constraints bite in practice. X-sources (uninitialized RAMs, non-scan flops, bus contention) corrupt the MISR, because an unknown bit propagates into the signature and makes it unpredictable — so LBIST designs need aggressive X-bounding or X-masking. And power: random patterns toggle far more nets than functional traffic, so shift and capture power must be throttled (low-toggle seeds, clock gating) to avoid IR-drop-induced false failures.

Tools and where it sits in the flow

Commercial LBIST is inserted by the same vendors you meet in scan/ATPG. Siemens EDA's Tessent LogicBIST and TestKompress, Synopsys' DFTMAX LogicBIST / SpyGlass DFT and Cadence's Modus all generate the LFSR, phase shifter, MISR, test-point logic and the golden signature as part of the DFT insertion step, then hand a BIST controller and an IEEE 1687 (IJTAG) or 1149.1 access wrapper to the integration team.

LBIST is a close cousin of memory self-test — see our deep dive on MBIST (memory BIST), which uses March algorithms instead of LFSRs — and it rides the same access fabric covered in scan chain design. For hands-on chip-level DFT insertion and sign-off services, our design partner Avecas VLSI design services implements these flows on production tapeouts.

Want to build and debug a full LBIST controller — LFSR polynomials, phase shifters, MISR signatures and test-point insertion — on a real RTL block? Our CourseTron DFT course walks you through it end to end on industry tools.

Frequently asked questions

Why use an LFSR instead of a true random generator?

Test must be repeatable and compact. An LFSR is a handful of flops and XORs, needs only a seed, and reproduces the exact same sequence every run — so the golden signature stays valid. A true random source would give a different, uncheckable signature each time.

What is MISR aliasing and should I worry about it?

Aliasing is when a faulty response compacts to the golden signature and the error is missed. The probability is about 2^−m for an m-bit MISR, so a 32-bit MISR hides a fault roughly once in 4.3 billion — far below real defect rates, so it is practically negligible.

Why does raw LBIST coverage stall below 90%?

Random-pattern-resistant faults need specific, unlikely value combinations that pseudo-random stimulus rarely produces. Inserting control and observe test points, reseeding, or adding a small deterministic ATPG top-up pushes coverage past 98%.

How does LBIST enable in-field test?

Because the generator, compactor and golden signature all live on-chip, a small controller can rerun the self-test at every power-on or periodically in mission mode with no external tester — exactly what ISO 26262 automotive and other safety standards require.