JOVANA
Library Glossary Getting Started Three Levels Fields How it works Mission
Join the mission
All guides

Scan Chains: Turning Flip-Flops Into Test Access Points

A modern chip can hold a million flip-flops buried dozens of logic stages deep, where no tester pin can reach them. Scan is the trick that turns every one of those hidden memory bits into a doorway: swap each flip-flop for a scan version, string them together into one giant shift register, and suddenly you can load any state you like and read back exactly what the logic computed. In eleven minutes you'll see how this one idea collapses an impossible sequential test problem into a tidy combinational one — and why almost every digital chip shipped today is built around it.

The buried-memory problem scan was invented to solve

Imagine a vast warehouse with a million light switches, but the only switches you can physically touch are the few hundred near the front door. Every other switch is wired so that its state depends on the ones before it, which depend on the ones before *them*, going back hours of accumulated history. Now I ask you: prove that switch number 814,562 still works. From the door, the only way is to flip the front switches in exactly the right sequence, wait for the effect to ripple all the way back, then somehow read a result that has to ripple all the way forward again. That is the daily reality of testing a chip's internal flip-flops.

The previous rung gave this difficulty a name: the bits deep inside a sequential circuit have terrible controllability and observability. To force a flip-flop into a chosen value you might need a precise sequence of dozens or hundreds of clock cycles, and to *see* what it captured you need an equally long sequence to march the value back out to a pin. Multiply that by a million flip-flops and the number of test cycles explodes past anything a test program could ever run. The hard part is not the logic in between — it is simply that you cannot get *at* the state.

The scan flip-flop: one extra mux, everything changes

The magic is almost embarrassingly small. A scan flip-flop is an ordinary flip-flop with a two-input multiplexer bolted onto its data input. One mux input is the functional data D — the value the circuit normally wants to store. The other is a scan-in (SI) input, fed from the *previous* scan flip-flop in the chain. A single global control wire, scan-enable (SE), picks which one wins. When SE is low the cell behaves exactly like the flip-flop the designer drew. When SE is high, the cell ignores its functional logic and listens only to its neighbour.

        functional data        scan-in (from prev FF)
              |                       |
              v                       v
            +---+   +-------------------+
         D--| 0 |   |                   |
            |mux|---| D'      FF      Q  |----> Q (to logic AND
        SI--| 1 |   |   (rising edge)   |       to next FF's SI)
            +---+   +---------^---------+
              ^               |
              |              CLK
            scan-enable (SE)

   SE = 0  ->  D' = D      (FUNCTIONAL / CAPTURE mode)
   SE = 1  ->  D' = SI     (SHIFT mode: the chain acts as a shift register)
A scan flip-flop = a normal flip-flop + a 2:1 mux on its data input. Scan-enable steers between functional data and the chain.

Now wire the Q output of each scan flip-flop to the SI input of the next, like beads on a string. With SE held high, every cell is taking its data from the one upstream, so the entire collection behaves as one long shift register: pulse the clock once and the whole pattern slides over by exactly one bit. The first cell's SI comes from a dedicated chip pin called scan-in; the last cell's Q goes out to a pin called scan-out. That string of stitched-together flip-flops is the scan chain.

The shift–capture–shift dance

With the chain in place, the tester runs one pattern as a three-beat dance. Beat one — shift in: raise scan-enable and clock the chain N times, where N is its length. Bit by bit you push a chosen pattern in through scan-in until every flip-flop holds exactly the value you want. You have just *placed the circuit into any state in a single, mechanical operation* — no clever sequence-finding required. Beat two — capture: drop scan-enable for exactly one clock pulse. Now every flip-flop is in functional mode, so each one samples whatever its real combinational logic computed from the state you loaded plus the values on the input pins. The circuit's response is now frozen inside the flip-flops. Beat three — shift out: raise scan-enable again and clock N more times to march that captured response out of scan-out, where the tester compares it bit-for-bit against the expected good-machine answer.

 SE  ___________                       ___________________________
    |           |                     |
  __|           |_____________________|
     <-- shift-in N --><-- capture --><-- shift-out N -->

 CLK  _ _ _ _ _ _ _      _              _ _ _ _ _ _ _
     | | | | | | | |    | |            | | | | | | | |
  ___| |_| |_| |_| |____| |____________| |_| |_| |_| |___
      load pattern    ONE pulse        unload response
                      (SE=0): FFs grab     (and load the
                       real logic output)   NEXT pattern in
                                            the SAME shifts!)
Shift–capture–shift. Loading the next pattern overlaps with unloading the current response, so the two N-cycle shifts cost only one set of clocks.

There is a beautiful efficiency hiding in beat three: while you shift the *current* response out, you are simultaneously shifting the *next* pattern in. The two N-cycle journeys share the same clocks. So the cost of a test pattern is roughly N shift cycles plus one capture cycle, and a full test of the chip is just a long stream of these — load, snap, unload, repeat — generated automatically and replayed on the tester at speed.

Why this collapses sequential test into combinational test

Here is the deepest payoff, and it is worth sitting with. A test generator's job is to find input patterns that expose manufacturing defects. For a sequential circuit this is brutally hard: the tool has to reason about *time*, searching for a sequence of inputs over many cycles that first drives the machine into a sensitising state and then propagates the fault's effect out — a search space that grows exponentially with cycle depth. It is one of the genuinely intractable problems in the field.

Scan makes the flip-flops vanish from that problem. Because you can directly *write* every flip-flop (via shift-in) and directly *read* every flip-flop (via shift-out), the generator no longer has to find a sequence to reach a state — it just asks for the state and the shift register delivers it. What remains between the flip-flops is pure combinational logic, with the scan flip-flop outputs now acting like extra controllable inputs and the scan flip-flop inputs like extra observable outputs. The tool only has to solve the static, time-free question 'what input vector exposes this stuck wire?' That combinational problem is what automatic test pattern generation actually attacks — and it is enormously more tractable.

Scan insertion: an EDA step late in the flow

Designers almost never draw scan flip-flops by hand. Scan is added by the tools, automatically, at a well-defined point in the flow — a step called scan insertion. The designer writes ordinary registers in their RTL and thinks purely about function; the test structure is grafted on afterwards so it never clutters the design intent.

  1. Synthesise as usual. Logic synthesis maps the RTL to standard cells, choosing ordinary flip-flops. Functionally the netlist is complete and correct.
  2. Swap to scan cells. The DFT tool replaces each eligible flip-flop with its scan-equivalent cell from the library — same function, plus the SI/SE mux. This is a one-for-one substitution that does not change what the circuit computes.
  3. Stitch the chain. The tool decides an ordering of the scan cells and connects each Q to the next SI, attaching the head to a scan-in pin and the tail to a scan-out pin. Often it reuses an existing functional pin as the scan-in/out port to avoid spending precious package pins.
  4. Check and re-time. The new mux and the chain wiring add delay, so the design is re-checked against timing; the chain itself only needs to meet timing in the slow shift mode, which is easy.
  5. Hand off to ATPG. With the structure in place and a model of the chain written out, the test-generation tool can produce the patterns — the subject of the next rung.

One chain of a million bits would take a million-plus clocks to load — far too slow. So the tool splits the flip-flops across many parallel chains, each fed by its own scan-in pin and read by its own scan-out pin. Twenty chains of 50,000 bits load in 50,000 clocks, not a million; a few hundred chains is common on a big design. Chain balancing is the housekeeping that keeps all of those chains close to the same length, because the tester clocks every chain together and the slowest (longest) chain sets the test time. Lopsided chains waste cycles waiting on the laggard.

What scan asks of you in return

Scan is not free, and a good designer knows its bill. The mux on every flip-flop adds a small delay to the functional path and a couple of percent of area. The scan-enable signal becomes one of the most fan-out-heavy nets on the chip — it touches every scan flip-flop — and must be routed and balanced like a second clock. And there are correctness rules the design has to obey for the chain to behave as a clean shift register: clocks must be controllable from pins during test, gated clocks need bypassing, and combinational feedback or uncontrolled latches can break the shift. Tools flag these as DFT rule violations, and fixing them is part of designing for test, not an afterthought.

Step back and the trade is plainly worth it. For a few percent of silicon and a disciplined set of design rules, you convert a chip whose internal state was effectively unreachable into one where every bit is a doorway you can write and read at will. That is why scan, born at IBM in the 1970s, is still the bedrock of digital test today — and why the next rung, automatic test pattern generation, has a tractable combinational circuit to work on at all.