Known-Good-Die and the Trust Problem in Multi-Die Assembly

A multi-die package is an assembly of parts that were each individually tested, and the yield of the assembly is not the product of the individual yields. The gap comes from three sources: the test each die received before assembly is not the test it would have received as a finished product, the assembly process itself can damage a good die, and the interaction between dies — thermal, mechanical, electrical — can create failures that neither die exhibits alone. The known-good-die concept exists to close the first gap, and the other two are why it does not close the whole thing.

Why probe-passing is not known-good

The phrase known-good die implies a guarantee. In practice the most that can be established before assembly is a die that passed a defined set of tests at a defined condition, and the value of that claim depends entirely on what the set was. A die that passed a wafer probe with structural vectors at wafer temperature is known to be free of the faults those vectors detect at that temperature. It is not known to be free of defects that only manifest at speed, at the package’s operating temperature, or under the burn-in stress that would have been applied to a packaged part.

The economics that make this matter are the assembly cost. In a single-die package, a die that fails final test costs the package and the assembly labour, and the loss is bounded by a small multiple of the die cost. In a module containing several dies that are permanently joined — through a silicon interposer, through direct bonding, or through a stacked connection — a single bad die destroys the whole module, and the loss is the sum of all the dies plus the assembly. The acceptable outgoing defect rate for each die therefore falls roughly in proportion to the module’s value, which for a large module can be an order of magnitude stricter than a single-die product would need.

What the die-level test must cover

Closing the gap requires moving tests that would have happened after packaging onto the die before assembly. Timing tests are the first: a die must be tested at its operating frequency, which requires either an on-die clock generation path or a tester capable of delivering the rate. An at-speed self-test engine can launch and capture at the die’s own clock, which makes the at-speed test independent of the probe card’s bandwidth, and the result is read out through a slow interface.

The second is temperature. A die tested at wafer probe has been at the chuck’s temperature and has not seen the thermal cycle of the assembly process, which for a solder reflow reaches well above two hundred degrees. A die with a marginal structure may survive probe and fail at reflow. Testing after a thermal excursion equivalent to the assembly is what converts a probe-passing die into a die that has at least seen the same thermal history.

The third is the interface the die will use in the module. A die whose only external connection in the module is a high-bandwidth die-to-die link must have that link tested before assembly, which in a single-die product would not be necessary because the link would be tested through the package pins after assembly. Loopback through the die’s own transceivers is the usual mechanism, with a test mode that connects the transmit path to the receive path internally.

The fourth is a stress screen. The latent-defect population that burn-in removes from a packaged part is not removed from a die that was never burned in, and in a module it cannot be removed after assembly without stressing every other die in the module. The usual choice is to apply the burn-in at wafer level, with the wafer held at temperature and the dies exercised through a test interface. That is the mechanism that burn-in cost makes expensive, and it is why the decision to eliminate burn-in is not available to a module product in the way it is to a single-die one.

Coverage of this kind is itself a die-area trade: the more that must be tested before assembly, the more of the die the test structure consumes. Each die in the module needs a test access mechanism, and the mechanism must reach every functional block that needs testing. The choice of access architecture therefore becomes a design decision with a yield consequence, not a test afterthought.

Test access across a stack

A die that will be stacked on another needs a way for the tester to reach it after the die above it is in place, because the pads of the lower die are covered. Two mechanisms exist. The first is through-silicon vias that carry test signals from the bottom of the stack to each die, with a daisy-chain structure that the tester can walk. The second is a boundary register around each die’s functional I/O, which lets a die’s ports be controlled and observed from a serial path that runs through the whole stack.

The serial path is the subject of a dedicated standard for three-dimensional stacked circuits, which defines a die wrapper register, a serial control path that can be configured to reach one die or all dies, and a set of instructions for testing an individual die in isolation, for testing the interconnect between two adjacent dies, and for testing the whole stack as a unit. The architecture’s purpose is to make the three test problems separable: a failure in the interconnect between die one and die two should be reportable as such, not as a failure of the stack.

The interconnect test is the part that has no single-die analogue. Two dies joined by thousands of short vertical connections need each connection verified as neither open nor shorted to its neighbour. The boundary registers on both sides drive a pattern into the connection and capture it on the other side, and the pattern is chosen so that an open connection reads a defined value and a short between two connections produces a detectable difference. The pattern’s quality is measured in the same way as a stuck-at test set, with the difference that the fault is in the connection rather than in either die’s logic. Inside a die, the same idea appears as memory redundancy and repair: a fault is not eliminated, it is routed around.

What this architecture cannot do is test the dies before assembly at the same level of coverage as after, because the through-silicon vias and the boundary registers only exist in their final form once the stack is built. The dies must be tested individually with a probe card that contacts the pads that will later be covered, which is a probe card design problem: the pads are at the die’s final pitch and position, and the card must contact them without damaging the surface that will later be bonded.

The trust boundary between vendors

A module assembled from dies made by different vendors places the assembly house in the position of relying on each vendor’s statement of die quality. The statement is not verifiable from outside, because verifying it would mean repeating the vendor’s tests, and repeating them requires the test patterns and the test access that the vendor does not necessarily disclose. The result is a trust boundary, and the industry’s response is contractual and structural rather than technical: a vendor supplying a die for a module is asked to supply it with a specified test coverage, a specified outgoing quality level, and a specified set of test results per die, sometimes as a per-die data record.

The structural response is to place the testing burden on a mechanism the integrator controls. If each die has a self-test engine that the integrator can command through a standard interface, then the integrator can verify the die’s health at any point in the flow without knowing the vendor’s internal patterns. The engine’s existence and its coverage become part of the die’s specification, and the interface is standardised so that the integrator’s tester can talk to it. This is the same architecture as built-in self-test for memory, applied at the die level, and it has the same property: it moves the test from a specialised tester into the die, at an area cost, and it makes the test repeatable by whoever holds the part.

The weakness is that the self-test’s coverage is a claim by the vendor. A self-test that passes a die with a defect it does not model provides no assurance, and the integrator has no way to inspect the claim. The practical mitigation is to combine the vendor’s self-test with an independent test of the interface — the die-to-die links and the power delivery — which the integrator can measure directly, and to qualify the vendor’s process through a sample of dies that the integrator tests destructively or in a module.

Where the economics stop working

The case for chiplets rests on the yield argument: a large die has poor yield because its area is large, while several small dies have better individual yields, and the product of those yields can exceed the yield of the large die. The argument holds only when the assembly and test costs are small compared with the yield gain. Those costs rise with every die added: each die needs its own probe, its own burn-in, its own place in the assembly sequence, and its own risk of being the one that destroys the module.

The crossover is a calculation, not a principle. The yield gain from splitting a die of area A into n dies of area A/n grows with the defect density and with A, because the yield function is exponential in area. The added cost per die grows with the number of dies, the number of assembly steps, and the test coverage each die requires. Where those two curves cross depends on the process’s defect density, on the module’s value, and on how much of the test can be moved on-die cheaply. A mature process with low defect density makes the yield argument weak; a large die in an immature process makes it strong; and in both cases the test access architecture is what determines whether the assembly can be economically verified at all.

The other constraint is that dies in a module are not independent in failure. A module whose thermal design concentrates heat in one die stresses its neighbours, so the module’s reliability is not the minimum of its dies’ reliabilities but a function of the whole assembly’s thermal and mechanical behaviour, which is the same power-density argument that decides a single-die package choice extended over a larger area. The qualification for a module therefore has to be done on the module, not on the dies, which means the qualification cost does not split with the dies and is paid once per module design.