Verification & Timing Closure

Ground-up guide to CMOS circuit design — transistors, gates, delay, power, memory, datapath and test

Getting to a Chip That Actually Works

Designing a chip is only half the job. The other half is proving it is correct and that it meets timing and power before you commit to making it. Once a chip is built, you cannot patch it. A single missed bug or a single failing path can waste months and a fortune. So verification and sign-off are where careful engineers spend much of their effort. This chapter explains, in plain words, the two big checks: does the chip do the right thing (functional verification), and does it run fast and cool enough (timing and power sign-off). It also covers corners, modes, late fixes (ECO), and the final checklist.

Two Different Questions

There are two separate questions, and they need different tools. The first is function: given any input, does the design produce the right output? This is about logic and behaviour. The second is timing and power: does the design meet its speed target and stay within its power budget? This is about physics — delays, voltages, heat. A design can be perfectly correct in function yet fail timing. Or it can hit timing yet compute the wrong answer. Both checks must pass. They are run by different teams with different methods.

Functional Verification

Functional verification asks whether the logic is correct. The main method is simulation: feed the design test inputs and check the outputs against what is expected. Good verification uses many tests, including random and corner-case inputs, and measures coverage (how much of the design the tests actually exercised). A second method is formal checking. Instead of trying inputs one by one, it mathematically proves a property holds for all inputs. This catches bugs that random tests might miss. A common use is equivalence checking: prove that two versions of a design (say, before and after an automated change) behave identically.

Worked example — coverage gap

A test suite exercises 92% of the design's logic.

untested = 100% - 92% = 8%
on a 5-million-gate design: 0.08 × 5,000,000 = 400,000 gates untested

That 8% can hide real bugs. Coverage numbers turn a vague "we tested it" into a measurable target, and teams push coverage toward 100% on critical logic.

Timing Sign-Off

Timing sign-off proves the chip meets its speed target. The main tool is static timing analysis: it checks every path against setup (data must arrive before the capture edge) and hold (data must not arrive too soon) without needing test inputs. It walks the whole design fast and flags any path that fails. The output is slack: how much each path passes or fails by. Positive slack means it passes; negative means it fails. The job of timing closure is to drive all slack to zero or above, by resizing cells, restructuring logic, or adjusting the clock.

Worked example — slack

A path's data arrives 0.92 ns after the launch edge. The required time is 1.05 ns.

slack = required - arrival = 1.05 - 0.92 = +0.13 ns
positive → the path passes setup with 0.13 ns to spare

Corners and Modes

A chip must work not in one condition but in many. The silicon varies (some chips come out fast, some slow). The voltage and temperature vary in use. Each combination is a corner. Sign-off checks the design at every important corner, because a path that passes at one may fail at another. The chip also runs in different modes: full-speed mode, low-power mode, test mode. Each mode has its own clocks and constraints. So sign-off is done across many mode-and-corner combinations. This is called multi-mode multi-corner analysis, and it is a big part of why sign-off takes so long.

Worked example — corner count

A design has 3 process corners, 2 voltages, 2 temperatures, and 3 modes.

combinations = 3 × 2 × 2 × 3 = 36 scenarios

Thirty-six scenarios to sign off. Tools prune the ones that cannot be worst-case, but the grid explains why timing closure is heavy work.

Power Sign-Off

Power sign-off confirms the chip stays within its power and supply limits. It checks total power (dynamic plus leakage) against the budget. It also checks the power delivery network: that voltage drop across the chip (IR drop) stays small, so distant blocks still get enough voltage to run correctly. A block starved of voltage by IR drop runs slow and can fail timing even if the logic is fine. So power and timing sign-off are linked: a power problem can become a timing problem.

Late Fixes and the Final Checklist

Near the end, problems still turn up: a small timing fail, a minor bug. Rebuilding the whole chip for each is too costly. Instead, designers use an ECO (engineering change order): a small, targeted change that fixes the issue while disturbing as little as possible. The fix is verified to be equivalent to intent and re-checked for timing. Before tape-out (sending the design to be made), a sign-off checklist must all pass: functional coverage met, all timing corners clean, power within budget, IR drop acceptable, physical rules clean, and equivalence confirmed. Only when every item passes does the chip go to manufacture.

design compute the right output for any input? Second, timing and power: does it meet its speed target and stay within its power budget? A chip can be functionally correct yet fail timing, or hit timing yet compute wrongly, so both must pass.

checks outputs, measuring coverage of how much logic was exercised — flexible but limited to the inputs tried. Formal verification mathematically proves a property for all inputs, catching cases random tests miss; equivalence checking, a common formal use, proves two design versions behave identically.

check by — positive means it passes, negative means it fails. Timing closure is the work of driving all slack to zero or above, using cell resizing, logic restructuring, or clock adjustment.

vary, and a path passing at one corner may fail at another; the chip also runs in modes (normal, lowpower, test) with different constraints. So sign-off checks the full grid of mode-and-corner combinations, which is why it is so time-consuming.

network, including IR drop — the voltage lost across the chip. A block starved of voltage by IR drop runs slower and can fail timing even though its logic is correct, so a power problem can turn into a timing problem.

that corrects a bug or timing fail while disturbing as little of the design as possible, avoiding a full rebuild. The change is verified equivalent to intent and re-checked for timing before it is accepted.

Key Takeaways

• Verification answers two separate questions: is it functionally correct and does it meet timing/ power.
• Simulation + coverage test with inputs; formal proof + equivalence checking cover all cases exhaustively.
• Static timing reports slack; timing closure drives all slack non-negative.
• Sign-off spans a grid of modes and corners, and power sign-off (IR drop) can turn into a timing problem.
• Late issues use targeted ECOs; a full sign-off checklist must pass before tape-out.