Types of ECO and When to Use Each

ECO types, unconstrained and metal-only flows, signoff-driven ECO, spare cells, timing fixes and verification

Types of ECO and When to Use Each

An Engineering Change Order is rarely a single, monolithic activity. The word "ECO" hides a whole family of operations whose cost, risk, and turnaround time differ by orders of magnitude. A timing fix that flips a single buffer in a sea of spare cells is a different universe from a functional rework that respins base layers across a multi-million-instance block. If you treat them as interchangeable, you will either over-engineer a trivial fix or under-scope a dangerous one — and in an interview, you will sound like someone who has only read about ECOs rather than executed them. The trick to mastering this topic is to stop thinking of ECO "types" as a flat list. Instead, classify every change along several independent axes. Any real ECO is a point in this multi-dimensional space: it has an intent, a layer freedom, a maturity context, and a driver. Once you can locate a change on each axis, the correct execution style follows almost mechanically. This chapter builds that taxonomy in plain terms and then gives you a decision framework and a cost/risk comparison you can recite under pressure.

Axis 1: Classification by Intent

The first question is always why the change exists. Intent does not by itself determine how you implement the change, but it shapes the netlist delta and tells you which sign-off views must reconverge afterward.

A subtle but interview-worthy point: these classes interact. A timing ECO that aggressively upsizes a driver can create a new SI aggressor; an SI fix that adds shielding can blow a density or routingcongestion check. Good ECO engineers always ask "what did my fix break?" — convergence is the recurring theme of this entire handbook. Functional changes are the riskiest because they alter behavior, so they demand logic equivalence checking against the updated reference. Timing, SI, and cleanup changes are behavior-preserving by construction, which is exactly why they can often be done with far more constrained, lower-risk techniques.

Axis 2: Classification by Layer Freedom

This axis is the one interviewers probe hardest, because it maps directly to manufacturing cost. The question is: which mask layers am I allowed to touch?

# Conceptual ECO that needs new placement — base layers move.
# This is an "all-layer" change: cell footprints change.
eco_add_cell    -ref BUFX4 -name eco_buf_17
eco_place_cell  -name eco_buf_17 -location {412.50 880.20}
eco_connect_net -net n_crit_42 -load eco_buf_17/A
eco_route_net   -net n_crit_42

All-layer ECO (base + metal). Here you are free to add new physical cells, re-place, and reroute. Because new transistors land on the substrate, the diffusion/poly/contact layers change, which means every mask in the stack can change. This is the most powerful style — it can fix essentially anything — but it is also the most expensive at the mask shop and the most disruptive to a converged floorplan. You reserve it for changes that genuinely cannot be absorbed by existing silicon. Metal-only constrained ECO (spare-cell remapping). This is the workhorse of late-stage and posttapeout fixes. The base layers are frozen. You may not add transistors. Instead, you reuse cells that are already physically present — typically spare cells (pre-placed unused gates) or gate-array filler that can be personalized — and you implement the change purely by altering metal: rewiring connections and changing vias. Because only metal and via masks are re-spun, the cost is a fraction of a full re-spin.

# Metal-only style: bind a logical change onto an EXISTING spare cell,
# then only metal/via masks change.
eco_map_to_spare -instance need_inverter \
-spare_ref INVX2 -spare_inst spare_cell_block3_09
eco_change_layer_scope -mode metal_only
eco_reroute -nets [get_eco_nets] -allow_via_change true

Purely-wiring ECO. The most constrained variant of all: no cell changes at all, not even spare-cell remapping. You only reroute existing connections, adjust via stacks, add shielding tracks, or detour a net to dodge a coupling problem. This is common for SI and certain DRC fixes where the logic is already correct and you simply need the physical realization to behave. It is the cheapest and least risky style, but it can only solve a narrow set of problems.

The strategic implication: spare-cell planning is an investment made early to buy cheap fixes later. A team that scatters a healthy, diverse population of spare cells (different drive strengths,

inverters, buffers, simple logic) across the floorplan during initial implementation is buying itself the option to do metal-only ECOs after tapeout. A team that skimps on spare cells may be forced into a full base-layer re-spin to fix a one-gate bug — a brutally expensive lesson.

Axis 3: Classification by Design Maturity

The same logical change is "easy" or "terrifying" depending on when in the program it lands.

Pre-tapeout ECO (flexible regime). Before the design is committed to masks, you have enormous freedom. You can re-place, reroute, even let the implementation tool re-optimize regions. The cost of a change is engineering time and the risk of disturbing convergence — not money at the mask shop. The discipline here is to apply changes incrementally so you do not lose the timing and DRC closure you already achieved. Even though you could re-run the whole flow, mature teams still prefer localized, surgical edits to protect a clean database. Post-tapeout / silicon-respin ECO (constrained regime). Once masks exist (or worse, once silicon is back from the fab and a bug is found in the lab), the rules harden dramatically. The base layers are frozen, so you are pushed toward metal-only or purely-wiring styles. Every change is scrutinized because re-spinning even a few metal masks costs real money and weeks of schedule, and because you cannot afford to introduce a new problem that forces yet another spin. This regime is where sparecell discipline and metal-only mastery pay off.

convergence risk

Post-tapeout (pre- Low (base frozen) Metal mask cost, schedule Metal-only, spare remap

Axis 4: Classification by Driver

Finally, how was the change derived? This axis separates the systematic from the ad hoc.

Sign-off-driven ECO. The change list comes from the final, golden static timing analysis (or noise analysis, or physical verification). The flow reads the violating endpoints, computes a precise set of fixes — resize this, buffer that, add this diode — and emits a change script that the implementation database consumes. Because the fixes are computed against the same engine that signs off the chip, they are self-consistent: you are fixing exactly what the sign-off tool will check. This is the preferred, lowest-surprise path and dominates the timing/SI/cleanup intents. Manual / late-spec ECO. The change originates from a human decision: a marketing-driven spec change, a last-minute test fix, a bug found by a verification engineer. These changes are described in logical terms ("make this register reset to 1," "add a bypass mux") and must be translated into a physical realization by the ECO engineer. They carry more risk because they are not derived from a sign-off measurement — you must independently prove they neither break function (equivalence check) nor timing. Functional ECOs are almost always manual/late-spec in origin.

A Decision Framework

Put the axes together and a clean decision procedure emerges. Given a violation and a maturity, choose the ECO style as follows:

1. 1. Identify intent. Is the behavior changing (functional) or being preserved (timing/SI/cleanup)?

Behavior-preserving fixes unlock the cheap, constrained styles.

1. 2. Check maturity. Are base layers still open (pre-tapeout) or frozen (post-tapeout/silicon)? Frozen

base forces metal-only or purely-wiring.

1. 3. Inventory your freedom. If base is frozen, do you have suitable spare cells nearby? If yes, metal-

only spare remap. If the fix needs only rerouting, prefer purely-wiring.

1. 4. Pick the smallest sufficient hammer. Always choose the most constrained style that can actually

solve the problem. Reaching for all-layer when a wiring change suffices needlessly risks convergence.

1. 5. Confirm the driver. If the change is sign-off-driven, let the tool emit the script and re-verify against

the same engine. If it is manual, add an equivalence-check gate before sign-off.

A worked example you can narrate in an interview: "We found a hold violation in the lab on returned silicon. Intent is timing — behavior-preserving. Maturity is post-silicon, so base is frozen. I have spare delay cells near the path, so I do a metal-only spare-remap ECO, inserting delay using existing cells, re-spinning only the affected metal/via masks. I re-run sign-off STA to confirm closure and check I created no new setup or SI issue on neighbors." That single answer touches all four axes and the framework — it is exactly what a strong candidate produces.

Cost and Risk Comparison Across Styles

The whole reason this taxonomy matters is economics. Here is the comparison engineers carry in their heads.

metal)

Three trade-offs deserve explicit mention because interviewers love them:

• Mask cost vs. fix power. Base-layer freedom buys the ability to fix anything but costs the most. Each step down the constraint ladder trades capability for cheapness and safety.
• Schedule vs. correctness. The cheapest fix is worthless if it does not actually close. Choosing a too-constrained style and iterating three times costs more schedule than picking the right style once. "Smallest sufficient hammer" means sufficient, not merely smallest.

• Disturbance risk. Every ECO threatens the convergence you already paid for. A large all-layer change can perturb placement and routing far beyond the intended region, spawning new violations. Constrained styles are prized precisely because their blast radius is small and predictable.

Interview Q&A

spins only the metal and via masks, leaving the expensive base layers (diffusion, poly, contact) untouched, so mask costs and turnaround shrink dramatically. It is possible only because the logic change is mapped onto cells that physically already exist — spare cells or personalizable gate-array filler — so no new transistors are needed; you change only how those existing cells are wired.

functional (behavior must change), which forces a logic equivalence check. Then check maturity: base is frozen, so I want metal-only if at all possible. I look for spare cells that can realize the needed logic; if the change can be built from spare-cell inventory plus rewiring, I do a metal-only ECO and re-spin only metal/via. If the logic cannot be realized from existing cells, I am forced into an all-layer re-spin — the expensive fallback. Either way I run equivalence and full timing sign-off afterward.

about ECO classification? That intent classes are not isolated — a timing fix created a signalintegrity problem because the stronger driver became an aggressor. It illustrates that every ECO must be re-verified across all relevant sign-off views, not just the one that motivated it. The fix is to address the new SI issue (shielding, spacing, or victim upsizing), ideally with a low-risk purely-wiring or constrained change, and re-check both timing and noise.

distribution is an option purchased early that pays off as cheap, low-risk metal-only fixes later. A diverse, well-spread spare population means most post-tapeout functional and timing fixes can avoid a base-layer re-spin entirely. Skimping on spares can force an expensive full re-spin to fix even a singlegate bug, so early planning directly de-risks the back end of the program.

Key Takeaways

• Do not treat "ECO" as one thing. Classify every change along four independent axes: intent (functional / timing / SI / cleanup), layer freedom (all-layer / metal-only / purely-wiring), maturity (pre-tapeout / post-tapeout / post-silicon), and driver (sign-off-driven / manual late-spec).
• Layer freedom maps to money. All-layer re-spins the full mask stack and fixes anything; metal- only re-spins only metal/via by reusing existing spare cells; purely-wiring touches the fewest masks and only solves routing/SI/antenna-class problems.
• Maturity narrows your options. Once base layers are frozen, you are pushed toward metal-only and purely-wiring styles — which is why spare-cell planning done early buys cheap fixes later.

• Use the decision framework: identify intent, check maturity, inventory spare-cell freedom, pick the smallest sufficient style, and confirm whether the change is sign-off-driven or manual (the latter needs an equivalence-check gate).
• Every ECO threatens existing convergence. The art is choosing the lowest-cost, lowest-blast-radius style that genuinely closes the problem — and always re-verifying across all relevant sign-off views, because one fix can spawn the next violation.