What is chip verification, and how do you know a design is right before tape-out?

Chip verification (also called design verification or functional verification) means checking, before a chip is made, that the design does what the spec says. Once the designers have written the circuit, verification engineers set it lots of test questions on a computer and check the answers; only when everything checks out does the design go to tape-out and on to the fab. It checks whether the design itself is right, not whether one particular chip came out well.

For the whole design process, see "How are chips designed?"; this article opens up the verification step.

Why verify before the chip is made?

Because once a chip is made, its circuit can't be changed. After the design goes out, a full set of photomasks has to be made first (What is a photomask?), then comes wafer start, and the wafers spend months going through the fab.

Find a design bug at that point, and you have to change the design, make new masks and start new wafers, losing money and months together (Why are chips so expensive?). And a design bug is the same in every single chip that comes out.

So everyone would rather spend more time hunting for bugs on a computer. The general view is that verification often takes a large share of design work.

How is it done? Step by step

Step 1: List what to test, from the spec

Verification engineers start by reading the spec and listing everything the chip should do: which functions it has, and how it should respond in each situation. The test questions have to come from the spec, not from the circuit the designers wrote: write questions from the circuit, and its mistakes get counted as right answers. Without this list, nobody can say whether verification is finished.

Step 2: Simulation: give it inputs, check the outputs

Simulation means letting a computer pretend to be the chip, working out beat by beat whether each wire is a 0 or a 1. Verification engineers build an "exam room" around it: they feed in inputs and compare the outputs with the expected answers, which often come from a simpler version written separately. A chip, in the end, is a huge number of logic gates deciding outputs from inputs (What are logic gates?); on a computer every wire is visible, so when something comes out wrong, it's quick to trace.

Apart from the questions people write, the computer also makes up lots of random ones within set rules, to hit combinations nobody thought of. Every time the design changes, all the old questions run again, to make sure the fix here didn't break something there. Skip this step, and bugs in the design only turn up when the chips come back from the fab, when fixing them means new masks.

Step 3: Coverage: which cases haven't been tested?

While the tests run, the computer records which parts of the circuit were exercised and which situations on the list came up. This is called coverage. Every answer being right doesn't mean the circuit is right; maybe the wrong part just hasn't been tested. Coverage shows which questions are missing, so they can be added. Hand the design over just because "everything passed", and the case nobody tested is often where trouble shows up later.

Step 4: Formal verification: prove with math that it always holds

However much you simulate, you can only try a limited number of questions. Take adding two 32-bit numbers (each written with 32 digits that are 0 or 1): there are 2 to the power of 64 possible inputs. Even at a billion tries a second, that would take more than five hundred years.

Formal verification sets no questions. It uses math to think through every possibility at once and prove that something always holds, for example "these two signals are never switched on together", or "the written behavior and the logic-gate circuit synthesized from it do exactly the same thing". Without it, rare combinations that simulation never reaches can stay hidden in the design. Its limit is that on a large circuit, there are too many possibilities to work through, so proofs like the first example are often used on smaller parts that matter most, alongside simulation.

Step 5: Run it faster on rewritable hardware

Software simulation works through it beat by beat, so a whole large chip runs very slowly. That's why the design is also loaded into a chip whose circuit can be rewritten (an FPGA), or into a large machine built to imitate chips, so that the circuit really runs, much faster. Fast enough to start running the software meant for this chip and see whether the two work together; otherwise software testing would have to wait until the chips come back, months later.

Step 6: Fast enough, enough power, can it be made?

Everything so far checks whether the chip does the right thing. Once the circuit is laid out as patterns, layer by layer (the layout), there are more checks: whether signals reach their next stop within each beat, at every corner, the fast and slow ways the fab's transistors can come out; whether the voltage drops too much on its way from outside to every part of the chip, and whether it uses too much power; and whether the patterns follow the fab's design rules. A circuit that's logically perfect still gets wrong answers if a signal is a little late or the voltage a little low; break a rule, and it can't be made. Most of these checks are done by design software (What is EDA?).

Step 7: Sign-off and tape-out

When every check has been confirmed, this stage is often called sign-off. Then the final design files go to the fab: that is tape-out (What is tape-out?). Any change after that means new masks, so there has to be a clear "this is where it stops".

Step 8: When the chips come back, test them for real

The first chips that come back are mounted on special boards, powered up and actually run: does each function work, is it stable at different voltages and temperatures, does it work with the software? This is called post-silicon validation. However careful the model on the computer is, it's still a model; some problems only show up when a real chip runs fast enough and long enough, and some were simply missed earlier. The hard part is that most of the wires inside a chip can't be seen, only the results outside, so finding the cause is much harder than on a computer. If a design bug turns up, the design is changed and taped out again.

How is verification different from a fab's metrology and chip testing?

All three check whether something is right, but they check different things:

	Chip verification	Metrology and inspection	Chip testing
What it checks	Whether the design is right	Whether key steps went right, such as film thickness and line width	Whether this chip, as made, is faulty
When	Before tape-out, mostly on a computer	In the fab, partway through	Usually once after the wafer is finished and once after packaging, every chip
If something's wrong	Every chip is wrong the same way	This lot, or these wafers, have a problem	That one bad chip is set aside

Think of building houses: verification is checking the blueprint before work starts, metrology is checking the walls are straight while building, and testing is turning on the taps and lights in every house before handover. If the blueprint has a mistake, every house is built from the wrong drawing; if the blueprint is right, one house can still be built badly. For how the other two are done, see "How does a chip fab know each step went right?" and "How are chips tested?".

Fabs and test-and-assembly houses also do other kinds of checking, such as reliability testing once a new product is made. This article is about verifying the design.

In fab24hr

There's no role in the game for designing or verifying chips; the main story, The life of a chip, starts after tape-out. The first time you play it, you see the prologue, "Tape-out": the design of the hearing-aid chip "Glowmere" is finished, checked and sent to the fab, where it becomes a set of photomasks.

Chapter 1, "How to Split 12", is the day before wafer start. You're the R&D integration engineer on the R&D line: the same design never comes out exactly the same, so a few of the first 12 wafers are made fast or slow on purpose, to see if the design holds up on real wafers. Chapter 10, "Standby Current", is at the test-and-assembly house, where the senior test engineer Ms. Zheng says the limit in the test program is a first version, set from design simulations; when the real chips come back, the edge ring sits right around that limit.

The companies, chip and people in the game are fictional; how verification is done comes from public, general sources, and every company does it differently. For other jargon, see Chip fab jargon in plain English.