CDC signoff on RTL proves the design is correct; it does not implement it. The physical-design and test teams inherit every assumption the RTL signoff made — synchroniser identity, placement intent, constraints, test-mode behaviour — and any assumption that does not survive the handoff fails silently in silicon. The handoff package is what carries them across.
Item | Why PD needs it |
|---|---|
Synchroniser inventory | To identify the flops that must not be merged, retimed, or optimised away |
Placement intent | To keep synchroniser flops together so wire delay does not eat settling time |
Do-not-touch marking | To protect synchroniser modules and Gray registers through synthesis and optimisation |
Datapath delay bounds | To implement the skew limits the protocol arguments assume |
Clock-group and false-path declarations | To apply the same exceptions — no more, no fewer — that signoff reviewed |
Scan stitching threads through synchronisers, and test modes create clock relationships the functional design never sees. DFT needs to know which crossings are functional (and must be preserved through scan insertion) and which paths are test-only (and need their own constraints and waivers, scoped to test mode). A synchroniser reordered for scan convenience is a synchroniser destroyed for functional safety — the handoff must say which structures are untouchable and why.
The handoff is versioned with the signed-off RTL and constraints, so PD and DFT can always check what they built against what was approved.
Changes during implementation — retiming, ECOs, scan reordering — return to CDC for re-check; the gate-level lesson explains what to re-run.
Handoff review is joint: PD confirms the constraints are applicable, DFT confirms test-mode crossings are covered, CDC confirms nothing was lost in translation.
CDC must approve, because the structure is untouchable without review. The structural re-check confirms the synchroniser still stands, and timing confirms the bound still holds on the new placement.
Because test modes create clock relationships functional analysis never covered. Borrowing functional exceptions for test paths — or leaving test paths uncovered — both fail: each mode needs its own reviewed statements.