Context, kept generic: a control block fully signed off for CDC and RDC, then given a small engineering change to fix an unrelated timing path. Days later, first-silicon-style vectors in gate-level simulation show the block waking into a half-reset state on some seeds: a few flops out of reset a cycle early, the rest on time. Nothing in the RTL changed near the reset logic, and the RTL testbench still passes.
The failure appears only in gate-level simulation with delays, never at RTL, and only when the release edge lands near a destination clock edge. Partial reset states follow: configuration flops awake while their enable flops still sleep, so the first transaction programs a default instead of the intended value. The randomness across seeds is the signature of a release edge drifting through a recovery window as delays shift.
Hypothesis | Evidence sought | Verdict |
|---|---|---|
The ECO changed the reset RTL behaviour. | Diff the RTL reset logic before and after. | Killed: the RTL is untouched near reset. |
The new delays expose a pre-existing marginal release. | Check whether the release path was ever glitch-free by construction. | Survives in part: the path was clean, but fragile. |
The ECO reroute altered the release path itself. | Compare the release net before and after layout. | Survives: see evidence below. |
The layout diff shows the ECO moved the reset synchroniser flops apart and rerouted the release net through a spare cell used as a buffer alongside unrelated glue, adding combinational depth and skew between the release branches. The no-logic-between-flops structure the signoff relied on no longer exists in silicon geometry: one branch now arrives earlier, and when the release edge lands near the clock, that branch's flops exit reset a cycle ahead. The RTL testbench cannot see it because it models the release as ideal; only the delayed gate-level run shows the split.
Root cause: the ECO broke the structural precondition of the reset synchroniser, combinational logic and skew inside the release path, converting a synchronised release into a skewed one. The fix restores the structure: the synchroniser flops placed together, the release net routed as a clean branch with no glue, and the change re-verified in gate-level simulation with the release edge swept across the clock. The glitchy-release lesson of the reset debug topic shows the same failure shape from the symptom side.
Signoff was correct for the design it analysed; the ECO created a new design that nobody re-signed. The methodology topic already requires structural re-checks after ECOs, but the project treated a layout-only change as exempt. The process change removes the exemption: any ECO touching a synchroniser, a release net, or their placement triggers the structural re-run and a gate-level release sweep before the gate re-opens, with the layout diff attached to the signoff record so the next ECO starts from evidence, not memory.
RTL models the release as ideal, so a skew introduced by placement and routing is invisible there by construction. The delayed gate-level run is the first model in the flow that can show it.
A rule requiring the layout diff attached to the signoff record with any ECO near synchronisers or release nets triggering the structural re-run: the diff existed, but nobody was obliged to read it.