The last three sections decide whether the chip ships: what was proven, what the package does to the signals, and what risk remains. These are judgement questions: the answers name a decision, its price and its fix path. Interviewers use this group to test whether candidates think past their own block.
Q1: What do you verify at top level that blocks cannot. Model: the map (overlap, alias, holes with the right error), connectivity of every wire including interrupts and resets, the boot flow end to end, power-state walks with isolation legality, reset sequencing, DMA across the fabric, and performance against budget. Blocks prove their logic; only the top proves the assembly. Follow-up: where does emulation earn its cost. Answer: long software-driven runs, boot with real firmware timing, and stress traffic that simulation cannot reach.
Q2: First-silicon checklist, day zero. Model: power rails sequenced with power-good, clocks present with PLL locked, reset released in order, debug access alive before the CPU runs, boot ROM fetching, and a known-good image ready to load. Each item has an owner and a fallback. Follow-up: what if debug access dies in sleep. Answer: the debug path must live in the always-on domain or carry a power request.
Q3: Performance verification against budget. Model: traffic generators per master replay the budgeted patterns while monitors on the fabric measure sustained rates and latency tails against the ledger. NanoSoC's numbers to beat are 361.4 per link and 180.7 shared per stream. Follow-up: what hides in averages. Answer: the tails: QoS starvation and same-bank contention appear only at full mix, so measure worst-case shares, not means.
Q4: Power-aware simulation: what does it catch. Model: missing isolation shows as X propagating into the on-domain, wrong sequences glitch the always-on logic, and retention mismatches resume the wrong state. It catches missing isolation, wrong power sequences and retention mismatches, which no functional test sees. Follow-up: what must the test bench model. Answer: the power switches, the isolation cells and the retention behaviour, or the simulation proves a chip without power intent.
Q1: Fit 400 functions on 120 pins. Model: a pin-mux matrix driven by a use-case table, each pin with a reset state, pull, drive strength and Schmitt setting, boot straps on dedicated or strapped pins with defined pulls, and a ballout checked against the board netlist. Follow-up: what is verified against what. Answer: the mux table against the ballout against the board netlist, by one pin database, plus simultaneous-switching analysis per supply pair.
Q2: Pad defaults that kill boards. Model: a bidirectional pad that drives at reset while the board device also drives, contention, current, a dead boot. Every pad needs a reset-state row: input with pull unless firmware enables the driver. Follow-up: who owns the table. Answer: the integrator with the board team, signed before tapeout, because neither side can fix it alone.
Q3: Power delivery through the package. Model: rails sized by total current over current per pad, ground pairs placed for return paths, decap strategy for switching noise, all co-designed with the board. Follow-up: what analysis proves it. Answer: dynamic IR drop with realistic vectors plus a power-virus bound, since average current hides the droop.
Q4: ESD and latch-up at the top. Model: every pad gets its protection cell with a discharge path to the right supply, verified by ring checks, and guard structures where the rules require. The integrator owns the ring architecture; the pad library owns the cells. Follow-up: what fails if the ring is incomplete. Answer: one unprotected pad, which fails in handling rather than in function, the most expensive kind of surprise.
Q1: Go or no-go with three open waivers. Model: classify each by blast radius and evidence, name the silicon fix path for each (metal fix, software workaround, none), and apply the rule: no waiver without a fix path ships. Follow-up: what is the executive summary. Answer: residual risk in one page per waiver with owner, evidence and fix cost, never a bare count of waivers.
Q2: What does equivalence cover that simulation cannot. Model: that the final netlist, including every ECO, implements the same logic as the verified RTL across all states simulation never reaches. Every netlist and every ECO gets the check; a skipped ECO is an unverified chip. Follow-up: what does equivalence miss. Answer: timing, power intent and X behaviour, which is why gate-level simulation and power-aware runs stay on the list.
Q3: ECO and respin risk. Model: price the ECO by layers touched, re-verification owed (equivalence, timing, affected tests) and schedule against the bug's blast radius. A wrong-data bug with a software workaround waits; a hang without one does not. Follow-up: metal fix versus full respin. Answer: metal fixes only what spare resources and upper layers can reach; anything deeper is a respin, decided by the fix map, not by optimism.
Q4: Errata and post-silicon. Model: every escape becomes an erratum with symptom, workaround and fixed-in version, owned like a register: generated from one source into docs, headers and driver checks. Follow-up: what makes errata trustworthy. Answer: reproduction on the bench tied to the escape analysis, so the workaround is proven, not hoped.
Because verification, package and signoff are judged by decisions under uncertainty: what to prove, what to co-design, what risk to carry. Definitions score 2; a priced decision with a fix path scores 3 or 4.