Gates without reviews are wishes. On NanoSoC the integration gate asks one question with teeth: does every consumer in the tree derive from the frozen tables at the stamped revision. The linker script, the C headers, the interconnect decoder, the verification memory model and the documentation table each carry a comment naming the map revision they were generated from, and the review compares the five stamps. When they match, the gate passes; when one is stale, the gate stops, because a stale consumer is a bug with a version number. Four standing reviews make that question the same at every gate.
Four reviews carry the project, each owned by the integrator but staffed by the owners it judges. The handoff review accepts or rejects each block bundle before it is wired in. The map and table review freezes the shared tables and stamps every generated consumer. The sequence review walks reset release, power-up, power-down, clock enabling and boot against the specified orders with simulation evidence. The signoff review checks the cross-discipline matrix: timing, power, CDC, DFT, functional, software and package, each with an owner and a waiver state. Each review ends in one of three states: pass, pass with dated waivers, or fail with a missing list. Pass with waivers is normal; waivers without dates or owners are failures wearing a nicer name.
Review | When | Proves | Fails on |
|---|---|---|---|
Handoff review | Before wiring each block | Bundle complete or dated-waived | Missing collateral wired around |
Map and table review | Integration freeze | All consumers stamped to one revision | One stale header or decoder |
Sequence review | Before verification closure | Reset, power, clock and boot orders simulated | Release order assumed, never shown |
Signoff review | Tapeout gate | Matrix green or risk-accepted per waiver | Open waiver without evidence or owner |
The script below is the map-and-table review in miniature: five NanoSoC consumers each stamping a map revision, a pass when all stamps match the frozen revision, and a failure that names the stale consumer when the header lags one revision behind. Pair it with the overlap checker from the map lessons and the wiring checker from the handoff topic, and the integration gate is three scripts plus judgement instead of a day of slide reading.
FROZEN = "map rev 7" # the integration freeze all consumers build against
def gate(consumers, frozen):
stale = [name for name, stamp in consumers.items() if stamp != frozen]
return ("pass", []) if not stale else ("fail", stale)
fresh = {"linker": FROZEN, "headers": FROZEN, "decoder": FROZEN,
"test_model": FROZEN, "docs": FROZEN}
assert gate(fresh, FROZEN) == ("pass", [])
stale = dict(fresh, headers="map rev 6") # header regenerated late
state, missing = gate(stale, FROZEN)
assert state == "fail" and missing == ["headers"], missing
# A frozen table never moves silently: bumping the freeze re-stamps all.
refrozen = {name: "map rev 8" for name in fresh}
assert gate(refrozen, FROZEN)[0] == "fail" # old freeze no longer matches
assert gate(refrozen, "map rev 8") == ("pass", [])
print("PASS: five stamps match; stale header named; refreeze detected")Each review record quotes the revision it judged, the evidence attached, and the waiver dates accepted.
No consumer builds against an unfrozen table after the freeze; the stamp check runs on every build.
The signoff matrix has one owner per cell and no cell is both red and unowned.
When a gate fails, fix the process before the artefact: a stale header means regeneration was manual, so automate it; a missing sequence proof means no testbench drives the order, so write one. For the pre-silicon versus post-silicon split that the signoff review straddles see Pre-Silicon and Post-Silicon; for workload-driven architecture context see Workload Taxonomy.
The table itself is wrong, not the stamping: all consumers faithfully derive from a bad source. Stamps prove consistency, not correctness; correctness needs the overlap, alignment and address-content checks from the map lessons.