NanoSoC boots in 12.581 milliseconds, and only 53.948 microseconds of that, about four tenths of one percent, is the hardware reset sequence. Everything else is software running on tables the integrator froze months earlier: the map, the headers, the linker script, the boot image layout. When a late change moves one of those tables, the cost is not the edit; it is rebuilding and requalifying every consumer. Milestones exist to say, per artefact, after which date that rebuild needs a formal change, not a quiet edit. The gates below say, per artefact, where that line is crossed.
Gate | Delivers | Freezes | Integrator's exit proof |
|---|---|---|---|
Specification | Requirements, use cases, constraints | What the chip must do, not how | Every requirement has an owner and a budget line |
Architecture and budgets | Map skeleton, domains, budget ledger | Partition plan and per-block budgets | Budgets sum within the envelope with margin |
RTL and handoffs | Block bundles per the eight-item list | Block behaviour and collateral | Acceptance gate: every bundle complete or dated-waived |
Integration | Wired top, decoders, sequences, headers | Shared tables at revision 1 | Checkers green: overlap, wiring, reset order |
Verification closure | Connectivity, boot, DMA, interrupt proof | Test plan; only waivers move | Coverage and the top-level test list signed |
Physical and signoff | Closed netlist, DFT insertion and test modes, power intent, pin map, PG | Netlist, constraints, pin map, test modes, power-intent revision | Equivalence on every ECO; scan coverage and power-intent checks green |
Tapeout and bring-up | Masks, boot image, errata process live | Silicon; software works around | Day-zero triage plan and debug access proven |
Two freezes deserve emphasis because newcomers fight them. The shared tables freeze at integration: after that, adding a peripheral takes a reserved slot and moving a base needs a change control, never a quiet edit. The netlist freezes at physical signoff: after that, even a one-gate fix is an ECO with equivalence proof, because the netlist must stay logically equivalent to the verified RTL.
The script below recomputes the NanoSoC reset release chain and the boot shares from the NanoSoC specification, and asserts the proportions this lesson quoted: the hardware sequence is 53.948 microseconds, boot totals 12,580.917 microseconds, and the SPI image load dominates at 86.9 percent. Run this shape of accounting at every gate and late surprises shrink: anyone proposing to halve boot time can see at once that only the SPI load and the banner matter.
T_PER, T_SYS, T_CPU = 41.667, 10.417, 5.208 # ns; NanoSoC specification periods
r1 = 1024 * T_PER # oscillator ready
r2 = 2 * T_PER # rst_per_n release
r3 = 260 * T_PER # PLL enable and lock
r4 = 2 * T_PER # clock gates open
r5 = 18 * T_SYS # rst_sys_n release
r6 = 8 * T_SYS + 2 * T_CPU # rst_cpu_n release, last
hw_us = (r1 + r2 + r3 + r4 + r5 + r6) / 1000
assert abs(hw_us - 53.948) < 0.01, hw_us
boot_us = 12580.917 # NanoSoC specification boot total
spi_us, banner_us = 10928.000, 1386.667
assert abs(spi_us / boot_us - 0.869) < 0.001
assert abs(banner_us / boot_us - 0.110) < 0.001
assert abs(hw_us / boot_us - 0.0043) < 0.0005
rest = boot_us - spi_us - banner_us - hw_us
assert abs(rest / boot_us - 0.017) < 0.003, rest
print("PASS: reset chain 53.948 us; SPI 86.9%, banner 11.0%, reset 0.43%")Each gate's exit proof is attached to the gate record, not remembered in meeting notes.
Frozen artefacts carry versions, and every consumer names the version it built against.
Any change after a freeze arrives as a change control with impact and requalification listed.
When a late bug appears, first ask which freeze it breaks: a moved base breaks the integration freeze, a new constraint breaks the handoff freeze, a netlist tweak breaks the signoff freeze. The answer routes the fix and prices it, which is the next lesson. For the implementation steps inside physical design see PD Flow Overview; for the synthesis box see Synthesis Flow Overview; for where chip-level verification sits see Levels and What They See.
It becomes a change control: impact on headers, linker script, decoder and tests is listed, all consumers regenerate and requalify, and the default answer is to take a reserved slot instead. Quiet edits after a freeze are how two teams ship against different maps.