Two NanoSoC bugs tell the whole story. In one, the slot decoder is written for 8 KB windows, so slots 0 and 1 overlap and writing SBR CTRL corrupts the DMA KEY; it is caught by an elaboration-time overlap check before any simulation runs, and the fix is one compare plus a re-run. In the other, an access to an unmapped address gets no response at all, so the CPU hangs on a wild pointer instead of taking a fault; if that reaches silicon, the fix is a respin or a software quarantine of every wild pointer. The difference is entirely the catching stage. Putting a price on each stage is how every check in this course earns its place at the cheapest stage that can catch its bug.
Fix cost rises by roughly a factor of three per stage in this illustrative table (about a factor of ten every second stage): a map-table edit at review, a decoder regeneration at integration, a testbench fix during verification, an ECO after physical signoff, a metal fix or software workaround after tapeout, and a respin once silicon proves the bug real. The multipliers below are illustrative teaching values, not measurements of any project, but their shape is the industry's settled experience and the reason this course front-loads checks: the overlap checker in the map lessons, the wiring-table checker in the handoff topic, and the default-slave rule that turns hangs into faults all catch their bugs at the two cheapest stages.
Catching stage | Example catch on NanoSoC | Illustrative relative cost |
|---|---|---|
Map and table review | Overlap check rejects the 8 KB slot select | 1 |
Integration checks | Wiring test catches DMA on input 6 | 3 |
Chip-level verification | Illegal-address test demands DECERR, finds a hang | 10 |
Physical signoff | Equivalence flags an unverified ECO | 30 |
Post-silicon workaround | Software avoids the alias; debug access proves it | 100 |
Respin | New masks for a missed isolation clamp | 300 |
The default slave is the cheapest bug-price cutter on the chip: by answering every unmapped access with DECERR within two system clocks, and every reserved APB slot with PSLVERR turned into SLVERR, it converts a hang that would be found late into a fault that software and verification find early. A bus watchdog that completes a clock-gated access with an error does the same for the gated-clock hang. Both are integration decisions with project-wide cost effects, which is exactly why they belong to the integrator.
The script below prices the overlap bug against the missing-default-slave bug across the stages, using illustrative multipliers, and asserts the two claims that drive front-loading: catching at review is two orders of magnitude cheaper than working around in silicon, and the default slave moves the unmapped-access bug from a hang found late to a fault found in verification. Recompute with your own project's multipliers; the conclusion survives any plausible set.
STAGES = ["review", "integration", "verification", "signoff",
"workaround", "respin"]
COST = { # illustrative teaching values: relative fix cost per stage
"review": 1, "integration": 3, "verification": 10,
"signoff": 30, "workaround": 100, "respin": 300}
overlap = {"review": COST["review"], "respin": COST["respin"]}
assert overlap["respin"] // overlap["review"] == 300
# Without a default slave the wild pointer hangs; found in silicon at best.
# With one it faults; found by the illegal-address test in verification.
hang = COST["workaround"]
fault = COST["verification"]
assert hang // fault == 10
for i in range(len(STAGES) - 1):
assert COST[STAGES[i]] < COST[STAGES[i + 1]], STAGES[i]
cheapest_pair = COST["review"] + COST["integration"]
assert cheapest_pair < COST["workaround"] // 10
print("PASS: review-to-respin 300x; default slave moves hang(100) to fault(10)")Every known failure mode names its cheapest catching stage, and that stage has a check, not a hope.
No check is scheduled later than the stage where its bug is still cheap: overlap at review, wiring at integration, faults in verification.
The default-slave and watchdog rules are verified present before any other integration sign-off.
When triaging, price the fix before choosing it: a hang in silicon gets a software workaround first and a metal fix second, while the same hang in verification gets an RTL fix at once. For the generic cost-of-escapes argument see The Cost of a Bug by Stage; for where chip-level verification sits in the plan see Levels and What They See.
First the software workaround that avoids or handles the fault, because silicon cannot wait; then the RTL fix with the default slave for the next spin, proven by the illegal-address test that now exists because of this bug.