On 31 January 2011 Intel announced that it had stopped shipping its 6 Series chipset, used with Sandy Bridge processors, code-named Cougar Point (fact C2). Some of its SATA ports, which connect disks and optical drives, could degrade over time. PC makers withdrew systems, and Intel corrected the design and replaced affected parts. The logic of the chipset was not wrong. A circuit was.
What does an escape that no functional test could see teach about the verification flow?
Fact | Source |
|---|---|
Some SATA ports in the 6 Series chipset could degrade over time; Intel stopped shipments and corrected the design with a metal-layer change | Intel press release, 31 January 2011 (fact C2) |
Reported cause: one transistor in the clocking tree of the 3 Gb/s SATA PLL was driven at too high a voltage for its thin gate oxide, so its leakage could grow over time | AnandTech, 31 January 2011, reporting Intel's explanation (fact C5) |
Only the 3 Gb/s ports (2-5) were affected, not the 6 Gb/s ports | Fact C5 |
Intel estimated about $700 million to repair and replace affected parts and systems | Fact C5 |
Everything this course has built assumes that a transistor switches when the logic says it does. RTL simulation, formal proof and emulation all model the design's logic; a correctly designed circuit that wears out because of an electrical stress looks perfect to every one of them on day one and every day after. The failure was in a different layer:
Layer | Question | Verified by |
|---|---|---|
Logic (this course) | Does the design compute the right thing? | Simulation, formal, emulation |
Circuit | Does each transistor operate within its rated voltages and currents? | Circuit simulation, electrical rule checks, design reviews |
Reliability | Will it keep working for its rated lifetime under stress? | Ageing analysis, accelerated stress testing of silicon (temperature, voltage, time) |
Silicon validation | Does real silicon work across voltage, temperature and process, now and after stress? | Characterisation and margin testing (lesson 11.5) |
The defect was time-dependent: ports that worked at first could degrade later. That is why the lesson belongs to reliability and validation: an initial functional test of silicon passes, and only stress over time, or an analysis of the transistor's operating voltage, reveals it.
Functional sign-off is not chip sign-off: lesson 14.4's residual risk should name what the functional evidence does not cover, including electrical and reliability risk owned by other teams.
Analogue and mixed-signal blocks are a seam: PLLs, PHYs and I/O are where circuit and logic verification meet, and where plans should check who owns which risk (lesson 1.5's integration seams).
Validation must include time and stress: a part that passes on day one can fail after months; accelerated stress testing exists to compress that time (lesson 11.5).
A metal-layer fix is not free: it still meant new silicon, replacement parts and systems withdrawn from sale (Part 12's cost of late bugs).
Question | Answer |
|---|---|
What failed? | SATA ports that could degrade over time, from an overstressed transistor in a PLL clocking tree (documented) |
Where could it have been caught? | Circuit-level checks of device operating voltages, reliability analysis, or longer stress testing of silicon (the course's reading) |
Why was it not caught? | Outside what logic verification models, and time-dependent, so initial silicon tests pass (the course's reading) |
What changed? | Shipments stopped, a metal-layer fix, replacement at an estimated $700 million (documented) |
RTL simulation models logic, not transistor voltages or wear-out; the logic was correct and the failure developed over time in a circuit.
That electrical, analogue and reliability risks are outside the functional evidence, and who owns them with what evidence.
Cougar Point: an overstressed transistor could degrade SATA ports over time (documented).
Logic verification cannot see circuit and reliability failures; they need circuit checks and stress testing.
State the boundary of functional sign-off and make sure the other risks are owned.