Verification: did we build it right, against the specification. Validation: did we build the right thing, against the real need. Manufacturing test checks each fabricated part.

A bug's cost grows by orders of magnitude with how late it is found; a few late escapes dominate total cost.

Yes: tests check a reading of the specification; a misreading shared by design and checks, or a specification that misstates intent, passes.

States grow as 2^k and input sequences as 2^(i·L); even 48 bits of state exceeds a year of simulation.

When several kinds of evidence agree strongly enough that the stated residual risk is acceptable; never proven correct.

Each level trades speed and visibility against realism; corners at low levels, integration and software at high levels.

Evidence: 42 of 45 specification rules have checks (3 waived: reserved debug modes); checks shown to fire in regression (no vacuous assertions); functional coverage 96% of a plan reviewed by the architect, 4% holes on two error-injection crosses; formal proofs of the descriptor FIFO and arbiter; bug trend: 31 bugs, 29 at block level, discovery flattening for three weeks while coverage still rose; independent model written by a second engineer. Missing: the two error crosses, SoC-level interaction with the memory controller. Residual risk: error handling under simultaneous faults (medium likelihood, low impact, firmware can retry) and integration timing (to be covered at subsystem level). Recommendation: ready for integration, not yet for tape-out sign-off.

Manufacturing test.

Validation.

Its 20 silicon and field bugs, 10% of bugs, are 96% of its cost.

That the design and the checks agree on what was run; not correctness.

2^811, about 10^244.

About 38.

The risk of remaining bugs that a sign-off decision accepts.

SoC level (or a subsystem that contains the shared map).

That the design and testbench are alive for a simple case.

3 of 24.