ECO in VLSI Physical Design: Timing ECOs, Functional ECOs, Spare Cells and Metal-Only Fixes

Almost no chip goes from "routing done" to tape-out without changes. Sign-off timing finds a handful of paths that still fail, a verification engineer finds a logic bug two weeks before tape-out, or silicon comes back with a bug that has to be fixed with the cheapest possible mask change. In every one of those cases the team does not rerun the whole flow. It makes an Engineering Change Order (ECO): a small, controlled edit to a design that is already placed and routed, followed by just enough re-verification to prove nothing else broke.

ECOs are where a lot of real physical design work happens in the last weeks of a project, yet most tutorials give them one paragraph. This guide covers the main kinds of ECO (timing, DRV, noise, leakage, functional, pre-mask and post-mask), how spare cells and metal-only ECOs work, how a timing ECO loop runs between the sign-off timer and the place-and-route tool, the checks you must repeat after every ECO, and how to debug an ECO that will not converge. It includes illustrative worked examples, a flowchart, interview questions and an FAQ.

Related reading: Physical Design Flow, Static Timing Analysis (STA) in VLSI, Setup and Hold Violations and Design Rule Violations (DRVs).

What an ECO is#

An ECO is any change made to a design after its main implementation steps are finished, applied incrementally so that the rest of the layout stays as it is. The point is containment. A full re-run of placement, clock tree synthesis and routing would fix the problem too, but it would also move thousands of cells, change every parasitic, and throw away weeks of timing, noise, IR and physical verification closure. An ECO touches only the cells and nets that need to change.

Every ECO has the same three parts:

1. Decide the change. For timing, the sign-off STA tool works out which cells to resize or where to insert buffers. For logic, an RTL fix is translated into a netlist patch.
2. Implement the change in the layout. The place-and-route (PnR) tool applies the change list, legalizes any new or resized cells near their old positions, and runs an incremental ECO route on only the affected nets.
3. Re-verify. Re-extract parasitics, re-run STA in all modes and corners, and re-run physical verification (DRC, LVS, antenna), logic equivalence (LEC), and IR/EM checks as the size of the change requires.

Types of ECO#

ECOs are usually grouped in two ways: by what is being fixed, and by when in the project it happens.

By what is fixed#

By when it happens#

• Pre-mask (all-layer) ECO. Masks have not been made yet, so any layer may change. New cells can be placed in free sites (often by removing filler cells), existing cells can be resized freely, and Vt swaps are allowed.
• Post-mask (metal-only) ECO. The base layers are already manufactured or the masks are already paid for. Only some metal and via masks may change, so the fix must use cells that already exist in the silicon, which is what spare cells are for. Which metal and via layers are allowed to change is a project decision made with the foundry and the program schedule.

The difference matters because a fix that is trivial pre-mask can be impossible post-mask. A Vt swap, for example, does not change the cell footprint, but it changes the implant layers, so it is not a metal-only change.

Timing ECOs in practice#

Most ECOs on a project are timing ECOs, and most of them are produced by the sign-off timer rather than by hand. A typical loop looks like this:

1. Run sign-off STA on the routed design with sign-off extraction, in every mode and corner the project signs off on.
2. Let the timer's ECO engine fix violations. Modern sign-off timers (for example PrimeTime from Synopsys or Tempus from Cadence) can run physically aware ECO: they read the placement and the cell and technology LEF so they only propose changes that fit in the available space.
3. Write out a change list, usually as a script of commands such as cell size changes and buffer insertions.
4. Apply that script in the PnR tool, legalize, and run ECO routing.
5. Re-extract and re-time. Repeat until the remaining violations are small enough to fix by hand or are waived with a documented reason.

Two principles keep this loop healthy:

• Fix in the right order. Fix DRVs first, then setup, then hold, then leakage recovery. Hold fixes add delay, so doing them before setup closure tends to undo each other. Leakage recovery goes last because it uses up positive slack.
• Fix across all corners at once. A change that helps one corner can hurt another. A buffer added to fix hold at the fast corner also adds delay at the slow corner, where cell delays are larger. Multi-corner ECO engines check every active scenario before committing a change.

Worked example 1: closing a setup violation (illustrative)#

A path at the slow corner shows −35 ps of setup slack. The report shows most of the delay in a weak driver (X1) driving a long route, plus two standard-Vt cells in the middle of the path. All numbers below are illustrative, not from a real library.

No single fix clears −35 ps with margin. Upsizing the driver (+20 ps) and swapping one of the two SVT cells (+12 to +13 ps) brings the path to about −2 ps. Swapping the second cell too brings it to about +10 ps. Before accepting this, check that the upsized driver did not slow the path that feeds it, that the extra leakage is within budget, and that the path's hold slack at the fast corner did not drop below zero. After ECO route and re-extraction, the real gain will differ a little from the estimate, which is why the loop always ends with a re-time.

Worked example 2: a hold fix that must not break setup (illustrative)#

A path shows −12 ps of hold slack at the fast corner and +80 ps of setup slack at the slow corner. The ECO engine proposes one delay cell that adds about 15 ps at the fast corner. Because cells are slower at the slow corner, the same cell might add about 40 ps there. The result:

• Hold slack at the fast corner becomes about −12 + 15 = +3 ps.
• Setup slack at the slow corner becomes about 80 − 40 = +40 ps.

Both checks pass. If the setup slack had been only +30 ps, this fix would have created a new setup violation, and the right answer would be a smaller delay cell, a buffer placed elsewhere on the path, or a look at whether the hold violation comes from clock skew that should be fixed in the clock tree instead. For more on the underlying checks, see Setup and Hold Violations.

Functional ECOs#

A functional ECO changes what the logic does. The trigger is usually an RTL bug found late, or a small specification change. Re-synthesizing the whole design and implementing it from scratch would change the netlist everywhere, so instead the team makes the smallest possible netlist change that produces the new behavior.

The usual flow is:

1. Fix the RTL and re-synthesize it to get a reference netlist that has the new behavior.
2. Generate a patch. An ECO tool based on logic equivalence checking (for example Conformal ECO from Cadence or Formality ECO from Synopsys) compares the implemented netlist with the new reference and works out the minimal set of gates to add, remove or rewire.
3. Implement the patch in the layout, either with new cells (pre-mask) or by mapping the new logic onto spare cells (post-mask).
4. Prove it. Run LEC between the new RTL (or reference netlist) and the patched netlist. LEC is the real proof that the functional ECO is correct and complete; simulation alone is not enough.
5. Re-route, re-extract, re-time and re-run physical verification as for any other ECO.

Two details catch people out. First, scan: new flops added by an ECO must be stitched into the scan chains, or test coverage drops, so the DFT owner needs to know. Second, the patch must be kept in sync with the RTL. Every later netlist the team produces has to include the ECO, or the fix silently disappears in the next drop.

Spare cells and metal-only ECOs#

Spare cells make post-mask ECOs possible. They are ordinary standard cells, such as NAND, NOR, inverters, buffers, multiplexers and flops, placed across the die during implementation but not connected to any logic. Their inputs are tied to a constant through tie cells (see Tie Cells) so they do not float, and their outputs are left unconnected.

When a metal-only ECO is needed, the change is implemented by:

• choosing spare cells close to the logic that has to change,
• disconnecting their inputs from the tie cells,
• and wiring them into the design using only the metal and via layers that are allowed to change.

Some libraries also provide metal-configurable ECO cells (sometimes called gate-array style ECO cells). These are base cells whose function is set by the metal connections, so the same unused base cell can become a NAND, a NOR or an inverter as needed. Where available, they are often placed in place of ordinary filler cells.

Planning spare cells#

Spare cells only help if they were planned before tape-out. Practical guidelines:

• Distribute them evenly, often in small groups, so any part of the design has spares within a short wire distance. A spare cell on the far side of the block is useless for a timing-sensitive fix.
• Pick a useful mix. Simple inverting gates (NAND2, NOR2, inverters) can build almost any function. Add some flops, buffers and multiplexers, and spare clock-gating cells if the team expects control changes.
• Size them sensibly. Spare cells that are too weak cannot drive a new route of any length.
• Tie them off correctly and keep their power connections and well taps like any other cell. They must pass LVS as unconnected logic.
• Keep track of them. Mark spare cells so optimization steps do not delete them or treat them as dead logic, and keep a list of which ones have been used after each ECO.

Worked example 3: a metal-only logic change (illustrative)#

After first silicon, the team finds that an enable signal should be EN = A AND B instead of EN = A. The base layers are frozen. Available nearby: a spare NAND2 and a spare inverter. The fix:

1. Disconnect the spare NAND2 inputs from the tie cell and connect them to A and B.
2. Connect the NAND2 output to the spare inverter input (disconnected from its tie), which gives A AND B.
3. Cut the old connection from A to the enable pin and connect the inverter output to it instead.
4. Route all of this on the allowed metal layers, run LEC against the corrected RTL, then re-extract, re-time and run DRC and LVS.

Because the new logic adds two gate delays and some wire, the enable path's timing must be checked carefully. If it fails and no faster spares are nearby, the team may need to accept a lower frequency on that revision or plan an all-layer fix for the next one.

What to re-check after every ECO#

An ECO is only finished when the design is signed off again. The checks depend on the size of the change, but a safe default list is:

• STA in all modes and corners with fresh extraction, including SI (crosstalk) analysis. ECO routing can create new coupling; see Crosstalk in VLSI.
• DRVs (max transition, max capacitance, max fanout).
• Logic equivalence (LEC) between the pre-ECO and post-ECO netlists for timing ECOs, and against the new reference for functional ECOs.
• Physical verification: DRC, LVS and antenna checks (see Antenna Effect and Technology DRCs).
• Filler and decap integrity: fillers removed to make space must be restored where space remains, and removing decap cells can affect dynamic IR drop.
• IR drop and EM for large ECOs or ECOs in high-activity regions (see IR Drop Analysis).
• Netlist and database hygiene: the final netlist, DEF/GDS and SDC must all match, and the ECO must be recorded so later drops include it.

Debugging an ECO that will not converge#

Sometimes each ECO iteration fixes some paths and creates new failures. The flowchart below is a practical order to look for the cause.

Common causes:

• Mismatched setup. The ECO engine uses different extraction, derates or SDC from the official sign-off run, so its estimates do not match reality.
• Corner ping-pong. Hold fixes at fast corners break setup at slow corners, and the next setup fix breaks hold again. Run the ECO with all corners active, and look at whether the real cause is clock skew.
• No room. The area around the failing cells is full or congested, so new cells land far away and long detour routes add more delay than they save.
• New SI problems. ECO routes run next to aggressors that did not exist before. Ask for spacing or shielding on critical ECO nets.
• Wrong problem. Thousands of violations rarely need thousands of cell changes. They usually point to a constraint error, a missing exception (see Multicycle Path and False Path in STA), or a clock tree problem that should be fixed at the source.

Interview questions and answers#

1. What is an ECO in physical design? An Engineering Change Order is a small, incremental change to a design that is already placed and routed, used to fix timing, DRV, noise or functional problems without re-running the full flow. The rest of the layout is kept unchanged.

2. What is the difference between a pre-mask and a post-mask ECO? A pre-mask ECO can change any layer, so new cells, resizing and Vt swaps are allowed. A post-mask ECO can change only certain metal and via layers, so it must use cells that already exist on silicon, usually spare cells.

3. Why is a Vt swap not allowed in a metal-only ECO? Cells with different threshold voltages differ in their implant layers, not only their metal. Changing them would need new base-layer masks.

4. What are spare cells and how are they connected? Spare cells are unused standard cells spread across the die with inputs tied to constants through tie cells and outputs left open. In a metal-only ECO, they are disconnected from the ties and wired into the design using metal changes only.

5. In what order would you fix violations in a timing ECO, and why? DRVs first, then setup, then hold, then leakage recovery. DRV fixes change transitions that affect all timing; hold fixes add delay that can hurt setup, so they come after setup closure; leakage recovery spends positive slack, so it comes last.

6. How do you verify a functional ECO? Run logic equivalence checking between the corrected RTL or reference netlist and the patched netlist, then re-run STA, DRC, LVS and the rest of sign-off.

7. Why can a hold fix create a setup violation? The delay a buffer adds is larger at slow corners than at the fast corner where hold is checked. If the path has little setup margin at the slow corner, the added delay can make it fail.

8. What makes a timing ECO "physically aware"? The ECO engine uses the real placement, cell sizes and technology rules to propose only changes that can be legally placed near the original location, so fewer changes fail or move far when applied in the PnR tool.

9. What checks are needed after an ECO? Re-extraction and multi-corner STA with SI, DRV checks, LEC, DRC, LVS and antenna, filler and decap restoration, and IR/EM checks for larger changes.

10. How would you plan spare cells for a block? Spread them evenly in small groups, include a mix of simple gates, flops, buffers and muxes, size them to drive realistic routes, tie their inputs off correctly, and mark them so optimization does not remove them.

FAQ#

Is ECO only done after tape-out? No. Most ECOs happen before tape-out, during timing and physical sign-off. Post-tape-out (post-mask) ECOs are less common and more limited.

Can a timing ECO change the logic function? It should not. Sizing, buffering and Vt swaps keep the function the same, which is why LEC between the pre-ECO and post-ECO netlists is part of the sign-off check.

Why not just re-run place and route? A full re-run changes most of the layout and its parasitics, so all the timing, SI, IR and physical verification closure already done would have to be repeated. An ECO limits the change to what is needed.

What happens if there are no spare cells near the logic to fix? Long routes to distant spares may be too slow, so the fix may not meet timing. The team may accept a lower-performance revision, or plan an all-layer fix in the next mask set.

Do ECOs affect power? Yes. Upsizing and lower-Vt cells increase leakage and switching power. That is why leakage recovery ECOs exist and why power is re-checked after large timing ECOs.

Summary#

• An ECO is a small, incremental change to a routed design, followed by targeted re-verification.
• ECOs are classified by what they fix (timing, DRV, noise, leakage, function) and when they happen (pre-mask or post-mask).
• Timing ECOs run in a loop between the sign-off timer and the PnR tool. Fix DRVs, then setup, then hold, then leakage, with all corners active.
• Functional ECOs turn an RTL fix into a minimal netlist patch, proven with LEC.
• Post-mask ECOs rely on spare cells or metal-configurable ECO cells, which must be planned before tape-out.
• An ECO is not done until STA, DRVs, LEC, DRC, LVS, antenna and, where needed, IR/EM are clean again.

References#

• A. B. Kahng, J. Lienig, I. L. Markov and J. Hu, VLSI Physical Design: From Graph Partitioning to Timing Closure, Springer, 2011.
• J. Bhasker and R. Chadha, Static Timing Analysis for Nanometer Designs: A Practical Approach, Springer, 2009.