Specification

You know the outline of the flow: the chip is described in code, the code is turned into logic gates, and the gates are laid out as the physical pattern the factory prints. The spec comes before all of it, and it is where most of the decisions that can’t be undone later are made:

• the process node, meaning which factory and which manufacturing generation will build the chip;
• the package, the case that connects the chip to a circuit board and carries its heat away;
• the die-size class, which largely sets what each chip costs;
• the interface standards it must support, such as PCIe, USB or a DDR memory type;
• which blocks to license from other companies instead of designing them; and
• the level of safety and security assurance the market demands.

Every later stage trades inside those limits. Few of them can move the limits.

The economics punish late discovery. A NASA study of large aerospace hardware and software projects put the relative cost of fixing a requirements error at 1 during requirements, 3–8 in design, 7–16 in build, 21–78 in integration and test, and from 29 to more than 1,500 in operations.⁴ That study did not look at chips, but chips have the same structure, with a sharp step at tapeout, when the finished layout goes to the factory. After that, a fix needs a new set of masks (the stencils used to print each layer) and another trip through the factory, which takes months.

Relative cost to fix a requirements error found in integration and test (NASA)

21–78×

…found in operations

29 to 1,500+×

Modeled foundry price per 300 mm wafer, 90 nm vs. 5 nm (CSET, 2020)

$1,650 vs. $16,988

The wafer prices come from a 2020 cost model by Georgetown’s Center for Security and Emerging Technology (CSET). A wafer is the 300 mm silicon disc that hundreds of chips are printed on at once.²²

The outputs that matter most downstream are often the least glamorous: the per-mode power budget and the I/O list.

• The power budget later becomes the chip’s UPF file, a standard format that tells the design tools which regions run at which voltage and which can be switched off. It also sets targets for the power grid, the mesh of metal wires that carries supply current across the chip.
• The I/O list names every external signal, the standard it follows, its voltage, and whether it needs a PHY (the analog circuit that drives a high-speed link). It drives the package choice, the number of solder balls under the package and the pad ring: the row of connection pads around the edge of the die.

Pads have a minimum size and spacing, so a die with many I/Os and little logic ends up pad-limited: its size is set by the ring of pads, not by the circuits inside.²³

The document stack and its owners

The PRD says what the product must do, not how, and is often written by marketing (sometimes as a separate MRD).¹ The chip requirements spec, sometimes called the product or target spec, is usually owned by the chip architect and the program lead. Below it sit:

• The architecture spec: how the chip is split into blocks; the memory map (which address reaches which block); the on-chip interconnect; the clock and power domains (regions with their own clock or their own on/off switch); the boot sequence; and the security architecture.
• Per-block microarchitecture specs: pipeline stages, state machines, interfaces with their timing cycle by cycle, and the register map. Registers here are the numbered control and status locations software reads and writes to drive the block.

Keep the register map in one machine-readable file and generate the design code, the verification models and the software’s header files from it, so the three can’t disagree. OpenTitan’s D1 checklist requires exactly that generated collateral alongside a complete spec.⁵

Requirements that survive signoff

Signoff is the final round of checks before the design goes to the factory. A requirement survives it only if it can be checked, and that takes conditions. Transistors vary from chip to chip and slow down when hot or at low voltage, so engineers check designs at named combinations of process, voltage and temperature called PVT corners.²⁵ “1.5 GHz” means nothing without the corner it applies at. Likewise, “≤ 5 W” means nothing without a workload.

The verification method decides who owns closing each requirement:²

• Test: running the design in simulation, or measuring real chips.
• Analysis: calculation by a tool. Examples are static timing analysis, which computes the worst-case delay through every path in the circuit without simulating it, power estimation and thermal simulation.
• Inspection: looking at the design files, layout or documents.
• Demonstration: showing the function working.

Requirements that can only be measured on finished chips, such as standby power, need a before-silicon analysis that stands in for the measurement, with explicit margin. Requirements must also be attainable. A clock target that no available cell library (the set of ready-made logic gates for a process) can meet at the chosen voltage is a defect in the spec.

Budgets and margin

Power and area budgets flow down to blocks. At the spec stage the numbers are estimates, scaled from the previous chip or from early models. So teams hold margin back at chip level and release it as better estimates arrive: first from the design code, then from the gate-level netlist, the list of logic gates and their connections that synthesis produces. A block that goes over its allocation either finds savings or negotiates margin from the pool. A pool that is empty before the design code is frozen is an early warning worth acting on.

Traceability in regulated flows

In safety-critical work, traceability is audited. FAA guidance for airborne electronic hardware calls a correct and complete set of requirements the cornerstone of development assurance. At the two most critical design assurance levels (DAL A and B), it asks for a review of traceability between the detailed design and the device requirements. It also asks for a review of the reports from synthesis and place-and-route, the tool steps that turn the design into gates and then into a layout. And it asks for a check that each verification case suits the requirements it traces to, and that those requirements are completely covered.¹⁰

In cars, ISO 26262 starts from hazard analysis. It sets top-level safety goals, gives each an ASIL (automotive safety integrity level, from A to the strictest, D), breaks the goals into safety requirements allocated to hardware and software components, and requires traceability between dependent work products.¹¹¹²

Change control

Late changes cost tens to hundreds of times more than early ones.⁴ A spec freeze is really a series of freezes: requirements, then architecture, then the features in the design code. A change request after each one carries an impact analysis across design code, verification, physical layout, software, manufacturing test and schedule. The commonest failure is not a bad decision but a silent one: the design code changes behavior, the spec is never updated, and the test plan keeps checking the old behavior.

Power budgets that hold up

A useful spec-stage power budget states four things: the operating mode, the workload, the junction temperature (the temperature of the transistors themselves) and the process corner (whether it assumes average, fast or slow transistors). It splits each block’s power into switching and leakage.

Leakage rises steeply with temperature,²⁵ so the budget at the hot corner is the one that sets TDP. A design with a lot of leakage can even run away thermally if the package is marginal: more heat means more leakage, which means more heat.

Peak current is a separate requirement. When a large block wakes up, the current it draws jumps within nanoseconds. The package’s power connections have inductance, which resists sudden changes in current, so the supply voltage on the die briefly sags. The fixes are more power bumps between die and package and more decoupling capacitance on the die, small charge reservoirs that cover the sudden demand. All of this has to be planned, and it can bite at mode changes even when average power is fine.

Battery products add a standby budget. It usually dictates the always-on domain (the part that never sleeps) and the power gating architecture (switches that cut the supply to idle blocks so they stop leaking). Those decisions later become the chip’s UPF power-intent file.

Cost beyond the die

Unit cost is the die cost, plus testing and packaging, plus the one-time costs (NRE) divided by the number of chips sold.²⁰ Large dies run into two walls: low yield, and the reticle limit, the largest area the lithography machine can print in one exposure. That is why big AI accelerators are split into chiplets, several smaller dies in one package. Chiplets trade die yield for the cost of die-to-die interfaces, advanced packaging, and testing each die before assembly to make sure it is a known-good die.

Node economics

The price per wafer is only half the story; what matters is the price per transistor. CSET priced a chip with a fixed number of transistors at each node. The factory’s price fell from $2,433 at 90 nm to $233 at 7 nm, then edged up to $238 at 5 nm, because at the newest node the wafer price rose about as fast as density.²² Cost per transistor no longer falls automatically, so the case for a new node rests on energy per operation, performance, or the sheer transistor count the product needs. Schedule risk adds to the cost: early in a node’s life the defect density is higher, and the cell libraries, process design kits and bought-in blocks are still changing.

Interfaces drive the floorplan

Interface choices fix bandwidth and pin budgets early. Take a 32-bit memory interface at 6,400 MT/s (million transfers per second). Each transfer moves 32 bits, or 4 bytes, so the peak is $4 \times 6{,}400\,\text{million} = 25.6\,\mathrm{GB/s}$. The spec must also say what fraction of that peak the workload needs to sustain, because that sets how many requests the memory controller must queue and how much buffering the chip needs.

Each PHY sits on the die edge and brings its own power supplies, electrostatic-discharge (ESD) protection and assignment of package balls. So the number of PHYs constrains the die’s shape and the package from day one. Compliance programs also require test modes, such as loopbacks that send a link’s output straight back into its input, which must be in the design. Pick IP with a compliance record on your node, because hard PHYs do not move between processes.¹⁶

Test, safety and security interact

Manufacturing-test targets follow from the quality target. Defect level, the fraction of bad chips that pass test, is a function of yield and fault coverage.¹⁵ So a DPPM goal translates into coverage numbers for two fault models: stuck-at faults, where a node is stuck at 0 or 1, and transition faults, where a node switches too slowly.

Safety adds test in the field. LBIST (logic built-in self-test) puts a pattern generator and a checker on the chip so the logic can test itself while the car runs. Safety also adds metrics with hard targets that depend on the ASIL. Diagnostic coverage measures how many faults a safety mechanism catches. The single-point fault metric must reach at least 99% for ASIL D.¹³

Security pulls the other way. Scan chains and JTAG give direct access to internal registers, and MITRE’s catalog of hardware weaknesses has a whole category for debug and test problems, next to power, clock, thermal and reset concerns.⁹ The usual answer is a set of life-cycle states. In OpenTitan, for example, debug and scan-based test are enabled during manufacturing and disabled in production, moving between states requires a token, and the design ensures that states with debug access cannot expose the device’s secrets in normal use.⁸ A spec that wants high coverage, self-test in the field and protected keys must define these states, how an unlock is authorized and how secrets are handled during test, before architecture starts.

The model is illustrative but exact, and the Expert view shows each formula with the current numbers substituted:

• supply voltage $V = 0.6 + 0.2 f$ ($f$ in GHz);
• switching power per core $0.8\,V^2 f$, and leakage per core $0.15\,V$;
• a fixed 0.5 W uncore;
• area 2.0 mm² per core plus 6.0 mm²; and
• dies per wafer $\approx \pi \cdot 150^2/A - \pi \cdot 300/\sqrt{2A}$.

The straight-line link between voltage and frequency is a stand-in for the alpha-power law (see “Under the hood”). In that law, a gate’s delay is roughly the charge it must move, $C V$, divided by the current its transistors can drive. That current grows as $(V - V_{\mathrm{T}})^{\alpha}$, where $V_{\mathrm{T}}$ is the voltage at which the transistors start to conduct.²⁸

Compare the default with 6 cores at 1.0 GHz. The supply drops from 0.9 V to 0.8 V, and that is where the saving comes from. Then find the highest throughput that fits in 5 W. Note which term dominates there (switching, leakage or uncore), and what it costs in dies per wafer.

The four blocks below follow one made-up system on a chip, the VX-200 smart-camera chip, from requirements to evidence: the requirements table, a spec-stage power budget, an excerpt from the test plan that ties tests to requirement IDs, and a requirements trace report from late in the project. All numbers are illustrative.

A script joins the requirements, the test plans, the results of the automated test runs, and the timing and power reports into a trace report. This is what a program review looks at. In airborne hardware it is the evidence reviewers use to confirm that every requirement is completely covered by verification.¹⁰ Two terms in the report: WNS (worst negative slack) is how far the slowest path misses its timing target, and ATPG coverage is the share of faults detected by the patterns from automatic test-pattern generation, the tool that creates the factory tests.

Requirements trace report, VX-200 spec rev 0.7, regression 2026-09-28 (illustrative)
REQ       Method  Covered by                          Evidence          Status
PERF-001  A, T    sta_signoff_ss_0p81v_105c           WNS -12 ps        OPEN
PERF-004  T       video_enc_4k30 (emulation)          31.2 frames/s     PASS
PWR-002   A, T    power_est_w1 (gate-level)           5.21 W            FAIL  budget 5.00 W
PWR-005   A, T    power_est_standby                   1.6 mW            PASS  silicon test pending
AREA-001  I       floorplan_area                      24.1 mm²          PASS
IF-003    T       pcie_rootport_link_gen4             2/2 tests         PASS
IF-007    T, A    ddr_training, ddr_bandwidth         2/2 tests         PASS
DFT-001   A       atpg_coverage                       98.6% stuck-at    FAIL  target 99%
SEC-004   T, I    debug_jtag_locked_prod              2/2 tests         PASS
SAF-002   I, T    sram_ecc_single_bit                 1/1 tests         PASS
ENV-001   T       (none)                              -                 UNTRACED
Summary: 11 requirements: 7 pass, 1 open, 2 fail, 1 untraced

• Corner mismatch. The spec states a frequency at one voltage and temperature, and signoff checks timing at another, so passing signoff doesn’t prove the requirement. Write the signoff corners into the requirement, so that timing closure at those corners is the evidence.
• TDP without a peak-current requirement. Average power fits the package, but the sudden jump in current when blocks switch modes makes the supply voltage sag (in engineering shorthand, a di/dt problem: current changing fast). Peak current needs its own requirement, which feeds the number of power bumps and the amount of on-die decoupling capacitance.
• A yield model too kind for a big die. Using the defect density of a mature process for a young one, or the wrong yield model, changes cost per good die by tens of percent at large area. Run both the Poisson and negative binomial models (see “Under the hood”), and use the factory’s numbers where you have them.²¹
• Security bolted on. A debug port left open in production, or secrets readable through scan, are catalogued hardware weaknesses.⁹ Test and debug interfaces belong in the threat model from the start.⁷
• Safety metrics found late. The automotive hardware metrics have hard targets, such as a single-point fault metric of at least 99% for ASIL D: at most 1% of faults that would directly break a safety goal may go uncaught by a safety mechanism.¹³ If the fault campaigns (simulations that inject faults and count how many are caught) run only after the design is frozen and fall short, adding safety mechanisms then costs area, power and re-verification.
• The executable model drifts. The reference model and the design code drift apart. The checker that compares them then starts treating design bugs as expected behavior. Version the model with the spec and review changes to both together.
• Too many firsts. A new process, a new interface generation and a new architecture on one chip multiply schedule risk. Late requirement changes then land on a project with no slack, which is where the NASA cost multipliers come from.⁴

This section covers the models behind the numbers in a spec: why power, not transistor count, limits modern chips, how voltage and frequency trade, and how die size turns into cost. A transistor here is just a voltage-controlled switch. A small voltage on its control input, the gate, turns it on or off, and the threshold voltage, $V_{\mathrm{T}}$, is roughly where it flips.

Dennard scaling

Dennard scaling comes from a 1974 paper. Dennard and colleagues showed what happens if you shrink a transistor’s dimensions and its supply voltage by the same factor $\kappa$ (and raise the doping, the impurities that set its electrical behavior, by $\kappa$). Its current and capacitance both scale by $1/\kappa$. The delay of each circuit scales by $1/\kappa$, so it gets faster. The power of each circuit scales by $1/\kappa^2$. The area of each circuit also falls by $1/\kappa^2$, so power per square millimeter stays constant. In their words: “even if many more circuits are placed on a given integrated circuit chip, the cooling problem is essentially unchanged.”²⁶ For decades, Moore’s law plus Dennard scaling gave exponential performance gains. Each new process brought more transistors, faster transistors and more efficient transistors at once.²⁷

Why it broke, and dark silicon

Dennard scaling requires the threshold voltage to fall along with the supply. But a transistor below threshold is not fully off. A small subthreshold current still flows, and it grows about tenfold for every 100 mV the threshold drops (at a subthreshold slope near 100 mV per decade). Harris’s 65 nm example gives off-currents of 1, 10 and 100 nA per µm of transistor width at $V_{\mathrm{T}}$ of 0.5, 0.4 and 0.3 V.²⁴ Multiply that by billions of transistors and the leakage becomes unaffordable. So the threshold stopped falling, supply voltage scaling slowed, and energy per transistor stopped falling as fast as transistor counts rose. Chips became limited by power.²⁷

Esmaeilzadeh and colleagues modeled what this means for multicore chips. They projected that 21% of a fixed-size chip must be powered off at 22 nm, and more than 50% at 8 nm, with only a 7.9× average speedup on parallel workloads through 2024.²⁷ That powered-off fraction is dark silicon. For a spec writer, it means the binding constraint on a large digital chip is usually the power budget, not the transistor budget. That is why modern SoCs fill their area with specialized accelerators that sit idle most of the time.

Switching power and leakage

Where $P = \alpha C V^2 f$ comes from: each time a node charges up and back down, it draws $C V^2$ of energy from the supply. A node that does this $f_{\mathrm{sw}} = \alpha f$ times per second therefore dissipates $\alpha C V^2 f$. A clock has $\alpha = 1$, a signal that switches once every cycle has $\alpha = 1/2$, and typical logic averages around 0.1. Short-circuit current, which flows for a moment while both transistors of a gate are partly on, usually adds less than 10% of switching power. Static power is the sum of four leakage currents times the supply: $(I_{\mathrm{sub}} + I_{\mathrm{gate}} + I_{\mathrm{junction}} + I_{\mathrm{contention}})\,V$. These are subthreshold, gate-insulator, junction and contention currents.²⁴

At the spec stage, each input comes from somewhere different. $C$ comes from the switched capacitance per mm² of a previous design, scaled for the new process. $\alpha$ comes from traces of the target workloads. Leakage comes from the cell library’s data at the hot corner. The least certain term is $\alpha$, which is why budgets state their workload.

The voltage–frequency relationship

Sakurai and Newton’s alpha-power law (their Berkeley report writes the exponent as n) models a transistor’s saturated current as proportional to $(V_{\mathrm{GS}} - V_{\mathrm{T}})^{\alpha}$. Here $V_{\mathrm{GS}}$ is the gate voltage and $V_{\mathrm{T}}$ the threshold. The exponent $\alpha$ falls from 2 toward 1 as velocity saturation grows: in short transistors, the electrons hit a speed limit. The law gives a gate’s delay in terms of $C_{\mathrm{L}} V_{\mathrm{DD}}$ (the charge to move) divided by that current.²⁸ Maximum frequency therefore scales roughly as $(V - V_{\mathrm{T}})^{\alpha} / V$. Well above threshold this is close to linear in $V$, which is why the simulator can use $V = 0.6 + 0.2 f$. Near threshold, it collapses.

Combine that with $P \propto V^2 f$, step by step:

1. If frequency is roughly proportional to $V$ over the operating range, then $V$ rises with $f$.
2. So switching power, $V^2 f$, rises roughly with the cube of frequency.
3. Energy per operation, $V^2$, rises with the square.
4. Throughput, meanwhile, grows linearly with the number of cores.

So more cores at a lower frequency and voltage can match the throughput of fewer, faster cores for less power: “wide and slow.” In the simulator, 4 cores at 1.5 GHz (0.9 V) need 4.93 W, while 6 cores at 1.0 GHz (0.8 V) deliver the same 6.0 throughput for 4.29 W. The costs are more area (18 mm² against 14 mm²), more leakage from more transistors, and workloads that must actually split across cores.

The trade has a floor. Dreslinski and colleagues report that lowering the supply from a nominal 1.1 V into the near-threshold range of 400–500 mV gives up to 10× better energy efficiency, at about 10× lower performance. In their 45 nm example, a standard delay benchmark (the fanout-of-four inverter delay) was 10× slower at 400 mV. Below threshold, delay grows exponentially, so leakage energy per operation rises, and total energy reaches a shallow minimum. Commercial parts typically keep the supply above about 70% of nominal because of robustness and performance concerns.²⁹ Near-threshold designs therefore need massive parallelism to recover throughput, and they suit power-capped products such as sensors. The same physics underlies DVFS (dynamic voltage and frequency scaling), which lowers voltage and clock together whenever full speed isn’t needed.

Dies per wafer

The standard estimate is:²⁰

The first term is the wafer’s area divided by the die’s area. The second approximates the loss at the edge. The wafer’s circumference, $\pi d$, divided by the diagonal of a square die, $\sqrt{2A}$, roughly counts the partial dies that straddle the edge. For a 300 mm wafer, a 100 mm² die gives about 640 and a 600 mm² die about 91. Production estimates also subtract the scribe lanes where the wafer is sawn, an unusable rim at the edge, and test sites.

Yield models

With mean defect density $D_0$ and die area $A$, the expected number of fatal defects per die is $D_0 A$. The models below differ in how they treat the fact that defects are not spread evenly: they vary from wafer to wafer and bunch together. Leachman’s notes give the standard family:²¹

• Poisson: $Y = e^{-D_0 A}$. Assumes defects land independently, like raindrops. Accurate for small dies (about 0.25 cm² or less) and $D_0 A$ below 1. Because the per-layer yields multiply, each layer’s defect density can be separated.
• Murphy: $Y = \left(\frac{1 - e^{-D_0 A}}{D_0 A}\right)^2$. Lets the defect density itself vary across wafers, with a triangular distribution.
• Seeds: $Y = 1/(1 + D_0 A)$. Assumes the defect density follows an exponential distribution, which means strong bunching.
• Negative binomial: $Y = (1 + D_0 A/\alpha)^{-\alpha}$. The defect density follows a gamma distribution with a cluster parameter $\alpha$ (a different $\alpha$ from the activity factor). With $\alpha$ of 10 or more it is essentially Poisson, $\alpha = 5$ closely approximates Murphy, and $\alpha = 1$ gives Seeds.

Bunching puts several defects on the same dies and leaves others clean, so Poisson underestimates the yield of large dies.²¹ Baas’s course notes use the negative binomial with $\alpha \approx 3$, and 0.5–1 defects per cm² as typical values for CMOS processes.²⁰ The models agree for small dies and diverge for large ones. At $D_0 = 0.2$ defects per cm², a 100 mm² die yields 82–83% under every model. A 600 mm² die ($D_0 A = 1.2$) yields about 30% under Poisson, 34% under Murphy, 36% under the negative binomial with $\alpha = 3$, and 45% under Seeds.

Cost per good die

Cost per good die is:²⁰

Dies per wafer falls slightly faster than $1/A$, and yield falls exponentially in $A$, so cost per good die grows faster than area. Use the numbers above with an illustrative $10,000 wafer and $D_0 = 0.2$ per cm²:

• A 100 mm² die costs about $19.
• A 600 mm² die costs about $300 under the negative binomial ($\alpha = 3$), and about $370 under Poisson.

That is roughly 16–19 times the cost for 6 times the area. Full unit cost adds testing and packaging, plus the one-time costs divided by volume.²⁰ These sensitivities are why the spec fixes a die-size class early, and why very large designs move to chiplets.