After tapeout

Tapeout hands the foundry the finished layout. From then on the design team works through four streams of evidence at once:

• the fab’s process and yield data, which say how well the wafers were made;
• the production test program (wafer sort, final test and burn-in), which decides which parts ship;
• lab bring-up and characterization, which show how the design actually behaves; and
• reliability qualification, which shows how long it will keep working.

They meet at one decision per chip revision: ship it, fix it by changing only the wiring layers, or respin with a new full mask set. Hunting design bugs in silicon (post-silicon validation) follows four steps: detect a problem, localize it, find the root cause, then fix or bypass it by patching, by editing the circuit, or, as a last resort, with a new mask.¹

This is where choices made before tapeout get judged. Design for test (DFT), the extra logic that lets a tester reach inside each chip, decides how fast bad dies are found and diagnosed. Spare cells, unused gates scattered through the layout, decide whether a bug can be fixed in metal. Debug access and on-chip monitors decide how long a bug hunt takes. The fab and packaging steps are covered in depth in Making them and Packaging and chiplets; this page follows the design team’s side of them.

Mask-set cost climbs steeply with each process generation. One estimate, quoted in a UC Davis course handout from AMD’s chief technology officer in 2016, put a full set at about $2 million for a 28 nm process, $4 million at 14/16 nm and $8–10 million at 7 nm. Two drivers dominate: finer features, which take longer to write and inspect, and the extra masks that multiple patterning needs for a single layer.⁴

Mask inspection measures feature placement as well as size,⁴ because a correctly sized shape in the wrong place turns into an alignment (overlay) error on every wafer. For the design team, mask cost shapes the fix strategy later. The masks for the transistor layers at the bottom of the stack (the base layers) are the most expensive. A fix that changes only the metal wiring reuses them and buys only new metal and via masks. A full respin needs a new set of base-layer masks before any wafer can start.

The design team sees the fab mostly through data. Each wafer carries small test structures between the dies, built to measure one process parameter each: transistor turn-on threshold, and the resistance of polysilicon and contacts.¹⁷ Their results (the parametric data) show where each wafer landed within the process’s allowed range. Yield losses come in two kinds. Line yield is whole wafers lost to damage or processing mistakes before they reach test; die yield is the share of dies on a finished wafer that pass, which is what wafer sort measures.¹⁶ Lining up a lot’s parametric data (a lot is a batch of wafers processed together) with its test results is the first step in explaining a bad wafer: a lot with slow transistors and a lot with a particle problem fail in different ways.

Lithography choices also reach back into the design. A layer printed with two masks needs every shape assigned to one of them, a step called coloring, and neighboring shapes on the same mask must stay far enough apart to print; the router enforced those rules before tapeout. High-NA EUV uses anamorphic optics, which magnify differently in the two directions and halve the area exposed in one shot from 26 × 33 mm to 26 × 16.5 mm.¹³ That halves the largest die one exposure can print, and pushes very large designs toward stitching two exposures together or splitting into several dies.⁵

Why the 76 nm figure, and how far EUV goes, is worked through step by step in Under the hood below. The process steps themselves (deposition, etching, implantation, polishing) are in Making them.

Tester time is expensive, so production tests are kept short. They give a go/no-go answer with no diagnosis, and testers save time by testing several dies at once.¹⁷ That means yield work needs a separate mode that logs the full failure data (which pattern failed, at which output) for a sample of dies, so the failures can be traced to a location later.

Wafer maps carry signatures that the yield model has to separate.

• Edge loss. Deposited films are often well controlled across the middle of the wafer but not near the edge, so dies near the edge fail together. Parametric tests and in-line inspection usually skip edge dies, so this loss shows up as die yield loss even though random defects don’t cause it.¹⁶
• Clustering. Real defects bunch together, so some dies collect several while their neighbors get none. That makes the random (Poisson) model pessimistic for large dies; the negative binomial model adds a cluster parameter $\alpha$ to account for it.¹⁶

For products built from several dies the arithmetic is unforgiving. If four dies are assembled untested and each is good with probability 0.9, the package works only if all four do: $0.9^4 \approx 66\%$, before any loss in assembly itself. Testing each die first and assembling only known-good die removes that multiplication.¹⁹³³ It also means the test logic has to reach every die, including dies buried in the middle of a stack.

Every assembly step can damage a good die, so testing moves earlier and repeats: each die at wafer sort, sometimes each partial stack, and the finished package. Chiplet designs pay for this in area, because every chiplet needs its own clocking, power management, test and debug circuitry that a single large die would have shared.³³ Stacks add two more problems. Test signals have to pass through the dies between the tester and the target,¹⁹ and heat builds up: in one simulation study, folding a 7 nm processor into two stacked tiers raised its peak temperature by up to 12 °C over the flat version, and putting memory on one tier and logic on the other halved that rise.³⁴

Die-to-die links also need a way to survive a bad connection. The UCIe standard for chiplet links takes different approaches in its two package types: the advanced-package version provides spare lanes that can stand in for a failed one, while the standard-package version instead runs the link at reduced width.²² Burn-in is very expensive and has to be balanced against the reliability target,¹⁷ so long burn-in is kept for products whose reliability requirements justify the oven time.

Stacking order is a yield decision. Wafer-to-wafer bonding, which bonds two whole wafers before cutting, is easier to align and reaches the finest pitches, 400 nm in research; chip-on-wafer bonding, which places individual dies onto a wafer, reached about 2 µm in the same work.²³ But a wafer-to-wafer stack is defective if any one of its dies is, whereas stacking individual dies lets each be tested first and even matched by bin.¹⁹ For the design team, that means the DFT plan has to cover each die alone at wafer sort, each partial stack, and the finished package.

Detection is cheap, because silicon runs real programs at full speed and a crash is obvious. Localizing the bug, narrowing it to one block and a short stretch of time, dominates the effort and cost, and one bug can hide others behind it.¹ Electrical bugs are the hardest: a logic bug typically takes hours to days to localize, an electrical bug days to weeks, with more expensive equipment.¹

The tools, and their limits:

• Trace buffers. How much a single run can capture is set by on-chip trace-buffer capacity. Compressing the data adds 20–30%, and sharing buffers between blocks on the fly, instead of fixing each block’s share at design time, doubled the data captured in one case study.¹
• Speed-path debug. A speed path is the slowest chain of logic, the one that limits the clock frequency. To find it, teams collect results at several clock frequencies, using clock-tuning circuits built into the design that stretch or shrink the clock for selected paths only.¹
• Scan dumps. Stopping the clock and shifting out every storage cell gives a complete snapshot, but it helps only if the failure repeats exactly. Many electrical bugs depend on noise and temperature and don’t repeat,¹ which is why the shmoo sweep comes first: it turns a vague failure into a reproducible point in voltage, frequency and temperature.
• Assertion monitors. Assertions are rules written during verification about how a block’s inputs and outputs must behave. Built into the chip as hardware checkers, a failing one narrows a crash to one block and one moment.¹

The methods used to diagnose manufacturing defects transfer only partly. They rely on scan test turning the chip’s logic into a simple input-to-output circuit for one clock tick, and a functional failure many millions of cycles into a program can’t be replayed that way.¹ The practical lesson for the next design is to budget debug hardware like any other feature: trace-buffer depth, trigger logic, monitor coverage and clock control all have to exist before the first part comes back.

In practice the fix path depends on what kind of problem was found:

A metal ECO is not free. Every one reruns the signoff checks on the changed design: equivalence checking (proving the edited netlist does what the fix intended), extraction and static timing analysis (recomputing wire delays and rechecking every timing path), design-rule and layout-versus-schematic checks, and local metal refill. It avoids a full new mask set, which costs far more than a few metal masks,²⁶⁴ but new metal and via masks and the back-end processing steps still take time.

Spare-cell density is a bet placed before tapeout on where bugs will be. In one study, pre-placing spare cells in 70% of the layout’s unused space let a spare-cell rewiring method repair 70% of injected functional errors.¹ A FIB edit that works on real silicon is the strongest evidence a metal fix will too.

Qualification targets the wear-out mechanisms, each a slow physical change that eventually breaks a part:³⁰

• Electromigration (EM): current gradually pushes metal atoms along a wire until it thins and opens.
• Hot-carrier degradation: fast-moving electrons damage the transistor near its drain, slowing it.
• Time-dependent dielectric breakdown (TDDB): the thin insulator under the gate wears through.
• Negative bias temperature instability (NBTI): PMOS transistors held on at high temperature drift, needing more voltage to switch.

HTOL is usually the final qualification step: typically about 100 parts for 1,000 hours at raised voltage and temperature. Stress levels are chosen to guarantee zero failures, and a test with zero failures yields little statistical data.³⁰ Worse, one stress condition speeds up each mechanism by its own factor, so a single acceleration factor gives the wrong answer when several mechanisms compete.³⁰

AEC-Q100 allows the HTOL temperature to be set by the chip’s own (junction) temperature rather than the surroundings. In that case the team must show the run is equivalent to 1,000 hours at the rated ambient temperature, using an activation energy of 0.7 eV or another justified value. It also asks for drift analysis of key electrical parameters after stress, to confirm the guard bands, the margins between measured performance and the data sheet, are large enough.³ This ties reliability back to characterization: the margin a part shows when new has to cover how far it drifts over its life.

The sample sizes reflect what each test is for. HTOL uses 231 parts to show the wear-out mechanisms stay outside the product’s life; ELFR uses 2,400 parts, 800 from each of three lots, because early-life failures are rare and need a large population to show up at all.³ Neither proves a low failure rate in the field on its own. Under the hood, below, turns a zero-failure result into a FIT bound step by step and shows how much that bound depends on the assumed activation energy.

The yield-learning loop

Leachman’s course notes split die yield into a part that depends on die area and a part that doesn’t:

Here $A$ is the die area, $D_0$ the density of random killer defects, and $Y_{\mathrm{s}}$ the systematic-limited yield, the losses that hit a die whatever its size. Taking logarithms gives $\ln \mathrm{DY} = \ln Y_{\mathrm{s}} - A D_0$, a straight line in $A$ with slope $-D_0$ and intercept $\ln Y_{\mathrm{s}}$.¹⁶

One product, with one die size, gives only one point on that line. The windowing technique makes more from the same wafer maps:¹⁶

1. Compute the ordinary die yield: one point at area $A$.
2. Group neighboring dies into pairs and treat each pair as one die of area $2A$, which works only if both halves work. Its yield is a second point.
3. Repeat with groups of three, four and so on, for points at $3A$, $4A$, …
4. Fit a line to $\ln(\text{yield})$ against area: the slope gives $D_0$ and the intercept gives $Y_{\mathrm{s}}$.

The split is by area dependence, not by cause, and a mechanism can land on either side. Edge loss, for instance, grows with die size and so ends up in $D_0$ even though random defects don’t cause it.¹⁶ For large dies, where defects cluster, the negative binomial model $Y = (1 + A D_0/\alpha)^{-\alpha}$ fits better; as the cluster parameter $\alpha$ grows past about 10 it becomes the same as the Poisson model.¹⁶

Fitted numbers measure the loss; finding its cause takes scan diagnosis. From a failing die’s tester response, a diagnosis tool lists candidate defect locations and behaviors. It is judged on resolution (how few candidates it reports) and accuracy (whether one of them is the real defect). Volume diagnosis then compares results across many failing dies to find a shared root cause, and selected dies go to physical failure analysis, which gives indisputable confirmation but is destructive and slow, so only a few dies get it.³¹ An inaccurate diagnosis sends that analysis to the wrong place on the wrong die.³¹

The other data sources have limits that make diagnosis central. Optical inspection in the fab finds defects less well as features shrink, and test structures such as comb drives and ring oscillators don’t reflect the variety of layout patterns in a real product, so failing product chips have themselves become the main vehicle for yield learning. Diagnosis is still improving: LearnX, which adds machine learning on top of conventional diagnosis, returned a single correct candidate for 73.2% of circuits in 30,000 simulated fault experiments, 86.6% more often than the commercial tool it was compared with.³¹

Physical failure analysis removes layers down to the suspect spot and images it. A focused ion beam can cut a cross-section through the exact location diagnosis points to, and prepare an electron-microscope sample of a single transistor out of millions.⁷³² The design team’s contribution comes earlier: test logic that makes diagnosis precise, fault models that know the layout, and full failure logs kept from production test.

Characterization methodology

Delft’s outline of characterization reads like a procedure:¹⁷

1. Set out to find the exact operating limits, with a worst-case test.
2. Choose a test that some chips pass and others fail.
3. Select a statistically significant sample of chips.
4. Repeat the test for every combination of two or more environmental variables, measuring DC and AC (steady-state and timing) parameters.
5. Plot the results as a shmoo.
6. Diagnose and correct design errors.
7. Develop the production test program.

It then continues for the production life of the chip.

Reading a shmoo is reasoning about physics. Gate delay falls as supply voltage rises, so a path that limits speed (a setup-limited path, where data must arrive before the next clock edge) gives a pass/fail boundary that slopes up and to the right. Hold violations, where data changes too soon after a clock edge, don’t depend on the clock period, so they show up as failures at every frequency, worst at high voltage on fast silicon. Holes inside the pass region suggest noise, a data-dependent electrical bug or a problem with the test itself. The sample has to include fast and slow material and every temperature corner before the team trusts any edge. Guard bands then go between the worst measured edge and the data-sheet limit, and AEC-Q100 asks for drift analysis after stress to confirm they are big enough.³

Lithography resolution

Rayleigh’s criterion says two points are just resolved when the central peak of one point’s image falls on the first dark ring of its neighbor’s; for a microscope this gives $R = 0.61\,\lambda/\mathrm{NA}$.¹² The numerical aperture is $\mathrm{NA} = n \sin\alpha$, where $n$ is the refractive index of the medium and $\alpha$ the largest half-angle of light the lens accepts.⁹ Lithography generalizes the criterion to $R = k_1 \lambda / \mathrm{NA}$, where $k_1$ collects everything else that sets resolution: the resist, the mask and the illumination.¹⁰ Depth of focus falls faster: in Rayleigh’s low-NA approximation, $\mathrm{DOF} = k_2 \lambda / \mathrm{NA}^2$.¹¹ As an illustration, a 248 nm (KrF) tool with NA 0.6 working at $k_1 = 0.75$ resolves $0.75 \times 248\,\mathrm{nm} / 0.6 \approx 0.31\,\mu\mathrm{m}$.

Resolution enhancement, meaning pre-distorted mask shapes (OPC), shaped illumination and phase-shifting masks, drives $k_1$ down, but a dense pattern of lines and spaces has a hard floor: $k_1$ cannot go below 0.25.¹³ Since $k_1$ here describes the half-pitch (one line or one space), the smallest pitch one exposure can print is $2 \times 0.25\,\lambda/\mathrm{NA} = 0.5\,\lambda/\mathrm{NA}$.¹⁴ The numbers follow directly:

The EUV wavelength and NA values come from IEEE Spectrum, the immersion figure from the multiple-patterning article, and the EUV pitches are arithmetic.¹³¹⁴ The depth-of-focus term explains why high NA costs more than the tool itself: the focus budget shrinks as $1/\mathrm{NA}^2$, so going from NA 0.33 to 0.55 cuts it to about $(0.33/0.55)^2 \approx 36\%$ of what it was, and wafer flatness, resist thickness and the polishing uniformity that metal fill protects all get tighter.

Reliability models

The bathtub curve has an early-failure period with a high but rapidly falling rate, an intrinsic period with a roughly constant rate, and a wear-out period in which degradation failures rise.²⁸ Burn-in addresses the first;¹⁷ FIT ratings describe the second;³⁰ qualification and design rules push the third past the product’s lifetime.

The acceleration factor is the ratio of time to failure in use to time to failure under stress, $t_{\mathrm{use}} = \mathrm{AF} \times t_{\mathrm{stress}}$, for the same failure mechanism. For temperature the Arrhenius model gives

with $k = 8.617 \times 10^{-5}\,\mathrm{eV/K}$, temperatures in kelvin, and $E_{\mathrm{a}}$, the mechanism’s activation energy, typically from 0.3 or 0.4 eV up to 1.5 eV or more.²⁹ Worked through for $E_{\mathrm{a}} = 0.7\,\mathrm{eV}$, the value AEC-Q100 names,³ stress at 125 °C against use at 55 °C:

1. Convert to kelvin: 125 °C = 398.15 K and 55 °C = 328.15 K.
2. $E_{\mathrm{a}}/k = 0.7 / (8.617 \times 10^{-5}) \approx 8124\,\mathrm{K}$.
3. $1/328.15 - 1/398.15 \approx 0.003047 - 0.002512 = 0.000536$ per K.
4. $\mathrm{AF} = \exp(8124 \times 0.000536) = \exp(4.35) \approx 78$.

So each hour at 125 °C stands for about 78 hours at 55 °C, for mechanisms that really have $E_{\mathrm{a}} = 0.7\,\mathrm{eV}$.

Zero-failure results only bound the failure rate. If failures happen at a constant rate $\lambda$, the chance of seeing none in $T$ equivalent device-hours is $e^{-\lambda T}$. Requiring that chance to be at most $1 - C$, for a confidence level $C$, gives $\lambda \le -\ln(1 - C)/T$. For an AEC-style HTOL:

1. Parts × hours: $3 \times 77 = 231$ parts for 1,000 hours = 231,000 device-hours.
2. Times the acceleration factor: $T \approx 231{,}000 \times 78 \approx 1.8 \times 10^{7}$ equivalent device-hours.
3. At 60% confidence, $-\ln(0.4) \approx 0.916$, so $\lambda \le 0.916 / (1.8 \times 10^{7}) \approx 5.1 \times 10^{-8}$ per hour.
4. FIT counts failures per $10^{9}$ device-hours, so that is about 51 FIT. At 90% confidence ($-\ln 0.1 \approx 2.30$) it is about 128 FIT.³⁰

The bound is only as good as the AF, and the AF is only right for mechanisms that share the assumed activation energy.³⁰ Redo step 2 with $E_{\mathrm{a}} = 0.4\,\mathrm{eV}$ and the AF falls to about 12, raising the 60% bound more than sixfold, to about 330 FIT.

Wear-out mechanisms get their own models. For electromigration, Black’s equation gives the median time to failure of a metal line as $t_{50} = A J^{-n} \exp(E_{\mathrm{a}}/kT)$, with $J$ the current density and $A$ a constant for the material and process. The original form uses $n = 2$; failures dominated by void growth, and narrow lines, fit $n = 1$. Higher current density and higher temperature both shorten life, which is what the electromigration limits checked at signoff protect against.³⁰