Checklist: 10 Steps to Tape Out a Chip Without Fatal Errors

Tapeout is the moment a design stops being software. Up to that point, a fix is an edit, a rebuild, and a rerun. After the mask set is ordered, a fix is a new set of masks, a new schedule slot, and a conversation with whoever is paying for the wafer. The frustrating part is that most chips that fail on the bench did not fail because of an exotic physics problem. They failed because a netlist was stale, a constraint nobody rechecked was hiding a violation, or a memory abstract did not match the GDS that actually taped out.

This is the checklist worth running in the final weeks, in order, with an owner and evidence for each line.

Freeze First, Verify Second

Everything below is worthless if it is not run on exactly one revision. Tag the source, record the commit hash, record the tool versions, and write down the exact command or script that produced each report. If two engineers are running DRC on two different checkouts, you do not have two opinions. You have two designs.

Freeze the spec alongside the netlist. If a feature was dropped in week thirty-four, the verification plan should say so. Half of the confusion in a tapeout review comes from checking against an intention rather than against what is actually in the RTL.

The Ten-Step Pre-Tapeout Checklist

1. Tag and lock one revision. No "latest" builds, no local patches, no uncommitted fixes. Confirm that generated files—memories, PLLs, analog macros—were regenerated from that revision and not pulled from a previous run.
2. Re-run structural checks on that revision. Lint, clock-domain crossing checks, reset-domain crossing checks, and X-propagation analysis. Review the waiver list line by line; a waiver written eighteen months ago for a block that has since changed is not a waiver, it is a guess.
3. Audit the constraints themselves. Run an SDC lint. Check every clock definition, generated clock, false path, and multicycle path, and make sure each one has a name and a reason attached. Bad constraints do not create violations—they hide them.
4. Close timing in every corner and every mode. Slow, fast, and typical; high and low voltage; hot and cold. Include scan shift, scan capture, memory BIST, JTAG, and any low-power or retention mode. On-chip variation, crosstalk, and min/max delays all belong in the signoff, not in a follow-up run.
5. Prove the power grid. Static and dynamic IR drop, electromigration on both signal and power nets, inrush current, and the power-up sequence. Verify that every always-on domain behaves like one and that nothing powers up in an undefined order.
6. Verify the low-power structures. Isolation cells present and enabled where required, retention flops wired as intended, level shifters on every crossing, and power switches controlled by logic that is itself always on.
7. Finish DFT and test-mode timing. Scan chains stitched and balanced, compression working, ATPG coverage at target, memory BIST instantiated, boundary scan connected. Then check all of it again in timing, because test modes are where corners quietly break.
8. Run full physical verification. DRC, LVS, ERC, antenna checks, density and fill, dummy devices. LVS must be run against the same netlist you taped out, including the final ECOs. A clean LVS from three weeks ago proves nothing about this week's layout.
9. Validate every hard macro against its real data. Memo, PLL, SerDes, analog blocks, IO cells. Compare the LEF against the GDS, confirm pin placement, check the abstract includes everything the router assumed, and confirm the timing models match the silicon you are buying.
10. Check the package and the edge of the die. Bump or pad map against the package substrate, pad ring order, seal ring, scribe-line rules, ESD structures. Mirror a bump map and you get a chip that works perfectly and cannot be assembled.

Where Real Tapeouts Actually Break

The failures that reach fab tend to be small, boring, and human. Watch for these patterns in the final review:

• A hard macro was regenerated with a slightly different aspect ratio, and the floorplan was never updated.
• An exception in the timing constraints was added to silence a warning and never removed.
• Two engineers ran the same check with different options and only the cleaner result was reported.
• A tie cell, filler cell, or well tap was dropped by a last-minute ECO with no rerun of physical verification.
• The test-mode clock reaches a block that has no scan path through it, so the block is untestable and nobody noticed.

None of these show up as dramatic. They show up as a phone call six months later.

Reviews and Sign-Off: Assign Names, Not Just Tools

Tools produce reports. People accept risk. Build a sign-off matrix with one row per discipline—timing, physical verification, power, DFT, analog, package—and a named owner for each. The owner writes down what was checked, what tool and version produced the result, and what is still open. "Open" is an acceptable answer. "Probably fine" is not.

Hold the review with the reports on screen, not summarized in a slide. Ask each owner to point at the actual output. It is uncomfortable and it catches things.

The Final Week

Stop adding features once the freeze is declared. Run the complete regression twice from a clean checkout, on two different machines if you can, and compare the results bit for bit. Freeze the layer map and the mask order form early, and have someone who did not create it check the revision numbers by hand.

Budget for a respin and hope you do not need it. The goal of this checklist is not a perfect chip—it is a chip whose problems are known, documented, and worth the cost of fixing. Get the boring steps right and the interesting ones have room to be interesting.

Photo: Quang Nguyen Vinh / Pexels