STA Interview Questions

What is static timing analysis, and how is it different from timing simulation?

Static timing analysis (STA) checks every timing path in a design against its clock constraints without applying any input vectors. It adds up the cell and wire delays along each path and compares the arrival time with the time the data is required at the capturing flop.

Timing simulation only checks the paths that the chosen test vectors happen to exercise, so it can miss a slow path that no test sensitizes. STA covers all paths exhaustively and runs in minutes, but it cannot tell whether a path is functionally possible, which is why constraints such as false paths are needed.

Read more on What Is Static Timing Analysis?.

What are the four types of timing paths?

• Input to register: from a primary input to the data pin of a flop.
• Register to register: from the clock pin of a launching flop to the data pin of a capturing flop.
• Register to output: from a flop to a primary output.
• Input to output: a purely combinational path from an input straight to an output.

Each path starts at a startpoint (an input port or a flop clock pin) and ends at an endpoint (an output port or a flop data pin). Input and output paths are timed with the input and output delays that describe the world outside the block.

Read more on Timing Paths.

What is slack, and what do WNS and TNS mean?

Slack is the margin on a path: for setup it is the required time minus the arrival time, and for hold it is the arrival time minus the required time. Positive slack means the check is met, negative slack means it is violated.

WNS (worst negative slack) is the most negative slack in the design, and it limits the clock frequency. TNS (total negative slack) is the sum of all negative slacks, and it shows how widespread the violations are. A design with a WNS of -50 ps on one path is much easier to close than one with the same WNS spread over thousands of endpoints.

Read more on Arrival Time, Required Time and Slack.

Write the setup and hold equations for a flop-to-flop path.

For a path launched and captured by the same clock with period T:

// Setup: data must arrive before the next capture edge
Tlaunch + Tclk_to_q + Tcomb  <=  T + Tcapture - Tsetup - Tuncertainty

// Hold: data must not change too soon after the same capture edge
Tlaunch + Tclk_to_q + Tcomb  >=  Tcapture + Thold + Tuncertainty

Here Tlaunch and Tcapture are the clock arrival times at the launching and capturing flops. Setup compares against the next clock edge, so it depends on the period. Hold compares against the same edge that launched the data, so the period does not appear at all.

Read more on The Setup Equation and The Hold Equation.

Which is more critical to fix, a setup or a hold violation?

A hold violation is more serious. A setup violation can be avoided by slowing the clock, so the chip still works at a lower frequency. A hold violation does not depend on the clock period, so a chip with a real hold violation fails at every frequency.

In practice setup is fixed first during optimization, because fixing it changes cell sizes and paths, and hold is fixed after clock tree synthesis, when the real clock skew is known. But hold must be clean before tapeout.

Read more on Fixing Hold Violations.

How does clock skew affect setup and hold?

Skew is the difference between the clock arrival times at the capturing and launching flops. If the capturing clock arrives later than the launching clock (positive skew), the data has more time, so setup improves but hold gets worse. If the capturing clock arrives earlier (negative skew), setup gets worse and hold improves.

Deliberately using skew to help a critical path is called useful skew. The same skew always moves setup and hold in opposite directions, so it has to be balanced against the hold margin on the same flops.

Read more on Clock Skew: Useful and Harmful.

What is the difference between clock latency and clock uncertainty?

Clock latency is the delay from the clock source to a flop's clock pin. Source latency is the part before the clock definition point, for example inside a PLL or off chip. Network latency is the part through the clock tree on the chip. Before clock tree synthesis, latency is estimated with set_clock_latency; after it, the real propagated tree delays are used.

Clock uncertainty is a margin added to the checks to cover what is not modelled: jitter, and before CTS also the expected skew. It makes setup and hold checks harder by the given amount.

set_clock_latency -source 0.5 [get_clocks clk]
set_clock_uncertainty -setup 0.10 [get_clocks clk]
set_clock_uncertainty -hold  0.05 [get_clocks clk]

Read more on Clock Latency and Clock Uncertainty.

What is a generated clock, and when do you need one?

A generated clock is a clock derived from another clock inside the design, for example by a divider flop, a clock gating cell output that is used as a clock, or a multiplexer. It is defined with create_generated_clock relative to its master clock.

create_clock -name clk -period 10 [get_ports clk]
create_generated_clock -name clk_div2 -source [get_ports clk] -divide_by 2 [get_pins div_reg/Q]

Without it, the tool does not know the derived clock's period and its phase relationship with the master, and flops clocked by the divider output are either left unconstrained or timed incorrectly.

Read more on Generated Clocks.

What do set_input_delay and set_output_delay describe?

set_input_delay is the time after the clock edge at which an input signal arrives at the block's port, coming from logic outside the block. set_output_delay is the time the external logic needs after the output leaves the block, before the next clock edge.

set_input_delay  2.0 -clock clk [get_ports data_in]
set_output_delay 3.0 -clock clk [get_ports data_out]

With a 10 ns clock, the input delay leaves 8 ns for the logic inside the block from data_in to its first flop, and the output delay leaves 7 ns from the last flop to data_out. Without them, the input and output paths are not timed at all.

Read more on Input and Output Delays.

What is a false path? Give an example.

A false path is a path that exists in the netlist but can never carry a meaningful transition within the timing check, so it should not be timed. Common examples are paths between asynchronous clock domains that go through a synchronizer, paths from static configuration registers that are written once and then held, and paths through logic that is never active together because of a mode select.

set_false_path -from [get_clocks clk_a] -to [get_clocks clk_b]

The risk is that a false path removes checking completely. A wrongly declared false path hides a real violation, so each one must be reviewed, and clock domain crossings still need a separate CDC check.

Read more on False Paths.

What is a multicycle path, and why does it usually need a hold adjustment?

A multicycle path is a path that is allowed more than one clock cycle to settle, for example a datapath whose result is only sampled every second cycle because an enable controls the capture flop.

set_multicycle_path 2 -setup -from [get_pins src_reg/CP] -to [get_pins dst_reg/D]
set_multicycle_path 1 -hold  -from [get_pins src_reg/CP] -to [get_pins dst_reg/D]

Moving the setup check to the second edge also moves the default hold check forward by one cycle, which would require the data to stay stable for a full extra cycle. The hold multiplier of N-1 (here 1) moves the hold check back to the original launch edge.

Read more on Multicycle Paths.

What are recovery and removal checks?

They are the setup and hold checks of an asynchronous control pin, such as an asynchronous reset or set, measured against the clock. Recovery is the minimum time between the reset being released and the next active clock edge. Removal is the minimum time the reset must stay asserted after a clock edge.

If the reset is released too close to the clock edge, the flop can go metastable or different flops can leave reset in different cycles. That is why asynchronous resets are usually asserted asynchronously but released through a reset synchronizer, so the release is timed like a normal synchronous path.

Read more on Recovery and Removal Checks.

Which PVT corner is used for setup and which for hold?

Setup is usually worst at the slow corner: slow process, low voltage and, in older nodes, high temperature, because cells are slowest. Hold is usually worst at the fast corner: fast process, high voltage and low temperature, because data arrives earliest.

In advanced nodes temperature inversion means cells can be slowest at low temperature, so both temperature extremes must be checked. Wire corners (RC corners) are combined with the transistor corners as well, which is why sign-off is done over many corners in multi-corner multi-mode analysis.

Read more on PVT Corners and MCMM Analysis.

What is on-chip variation, and what does CPPR do?

On-chip variation (OCV) means two identical cells on the same die can have slightly different delays. STA models it with derates: for setup, the launch clock and data paths are made slower and the capture clock path faster, and the opposite for hold. Advanced methods such as AOCV and POCV make the derate depend on path depth and statistics instead of one flat number.

The flat derate is pessimistic on the part of the clock tree that the launch and capture clocks share, because the same buffer cannot be both fast and slow at the same time. Common path pessimism removal (CPPR) adds back that artificial difference for the shared portion of the clock path.

Read more on On-Chip Variation and Derates and CPPR.

How do you fix a setup violation and a hold violation?

For setup, the goal is to make the data path faster or give it more time:

• Upsize cells on the critical path, or use a lower threshold voltage cell.
• Restructure logic to reduce depth, or pipeline the path in RTL.
• Buffer long or heavily loaded nets, and move cells closer together.
• Use useful skew if the next stage has margin.

For hold, the data path must be made slower without hurting setup: insert delay buffers on the short path, usually near the capturing flop, or downsize cells. Hold fixes are done after clock tree synthesis, with real clock skew, and must be checked at the fast corner.

Read more on Fixing Setup Violations and Fixing Hold Violations.