FPGA and RTL review
The failures that matter here pass simulation, close timing, and break in hardware. Finding them takes someone who has debugged them before.
Green reports that mean nothing
An FPGA design can report zero timing violations, zero critical warnings and full functional coverage while carrying a defect that will bite in the field. Timing closes because a false path was declared that isn’t false. Simulation passes because the testbench never drove the case that breaks it. The CDC tool ran and every one of its warnings was waived by someone in a hurry.
Those are the things I go looking for first: whether the constraints are honest, whether the waivers were justified individually or in a batch, and whether the verification actually exercised the corners it claims to.
After that it’s the classics that survive every automated check. Clock domain crossings on control paths with no synchroniser. Reset domain crossing. An accumulator sized for expected data rather than full-scale input. A state machine with no recovery from an illegal state, on a board that will see radiation or a brown-out.
Vendors
Xilinx and AMD (Vivado), Intel and Altera (Quartus), Microchip and Microsemi (Libero), including the flash-based parts used for rad-tolerant work. Behaviour differs between them in ways that matter, particularly around global reset and configuration, and findings name the vendor where it does.
Send me the warnings
The full synthesis and implementation logs, not the summary. “Unused sequential element removed” is reported as informational and nearly always means a connection somebody intended is missing.
What gets worked through
Architecture and partitioning
Whether the partitioning matches the problem or the org chart. Device selection and utilisation headroom against where this design will be in two years. Where the hard blocks are used and where they should have been.
Clocking
PLL and MMCM configuration against the actual requirement. Derived clocks, clock enables against gating, and whether any clock mux can glitch. What happens on reference loss.
Clock domain crossing
Every crossing enumerated, and the right synchroniser type for each kind of crossing rather than a two-flop chain everywhere. Gray coding on counters, handshakes on control, async FIFOs sized against the real burst. The CDC report read, with every waiver challenged individually.
Reset architecture
Asynchronous assert with synchronous de-assert, reset domain crossing, power-on behaviour, and vendor-specific global reset behaviour, which differs enough between families to matter.
Constraint honesty
Whether the constraint set is complete, and whether the false paths and multicycles are real or are hiding failures. Input and output delay constraints checked against the actual board rather than left at defaults. Over-broad exceptions that quietly disable analysis on paths that need it.
Timing closure quality
Not just whether it closed. Slack margin, hold analysis across corners, temperature and voltage extremes, on-chip variation, and how much of the closure depends on a placement seed that will not survive the next edit.
RTL and coding
Latch inference, incomplete sensitivity, incomplete case, full_case and parallel_case pragmas challenged one at a time. Blocking against non-blocking discipline. State machine recovery from illegal states. Width mismatches and signedness at every arithmetic boundary.
Arithmetic and overflow
Every accumulator sized against the maximum accumulation actually reachable, including the pathological input. Saturation checked at both ends including the asymmetric negative limit. Rounding mode stated and matching the golden model. Fixed-point formats tracked through every operation.
External interfaces and pinout
IO standards and drive strength against what the board needs. Source-synchronous and high-speed serial interface logic. Pin assignment cross-checked against the schematic, which is a cheap check that catches expensive mistakes.
Verification
Testbench structure, coverage, assertions, and whether error and corner cases were exercised or just the happy path. Whether the regression is runnable by someone who didn’t write it.
High reliability
Where it applies: SEU, SET and SEFI mitigation, TMR, configuration memory scrubbing and readback, ECC, watchdogs with an independent time base, and defined safe states on fault.
Build integrity
Whether the design rebuilds from a clean checkout, whether tool and IP versions are pinned, and bitstream traceability including golden image and fallback or multiboot arrangements.
The package
- Complete RTL source. Repository access is better than an archive.
- All constraint files. XDC, SDC or PDC.
- Post-implementation timing report, all corners, and the utilisation report.
- Full synthesis and implementation logs, warnings included.
- Device part number, speed grade, package, and the exact tool version.
- IP list with versions, licences and configuration.
- Block diagram, and a description of the clock and reset architecture.
- Pin assignment, plus the schematic to cross-check it against.
- Register map or software interface document.
- Testbenches, simulation results and any coverage report.
- CDC and lint reports if they exist, with any waivers and their justification.
Depth
| Tier | Depth | From |
|---|---|---|
| Scan 3 days | Architecture, clocking and reset structure, a read of the timing and utilisation reports, and a first pass over the CDC situation. No line-by-line RTL work. | £750 +VAT |
| Standard 7 days | Full checklist. Every clock domain crossing enumerated, constraints assessed for honesty, RTL reviewed at architecture and module level, verification evidence assessed, pinout cross-checked against the schematic. | £2,750 +VAT |
| Deep 15 days | Adds rebuilding the design in the vendor tools, running CDC and lint myself rather than reading yours, re-deriving constraints independently, and a re-review of the corrected revision. | £6,500 +VAT |
Starting prices. Where a job lands within a tier depends on size and complexity, and the proposal carries one firm number before anything begins.
Full pricing and what changes it →
Why this one is worth buying in
Very few independent reviewers can do FPGA work credibly, and the failure modes are the kind that survive every automated check your flow already runs. If you have one FPGA engineer and nobody to check them, this is the gap.
Reviewing something else?
Four review types, run to the same standard. Two in one engagement takes 10% off the second.
Got an FPGA nobody else can check?
Thirty minute call, no charge. Tell me the device, the clock domain count and roughly how much RTL, and I will tell you which tier fits.