What does physical verification prove that timing signoff doesn't?

Short Answer

Timing signoff proves the circuit is fast enough. Physical verification proves the layout can be manufactured (DRC), that it is the circuit you meant to build (LVS), that nothing is electrically unsafe such as a floating gate (ERC), and that the power grid and wires survive real current (IR drop and EM). A block can meet timing in every corner and still be unbuildable or fail in the field, so tapeout needs both gates.

Technical Explanation

• Timing signoff works on a netlist plus extracted parasitics. It asks whether signals arrive in time. It never checks whether a metal shape is too narrow for the fab, whether two nets touch, or whether the layout matches the schematic. Those questions need the geometry itself.
• DRC (design rule checking) proves manufacturability. The foundry runset checks width, spacing, enclosure, area and density on every layer. A single spacing violation can print as a short on the wafer, and a density violation can cause planarity problems during polishing.
• LVS (layout versus schematic) proves connectivity equivalence. IC Validator extracts devices and nets from the layout and compares them with the reference netlist through the compare() (ICV) runset function. A short between two signals can leave timing reports looking normal, because the timing netlist still shows two separate nets.
• ERC (electrical rule checking) proves electrical sanity: no floating gates, no wells left without a tie, no gate driven straight from a supply rail where a tie cell is required. These are faults that a matching netlist can still contain.
• IR drop and EM analysis prove reliability. Static and dynamic voltage drop show whether cells see enough supply voltage, and electromigration checks show whether wires and vias carry more current density than the process allows over the product lifetime. This is RedHawk Fusion inside ICC2 through analyze_rail (ICC2), or standalone RedHawk.
• The two gates interact. A late DRC fix moves wires, which changes parasitics, so timing must be rechecked. A timing ECO adds cells, which can create new DRC or LVS errors. That is why the final gate is run on the same database for both.
• The failure cost is different. A timing miss often means a slower bin or a clock change. A missed short or open usually means a dead die and a respin, which at an advanced node means a very expensive new mask set and months of delay.

Follow-up Question & Model Response

"If the ICC2 routing checks are clean, why do you still need signoff LVS?"

Candidate Model Response: ICC2 check_lvs (ICC2) looks for shorts, opens and floating route shapes at the routing level, using the cell views loaded in the design library. It does not extract transistors, so it cannot tell you whether a device inside a macro or a standard cell is missing or wired differently. Signoff LVS in IC Validator extracts devices from the real GDS and compares them with the reference netlist. It also catches problems introduced after ICC2, such as a wrong cell version merged at stream-out. The routing check is a fast pre-check; the IC Validator run is the proof.