Every team that tapes out has a story about the bug that reached silicon. I am never that interested in the bug. I am interested in the door it walked through. A bug that survives to silicon has usually had several chances to be caught, and those chances belong to different parts of the flow: the specification, the stimulus, the checking, the triage, and the model. When I look at an escape, I sort it into one of five doors before I look at the fix, because each door has a different fix, and fixing the wrong door feels productive while changing nothing.
Door one: the spec never said it
The requirement was missing, ambiguous, or read in two different ways by two teams, each of them faithfully. Suppose a register description says a status bit is cleared on reset. The design team reads reset as the power on reset. The verification team reads it as any reset, including the warm reset the software team uses every day. Both implementations agree with the sentence. The bug is in the sentence.
The smell is agreement everywhere except at the system level: the block is right, the test is right, and the chip still misbehaves. The countermeasure is to read the specification as an adversary. Every sentence that two engineers can read two ways becomes a written question to the architect, asked before the testplan is agreed, not after the failure.
Door two: the stimulus never went there
The design was exercised hard, just never in the one state where the bug lives. Random testing is good at common behaviour and poor at coincidences. Suppose a FIFO misbehaves only when a push and a pop arrive in the same cycle while it holds exactly one entry. Each condition alone is ordinary. Together they are rare, and a single constraint written to keep tests simple, one that quietly forbids simultaneous push and pop, removes the combination from the space entirely.
The smell is coverage that looks complete at the level of single bins while the crosses between bins were never a target. The countermeasure is to name the corners before trusting the random: write the directed test, or the covergroup cross, for every combination the design team mentions with the words that can never happen. Then read every constraint and ask what legal behaviour it forbids, and whether you truly want it forbidden.
Door three: the check never looked
The stimulus reached the bug, the design produced the wrong answer, and nothing complained. The scoreboard compared the data but not the order it arrived in. Or the assertion existed and passed every night because it was vacuous: its trigger never fired, so it checked nothing, politely, for months.
The smell is a test that cannot fail. The countermeasure is to prove that every important check can fail. Take a scratch copy of the design, break it on purpose, and watch the check fire. An assertion that has never failed has never really been tested, and a checker that has never caught anything is a decoration.
Door four: the check fired and nobody listened
This is the door nobody wants to own, because it is a process failure wearing a technical costume. The failure appeared in a regression, was labelled a known issue or blamed on the testbench, and was carried from one milestone to the next until it shipped. Nothing about the design hid it. The organisation filed it.
The smell is a waiver list that only grows, where entries have no owner and no date. The countermeasure is discipline, not tooling: every waived failure carries a name, a reason, and an expiry, and a waiver that survives two milestones is reviewed again as if it were a new bug, because by then it is one.
Door five: the environment lied
The reference model shared the design team's misunderstanding, so the design and the model were wrong in the same way and every comparison passed. Or the testbench treated the hardware more kindly than silicon will: resets released too cleanly, unknown values resolved optimistically, a clock crossing exercised only at a friendly ratio.
The smell is perfect agreement, early, between a model and a design that were both written from the same reading of the same document. The countermeasure is independence. Build the model from the specification text, not from the RTL and not from the designer's slides, and treat a long run of perfect agreement at the start of a project as a warning rather than a comfort. Models earn trust by disagreeing sometimes and being right.
Keep an escape log
When a bug escapes, write down the door, not only the bug. Across one project the log starts to show a pattern, and the pattern is almost never that we need more tests. It is one door, opened again and again by the same habit. Fix that habit and the next project starts stronger than the last one did.
Key takeaway: an escape is a flow failure with a bug attached. Every escape should leave two things behind: a regression test that would have caught it, and one line on the checklist the team actually reads.