Pre-tapeout bug hunt
We look for functional bugs in your RTL before you tape out. You pay only for bugs that are verified.
The engineering is done by AI coding agents (Claude and Codex), directed by ChipLab's founder, Nathan Chandrasekar. One agent finds and documents each bug. A different agent reproduces it independently before it reaches you.
What each bug report contains
- A minimal reproducer that runs on your RTL.
- A trace against a golden model or the specification, showing where the design diverges.
- The root cause in your RTL.
- A check against your known-issues list, so you are not sent what you already know.
Results are private to you. We do not publish client findings or file them anywhere.
How it works
-
Scope
You send the RTL, the spec or design notes, and your known-issues list. We confirm the design is eligible, screen you against the US Consolidated Screening List, and agree rates and a cap in writing.
-
Hunt
Agents write tests and compare your design with a golden model or the spec, using open-source simulators (Verilator and Icarus Verilog).
-
Independent reproduction
A second agent reproduces each candidate bug from scratch. A bug it cannot reproduce is not reported.
-
Report
You receive each verified bug privately. You pay per verified bug, up to the cap.
-
Delete
At the end of the engagement we delete your files.
Pricing
| Bug class | Per verified bug |
|---|---|
| Minor or corner case | $250–400 |
| Wrong result or ISA/spec violation | $750–1,000 |
| Hang, deadlock or silent data corruption | $1,500–2,500 |
Shuttle teams: a flat pre-tapeout sweep at $750–1,500 per design.
Every engagement has a cap agreed up front (by default $5,000). An optional $500 onboarding fee is credited in full against bug fees.
Published starting prices in US dollars. Exact rates are set in writing before work starts. Duplicates of your known issues and bugs we cannot reproduce are not charged.
Terms
- To start, we take only published designs or EAR99 designs. We screen every client against the US Consolidated Screening List.
- RTL only. We do not take PDK files or NDA'd libraries.
- Your RTL is processed by the commercial AI models our agents run on, on plans where your data is not used for model training. We name each provider in the engagement letter.
- Your files are deleted at the end of the engagement.
- This is not sign-off and not a warranty that your RTL is free of bugs.
Open-PDK shuttle deadlines
Send RTL early enough to fix what we find before your deadline.
| Shuttle | Deadline |
|---|---|
| Tiny Tapeout SKY26d | Closes 30 November |
| Tiny Tapeout GF26c | Closes 7 December |
| ChipFoundry CI2612 | Commitment 4 November; tapeout 7 December |
| wafer.space GF180 Run 3 | Slots close 9 December; GDS due 16 December |
2026 dates as published by each platform on 10 October 2026. Check with the platform before planning around them.
Public record
The same method, run in public on open-source cores. The Conformance Matrix runs the official RISC-V architecture tests across 11 open cores. The Findings page lists every public report.
| Project | Public issue |
|---|---|
| Hazard3 RISC-V core in Raspberry Pi's RP2350 | #52 amominu.w and amomaxu.w store the signed min/max when Zbb is disabled. |
| Hazard3 | #51 A host write to data0 while an abstract command is busy changes data0; the spec says it must not. |
| Hazard3 | #50 sbcs.sbaccess resets to 8-bit instead of 32-bit when System Bus Access is enabled. |
| NEORV32 | #1663 A DMA byte-to-word transfer replicates the byte instead of zero-extending it. |
| NEORV32 | #1662 SLINK interrupt-enable bits sit at different positions in the RTL and the datasheet. |
| SERV | #173 Reading mie clears MTIE, which disables timer interrupts. |
| Microwatt | Under verification. |
Contact
Tell us what the design does, its rough size, your shuttle or tapeout date, and whether it is published or EAR99.