Static timing analysis forces you to design for the worst-case corner: slowest silicon, lowest voltage, highest temperature. Every chip on your wafer that isn't a runt is running with margin it never uses. If you could detect a timing violation the instant it happened and roll back, you could safely run at a voltage where 99.9% of cycles pass — and pay only for the rare failures. That's the Razor idea, published by Ernst, Kim, and Blaauw at Michigan in 2003.

A Razor flip-flop is a normal D flip-flop with a shadow latch hanging off the same D input, clocked by a delayed clock. The main FF captures at the normal edge; the shadow latch captures a bit later — comfortably after the signal has settled. A comparator XORs the two outputs. If they disagree, the main flop captured a value that was still transitioning: a late-arriving data error. The comparator raises an error flag, and pipeline control uses the shadow latch's (correct) value to restart the offending instruction.

Concrete example: Intel's 2007 Razor test chip on a 64-bit Kogge-Stone adder ran at 1.2 V nominal. Dropping to 0.83 V, error rate stayed under 0.1% — a 33% energy reduction after paying for the ~1% recovery overhead. Same silicon, no worst-case guardband.

Rule of thumb: the "point of first failure" (PoFF) — where the first path starts violating — sits roughly 20–30% below the worst-case sign-off voltage. Every millivolt above PoFF is guardband you're burning. Dynamic power scales as CV²f, so a 20% voltage cut ≈ 36% dynamic energy savings.

The gotchas are subtle:

• Short-path constraint: the shadow latch's delayed clock means any path faster than the delay window causes the shadow to capture the next cycle's data. You must pad short paths with buffers — the opposite of normal hold-time fixes.
• Metastability on the error signal: if the main FF itself goes metastable, the comparator output is garbage. Razor-II added a transition detector instead of a shadow latch to avoid this.
• Recovery cost: flushing the pipeline is expensive. You want error rate low enough (<0.1%) that the energy savings outweigh the recovery penalty. Cross that threshold and you're burning more power than a guardbanded design.

The philosophical shift: instead of proving your circuit meets timing under all conditions, you observe whether it did and correct if not. Same idea as branch misprediction recovery — speculate aggressively, pay a small penalty when wrong.