Timing ECO
A timing ECO is a small, surgical change made to an almost-finished layout specifically to fix the last stubborn timing violations — a few buffers added, a gate upsized, a path rerouted — without re-running the whole flow from scratch. Late in the project, you cannot afford to re-synthesize and re-place an entire chip just because a handful of paths missed by a few picoseconds; instead you patch exactly those paths, like fixing a typo on a printed page rather than reprinting the book. ECOs are how the last mile of timing closure actually gets walked.
There are two flavours. A pre-mask ECO can still change any layer freely, since no photomask has been made yet. A post-mask (metal-only or 'spare-cell') ECO is far more constrained: the transistors are already frozen in silicon, so the fix must be wired up using pre-placed spare gates and changes to only the cheap upper metal layers — saving a fortune by reusing the expensive base-layer masks. In both cases the cardinal rule is minimal disturbance: every ECO must fix its targets while provably not creating new violations elsewhere, which is verified by a fresh, full STA run afterward.
A metal-only ECO closes the last paths without a new base-layer mask set.
Functional ECOs (changing logic to fix a bug) and timing ECOs share the same mechanics but differ in intent — and an automated tool can generate timing ECOs, whereas a functional ECO usually needs a human to reason about correctness before it touches the netlist.