Safe boundaries across time and voltage
Clock, Reset, CDC and Power
Operate a dual-clock, power-gated sensor subsystem from cold reset through configuration, streaming, quiesce, sleep, wake, and recovery while every crossing preserves meaning.
Classify each boundary by clock relationship, payload semantics, reset behavior, and power state; then select a structure and signoff evidence that remain safe in silicon.
Boundary control room · active
One island. Three clocks. Four meanings.
The same pair of domains needs different circuitry for a persistent mode, a short event, a coherent configuration word, and a continuous sample stream.
Always-on control
- Clock
- clk_aon · 50 MHz
- Reset
- por_n → rst_aon_n
- Power
- Always on
Sensor peripheral
- Clock
- clk_sensor · 125 MHz
- Reset
- rst_sensor_n
- Power
- Standby capable
Compute island
- Clock
- clk_compute · PLL 500 MHz
- Reset
- rst_compute_n
- Power
- Switchable + retention
Domain atlas
Draw the boundaries before choosing circuitry.
Start with clock provenance, reset ownership, voltage, switchability, and payload direction. Frequency alone never tells you whether a crossing is synchronous.
Compute island
- Clock
- clk_compute · 500 MHz
- Provenance
- PLL output behind an ICG
- Reset
- Local release after power-good + PLL lock
- Power
- 0.72 V · Switchable, selected state retained
- Traffic
- Configuration, samples, completion
- Owned state
- Filter pipeline, FIFO read side, retained mode
- Signoff boundary
- CDC + RDC + power-aware + clock-gating checks
| Payload | Source → destination | Clock relation | Reset epoch | Power rule |
|---|---|---|---|---|
| mode_en | AON → compute | Related while compute clock runs | AON survives compute reset | Clamp before compute OFF |
| sample_event | Sensor → AON | Independent clocks | Reject stale toggle epoch | Both domains powered |
| config[31:0] | AON → compute | Related bundled transfer | Handshake restarts after reset | Level shift + isolation |
| samples | Sensor → compute | Dual-clock FIFO | Pointers converge from empty | Drain before compute OFF |
Reset and RDC
Release locally. Reconnect deliberately.
Asynchronous assertion can force safety without a clock. Deassertion is a timed local event, and related state must not reconverge until reset epochs agree.
Payload-driven CDC
Transfer meaning, not merely wires.
A CDC structure preserves the meaning of a payload. First classify persistence, coherence, event rate, throughput, and backpressure—then choose circuitry.
Dual-clock asynchronous FIFO
- Contract
- Data stays in dual-port storage. Each side computes full or empty from a synchronized, possibly stale opposite pointer.
- Delivery
- Elastic until the rate difference and burst envelope consume depth.
- Do not use it when
- Gray encoding is not a replacement for synchronizer stages, reset coordination, or pointer-bus skew constraints.
- One-bit Gray transitions and bounded bus skew
- Full/empty at wrap boundaries
- Overflow, underflow, reset convergence, and rate stress
| Binary | Gray | Δ bits |
|---|---|---|
| 000 | 000 | 0 |
| 001 | 001 | 1 |
| 010 | 011 | 1 |
| 011 | 010 | 1 |
| 100 | 110 | 1 |
| 101 | 111 | 1 |
| 110 | 101 | 1 |
| 111 | 100 | 1 |
The synchronized opposite pointer may be stale, which makes full or empty conservative. Gray coding reduces incoherent transitions; it does not remove the synchronizers or the pointer-bus skew constraint.
Resolution time changes risk exponentially.
This is a sensitivity comparison, not an absolute MTBF prediction. The fixed baseline is 2 ns, 500 MHz, 10 MHz, and τ = 60 ps; C is held constant. Device-specific τ and C come from characterized library data and vary with process, voltage, temperature, cell choice, placement, and routing. Metastability risk approaches zero with more resolution time; it never becomes zero.
Clocks and gating
Prove the relationship before applying an exception.
A crossing can be timed only when the tool knows the actual phase relationship. Clock gating is a separate functional contract that must preserve complete pulses.
Highlighting · clk_sensor ↔ clk_aon / clk_compute
- Relationship
- No fixed phase relationship exists, even if two independent oscillators happen to have the same nominal frequency.
- Timing action
- Use a recognized CDC structure. Constrain the relationship without pretending ordinary setup/hold can prove functional sampling.
- Design boundary
- Review every crossing by payload semantics with structural CDC and protocol evidence.
- Evidence
- Clock interaction + CDC/RDC analysis
The latch prevents enable transitions during the high phase, so the AND gate cannot create a runt pulse. Use a library ICG cell, include the test override, constrain the generated clock, and verify min pulse width—not a hand-built RTL AND gate.
Power intent
Keep electrical truth beside functional intent.
RTL describes logic behavior. IEEE 1801 UPF adds supply networks, power domains, switch control, isolation, retention, level shifting, and legal power states.
| State | Supply | Clock | Isolation | Retention | Traffic |
|---|---|---|---|---|---|
| ACTIVE | ON | RUN | OPEN | TRACK | LEGAL |
| IDLE | ON | GATED | OPEN | TRACK | BLOCKED |
| RETENTION | RET | OFF | CLAMP | SAVED | BLOCKED |
| OFF | OFF | OFF | CLAMP | SELECTED HOLD | BLOCKED |
IsolationClamp outputs from a domain that may be off before its supply becomes invalid. Choose clamp values from the receiving protocol's safe state.
Level shiftingInsert direction-appropriate cells when voltage domains differ. Cell placement and supply ownership are implementation decisions encoded by power intent.
RetentionRetain only state whose restoration cost justifies the always-on leakage and sequencing complexity. Reset and retained state need an explicit precedence rule. This worked subsystem holds mode_reg and calibration_epoch in OFF; a cold-off policy may discard them only if wake skips restore and reinitializes that state instead.
Safe sleep and wake
Quiesce first. Reconnect last.
Power transitions are distributed protocols. Every step has an owner, prerequisite, acknowledgment, timeout, and proof that accepted work is not lost.
Compute accepts samples and may create new work.
Why nowAll dependencies are valid: supply, PLL, clock, reset, isolation, and domain-ready.
Prove itTraffic is legal only while domain_ready is true.
Reasoning checkpoints
Questions worth answering without notes.
Each answer states the mechanism first, then the consequence.01Why does a two-flop synchronizer reduce risk instead of eliminate it?+
The first destination flop can still enter metastability when an asynchronous transition violates its sampling aperture. The second stage gives that analog state additional resolution time, which improves MTBF exponentially, but the probability is never mathematically zero and depends on library parameters, placement, clock rate, data-toggle rate, and available resolution time.
02Why is synchronizing every bit of a bus independently unsafe?+
Each bit can resolve on a different destination edge, so the receiver may observe a word that never existed at the source. Preserve coherence with a bundled-data handshake, Gray-coded control state, source-synchronous transfer, or asynchronous FIFO selected for the payload and throughput contract.
03What is the safe order for powering down a domain?+
Stop new work, drain or cancel accepted work according to the protocol, save retained state, assert isolation while source outputs are still valid, gate clocks when the domain is idle, then remove power. Wake-up reverses the dependency carefully: restore power, wait for stability, enable clocks, restore or reset state, validate readiness, and only then release isolation and accept traffic.
Keep practicing
Move from recognition to explanation.
These links open the existing practice bank without publishing protected solutions on this guide.Continue the system