Part 2 · CDC and clocks

Select CDC protocols and constrain real clock relationships

Match levels, events, bundles, and streams to safe crossings, quantify metastability risk, preserve Gray-pointer assumptions, and gate clocks without glitches.

Classify each boundary by clock relationship, payload semantics, reset behavior, and power state; then select a structure and signoff evidence that remain safe in silicon.

Updated July 20262 connected chaptersInteractive labs + worked examples

Payload-driven CDC

Transfer meaning, not merely wires.

A CDC structure preserves the meaning of a payload. First classify persistence, coherence, event rate, throughput, and backpressure—then choose circuitry.

Recommended mechanism

Dual-clock asynchronous FIFO

1Write local RAM2Cross Gray pointers3Read local RAM

Contract: Data stays in dual-port storage. Each side computes full or empty from a synchronized, possibly stale opposite pointer.
Delivery: Elastic until the rate difference and burst envelope consume depth.
Do not use it when: Gray encoding is not a replacement for synchronizer stages, reset coordination, or pointer-bus skew constraints.

One-bit Gray transitions and bounded bus skew
Full/empty at wrap boundaries
Overflow, underflow, reset convergence, and rate stress

Async FIFO · ownership topologyMove pointers across domains, not the data bus.

clk_sensorWrite pointerbinary → Gray → 2FF

01234567Dual-port storage

clk_computeRead pointerbinary → Gray → 2FF

Binary wrap0111 → 1000Four bits may change

Gray wrap0100 → 1100One bit changes

Three-bit binary to Gray progression
Binary	Gray	Δ bits
000	000	0
001	001	1
010	011	1
011	010	1
100	110	1
101	111	1
110	101	1
111	100	1

The synchronized opposite pointer may be stale, which makes full or empty conservative. Gray coding reduces incoherent transitions; it does not remove the synchronizers or the pointer-bus skew constraint.

Relative reliability explorer

Resolution time changes risk exponentially.

Relative to the baseline1× baseline

MTBF ∝e^{Tresolve / τ}fclk · fdata · C

Resolution time 2.0 nsDestination clock 500 MHzAsync toggle rate 10 MHzIllustrative τ 60 ps

This is a sensitivity comparison, not an absolute MTBF prediction. The fixed baseline is 2 ns, 500 MHz, 10 MHz, and τ = 60 ps; C is held constant. Device-specific τ and C come from characterized library data and vary with process, voltage, temperature, cell choice, placement, and routing. Metastability risk approaches zero with more resolution time; it never becomes zero.

Clocks and gating

Prove the relationship before applying an exception.

A crossing can be timed only when the tool knows the actual phase relationship. Clock gating is a separate functional contract that must preserve complete pulses.

Clock interaction reportSubsystem relationship matrix

Highlighting · clk_sensor ↔ clk_aon / clk_compute

clk_aonclk_sensorclk_computeclk_aonSELFASYNCRELATEDclk_sensorASYNCSELFASYNCclk_computeRELATEDASYNCSELF

Relationship: No fixed phase relationship exists, even if two independent oscillators happen to have the same nominal frequency.
Timing action: Use a recognized CDC structure. Constrain the relationship without pretending ordinary setup/hold can prove functional sampling.
Design boundary: Review every crossing by payload semantics with structural CDC and protocol evidence.
Evidence: Clock interaction + CDC/RDC analysis

Integrated clock gateCapture enable while the positive-edge clock is low.

functional_enLow-level latchscan_enAND with root clockgclk_compute

The latch prevents enable transitions during the high phase, so the AND gate cannot create a runt pulse. Use a library ICG cell, include the test override, constrain the generated clock, and verify min pulse width—not a hand-built RTL AND gate.

Reasoning checkpoints

Questions worth answering without notes.

Each answer states the mechanism first, then the consequence.

01Why does a two-flop synchronizer reduce risk instead of eliminate it?

The first destination flop can still enter metastability when an asynchronous transition violates its sampling aperture. The second stage gives that analog state additional resolution time, which improves MTBF exponentially, but the probability is never mathematically zero and depends on library parameters, placement, clock rate, data-toggle rate, and available resolution time.

02Why is synchronizing every bit of a bus independently unsafe?

Each bit can resolve on a different destination edge, so the receiver may observe a word that never existed at the source. Preserve coherence with a bundled-data handshake, Gray-coded control state, source-synchronous transfer, or asynchronous FIFO selected for the payload and throughput contract.

Keep practicing

Move from recognition to explanation.

These links open the existing practice bank without publishing protected solutions on this guide.

Choose a CDC strategyMatch the transfer mechanism to payload semantics.Model an asynchronous FIFOReason about Gray pointers, full/empty, and reset convergence.Check clock gatingProve glitch-free enable capture and stopped-clock behavior.

Continue the system

Connect the adjacent layer.

Logic to reliable timingDigital DesignConnect logic behavior to its physical timing contract, then choose safe structures for paths that cross cycles, clocks, and module boundaries.Product intent to buildable machineSpecification to MicroarchitectureFollow one realistic DMA subsystem from an ambiguous product request to measurable requirements, executable interface contracts, a block architecture, and an evidence-ready handoff.RTL intent to signoff marginSynthesis and Timing ClosureAutopsy one failing register-to-register path as it moves from elaborated RTL to a mapped netlist, placed design, clock tree, extracted route, and signoff corner.