Domain atlas
Draw the boundaries before choosing circuitry.
Start with clock provenance, reset ownership, voltage, switchability, and payload direction. Frequency alone never tells you whether a crossing is synchronous.
Primary sourceCrystalIndependent sourceSensor clockElectrical + temporal boundaryCDC · RDC · isolation · level shift
Compute island
- Clock
- clk_compute · 500 MHz
- Provenance
- PLL output behind an ICG
- Reset
- Local release after power-good + PLL lock
- Power
- 0.72 V · Switchable, selected state retained
- Traffic
- Configuration, samples, completion
- Owned state
- Filter pipeline, FIFO read side, retained mode
- Signoff boundary
- CDC + RDC + power-aware + clock-gating checks
| Payload | Source → destination | Clock relation | Reset epoch | Power rule |
|---|---|---|---|---|
| mode_en | AON → compute | Related while compute clock runs | AON survives compute reset | Clamp before compute OFF |
| sample_event | Sensor → AON | Independent clocks | Reject stale toggle epoch | Both domains powered |
| config[31:0] | AON → compute | Related bundled transfer | Handshake restarts after reset | Level shift + isolation |
| samples | Sensor → compute | Dual-clock FIFO | Pointers converge from empty | Drain before compute OFF |
Reset and RDC
Release locally. Reconnect deliberately.
Asynchronous assertion can force safety without a clock. Deassertion is a timed local event, and related state must not reconverge until reset epochs agree.
RDC release scopeSafe structure
