Clock-domain crossing
Transfer meaning, not merely wires.
Metastability is an analog consequence of sampling near an aperture. A CDC structure contains that risk and preserves the payload’s protocol: level, event, coherent value, or stream.
CDC structure selector
What must cross?
Recommended mechanism
2-flop synchronizer
Two destination-clock flip-flops in seriesThe first stage may become metastable; the second gets almost a full destination period for that analog state to resolve.
- 1Asynchronous level
- 2Metastability containment
- 3Synchronized level
The source level must remain stable long enough to be observed for at least one destination sampling opportunity.
Do not synchronize each bit of a related bus independently. Their resolving cycles can differ.
Usually two destination edges, with a possible extra cycle depending on phase. There is no acknowledgment or backpressure.
Constrain the minimum source pulse width, mark the synchronizer stages, place them close, and calculate MTBF for the real toggle and clock rates.
For Slow single-bit level, use 2-flop synchronizer. The first stage may become metastable; the second gets almost a full destination period for that analog state to resolve.
Why Gray pointers help an async FIFO
Only one pointer bit changes per adjacent count.
Binary 0111 → 1000 changes four bits. Gray 0100 → 1100 changes one. The synchronized pointer may be old, which is safe for conservative full/empty decisions, but it is far less likely to look like an unrelated mixed value.
Reset-domain crossing
Assert safely; release on each local clock.
An asynchronous reset may assert without a running clock, but its deassertion must satisfy recovery and removal. Synchronize deassertion separately in every clock domain, then exchange explicit ready or initialization state before domains interact.
Reconvergence risk
Related signals can become unrelated after crossing.
Two independently synchronized control bits can emerge on different destination cycles. Even duplicate synchronizers fed by one source may disagree temporarily. Synchronize once and fan out locally, or transfer an encoded state, bundle, handshake, or FIFO entry atomically.
CDC and RDC signoff
Structure finds risk; assertions prove the protocol.
- Structural CDC/RDC analysis with reviewed, specific waivers
- ASYNC_REG intent, synchronizer placement, and MTBF analysis
- Gray-bus skew constraints and pointer-transition assertions
- Randomized phase, reset, backpressure, overflow, and underflow tests
- No combinational logic between metastability containment stages
Lab-to-silicon debug
Start with the physical contract that was assumed.
Both failures below look logical at first. The decisive evidence comes from clock ancestry, minimum delay, pulse width, phase behavior, and the protocol used to move state.
Decoded counter enable
A decoded count is a minimum-delay path to the clock-enable pin.
The source asks why a one-cycle counter decode could fail in hardware even though RTL simulation looks deterministic.
Before: a multi-bit decode feeds a synchronous enable directly
The slide’s intended risk is a minimum-delay path from counter Q through a small equality comparator to the destination enable mux or clock-enable pin. Unequal counter-bit delays can also make the equality decode glitch as the bits reconverge.
- 1Counter edge launches several bits
- 2Clock-to-Q, route, and comparator delays determine the decode waveform
- 3The decode reaches the destination enable path
- 4STA checks whether its earliest change violates destination hold
logic [3:0] count;
wire enable = (count == 4'd15);
always_ff @(posedge clk) begin
count <= count + 1'b1;
end
always_ff @(posedge clk) begin
if (enable) data_reg <= data_in;
endThe slide is aiming at a hold or minimum-delay check on counter Q through the equality decode to the destination enable path. Setup must also be checked at the maximum-delay corner.
As written, both blocks use the same clock, so this is a normal synchronous register-to-register control path. A combinational enable is not automatically a violation. STA must decide from real min delay and skew.
Several counter bits can change with unequal delays and reconverge in the comparator. A transient is dangerous if it overlaps a sampling aperture or is misused as a clock or asynchronous control.
Compare against 14, register the result, and consume that registered enable when the old counter value is 15. Keep the root clock and verify the new path’s setup, hold, and pulse alignment.
Before: a multi-bit decode feeds a synchronous enable directly. The slide’s intended risk is a minimum-delay path from counter Q through a small equality comparator to the destination enable mux or clock-enable pin. Unequal counter-bit delays can also make the equality decode glitch as the bits reconverge.
The reusable reasoning model