Clock-domain boundaries and metastability

Inputs from another clock have no guaranteed edge separation

Setup^{iSetup The minimum time that input data must be stable before the capturing clock edge. If it is violated, the stored result is not guaranteed. Learn more} and hold^{iHold time The minimum time that input data must remain stable after the capturing clock edge. Check the context to distinguish it from ordinary value retention. Learn more} require data to remain stable around the receiving clock edge. A button or output from an independent clock domain has an arbitrary relationship to that edge, making this difficult to guarantee continuously.

A flip-flop's^{iFlip-flop An element that captures its input at a specified clock edge and holds it until the next edge. The input must meet setup and hold requirements. Learn more} internal state may then take time to settle to 0 or 1: metastability. Ordinary 0/1 RTL simulation does not directly represent this analog phenomenon. A clean test waveform does not prove CDC safety.

A two-stage synchronizer is for a single bit held long enough

module level_synchronizer (
    input  logic clk_dst,
    input  logic rst_dst,
    input  logic async_level,
    output logic synced_level
);
    logic first_stage;
    always_ff @(posedge clk_dst) begin
        if (rst_dst) begin
            first_stage  <= 1'b0;
            synced_level <= 1'b0;
        end else begin
            first_stage  <= async_level;
            synced_level <= first_stage;
        end
    end
endmodule

This structure gives the first flip-flop time to resolve before the second samples it. Functional logic uses the last-stage output, without branching directly from the first. The reset above is assumed synchronous to the destination clock.

Physical implementation requires tool- and device-appropriate treatment, including synchronizer^{iSynchronizer A circuit that makes a signal from another timing domain usable in the receiving clock domain. A multistage flip-flop synchronizer for a single bit must not simply be applied independently to multibit data.} attributes, short interstage wiring, STA and CDC checks. Using two registers^{iRegister A circuit that stores multiple bits of state. The synchronous registers in this course store their specified inputs at a clock edge. Learn more} alone does not establish placement or path conditions.

The asynchronous input feeds the first stage; functional logic uses only the last. The interval between stages provides resolution time, but does not guarantee that analog metastability^{iMetastability An analog state in which a storage element temporarily fails to settle to 0 or 1. A synchronizer reduces the probability of propagation; it does not make occurrence impossible.} always disappears.

Reduce the failure probability, not to zero

One simplified model gives the following trend for mean time between failures, MTBF:

$T_{\mathrm{resolve}}$ is available resolution time, $\tau$ a device characteristic, $f_{\mathrm{dst}}$ the receiving-clock frequency, and $f_{\mathrm{event}}$ the asynchronous transition rate. Actual calculations need device-specific constants. This expression alone cannot assign an arbitrary circuit a guaranteed number of safe years.

Different transfer problems need different structures

For example, independently synchronizing each bit of a 4-bit transition from 0111 to 1000 can produce an observed combination that never existed at the source. Preserving bus coherence requires designing the relationship between the whole data word and transfer completion.

Further reading: MIT OpenCourseWare — Synchronization, Metastability and Arbitration