Clock Domain Crossing (CDC)
CDC occurs when a signal crosses from one clock domain to another. This creates a risk of metastability - the output of a flip-flop remains at an indeterminate
CDC occurs when a signal crosses from one clock domain to another. This creates a risk of metastability - the output of a flip-flop remains at an indeterminate voltage level for an unpredictable time if setup/hold requirements are violated during the crossing.
2-FF Synchronizer (Most Common Fix)
CDC Signal Crossing Waveform
| CDC Violation Type | Description | Fix |
|---|---|---|
| Single-bit crossing (no sync) | Flip-flop driven by different clock without synchronizer | Add 2-FF synchronizer |
| Multi-bit bus crossing | Multiple bits cross independently - may sample incoherent values | Use gray code, handshake, async FIFO |
| Fast-to-slow domain | Source clock faster; receiving domain may miss pulses | Pulse stretcher + synchronizer |
| Reconvergence | Two paths from different domains merge - non-deterministic glitch | Re-synchronize before combining |
CDC Synchronization Structures
2-FF Synchronizer (Single bit)
Two back-to-back FFs in the destination domain. First FF may go metastable - but given one full destination clock cycle to resolve before FF2 captures it. MTBF increases exponentially with resolution time. Use for: control signals, enable pulses, flag bits.
Async FIFO (Multi-bit data)
FIFO with separate read/write clocks. Read and write pointers encoded in Gray code (only 1 bit changes per increment) so pointer can safely cross domains with a 2-FF synchronizer. Use for: data buses, pixel data, packet payloads.
Handshake Protocol (Slow control)
Request signal crosses with 2-FF sync, receiver asserts Acknowledge which crosses back with 2-FF sync. Ensures data is only sampled after proper synchronization. Slow (4 clock cycles minimum) but 100% safe. Use for: configuration registers, slow control signals.
Gray Code Pointer
Counter encoded so only 1 bit changes per increment. If metastability occurs on a gray-coded pointer crossing, only 1 bit resolves incorrectly - worst case the pointer reads as ±1, which looks like empty/full - not data corruption. Essential for async FIFO pointers.
CDC in STA - SDC Constraints
# Method 1: set_clock_groups (most common)
# Tells STA: don't analyze paths between clk_a and clk_b
set_clock_groups -asynchronous -group [get_clocks clk_a] -group [get_clocks clk_b]
# Method 2: set_false_path (directional)
# Only suppress path from clk_a → clk_b
set_false_path -from [get_clocks clk_a] -to [get_clocks clk_b]
# Method 3: set_max_delay (for CDC paths with latency requirement)
# Path must complete within 100ns (even though async)
set_max_delay 100 -from [get_clocks clk_a] -to [get_clocks clk_b] -datapath_only
# Method 4: For synchronizer FFs - constrain with MTBF requirement
# Apply max_delay equal to 1 destination clock period
set_max_delay [expr 1.0/500e6] -to [get_pins sync_ff1/D] -datapath_onlyCDC is NOT just a STA problem — STA with set_clock_groups only suppresses timing analysis - it does NOT verify that your synchronizer is correctly designed. A separate CDC verification tool (Cadence JasperGold CDC, Mentor Questa CDC, Synopsys SpyGlass CDC) must check that every crossing has a proper synchronizer. set_clock_groups without CDC tool sign-off is incomplete.
MTBF Formula
MTBF = e(Tresolve / τ) / (fclkB × fdata × Tw) Tresolve = time given for metastability resolution (≈ 1 clock cycle of clkB) · τ = technology metastability constant (library parameter) · Doubling Tresolve increases MTBF exponentially → reason 3-FF synchronizer is used in safety-critical designs