Clock Domain Crossing (CDC)

What is a clock domain crossing?

A clock domain is a group of flip-flops driven by the same clock (or by clocks with a known, fixed phase relationship). A crossing happens when a signal generated in one domain is sampled in another domain whose clock has no fixed relationship to the first, different frequency, or the same frequency but drifting phase. Because the two edges can land anywhere relative to each other, sooner or later the data will change right at the capture edge.

Metastability, the core hazard

A flip-flop guarantees a clean output only if data is stable through its setup and hold window. Violate that, which an asynchronous crossing eventually will, and the output can hover between 0 and 1 (metastable) before randomly resolving. If downstream logic samples it during that window it may see different values on different paths, and the design fails intermittently. You cannot prevent metastability from ever occurring; you can only give it time to resolve and make its probability negligibly small (a huge MTBF).

Why STA can't time an asynchronous crossing

STA computes slack from a fixed relationship between the launch and capture edges. On an asynchronous crossing there is no fixed relationship, so slack is meaningless, any value is possible. The correct thing to tell STA is that this path is not a real timing path: you declare the clocks asynchronous with set_clock_groups -asynchronous (or false-path the crossing) in the SDC, so STA stops trying to time it. Safety is then handled structurally, by the synchronizer, not by timing.

The two-flop synchronizer (single bit)

The standard fix for a one-bit control signal is two flip-flops in series in the destination domain. The first flop may go metastable, but it is given a full destination-clock cycle to settle before the second flop samples it, so the second flop almost always sees a clean value. Two stages make the failure probability tiny; very high-reliability designs use three.

Crossing multi-bit buses

You cannot just put a two-flop synchronizer on each bit of a bus: the bits would resolve on slightly different cycles, and the receiver could latch a value that never existed. Multi-bit crossings need a scheme that transfers a coherent value: Gray coding (only one bit changes at a time, used for counters like FIFO pointers), a request/acknowledge handshake, or an asynchronous FIFO for streaming data across the boundary.

CDC verification is not STA

Because STA cannot check crossings, teams run dedicated structural CDC verification, tools that trace every domain crossing and check that each one is properly synchronized, with no combinational logic between the crossing and its synchronizer. It is a separate signoff step, covered in depth in the Clock Domain Crossing path.