Clock Domain Crossing Verification
Clock Domain Crossing (CDC) Verification is the systematic process of identifying and validating all signal transitions between asynchronous clock domains in a digital design to ensure metastability is properly managed and data integrity is maintained across every domain boundary.
CDC Fundamentals and Risks:
- Metastability: when a signal from one clock domain is sampled by a flip-flop in another domain during its setup/hold window, the output can enter an indeterminate state lasting multiple clock cycles
- Mean Time Between Failures (MTBF): metastability resolution probability depends on the synchronizer's recovery time constant τ—MTBF must exceed 100+ years for production silicon
- Data Coherency: multi-bit signals crossing domains without proper synchronization can be sampled in partially updated states, creating data corruption that is extremely difficult to debug in silicon
- Convergence Issues: when multiple individually synchronized signals reconverge in combinational logic, their relative timing is unpredictable, creating functional failures even with proper synchronization on each path
CDC Structural Verification Techniques:
- Static CDC Analysis: tools like Synopsys SpyGlass CDC and Cadence Conformal CDC traverse the netlist to identify all clock domain boundaries and classify crossing types
- Missing Synchronizer Detection: flags any signal path crossing between asynchronous domains without passing through a recognized synchronization structure (two-flop synchronizer, FIFO, handshake)
- Reconvergence Analysis: identifies paths where synchronized signals reconverge—each reconvergence point requires either a single synchronization point for all bits or FIFO-based transfer
- Glitch Detection: combinational logic in the crossing path before synchronizers can generate glitches that propagate through and violate metastability requirements
- Reset Domain Crossing (RDC): verifies that asynchronous resets are properly synchronized before de-assertion to prevent partial reset of sequential logic
Synchronization Structures:
- Two-Flop Synchronizer: simplest single-bit synchronizer using two back-to-back flip-flops in the receiving domain—adds 1-2 cycle latency but achieves MTBF >1000 years at typical process nodes
- FIFO Synchronizer: dual-clock FIFO with Gray-coded read/write pointers for multi-bit data transfer—pointer encoding ensures only one bit changes per clock cycle, making single-bit synchronization safe
- Handshake Protocol: request/acknowledge signaling between domains for infrequent transfers—pulse synchronizers convert level-to-pulse and pulse-to-level across boundaries
- MUX Recirculation: data is held stable in source domain while a synchronized control signal selects it in the destination domain—requires hold time > receiving clock period
Functional CDC Verification:
- CDC-Aware Simulation: metastability injection during RTL simulation randomly corrupts outputs of synchronizers to verify that the design tolerates worst-case metastability resolution delays
- Formal CDC Analysis: uses property checking to prove that all data crossing asynchronous boundaries maintains coherency under all possible timing relationships
- Protocol Verification: ensures handshake and FIFO protocols cannot deadlock or lose data under back-pressure conditions—critical for AXI clock-crossing bridges
- Coverage Metrics: CDC verification completeness measured by percentage of crossings with verified synchronization schemes and confirmed protocol compliance
CDC verification is one of the most critical sign-off checks in modern SoC design, as CDC bugs account for over 50% of silicon re-spins—these failures are nearly impossible to detect through conventional simulation alone because they depend on the precise phase relationship between asynchronous clocks.