clock domain crossing
**Clock domain crossing (CDC)** is the interface where a signal passes between two parts of a chip running on different clocks — a point where metastability can corrupt data and cause silent, intermittent failures that are nearly impossible to debug in silicon. Every modern SoC has dozens of clock domains (CPU cores at one frequency, memory controller at another, PCIe PHY at a third, always-on power management at a fourth), and every signal that crosses between them is a potential CDC bug. CDC verification consumes 5–15% of total design verification effort and is the #1 source of post-silicon functional bugs that escape pre-silicon simulation.
**Why CDC is dangerous — metastability.** When a flip-flop samples a signal that is changing (violating setup or hold time), the output can enter a metastable state — an unstable voltage between 0 and 1 that eventually resolves to one value, but takes an unpredictable amount of time. If downstream logic reads the output before it resolves, the "0 or 1" uncertainty propagates as data corruption. Since clocks in different domains are asynchronous (no fixed phase relationship), any signal crossing a domain boundary will inevitably violate timing at some point — metastability is not a maybe, it's a certainty.
**The mean time between failures (MTBF)** for a single synchronizer:
$$\text{MTBF} = \frac{e^{t_r / \tau}}{f_s \cdot f_d \cdot T_0}$$
where $t_r$ is the resolution time (slack available for metastability to resolve), $\tau$ is the metastability time constant of the flip-flop (~20–50 ps at 5 nm), $f_s$ is the source clock frequency, $f_d$ is the destination clock frequency, and $T_0$ is a technology-dependent constant. A two-flip-flop synchronizer provides $t_r$ equal to one full destination clock period — giving MTBF of thousands of years. A single flip-flop with no margin gives MTBF of seconds to minutes.
**The standard solution — synchronizer circuits:**
| Crossing type | Circuit | Latency | When to use |
|---|---|---|---|
| Single bit (level) | 2-FF synchronizer (double-flop) | 2 destination clocks | Control signals, enables, flags |
| Single bit (pulse) | Pulse synchronizer (toggle + 2-FF) | 2–3 clocks | Event pulses, interrupts |
| Multi-bit (bus) | Gray-code FIFO (async FIFO) | 2–4 clocks | Data buses, streaming interfaces |
| Multi-bit (register) | MUX-based handshake (req/ack) | 4–8 clocks | Configuration registers, slow updates |
| Multi-bit (memory) | Dual-clock FIFO with gray pointers | 2–4 clocks | High-throughput data paths (DMA, NoC) |
| Full bus (protocol) | Credit-based or valid/ready with sync | Variable | NoC links, AXI async bridge |
**The two-flip-flop synchronizer** is the fundamental building block: two back-to-back flip-flops on the destination clock. The first flip-flop may go metastable, but has a full clock period to resolve before the second flip-flop samples it. This reduces the probability of failure exponentially. Three-flop synchronizers are used for higher reliability (automotive, aerospace).
**Async FIFO — crossing multi-bit data safely.** You cannot simply synchronize each bit of a bus independently (different bits might resolve to different values on different cycles — data corruption). The async FIFO solves this: write data into a dual-port RAM using the source clock, read it using the destination clock, and synchronize only the read/write pointers (encoded in Gray code, so only one bit changes at a time — safe to synchronize bit-by-bit).
**CDC verification — finding bugs before silicon:**
- **Structural CDC analysis** (Synopsys SpyGlass CDC, Cadence Conformal CDC): statically identifies all clock-domain crossings in the RTL and checks that each has a proper synchronizer. Reports unsynchronized crossings, incorrect FIFO depths, reconvergence issues.
- **Formal CDC verification**: proves that no data can be corrupted under any possible timing relationship between clocks — exhaustive, not dependent on simulation stimulus.
- **Simulation with randomized clock ratios**: run gate-level simulation with intentionally jittered clocks to exercise metastability windows. Catches functional protocol bugs that structural checks miss.
```svg
```
**CDC in AI chips — many domains, high bandwidth.** A modern GPU or AI accelerator has 30–50 independent clock domains: each compute cluster has its own frequency (for per-core DVFS), the HBM PHY runs at a different rate, the PCIe/NVLink SerDes has its own recovered clock, and the power management unit runs on a low-frequency always-on clock. Every data path between these domains — thousands of crossings on a large chip — must have correct synchronization. A single missed crossing can cause silent data corruption during AI training, producing wrong model weights that are almost impossible to trace back to a hardware bug.
**CDC and the CFS platform.** The CFS clock-tree keyword covers the clock distribution within a single domain; CDC covers the boundaries between them. The verification keyword covers the formal and simulation methods used to prove CDC correctness. Together they represent the timing-integrity side of chip design — ensuring signals arrive when expected, across every clock boundary, for the lifetime of the product.