clock domain crossing verification
**Clock Domain Crossing (CDC) Verification** is the **systematic identification and validation of all signals that traverse between different clock domains in an SoC**, ensuring proper synchronization to prevent metastability-induced failures — one of the most insidious classes of bugs because metastability failures are probabilistic and may not appear during simulation or initial silicon testing.
Modern SoCs contain dozens of clock domains: CPU clocks (potentially with per-core DVFS), bus clocks, peripheral clocks, I/O interface clocks, and PLL-generated clocks. Every signal crossing between asynchronous domains is a potential metastability hazard.
**Metastability Fundamentals**: When a flip-flop samples a signal transitioning exactly at the clock edge, the output enters a metastable state — neither logic 0 nor logic 1 — that persists for a random duration. The **Mean Time Between Failures (MTBF)** for a single synchronizer flip-flop is often unacceptably low (seconds to minutes). A two-flip-flop synchronizer increases MTBF exponentially — typically to centuries or millennia for practical clock frequencies.
**CDC Crossing Types**:
| Crossing Type | Hazard | Solution |
|--------------|--------|----------|
| **Single-bit control** | Metastability | 2-FF synchronizer |
| **Multi-bit bus** | Data incoherency | Gray code + 2-FF, or MUX recirculation |
| **Multi-bit with enable** | Glitch on enable | Pulse synchronizer + data hold |
| **Reset crossing** | Async reset metastability | Reset synchronizer (assert async, deassert sync) |
| **FIFO interface** | Pointer corruption | Async FIFO with Gray-coded pointers |
**Structural CDC Verification**: Tools (Synopsys SpyGlass CDC, Siemens Questa CDC) perform static analysis of the RTL to identify: all clock domain crossings, missing synchronizers, incorrect synchronizer structures, multi-bit crossings without proper reconvergence handling, and glitch-prone crossing patterns. Structural CDC finds >95% of CDC issues without simulation.
**Functional CDC Verification**: Beyond structural correctness, functional CDC verifies protocol-level behavior: does the FIFO pointer synchronization correctly handle full/empty conditions? Does the handshake protocol handle back-to-back transfers? Metastability injection simulation randomly delays synchronized signals to expose functional failures that depend on synchronization latency variation.
**Common CDC Pitfalls**: **Fan-out from a single synchronizer** — multiple destinations sample the synchronized signal at different times, creating skew; **reconvergent clock domain paths** — two signals from the same source domain cross to the same destination but arrive at different times due to different synchronizer paths; **quasi-static signals assumed stable** — configuration registers written during initialization may actually be written at any time during operation.
**CDC verification is the guardian against the most dangerous class of digital design bugs — metastability failures that pass all functional simulation, appear intermittently in silicon, and may only manifest under specific temperature, voltage, or frequency conditions, making them nearly impossible to debug after tapeout.**