clock domain crossing verification

**Clock Domain Crossing (CDC) Verification** is **the systematic process of identifying and validating all signal transitions between asynchronous clock domains in a digital design to ensure metastability is properly managed and data integrity is maintained across every domain boundary**. **CDC Fundamentals and Risks:** - **Metastability**: when a signal from one clock domain is sampled by a flip-flop in another domain during its setup/hold window, the output can enter an indeterminate state lasting multiple clock cycles - **Mean Time Between Failures (MTBF)**: metastability resolution probability depends on the synchronizer's recovery time constant τ—MTBF must exceed 100+ years for production silicon - **Data Coherency**: multi-bit signals crossing domains without proper synchronization can be sampled in partially updated states, creating data corruption that is extremely difficult to debug in silicon - **Convergence Issues**: when multiple individually synchronized signals reconverge in combinational logic, their relative timing is unpredictable, creating functional failures even with proper synchronization on each path **CDC Structural Verification Techniques:** - **Static CDC Analysis**: tools like Synopsys SpyGlass CDC and Cadence Conformal CDC traverse the netlist to identify all clock domain boundaries and classify crossing types - **Missing Synchronizer Detection**: flags any signal path crossing between asynchronous domains without passing through a recognized synchronization structure (two-flop synchronizer, FIFO, handshake) - **Reconvergence Analysis**: identifies paths where synchronized signals reconverge—each reconvergence point requires either a single synchronization point for all bits or FIFO-based transfer - **Glitch Detection**: combinational logic in the crossing path before synchronizers can generate glitches that propagate through and violate metastability requirements - **Reset Domain Crossing (RDC)**: verifies that asynchronous resets are properly synchronized before de-assertion to prevent partial reset of sequential logic **Synchronization Structures:** - **Two-Flop Synchronizer**: simplest single-bit synchronizer using two back-to-back flip-flops in the receiving domain—adds 1-2 cycle latency but achieves MTBF >1000 years at typical process nodes - **FIFO Synchronizer**: dual-clock FIFO with Gray-coded read/write pointers for multi-bit data transfer—pointer encoding ensures only one bit changes per clock cycle, making single-bit synchronization safe - **Handshake Protocol**: request/acknowledge signaling between domains for infrequent transfers—pulse synchronizers convert level-to-pulse and pulse-to-level across boundaries - **MUX Recirculation**: data is held stable in source domain while a synchronized control signal selects it in the destination domain—requires hold time > receiving clock period **Functional CDC Verification:** - **CDC-Aware Simulation**: metastability injection during RTL simulation randomly corrupts outputs of synchronizers to verify that the design tolerates worst-case metastability resolution delays - **Formal CDC Analysis**: uses property checking to prove that all data crossing asynchronous boundaries maintains coherency under all possible timing relationships - **Protocol Verification**: ensures handshake and FIFO protocols cannot deadlock or lose data under back-pressure conditions—critical for AXI clock-crossing bridges - **Coverage Metrics**: CDC verification completeness measured by percentage of crossings with verified synchronization schemes and confirmed protocol compliance **CDC verification is one of the most critical sign-off checks in modern SoC design, as CDC bugs account for over 50% of silicon re-spins—these failures are nearly impossible to detect through conventional simulation alone because they depend on the precise phase relationship between asynchronous clocks.**