metastability
**Metastability** is the **unstable equilibrium condition in bistable circuits (flip-flops, latches) that occurs when setup or hold time is violated** — causing the output to linger at an intermediate voltage between logic 0 and 1 for an unpredictable duration before resolving to a valid state, where this resolution time can exceed a clock period and propagate corrupt data through the design, making metastability management through proper synchronizer design the critical reliability mechanism for every clock domain crossing.
**What Causes Metastability**
- Flip-flop has setup time (Tsu) and hold time (Th) requirements around clock edge.
- If data changes within the setup-hold window → flip-flop enters metastable state.
- The cross-coupled inverters inside the flip-flop are balanced at an unstable midpoint.
- Resolution: Thermal noise and transistor mismatch eventually push output to 0 or 1.
- Resolution time: Exponentially distributed — usually fast, but CAN be arbitrarily long.
**Resolution Time Model**
$P(t_{resolve} > t) = T_0 \cdot f_{clk} \cdot f_{data} \cdot e^{-t/\tau}$
- τ (metastability time constant): Process-dependent, typically 20-50 ps in advanced nodes.
- Smaller τ → faster resolution → better.
- T₀: Setup-hold window width (technology-dependent).
- f_clk, f_data: Clock and data transition frequencies.
**MTBF (Mean Time Between Failures)**
$MTBF = \frac{e^{t_{resolve}/\tau}}{T_0 \cdot f_{clk} \cdot f_{data}}$
- t_resolve = available resolution time (clock period minus flip-flop delays).
- Example: τ=30ps, T₀=0.04, f_clk=1GHz, f_data=500MHz:
- 1 synchronizer stage (t=0.5ns): MTBF ≈ hours → unacceptable.
- 2 synchronizer stages (t=1.0ns): MTBF ≈ 10^7 years → acceptable.
- 3 stages (t=1.5ns): MTBF ≈ 10^14 years → extremely safe.
**Two-Stage Synchronizer**
```
Async Input → [FF1] → [FF2] → Synchronized Output
↑ ↑
clk_dst clk_dst
```
- FF1 may go metastable → has one full clock period to resolve.
- FF2 samples resolved output of FF1 → clean output with high MTBF.
- Industry standard: 2 stages for most crossings. 3 stages for safety-critical.
**Clock Domain Crossing (CDC) Synchronization**
| Crossing Type | Synchronizer | Latency |
|--------------|-------------|--------|
| Single bit | 2-FF synchronizer | 2 dest clocks |
| Multi-bit gray | Gray code + 2-FF per bit | 2 dest clocks |
| Multi-bit bus | Handshake protocol | 3-4 clocks |
| FIFO | Async FIFO (gray pointers) | Pipeline depth |
| Pulse | Pulse synchronizer (toggle + 2-FF) | 2-3 dest clocks |
**Common CDC Bugs**
| Bug | Cause | Consequence |
|-----|-------|-------------|
| Missing synchronizer | Direct connection across domains | Random metastability failures |
| Binary counter crossing | Multi-bit changes asynchronously | Incorrect count sampled |
| Reconvergent paths | Synced signals rejoin later | Data coherence lost |
| Glitch on async reset | Reset deasserts near clock edge | Metastable reset |
**CDC Verification**
- **Lint tools** (Spyglass CDC, Meridian CDC): Structurally detect unsynced crossings.
- **Formal verification**: Prove no data loss through async FIFOs.
- **Simulation**: Cannot reliably catch metastability → must rely on structural checks.
Metastability is **the fundamental reliability hazard at every clock domain boundary** — while a two-flip-flop synchronizer seems trivially simple, the mathematical analysis behind it and the systematic CDC verification needed to ensure every asynchronous crossing is properly handled represent one of the most critical aspects of digital design correctness, where a single missed synchronizer can cause random, unreproducible field failures that are nearly impossible to debug.