Clock Domain Crossing (CDC) Design and Verification is the methodology for safely transferring data between circuits operating on different, asynchronous clocks — where each crossing is a potential source of metastability (a flip-flop entering an indeterminate state when sampling a signal transitioning exactly at the clock edge), data corruption, and data loss, making CDC the most common source of silicon bugs in multi-clock SoC designs.

The Metastability Problem

When a flip-flop samples a signal that changes within its setup/hold window, the output does not resolve cleanly to 0 or 1. Instead, it enters a metastable state — an intermediate voltage that may take an arbitrarily long time to resolve. In a multi-clock system, signals crossing between clock domains have no guaranteed timing relationship, so metastability is structurally inevitable without proper synchronization.

CDC Synchronization Circuits

• Two-Flop Synchronizer: The simplest and most common. Two flip-flops in series on the destination clock domain. The first flop may go metastable; the second flop samples the resolved output one cycle later. Reduces metastability failure probability from ~10⁻¹ to ~10⁻²⁰ per crossing (for properly designed synchronizers at modern process nodes). Works for single-bit signals only.

• Gray-Code FIFO (Async FIFO): For multi-bit data crossing. Write pointer (binary) is converted to Gray code (only one bit changes per increment), synchronized to the read clock domain via two-flop synchronizers, and compared with the read pointer to determine FIFO empty/full status. The single-bit-change property of Gray code ensures that synchronized pointer values are always valid (at most one increment behind).

• Handshake Protocol: REQ signal is synchronized to the destination domain. Destination processes data and asserts ACK, which is synchronized back to the source. Guarantees safe transfer but throughput is limited by double synchronization latency (4-6 clock cycles per transfer).

• Pulse Synchronizer: Converts a pulse on the source clock to a level toggle, synchronizes the toggle, then edge-detects on the destination clock to regenerate the pulse. Used for single-event notifications (interrupts, flags).

CDC Verification

Static CDC verification tools (Synopsys SpyGlass CDC, Cadence Conformal CDC, Siemens Questa CDC) perform structural analysis:

• Identify all CDC paths: Every signal crossing between clock domains.
• Check synchronization: Verify that every crossing goes through a recognized synchronizer structure.
• Multi-bit analysis: Flag multi-bit buses that are not properly synchronized (individual two-flop synchronizers on bus bits can produce glitch values when bits arrive at different times).
• Reconvergence analysis: Detect signals that split, cross the CDC boundary on different paths, and reconverge — creating potential data coherency issues.

Silicon Bug Statistics

Industry data shows that CDC bugs are the #1 or #2 cause of silicon respins. A single missing synchronizer can cause a system crash that occurs once per week under specific workload conditions — impossible to reproduce in simulation but catastrophic in production.

CDC Verification is the essential safety net for multi-clock designs — catching the timing hazards that functional simulation cannot detect because metastability is a physical phenomenon invisible to logic simulation, requiring structural analysis tools that understand the physics of clock domain boundaries.