Clock Domain Crossing (CDC) Design is the critical design discipline for safely transferring signals between asynchronous clock domains — where failure to properly synchronize results in metastability, data corruption, or system hangs that are non-deterministic and virtually impossible to debug in silicon, making CDC verification one of the mandatory signoff checks before tapeout.

The Metastability Problem

When a flip-flop samples an input that is changing during the setup/hold window, the flip-flop enters a metastable state — its output hovers between 0 and 1 for an unpredictable time before resolving to either value. In a synchronous design, timing closure ensures this never happens. But when signals cross between unrelated clock domains, the receiving clock can sample at any point relative to the transmitting clock — metastability is statistically certain.

Synchronization Techniques

• Two-Flip-Flop Synchronizer: The simplest and most common technique. Two back-to-back flip-flops on the receiving clock domain. The first flip-flop may go metastable; it has one full clock period to resolve before the second flip-flop samples a clean value. MTBF (Mean Time Between Failures) increases exponentially with the number of synchronizer stages — two stages typically achieve MTBF > 1,000 years.

• Gray-Code FIFO: For multi-bit data transfer between clock domains. Write pointer and read pointer are converted to Gray code (only one bit changes per increment), ensuring that even if the synchronizer samples mid-transition, the error is at most ±1 count — never a catastrophic mis-decode. The FIFO depth buffers rate differences between the two domains.

• Handshake Protocol: For infrequent transfers. The transmitter asserts a request signal (synchronized to receiving domain), the receiver captures data and asserts an acknowledge (synchronized back to transmitting domain). Guarantees data validity at cost of latency (4-6 clock cycles round trip).

• Pulse Synchronizer: Converts a pulse in one domain to a level toggle, synchronizes the toggle, then edge-detects in the receiving domain to regenerate the pulse. Used for single-cycle event signals.

CDC Verification

Formal CDC verification tools (Synopsys SpyGlass CDC, Cadence JasperGold CDC, Siemens Questa CDC) analyze the RTL for:

• Missing Synchronizers: Any signal crossing a clock domain boundary without a synchronizer.
• Multi-Bit CDC without FIFO/Gray: Multiple bits crossing together without a proper multi-bit synchronization scheme — guarantees data corruption.
• Reconvergence: A signal that fans out, crosses a domain boundary through separate synchronizers, then reconverges — the two synchronized copies may disagree for one cycle, causing glitches.
• Reset Domain Crossing: Reset signals crossing clock domains need their own synchronization (reset synchronizer with async assert, sync deassert).

CDC Design is the guardrail between deterministic digital logic and the statistical reality of metastability — the engineering practice that ensures signals crossing clock boundaries arrive correctly despite the fundamental impossibility of synchronous sampling between unrelated clocks.