Clock Domain Crossing (CDC) Verification is the systematic detection and validation of signals crossing between different clock domains, ensuring proper synchronization (multi-flop synchronizers, handshakes, or async FIFOs) to prevent metastability-induced data corruption. CDC bugs are among the most insidious failures — non-deterministic, escaping simulation, manifesting intermittently in silicon.

Why CDC Is Critical: Modern SoCs contain 10-100+ independent clock domains. Any unsynchronized crossing risks metastability: the receiving flip-flop samples during its setup/hold window, entering an indeterminate state that propagates as silent data corruption.

Structural Verification:

Methodology: Static analysis tools (Conformal CDC, SpyGlass CDC, Questa CDC) parse RTL to: identify all clock domains, trace every crossing signal, check for proper synchronizers, detect multi-bit crossings without Gray coding, and flag reconvergence (two related signals crossing through different synchronizers and being recombined — relative timing undefined).

Common Bug Patterns: Missing synchronizer; multi-bit binary crossing (must use Gray code); reconvergent paths (signals separated by sync, later combined); FIFO issues (non-Gray pointers, incorrect full/empty); pulse loss (short pulse undetectable in destination domain — needs pulse stretcher); reset deassertion metastability.

Functional CDC: Beyond structural checks, CDC simulation with random clock skews exposes functional bugs. Formal CDC proves synchronized data is correctly consumed.

CDC verification is the most frequently cited source of silicon re-spins — bugs survive exhaustive functional simulation because simulation uses ideal clocks, making dedicated CDC analysis an absolute requirement.