Clock Domain Crossing (CDC) Verification is the systematic identification and validation of all signals that traverse between different clock domains in an SoC, ensuring proper synchronization to prevent metastability-induced failures — one of the most insidious classes of bugs because metastability failures are probabilistic and may not appear during simulation or initial silicon testing.

Modern SoCs contain dozens of clock domains: CPU clocks (potentially with per-core DVFS), bus clocks, peripheral clocks, I/O interface clocks, and PLL-generated clocks. Every signal crossing between asynchronous domains is a potential metastability hazard.

Metastability Fundamentals: When a flip-flop samples a signal transitioning exactly at the clock edge, the output enters a metastable state — neither logic 0 nor logic 1 — that persists for a random duration. The Mean Time Between Failures (MTBF) for a single synchronizer flip-flop is often unacceptably low (seconds to minutes). A two-flip-flop synchronizer increases MTBF exponentially — typically to centuries or millennia for practical clock frequencies.

CDC Crossing Types:

Structural CDC Verification: Tools (Synopsys SpyGlass CDC, Siemens Questa CDC) perform static analysis of the RTL to identify: all clock domain crossings, missing synchronizers, incorrect synchronizer structures, multi-bit crossings without proper reconvergence handling, and glitch-prone crossing patterns. Structural CDC finds >95% of CDC issues without simulation.

Functional CDC Verification: Beyond structural correctness, functional CDC verifies protocol-level behavior: does the FIFO pointer synchronization correctly handle full/empty conditions? Does the handshake protocol handle back-to-back transfers? Metastability injection simulation randomly delays synchronized signals to expose functional failures that depend on synchronization latency variation.

Common CDC Pitfalls: Fan-out from a single synchronizer — multiple destinations sample the synchronized signal at different times, creating skew; reconvergent clock domain paths — two signals from the same source domain cross to the same destination but arrive at different times due to different synchronizer paths; quasi-static signals assumed stable — configuration registers written during initialization may actually be written at any time during operation.

CDC verification is the guardian against the most dangerous class of digital design bugs — metastability failures that pass all functional simulation, appear intermittently in silicon, and may only manifest under specific temperature, voltage, or frequency conditions, making them nearly impossible to debug after tapeout.