Clock Domain Crossing (CDC) Verification is the systematic process of identifying and validating all signal transitions between asynchronous clock domains in a digital design to ensure metastability is properly managed and data integrity is maintained across every domain boundary.

CDC Fundamentals and Risks:

• Metastability: when a signal from one clock domain is sampled by a flip-flop in another domain during its setup/hold window, the output can enter an indeterminate state lasting multiple clock cycles
• Mean Time Between Failures (MTBF): metastability resolution probability depends on the synchronizer's recovery time constant τ—MTBF must exceed 100+ years for production silicon
• Data Coherency: multi-bit signals crossing domains without proper synchronization can be sampled in partially updated states, creating data corruption that is extremely difficult to debug in silicon
• Convergence Issues: when multiple individually synchronized signals reconverge in combinational logic, their relative timing is unpredictable, creating functional failures even with proper synchronization on each path

CDC Structural Verification Techniques:

• Static CDC Analysis: tools like Synopsys SpyGlass CDC and Cadence Conformal CDC traverse the netlist to identify all clock domain boundaries and classify crossing types
• Missing Synchronizer Detection: flags any signal path crossing between asynchronous domains without passing through a recognized synchronization structure (two-flop synchronizer, FIFO, handshake)
• Reconvergence Analysis: identifies paths where synchronized signals reconverge—each reconvergence point requires either a single synchronization point for all bits or FIFO-based transfer
• Glitch Detection: combinational logic in the crossing path before synchronizers can generate glitches that propagate through and violate metastability requirements
• Reset Domain Crossing (RDC): verifies that asynchronous resets are properly synchronized before de-assertion to prevent partial reset of sequential logic

Synchronization Structures:

• Two-Flop Synchronizer: simplest single-bit synchronizer using two back-to-back flip-flops in the receiving domain—adds 1-2 cycle latency but achieves MTBF >1000 years at typical process nodes
• FIFO Synchronizer: dual-clock FIFO with Gray-coded read/write pointers for multi-bit data transfer—pointer encoding ensures only one bit changes per clock cycle, making single-bit synchronization safe
• Handshake Protocol: request/acknowledge signaling between domains for infrequent transfers—pulse synchronizers convert level-to-pulse and pulse-to-level across boundaries
• MUX Recirculation: data is held stable in source domain while a synchronized control signal selects it in the destination domain—requires hold time > receiving clock period

Functional CDC Verification:

• CDC-Aware Simulation: metastability injection during RTL simulation randomly corrupts outputs of synchronizers to verify that the design tolerates worst-case metastability resolution delays
• Formal CDC Analysis: uses property checking to prove that all data crossing asynchronous boundaries maintains coherency under all possible timing relationships
• Protocol Verification: ensures handshake and FIFO protocols cannot deadlock or lose data under back-pressure conditions—critical for AXI clock-crossing bridges
• Coverage Metrics: CDC verification completeness measured by percentage of crossings with verified synchronization schemes and confirmed protocol compliance

CDC verification is one of the most critical sign-off checks in modern SoC design, as CDC bugs account for over 50% of silicon re-spins—these failures are nearly impossible to detect through conventional simulation alone because they depend on the precise phase relationship between asynchronous clocks.