Every pulse scheme has a spacing rule, and spacing violations are the most common pulse-synchroniser bug found at signoff. The mechanism is silent: the destination reports fewer events than the source sent, the counts drift apart over hours of operation, and no flag is ever raised. The rule must therefore be enforced by construction and checked by an assertion, not left to software discipline.
Consecutive source pulses must be spaced by at least the synchroniser latency plus the detection time at the destination, typically three or more destination clock periods. Two destination periods is only the sampling floor: it lets a change be registered, but a toggle at exactly that spacing can still merge with the previous one while the synchroniser is settling. The design document states the gap in destination periods, never in nanoseconds alone, so the rule survives clock-frequency changes.
Violation | What the destination sees | How it shows up |
|---|---|---|
Two toggles inside one destination period | One flip, or none | Lost event; event counts diverge |
Two stretched pulses overlapping | One long level, one edge | Lost event; same symptom |
Sustained rate above the limit | A fraction of events arrive | Throughput shortfall under load, missed interrupts |
The robust source refuses to accept a new pulse until the minimum gap has elapsed. A compact guard is a countdown that blocks re-arming:
// snippet: source-side spacing guard; pulse_in is the raw event,
// pulse_out the qualified pulse that drives the toggle or stretch logic.
// parameter MIN_GAP: minimum source cycles between accepted pulses.
// if (!rst_n) grant <= 1; else if (pulse_in && grant) grant <= 0;
// (counter reloads MIN_GAP and counts down; grant = (counter == 0))Where the event source cannot be throttled (a free-running interrupt line), accumulate instead: count events in a source-domain counter and cross the count with Gray code, or queue them in a FIFO. The protocol verification topic shows the assertions that pin the spacing rule and the stress scenarios that break undisciplined sources.
A structural review asks three questions: is there a stated minimum gap, is it expressed in destination periods, and is there an assertion plus a test that violates the gap on purpose to prove the check has teeth. A testbench that only ever sends well-spaced pulses proves nothing about the guard.
At 25 MHz the destination period is 40 ns, so even the two-period sampling floor is 80 ns and the typical three-period rule is 120 ns: a 60 ns gap violates the rule at the slow corner. Either widen the gap above 120 ns or qualify the design to the fast corner only.