Logic simulators do not reproduce real metastability: a flop model resolves cleanly where silicon dithers. Metastability injection closes part of that gap deliberately — when source data changes near a destination sampling edge, the check replaces the sampled value with a random choice of old or new. The protocol must survive that randomisation; if it does, the design tolerates late resolution.
Identify the sampling points: the first flop of each synchroniser, the capture flop of each handshake, the Gray pointer registers.
Detect the vulnerable window: source data changing within the setup-hold neighbourhood of the sampling edge.
On a window hit, force the sampled value to a random old-or-new choice with an explicit seed or pattern, so the run is reproducible.
Run the normal regression on top: protocols, scoreboards, and assertions all observe the randomised behaviour.
Proves | Cannot prove |
|---|---|
The protocol tolerates either resolution of a window hit | Real metastability timing or frequency |
No X-optimism hides a torn value: the random choice explores both outcomes | Electrical behaviour: resolution time, oscillation, mid-rail hold |
Back-to-back hits and bursts are survivable, if the stimulus covers them | Anything about stimulus never applied — coverage still rules |
Injection is aimed, not blanket: every synchroniser input, every handshake capture flop, and every Gray pointer register gets it, while ordinary single-domain logic does not. The inventory from structural analysis provides the target list, which is another reason injection results are only meaningful on the same setup and revision as the structural run. Injecting everywhere wastes cycles; injecting from a stale target list misses the crossings that moved.
The key sentence for every review: injection proves the protocol is insensitive to which way a race resolves, not that races are rare. Rarity comes from the synchroniser and its settling time; correctness-under-race comes from the protocol, and injection tests exactly that half.
Nothing about metastability tolerance: the vulnerable condition never occurred, so the randomisation never engaged. The stimulus must first be shown to hit the windows.
Reproducibility and honesty: an explicit seed replays the run, and hit counts prove both resolutions were exercised rather than assumed.