One page for revision. Every row restates a lesson rule without its explanation; follow the links when a row needs its reasoning. No thresholds appear here: stage counts, depths, and dates come from project policy and the sizing calculations, never from memory.
From the decision matrix: crossing type to pattern to the hazard the review asks about.
Crossing type | Pattern | Hazard to handle |
|---|---|---|
Single-bit level | Two-flop synchroniser | Level held fewer than two destination periods. |
Single-bit pulse, slow-to-fast | Direct two-flop if the pulse spans two fast periods, else stretch first | Marginal widths near the ratio limit. |
Single-bit pulse, fast-to-slow | Toggle or stretch scheme with spacing rules | Lost pulse between sampling edges. |
Multi-bit word | Handshake ( | Data released before acknowledge completes. |
Stepping counter | Gray code plus per-bit synchronisers | A jump of more than one step; sampling skips values. |
Streaming data | Async FIFO with Gray pointers | Burst overflow: depth sized for the worst case. |
Rare configuration bus | Load pulse with held data | Data changing inside the capture window. |
Reset release | Per-domain reset synchroniser | Deassertion racing the destination clock. |
From the synchroniser rules, the pulse and multi-bit topics, and the reset section.
# | Rule | Breaks when |
|---|---|---|
1 | The source is a registered output in its own domain. | A combinational decoder output feeds the first flop and glitches as data. |
2 | No logic sits before the first flop or between the flops. | A gate in the path glitches or stretches the wire and eats resolution time. |
3 | All synchroniser flops share one destination clock. | Mixed clocks leave the settling budget uncontrolled. |
4 | The flops are placed together with a short route between them. | A long route steals resolution time. |
5 | Only the last flop drives logic; the first flop is never tapped. | A debug tap or branch reads a possibly metastable value. |
6 | Levels are held stable for at least two destination periods, measured against the slowest destination period in any supported mode. | A short level is sampled as a pulse or missed entirely. |
7 | Fast-to-slow pulses use toggle or stretch with minimum spacing. | A narrow pulse falls between sampling edges and is lost. |
8 | Words cross by handshake, FIFO, or qualified capture, never by per-bit sync. | Bits resolve independently and the word tears. |
9 | Gray-coded values step one at a time under the crossing. | A multi-bit jump samples to an unrelated value. |
10 | Each domain releases reset through its own synchroniser. | Unsynchronised deassertion violates recovery and removal. |
Triage highest severity first, per the violation classes. Order: prove the setup first, then work the classes top to bottom.
Order | Finding class | Meaning and typical fix |
|---|---|---|
0 | Setup: clocks, resets, intent | Confirm the run covers the design at the signed-off revisions before reading any finding. |
1 | Unsynchronised crossing | No synchronising structure; defect until proven otherwise. Add a synchroniser, handshake, or FIFO. |
2 | Logic before the synchroniser | Combinational logic in the path; glitches captured as data. Move it or register the source. |
3 | Multi-bit crossing without a protocol | Independent bit syncs; the value tears. Gray, handshake, or FIFO by data type. |
4 | Reconvergence | Synchronised branches rejoin unprotected. Restructure or bound the skew with evidence. |
5 | Reset crossing | Release races the destination clock. Per-domain reset synchroniser. |
6 | Synchroniser misuse | Right structure, wrong use (short pulse, tapped first flop, shared bits). Match structure to signal. |
From release order, isolation, and the RDC categories.
Rule | What to do |
|---|---|
Asynchronous assert, synchronous release | Assertion may be immediate; deassertion always passes through the destination-domain synchroniser. |
Receivers before senders | The consumer leaves reset first with pointers and handshakes idle; the producer starts only after. |
Ready flags between blocks | Each block announces it is out of reset and idle; no traffic starts on an unannounced peer. |
Ordered sequencer with gaps | Release domain resets in dependency order with settling gaps; same-cycle release is not sequencing. |
Reset the whole protocol group together | Partial or conditional reset of a crossing group needs proof the unreset flops cannot affect it. |
No logic on the reset net | The synchroniser output reaches the flops unmodified; no gates or muxes in between. |
Isolate during sequencing | Hold downstream logic known while its domain is inactive so unknowns cannot propagate. |
Every waiver carries all five rows, per Evidence for a Waiver. A missing row rejects the waiver without technical discussion.
Field | Content |
|---|---|
Finding reference | Instance path, check class, and the reporting run; never a count or a pattern. |
Protocol argument | Three sentences: what is guaranteed, by which mechanism, under which conditions. |
Assertion or simulation proof | Named assertions covering the assumed condition, re-checked every regression. |
Constraint reference | The timing exception or delay bound carrying the assumption, reviewed against the inventory. |
Owner and expiry | Named owner, the design revision it applies to, and the change that re-opens it. |
Each owner answers in writing before the review, per the review checklists.
Owner | Checks |
|---|---|
Design | Every crossing has an intended structure; sources registered with no logic before the first flop; protocols match the data type; boundary crossings name their owning side. |
Verification | Protocol assertions written and passing; metastability-injection checks cover the synchronisers; quasi-static assumptions re-checked every regression; stall and back-pressure covered. |
Signoff | Setup reviewed against the architecture; runs cover the full hierarchy at the signed-off revisions; every finding fixed or waived with evidence; constraints reviewed; dashboard history continuous. |
Qualitative models from the MTBF lesson and depth sizing. Words first, symbols second, project numbers never from memory.
Model | In words | Symbolic form |
|---|---|---|
MTBF | MTBF grows exponentially with resolution time over the flop time constant, and falls only linearly with clock and data rates. | MTBF ~ exp(t_r / tau) / (T_W x f_clk x f_data) |
Extra stage | One more destination period of settling multiplies MTBF enormously while adding one cycle of latency. | MTBF x exp(T_dest / tau) per added stage |
Linear levers | Doubling the data rate merely halves MTBF; halving the window merely doubles it. | Denominator is linear in each rate |
FIFO depth | Depth covers burst accumulation plus the entries hidden by stale synchronised pointers plus flag-reaction margin. | depth >= (Rw - Rr) x T_burst + N_sync_cover + N_flag_margin |
The sizing calculation with its named inputs: burst length, rate mismatch during the burst, and synchroniser latency cover, plus any flag margin; and the testbench run covering the worst-case burst with the consumer initially stalled.