Most multi-bit crossings are not streams: mode selects, calibration values, address offsets. These buses sit unchanged for thousands of cycles and move only in maintenance windows. Qualified capture crosses them almost for free: synchronise one qualifier and sample the stable bus with it. The saving is real and so is the obligation: the bus must really be stable.
The source changes the bus only while idle, then raises a qualifier that crosses through a synchroniser. The destination samples the bus directly (no per-bit synchronisers) on the qualified edge. Sampling an unsynchronised bus is sound here for exactly one reason: nothing on it is changing.
Obligation | What to show |
|---|---|
Bus stable around every qualifier | No source path changes any bus bit from well before the qualifier until the capture settles, covering synchroniser latency and skew |
Qualifier itself clean | Single-bit level or pulse synchroniser with the standard rules (registered source, no logic between flops) |
Change protocol quiesces first | The maintenance window stops all qualifiers before touching the bus and re-arms after |
No hidden writers | Every driver of every bus bit enumerated; no debug, test, or exception path writes outside the window |
Reset state consistent | Bus and qualifier reset to a pair the destination may legally sample |
The fourth row fails most often in review: a scan dump, a firmware poke, or an error-injection path writes the “static” bus during operation. Each needs either exclusion by construction or its own quiesce rule.
Qualified capture: cross the lock (or a done strobe) as the qualifier and sample the bus with it. Prove the boot sequence writes the bus before raising the qualifier, nothing writes after the lock, and reset holds a legal default until boot completes.