A flop with an asynchronous reset has two timing requirements that apply at the moment of release. They are the reset analogues of setup and hold, and they exist for the same reason: the flop needs its control inputs stable around the clock edge to decide cleanly.
Check | Plain meaning | Data analogy |
|---|---|---|
Recovery | The release must happen at least the recovery time before the next active clock edge | Setup: data stable before the edge |
Removal | Deassertion is forbidden inside the removal window just after a clock edge (the release must not sit just after the previous edge); the minimum asserted pulse width is a separate check | Hold: data stable after the edge |
A raw asynchronous release lands at a random point in the clock period, so it violates one of the two windows with a probability roughly equal to the windows' combined width divided by the period. The sketch below works that share for illustrative numbers:
illustrative share of releases landing in a forbidden window
recovery window 0.30 ns, removal window 0.15 ns, period 10 ns
share = (0.30 + 0.15) / 10 = 0.45 / 10 = 0.045 = 4.5% (illustrative)A few percent of releases going metastable is catastrophic at chip scale: one bad release can corrupt a whole domain's starting state, and the failure never repeats the same way twice. The reset synchroniser converts the problem from a random-timed release into an ordinary clocked path, because the domain reset now changes only just after a clock edge of its own domain.
Recovery and removal are timed like setup and hold on every flop with an asynchronous reset, across the operating corners.
The inter-stage path inside the synchroniser and the path from its output to the domain's flops are ordinary same-domain paths. The entry path (the asynchronous source into the first flop) is not: it needs its asynchronous exception plus a delay bound, reviewed with the CDC evidence.
Any flop whose reset bypasses the synchroniser keeps the raw-release hazard and must be justified or fixed; there is no statistical argument that makes a raw release acceptable.
About 4.5%: (0.30 + 0.15) / 10 = 0.045. The sketch above shows the arithmetic.
An ordinary flop-to-flop path on the domain clock, checked like any other synchronous path. That is the point of the synchroniser: no more randomly timed edge.