A reset has two edges and only one of them is dangerous. Assertion drives every flop's asynchronous clear at once, independent of any clock, so all flops in the domain land in their reset state together. Nothing samples anything at that moment, so there is no timing window to violate.
Deassertion is the opposite: one edge in time, seen by every flop, with no relationship to the clock. A flop whose release lands too close to its clock edge can go metastable exactly like a data input that changes inside the setup/hold window. The design then wakes up with some flops out of reset and others still resolving, which is an inconsistent starting state that no plain RTL simulation, without timing or metastability modelling, will show.
Assertion | Deassertion (release) | |
|---|---|---|
Needs a clock | No: the clear is asynchronous | Yes: release must be timed to the clock |
Timing windows | None | Recovery and removal around the clock edge |
Failure mode | Essentially none | Metastable flops, staggered wake-up across the domain |
Fix | Route the reset to every flop that needs it | A reset synchroniser per domain |
Imagine two control flops released by the same raw reset. The release lands just before a clock edge: the first flop resolves in time and captures its post-reset value, while the second is still resolving and holds its reset value for one more cycle. A state machine built from those two flops now sits in a state its designer never drew, for example with valid high while the FSM still believes it is in IDLE.
The release landed inside one flop's recovery/removal window: that flop resolved late (or metastably) while the other came out cleanly. The fix is a synchronised release, covered in the next lesson.
Assertion forces the flop through its asynchronous clear path rather than racing the clock: the flop is held in reset regardless of clock edges, so no sampling window is involved. The race only exists at release, when the flop must resume clocked operation.