No single check proves a crossing safe. Structural analysis, hostile simulation, protocol assertions and implementation constraints each cover one layer.
Read the stack from the bottom. A crossing can pass every layer below and still fail the next one: a correctly built synchroniser says nothing about whether the handshake on top of it holds req until ack.
Layer | Question | Tool |
|---|---|---|
Structural | Is every crossing a synchroniser, handshake, Gray pointer or FIFO? | CDC analysis tool, lint |
Functional | Does the protocol work with random phases, ratios and resets? | Simulation with metastability-aware models |
Protocol | Does req stay up until ack? Is data stable? Is Gray one bit per step? | SVA assertions (simulation or formal) |
Implementation | Are skew and delay bounds on the crossing paths met? | STA with CDC constraints |
7 lessons, about 45 min
With commensurate clocks the relative phase takes only a few values, so the metastability window may never be hit. Random phases, ratios and jitter are needed (the simulation lesson measures this).
The whole topic on one page, taken from each lesson's Remember box. Read it before an interview, or print it.
Rules
A violation needs a fix or a justified waiver. A caution needs review. A missing info entry means the tool did not see the intended structure.
A waiver carries a reason, an owner and a review date, under version control.
Logic in front of a synchroniser can glitch on the sampling edge, so register in the source domain first.
Rule of thumb: name synchroniser modules consistently, so the tool knows the approved ones and custom structures stand out.
Simulation
Zero window hits on a crossing is inconclusive, not a pass. Change the ratio, offset or jitter and run longer.
Hostile timing has seven ingredients: unrelated periods, random offsets, jitter, perturbation models, random resets, long runs and hit coverage.
Plain RTL simulation does not model analog metastability. Hits show exposure to the model's window, not a failure probability.
Assertion Patterns
Bind the Gray one-bit check to the registered source pointer and source clock, once for each FIFO direction.
A slow destination can skip Gray values: 000 to 011 is a legal two-bit change there. Never apply the one-step check to destination samples.
Stay in the simple SVA subset (implication, $past, $stable, $rose, fixed delays) so the checks run in every assertion-capable flow.
FIFO Tests
r_data must be the word consumed at that edge (show-ahead). A registered-read FIFO needs a latency-aware checker.
Check the queue size against the depth as well as the data, or overflow goes unseen.
After one dropped word, every later read mismatches, so a real bench may stop at the first error.
Rule of thumb: a test that cannot fail on a known-bad FIFO is not a CDC test.
Signoff
FIT = 10^9 / MTBF hours. Sum every crossing, including each synchroniser bit, against the allocation.
Window-hit counts cannot supply reliability parameters. Use characterised cells, PVT and the implemented settling time.
Keep the signoff table in the repository and update it each release.
Rule of thumb: classify, use the matching structure, constrain, check structurally, simulate hostile, and prove the tests catch injected bugs.
Reading a CDC Report
A per-bit synchroniser is wrong whenever bits change on the same edge, whether they form one bus or rejoin later (reconvergence).
A counter crosses as registered Gray code; data crosses by handshake or async FIFO; related flags are consolidated to one bit first.
Only quasi-static values are waived, and the waiver names the write condition, the assertion that checks it and what voids it.
Rule of thumb: fix by class, and waive only what an assertion keeps proving.
A CDC Mini Project
List every signal that crosses the boundary and give each one a scheme: a level synchroniser, a handshake, Gray pointers or a FIFO.
Data held under a protocol needs a max-delay constraint, not a synchroniser; per-bit synchronisers on it can make it worse.
A passing run counts only with its numbers: several seeds, window hits on every crossing, and each mutant shown to fail.
Rule of thumb: no crossing without a scheme, no seed count of one, no pass without window hits.
Practice question: Waveform debug of a CDC glitch causing metastability
Practice question: Inline RTL checkers: X/Z detection and handshake liveness
Practice question: CDC FIFO read data mismatch from clock misalignment
Code lab: Gray code sync bus
Code lab: CDC handshake
Interview: run a mock interview on this topic