A CDC tool recognises approved structures. Anything else is a violation.
Each rule below names the violation, the reason and the fix.
Rule | Violation looks like | Why it is a problem | Fix |
|---|---|---|---|
Every crossing is synchronised | A flop in clock A feeds a flop in clock B directly | Metastability reaches logic | Add a 2FF, handshake or FIFO |
No combinational logic before a synchroniser | Source logic (AND/OR of flops) feeds the 2FF | Glitches can be sampled | Register the signal in the source domain first |
No logic between synchroniser flops | Gate between flop 1 and flop 2 | Settling time reduced | Remove it |
No fan-out of the first synchroniser flop | Flop 1 also feeds other logic | Metastable value used | Use only the last flop |
Multi-bit crossings are coded safely | N bits each through its own 2FF | Bits may be sampled at different times | Gray code, handshake or FIFO |
No reconvergence | Two synchronised copies of related signals combine in the destination | They may arrive on different cycles | Synchronise once and share, or send as a single word |
Control and data are separated correctly | Data crosses before its control signal is stable | Data can be captured early | Hold data until the synchronised control has been seen |
Reset crossings are synchronised | Async reset used raw in a domain | Recovery/removal violations | Reset synchroniser per domain |
Clock enables do not cross domains unsynchronised | An enable from domain A gates a flop in B | Same as a data crossing | Synchronise the enable |
Two rules in the table are about timing that a schematic does not show: logic in front of a synchroniser, and reconvergence. Each picture below is a small simulation.
Each slot is 0.5 ns, from 8.0 ns. y_comb is a & b straight from the source flops; q_d is the first synchroniser flop fed by it; y_reg is the same AND registered in the source domain.
Slot 4: a rises. The falling b reaches the gate 1 ns later (slot 6), so y_comb is high for slots 4 and 5, although a & b is 0 before and after the edge.
Slot 5: a destination edge lands inside the glitch, and q_d captures 1: a false event.
All slots: y_reg stays 0. A flop changes only at its clock edge, so the registered signal cannot glitch. That is the fix in the table.
Each slot is one destination clock cycle. s0 and s1 are the outputs of two separate two-flop synchronisers, and sel_d is {s1, s0}.
Slot 2: both source bits change together, from 01 to 10. Bit 0 arrives before the next destination edge; bit 1's longer path arrives 0.5 ns after it.
Slot 3: s0 has fallen but s1 has not yet risen, so sel_d reads 00: a value the source never held.
Slot 4: s1 catches up and sel_d is 10. Any logic that decoded 00 in slot 3 has already acted on it.
Violations are crossings without a recognised structure. Each needs a fix or a justified waiver.
Cautions are crossings that look right but the tool cannot prove. Review each one and waive with a reason when it is correct.
Info items list the safe crossings the tool recognised. A missing entry means the tool did not see the intended structure.
Waivers carry a reason, an owner and a review date, and live under version control.
Logic can produce brief glitches when its inputs (flops in the source clock) change at slightly different times. A glitch landing on the sampling edge is captured as a real pulse. A flop in the source domain between the logic and the synchroniser removes the glitches.