Each row names the evidence for one area. A row without evidence is work still open.
Area | Item | Evidence |
|---|---|---|
Structure | All crossings classified (single bit, pulse, word, stream, counter) | CDC tool report; crossing table in the design document |
Structure | No unwaived violations; every waiver has a reason | Waiver file under version control |
Reset | One synchroniser per domain; release order defined | Reset tree document; sequencer test |
Reset | RDC report reviewed; one-sided reset behaviour tested | Randomised reset tests |
Simulation | Several clock ratios, random offsets and jitter; window hits counted per crossing | Regression log with hit counts |
Simulation | Mutation runs fail as expected (binary pointers, unstable data, short hold) | Mutation log |
Assertions | Protocol assertions bound to every handshake and FIFO | Assertion report: no failures, cover points hit |
Implementation | Delay and skew constraints on crossing paths; synchroniser flops protected from merging and placed together | STA report; netlist check |
Implementation | Recovery/removal passes for all asynchronous reset releases | STA report |
Reliability | Allocate total CDC FIT across crossings and compare characterized estimates at worst operating corners | Product failure budget, crossing count/activity and summed FIT with assumptions |
Reliability | Use implemented minimum settling time, not nominal clock period, in each estimate | Post-route stage-1 Q to stage-2 D timing, clock uncertainty/skew, setup and characterized cell parameters at PVT; estimate and margin review |
Documentation | Each crossing lists the structure, the stability or spacing assumption and the throughput | Design document |
Follow the MTBF and third-flop lesson. Illustrative allocation only: a 10 FIT product budget assigns 1 FIT to all CDC crossings; 100 equal-budget crossings each receive 0.01 FIT, requiring MTBF ≥ 10^11 hours per crossing (about 11.4 million years). FIT = 10^9 / MTBF_hours; sum crossing FIT, including every relevant synchronizer bit, against the allocation. Unequal activity and fault consequences usually justify unequal budgets. A 500-device-year MTBF is about 228 FIT and would exceed this example's entire CDC allocation.
For each crossing, retain destination frequency, bounded data-toggle rate, stage count, cell/library characterization and PVT, and the minimum implemented settling time from the timing model (receiving period adjusted for clock-to-Q, interstage route, setup, clock skew and uncertainty). Apply the characterized model with consistent units and compare worst-corner FIT and margin to its allocation. A third stage, better placement, a slower destination or reduced activity may be needed. Functional window-hit counts cannot supply these parameters.
Draft evidence record | Status for this course example |
|---|---|
Allocation: 1 FIT CDC / 100 crossings = 0.01 FIT each | Illustrative assumption; product owner must approve actual allocation |
Cell parameters, stage timing, corners and activity | Pending characterization and post-route timing; no measured settling time supplied |
Per-crossing and summed FIT; margin; fault containment review | Pending calculation and reliability/implementation review; no physical signoff claimed |
Each finding below points at the check that would have caught it.
Finding | Usually caused by |
|---|---|
Intermittent lost word in the lab | A pulse crossing with spacing below the limit, or a hold time that assumed a fixed clock ratio |
Wrong pointer or count after a clock change | Binary instead of Gray, or Gray computed combinationally |
Duplicate or garbage word after a reset | One-sided reset of a handshake (RDC) |
Random startup failures | Missing reset synchroniser, unsafe release order, or an unreset control flop |
Timing report clean but chip fails | A blanket false path or clock-groups statement that hid a crossing without a synchroniser |
The mutation run with metastability-aware synchronisers (and the CDC tool's multi-bit crossing rule). A plain simulation without metastability modelling passes the broken design.
The allocation (10 FIT product budget, 1 FIT for CDC, 100 crossings at 0.01 FIT each) is an illustration; the product owner must approve the real one. The draft evidence table is pending characterisation and post-route timing, and no physical signoff is claimed.