DCRouter runs on one clock, which made every lesson in this course simpler. In a real SoC its APB register port might run on a slow peripheral clock while its packet ports run on a fast fabric clock. Every register value then crosses between clocks. In RTL simulation, the crossing works perfectly every time: the simulator moves a value from one flip-flop to another in zero time with no uncertainty. In silicon, a flip-flop sampling a signal that changes near its clock edge can go metastable, and two bits sampled separately can arrive in different cycles.
Why isn't simulation enough for clock-domain crossings?
The obvious approach simulates the two clocks at different frequencies and checks the results. RTL simulation does not model metastability or the variable delay of a synchroniser; a missing synchroniser behaves perfectly in simulation, and a multi-bit bus crossing with no protocol looks fine because all bits arrive together. The failure lives in physics the simulator abstracts away, so the main verification method has to be structural.
Method | What it checks | Finds |
|---|---|---|
Structural CDC analysis | Every signal crossing between clock domains: is it synchronised, and by an approved structure? | Missing synchronisers, multi-bit buses crossed bit by bit, reconvergence of separately synchronised signals, glitch-prone logic before a synchroniser |
Protocol assertions on crossings | Handshakes and FIFO pointers obey their rules (stable data while a request is pending; Gray-coded pointers change one bit at a time) | Protocol misuse at synchronised crossings |
Simulation with metastability modelling | Random extra or fewer cycles of delay on synchronised signals | Logic that depends on exact crossing latency |
Structural RDC analysis | Reset domains: asynchronous resets crossing domains, resets released at different times | Registers left in inconsistent states by partial resets; glitches from reset assertion |
CTRL writes from the APB clock to the packet clock: synchronise as a multi-bit value with a handshake or a pulse-and-hold scheme, never bit by bit.
Counters read back (ERR_CNT, PKT_CNT): capture a stable snapshot in the packet domain, then cross it with a handshake.
sleeping and wake: single-bit level signals through two-flop synchronisers, with the wake latency now variable by a cycle; the R13 rules would need a bound of a few cycles instead of "next cycle".
The plan gains features for each crossing, a structural CDC sign-off criterion, and protocol assertions on the handshakes.
A clock and reset architecture document listing domains and intended crossings.
Structural CDC and RDC analysis as a sign-off criterion, with every violation fixed or waived (lesson 14.3).
Assertions on every crossing protocol, run in simulation and formal.
Metastability-aware simulation for logic sensitive to crossing latency.
Re-run on every change to clocks, resets or crossing logic.
Practice | Purpose |
|---|---|
CDC and RDC tools run on every RTL release | Structural crossing bugs found before simulation |
Approved synchroniser and FIFO libraries | Crossings built from verified structures |
Waivers for analysed crossings recorded and reviewed | Exceptions owned, not ignored |
A team (illustrative) crossed a 4-bit configuration field between clocks with a two-flop synchroniser on each bit. Every simulation passed. In silicon, a write changing the field from 0111 to 1000 was occasionally seen for one cycle as 1111, because the bits resolved in different cycles, briefly selecting an illegal mode. A structural CDC check flags multi-bit crossings without a protocol on the first run.
The simulator delivers every bit in the same cycle; in silicon, bits can resolve in different cycles and produce a transient illegal value.
Wake would arrive through a synchroniser with a cycle of uncertainty, so the rule would need a bound (within a few cycles) instead of "in the next cycle".
CDC and RDC failures live in physics RTL simulation does not model.
Verify crossings structurally first, then with protocol assertions and latency-aware simulation.
Make structural CDC and RDC analysis a sign-off criterion with owned waivers.