Metastability and synchronizers: Exercises — Hardware deep dive

Before we start, one table of the symbols we reuse, so nothing appears unexplained:

Definition Symbol dictionary (everything used below)

$f_{c l k}$ ::: clock frequency (edges per second) of the destination flip-flop.
$f_{d a t a}$ ::: rate at which the asynchronous data changes (changes per second).
$T_{c l k} = 1/ f_{c l k}$ ::: one clock period, in seconds.
$t_{s u}$ ::: setup time — the interval before a clock edge during which the data input must already be stable; if data moves inside it, the flop may go metastable.
$t_{h}$ ::: hold time — the interval after a clock edge during which the data input must stay stable; if data moves inside it, the flop may also go metastable.
$t_{p d}$ ::: propagation delay — the time a flip-flop takes to push its sampled value out to its own output pin after the clock edge.
$τ$ ::: the flip-flop's resolving time constant — how fast the internal positive-feedback loop pushes an imbalance toward a clean 0 or 1. Smaller $τ$ = faster escape.
$T_{0}$ ::: the metastability window constant — the tiny slice of time around the edge where a data change can trip the knife-edge. It bundles both the setup-side and hold-side danger zones into one effective width (see the note below).
$t_{r}$ ::: resolution time available — how long we let a possibly-metastable node settle before the next stage samples it.
$MTBF$ ::: Mean Time Between Failures — average seconds between two synchronizer escapes-that-were-too-late.
$e$ ::: Euler's number $\approx 2.71828$ , the natural exponential base. Writing $e^{x}$ means " $e$ raised to the power $x$ "; it is the constant that describes anything growing (or decaying) at a rate proportional to its own size — exactly what a positive-feedback loop does. Every $e^{\dots}$ on this page uses this same number.

Definition Where did the hold time

$t_{h}$ go? Metastability can be triggered by a data change on either side of the edge: inside the setup window ( $t_{s u}$ before) or inside the hold window ( $t_{h}$ after). Both danger zones matter. In the MTBF law they are already accounted for — they are bundled into the single susceptibility constant $T_{0}$ , which measures the total effective width of the "if data lands here, the flop can go metastable" slot around the edge (setup-side + hold-side). That is why $t_{h}$ appears in the symbol table but not in the MTBF formula: the formula measures the coincidence probability through $T_{0}$ , not through the individual $t_{s u}$ / $t_{h}$ values. The subtraction $t_{r} = T_{c l k} - t_{s u} - t_{p d}$ uses $t_{s u}$ (of the next flop) because that is what eats into the settling budget on the receiving edge; the hold condition is a same-cycle constraint that STA checks separately and does not shorten $t_{r}$ . In every problem below we assume the hold constraint is met by the routing (a normal, easily-satisfied requirement), so $t_{h}$ never enters the arithmetic — but it is not ignored, only absorbed into $T_{0}$ .

Definition The assumptions this MTBF formula quietly relies on

The formula is a statistical one — before trusting a number, check these hold:

Random, independent arrivals. Clock edges and data changes are treated as two independent streams of events landing at random relative times — a Poisson-style picture. The chance that a data change falls in the tiny window $T_{0}$ around an edge is then just "rate $\times$ rate $\times$ window," which is where $T_{0} f_{c l k} f_{d a t a}$ comes from. If the data is somehow correlated with the clock (e.g. derived from it), this coincidence probability is wrong.
Memoryless resolution. Once metastable, the probability of still being stuck after time $t$ is $e^{- t / τ}$ — the flop "forgets" how long it has already been stuck. This is the exponential-decay assumption behind the whole law.
One settling window per stage. Each flip-flop supplies its own independent resolution window $t_{r}$ ; independence is why their survival probabilities multiply (see L4).

Below, one figure fixes the single most important behaviour — that MTBF rises exponentially with the settling time you grant. Study it before the exercises: the y-axis is logarithmic, yet the curve still shoots upward, which is the visual signature of exponential growth.

Figure — Metastability and synchronizers

Reading the figure (s01): the horizontal axis is $t_{r}$ (settling time in ns), the vertical axis is MTBF on a log scale. The fixed parameters are printed on the plot itself — $τ = 0.25$ ns, $T_{0} = 0.2$ ns, $f_{c l k} = 50$ MHz, $f_{d a t a} = 2$ MHz — so you can reproduce every point. The dashed blue and pink lines mark $t_{r} = 4$ ns and $t_{r} = 5$ ns — just one extra nanosecond apart. Yet on the curve they are separated by a factor $e^{1/ τ} = e^{1/0.25} = e^{4} \approx 55 \times$ in MTBF. That one-nanosecond jump for many orders of magnitude of safety is the entire economic argument for synchronizers.

Level 1 — Recognition

L1.1

State, in one sentence each, what $τ$ and $T_{0}$ physically represent, and say which of the two you'd want smaller to improve MTBF.

Recall Solution

$τ$ = resolving time constant: how quickly the cross-coupled loop amplifies a tiny imbalance away from the knife-edge. Smaller $τ$ helps (faster escape → larger $e^{t_{r} / τ}$ ).
$T_{0}$ = susceptibility window: the width of the time slot (setup-side + hold-side) in which a data change can trip metastability. Smaller $T_{0}$ also helps (smaller failure prefactor), but it sits in the denominator, so its effect is only linear — nowhere near as powerful as shrinking $τ$ , which sits in the exponent. Answer: both smaller is better, but $τ$ is the high-leverage one because it lives in the exponent.

L1.2

Look at the master MTBF equation. Which single quantity, when increased, makes MTBF grow exponentially rather than linearly?

Recall Solution

$t_{r}$ , the resolution time available. It sits inside $e^{t_{r} / τ}$ . Every extra $τ$ worth of $t_{r}$ multiplies MTBF by $e^{1} \approx 2.72$ . This is why a synchronizer works: it hands the metastable node an almost-full clock period of $t_{r}$ .

Level 2 — Application

L2.1

A synchronizer has $τ = 0.25$ ns. You currently give it $t_{r} = 5$ ns. By what factor does MTBF change if you increase $t_{r}$ to $6$ ns?

Recall Solution

MTBF $\propto e^{t_{r} / τ}$ , so the factor is $\frac{e ^{6/0.25}}{e ^{5/0.25}} = e^{(6 - 5) /0.25} = e^{4} \approx 54.6.$ WHAT we did: took the ratio of the two exponentials so the prefactor cancels. WHY: only the change in $t_{r}$ matters, and it enters through $Δ t_{r} / τ = 1/0.25 = 4$ . Answer: MTBF grows by $\approx 54.6 \times$ for one extra nanosecond. Cheap insurance. (This is exactly the blue-to-pink jump you read off figure s01.)

L2.2

Compute MTBF for: $f_{c l k} = 50$ MHz, $f_{d a t a} = 2$ MHz, $τ = 0.5$ ns, $T_{0} = 0.2$ ns, $t_{r} = 15$ ns.

Recall Solution

Step 1 — prefactor (failure-rate scale): $T_{0} f_{c l k} f_{d a t a} = (0.2 \times 1 0^{- 9}) (50 \times 1 0^{6}) (2 \times 1 0^{6}) = 0.2 \times 1 0^{- 9} \times 1 0^{14} = 2 \times 1 0^{4} s^{- 1} .$ Why: both a clock edge and a data change must nearly coincide, so multiply both rates by the window width (this is the independent-arrivals assumption in action). Step 2 — exponent: $t_{r} / τ = 15/0.5 = 30$ , so $e^{30} \approx 1.068 \times 1 0^{13}$ . Step 3 — combine: $MTBF = \frac{e ^{30}}{2 \times 1 0 ^{4}} \approx \frac{1.068 \times 1 0 ^{13}}{2 \times 1 0 ^{4}} \approx 5.3 \times 1 0^{8} s \approx 16.9 years .$

Level 3 — Analysis

L3.1

A design runs at $T_{c l k} = 8$ ns with $t_{s u} = 0.6$ ns and $t_{p d} = 1.2$ ns in a two-flop synchronizer. (a) Find $t_{r}$ . (b) The team doubles the clock frequency. Assuming $t_{s u}$ and $t_{p d}$ are unchanged, find the new $t_{r}$ and the factor by which MTBF changes from the $t_{r}$ term alone, given $τ = 0.3$ ns.

Recall Solution

(a) $t_{r} = T_{c l k} - t_{s u} - t_{p d} = 8 - 0.6 - 1.2 = 6.2$ ns. (b) Doubling frequency halves the period: $T_{c l k}^{'} = 4$ ns. Then $t_{r}^{'} = 4 - 0.6 - 1.2 = 2.2 ns .$ The exponent term changes by $e^{(t_{r}^{'} - t_{r}) / τ} = e^{(2.2 - 6.2) /0.3} = e^{- 4/0.3} = e^{- 13.33} \approx 1.6 \times 1 0^{- 6} .$ Interpretation: the $t_{r}$ term alone collapses MTBF by a factor $\approx 1.6 \times 1 0^{- 6}$ (roughly 620,000× worse). And there's an extra hit: $f_{c l k}$ in the denominator also doubles, worsening MTBF by another $2 \times$ . WHAT IT MEANS: doubling clock speed doesn't halve MTBF — it demolishes it, dominated by the exponential. This is exactly the parent note's "Forecast-then-Verify."

Common mistake Corner case every designer must check:

$t_{r} \leq 0$ . The setup: push the clock fast enough and $T_{c l k}$ shrinks until $T_{c l k} \leq t_{s u} + t_{p d}$ , giving $t_{r} \leq 0$ . Plugging that into the formula yields $e^{t_{r} / τ} \leq 1$ — the maths still "returns a number," so it silently reports a garbage MTBF smaller than the raw failure interval. The truth: with $t_{r} \leq 0$ there is no settling time left at all — FF2 samples FF1 before FF1 has even produced a stable output, so the synchronizer provides zero protection and static timing analysis fails outright (it's a plain setup violation on the FF1→FF2 path). Fix: always confirm $t_{r} > 0$ (ideally $t_{r} ≫ τ$ ) before computing MTBF; if not, you must slow the clock, cut $t_{p d}$ , or restructure the path — the exponential formula does not apply below $t_{r} = 0$ .

Level 4 — Synthesis

The next figure shows why stages multiply rather than add — look at it before solving L4.

Reading the figure (s02): three flip-flops (FF1, FF2, FF3) sit in series, all driven by the destination clock shown along the bottom. The async flag enters FF1 on the left. Between FF1→FF2 and again between FF2→FF3 sits one full clock period labelled $t_{r}$ , and above each gap is written $\times e^{t_{r} / τ}$ . The point the picture makes visually: each gap is an independent chance to settle, so their safety factors multiply — two gaps means the MTBF carries $e^{t_{r} / τ}$ twice.

L4.1

Your two-flop synchronizer gives MTBF $= 1 0^{4}$ s (about 2.8 hours — unacceptable). You may add a third flip-flop, which grants a second full resolution window of $t_{r} = 7$ ns. With $τ = 0.35$ ns, what is the new MTBF, and is it acceptable (say, > 1000 years)?

Recall Solution

WHAT a third flop does: FF2's output now also gets a whole clock period ( $t_{r}$ ) to settle before FF3 samples it. Because that window is independent of FF1's window (the independence assumption from the top of the page), the survival probabilities multiply — so MTBF gains another exponential factor $e^{t_{r} / τ}$ . $MTBF_{3} = MTBF_{2} \times e^{t_{r} / τ} = 1 0^{4} \times e^{7/0.35} = 1 0^{4} \times e^{20} .$ $e^{20} \approx 4.85 \times 1 0^{8}$ , so $MTBF_{3} \approx 4.85 \times 1 0^{12} s \approx 1.54 \times 1 0^{5} years .$ Answer: about 154,000 years — comfortably above 1000 years. Yes, acceptable. Each added flop multiplies MTBF by $e^{t_{r} / τ}$ ; that's why depth (more flops) beats almost every other fix.

Level 5 — Mastery

L5.1 (Design + defend)

You must cross a 1-bit control flag from a 40 MHz domain into a 200 MHz domain. Device specs: $τ = 0.2$ ns, $T_{0} = 0.15$ ns, $t_{s u} = 0.4$ ns, $t_{p d} = 0.9$ ns. The flag toggles at most $f_{d a t a} = 5$ MHz. Requirement: MTBF > 100 years. (a) Which domain's clock governs the synchronizer, and why? (b) Compute $t_{r}$ for a two-flop synchronizer. (c) Compute MTBF. Does two flops suffice? (d) If not, how many flops total are needed?

Recall Solution

(a) WHICH clock: the synchronizer lives in the destination domain — here 200 MHz — because the destination is the one sampling the asynchronous flag. The flag is async relative to the 200 MHz clock, so that clock's period is what buys the resolution time. Use $T_{c l k} = 1/200 MHz = 5$ ns. (b) $t_{r}$ : $t_{r} = T_{c l k} - t_{s u} - t_{p d} = 5 - 0.4 - 0.9 = 3.7 ns .$ (Sanity: $t_{r} = 3.7 > 0$ , so the model applies — always check this first, per the L3 corner case.) (c) MTBF (two flops):

Prefactor: $T_{0} f_{c l k} f_{d a t a} = (0.15 \times 1 0^{- 9}) (200 \times 1 0^{6}) (5 \times 1 0^{6}) = 0.15 \times 1 0^{- 9} \times 1 0^{15} = 1.5 \times 1 0^{5} s^{- 1} .$
Exponent: $t_{r} / τ = 3.7/0.2 = 18.5$ , so $e^{18.5} \approx 1.083 \times 1 0^{8}$ .
$MTBF_{2} = \frac{e ^{18.5}}{1.5 \times 1 0 ^{5}} = \frac{1.083 \times 1 0 ^{8}}{1.5 \times 1 0 ^{5}} \approx 722 s \approx 12 minutes .$ Two flops fail badly ( $≪$ 100 years) — nowhere near the requirement. (d) How many flops: each extra flop beyond the second multiplies MTBF by $e^{t_{r} / τ} = e^{18.5} \approx 1.083 \times 1 0^{8}$ . Target: $MTBF > 100 years = 100 \times 3.156 \times 1 0^{7} \approx 3.156 \times 1 0^{9}$ s.
3 flops (one extra window): $MTBF_{3} = 722 \times 1.083 \times 1 0^{8} \approx 7.8 \times 1 0^{10}$ s $\approx 2480$ years. ✓ (already clears 100 years)
(For contrast, 4 flops would give $\approx 7.8 \times 1 0^{10} \times 1.083 \times 1 0^{8} \approx 8.5 \times 1 0^{18}$ s — absurd overkill.) Answer: a 3-flop synchronizer suffices ( $\approx 2480$ years $>$ 100 years, with large margin). Two flops do not; three do. Check: $7.8 \times 1 0^{10} s > 3.156 \times 1 0^{9} s$ , so requirement met.

Recall One-line self-test

Why does adding a flip-flop multiply MTBF by $e^{t_{r} / τ}$ instead of adding to it? Question ::: Because each stage grants an independent resolution window; survival probabilities across independent stages multiply, and each contributes its own exponential $e^{t_{r} / τ}$ factor.

Connections

D Flip-Flop — every stage above is a D flip-flop chained in series.
Setup and Hold Time — $t_{s u}$ and $t_{h}$ bound the window folded into $T_{0}$ ; $t_{s u}$ enters $t_{r} = T_{c l k} - t_{s u} - t_{p d}$ .
Clock Domain Crossing (CDC) — L5 is a textbook CDC of a 1-bit control flag.
FIFO Design — multi-bit crossings use synchronized Gray pointers, not raw synchronizers.
Positive Feedback and Regeneration — the origin of the $e^{t / τ}$ resolution law.
Timing Analysis — where $t_{r}$ , $t_{s u}$ , $t_{p d}$ come from in a real timing report.