Metastability and synchronizers: Question bank — Hardware deep dive

True or false — justify

A two-flip-flop synchronizer eliminates metastability.

False. It cannot eliminate the knife-edge event; it only gives the first flop nearly a full clock period to resolve, making the chance of a bad value propagating astronomically small (huge MTBF), not zero.

Metastability only happens when data violates setup time (not hold).

False. A change inside either the setup window (before the edge) or the hold window (after it) can trigger it — the danger zone is the whole interval

[- t_{s u}, + t_{h}]

around the edge. See Setup and Hold Time.

The resolution time of a metastable flip-flop has a fixed upper bound.

False. It is unbounded and probabilistic: the voltage grows as

v_{0} e^{t / τ}

, and

v_{0}

can be arbitrarily tiny, so no finite time guarantees resolution — only larger

t_{r}

makes "still stuck" exponentially unlikely.

A synchronous signal (same clock domain, meeting timing) still needs a synchronizer.

False. If it already satisfies setup/hold relative to the sampling clock, it never enters the danger window, so no synchronizer is needed. Synchronizers are for asynchronous / cross-domain signals — see Clock Domain Crossing (CDC).

A slowly-changing async signal is safe because it rarely changes.

False. "Rarely" is not "never": the one time it happens to change near the edge it can still go metastable. Any signal crossing a clock domain must be synchronized regardless of its data rate.

Doubling the clock frequency roughly halves the MTBF.

False. MTBF

\propto \frac{1}{f _{c l k}} e^{t_{r} / τ}

; doubling

f_{c l k}

also shrinks

t_{r}

(less of a clock period as slack), and the exponential term collapses far faster than the linear

\frac{1}{f _{c l k}}

— MTBF plummets, it does not merely halve.

A faster (smaller

τ

) flip-flop with almost no slack is still safe.

False. MTBF depends on the ratio

t_{r} / τ

. A tiny

τ

helps, but if

t_{r} \approx 0

the exponent

t_{r} / τ

is small and MTBF stays poor — you need adequate slack and fast resolution.

Adding a third flip-flop multiplies MTBF by roughly

e^{T_{c l k} / τ}

True. Each extra stage donates another whole clock period of resolution time, and MTBF scales as

e^{t_{r} / τ}

, so one more period multiplies MTBF by an exponential factor — often orders of magnitude.

Metastability is a manufacturing defect that better silicon removes.

False. It is a fundamental consequence of a bistable element with a continuous transfer curve and positive feedback — every real flip-flop has a balance point. Better silicon shrinks

τ

and

T_{0}

but never abolishes the phenomenon.

The output of FF2 in a synchronizer can never be metastable.

False (rarely). If FF1 hadn't fully resolved by the time FF2 samples, FF2 can itself go metastable — that residual probability is exactly the tiny failure term left in the MTBF.

Spot the error

"I fed my async signal into two synchronizers (one per consumer) to be safe, since symmetry can't hurt."

Error: each synchronizer may resolve the same edge to a different value (one to 0, one to 1), producing an inconsistent state. Fix: synchronize once, then fan the clean output out.

"MTBF

= \frac{e ^{t_{r} / τ}}{f _{c l k} f _{d a t a} T _{0}}

, so raising

T_{0}

raises MTBF — pick a chip with a bigger window."

Error:

T_{0}

is a susceptibility window in the denominator; a larger

T_{0}

means the flop enters metastability more easily, so it lowers MTBF. You want

T_{0}

small.

"I put the two synchronizer flip-flops on different clocks to catch the signal twice."

Error: both flops in a synchronizer must run on the destination clock so the full period between them becomes resolution time. Mixing clocks just creates a second clock-domain crossing and more metastability.

"Data goes metastable, so I'll gate the clock off until it settles."

Error: you cannot know when it has settled (resolution time is unbounded/probabilistic), and gating the clock breaks timing everywhere else. The correct tool is a synchronizer that simply waits a fixed extra clock period.

"Since MTBF came out to 9 million years, metastability is fully solved for this design."

Error: MTBF is a statistical mean, not a guarantee — a failure can occur tomorrow. It only means failures are so improbable they are acceptable; think in probabilities, never in "solved".

"The exponent is

t_{r} / τ

, so I'll increase

τ

to make it bigger."

Error:

τ

is the resolving time constant — a larger

τ

means slower regeneration, so

t_{r} / τ

shrinks and MTBF drops. You want

τ

small and

t_{r}

large.

Why questions

Why is the marble-on-a-hilltop analogy accurate for metastability?

The hilltop is an unstable equilibrium: in theory the marble balances forever, but any infinitesimal nudge sends it into one valley (0 or 1). The regenerative loop amplifies that infinitesimal imbalance exponentially, exactly like gravity pulling the marble off the crest.

Why does giving the first flip-flop a full clock period help so much?

Because resolution is exponential (

v_{0} e^{t / τ}

): the "still stuck" probability decays as

e^{- t_{r} / τ}

. Trading a whole clock period for

t_{r}

pushes the exponent large, turning a likely failure into a once-in-centuries event.

Why does a faster clock make metastability worse on two counts?

(1) More clock edges per second raise the entry rate

f_{c l k}

; (2) a shorter period leaves less slack

t_{r} = T_{c l k} - t_{s u} - t_{p d}

, shrinking the exponent. Both effects push MTBF down, one linearly and one exponentially.

Why can't we just measure a flip-flop's worst-case resolution time and design for it?

There is no worst case — resolution time is unbounded because the initial imbalance

v_{0}

can be arbitrarily small. You can only design for an acceptable probability of exceeding your slack, which is what MTBF captures.

Why does the failure probability scale with both

f_{c l k}

and

f_{d a t a}

A dangerous event needs a clock edge and a data change to nearly coincide. The chance of near-coincidence grows with how often each occurs, so the entry rate is proportional to the product

f_{c l k} f_{d a t a}

(times the window

T_{0}

Why is positive feedback essential to how metastability eventually resolves?

The cross-coupled inverter loop has gain

A > 1

, so any deviation from balance feeds back and grows exponentially with time constant

τ = R C / (A - 1)

. Without that regeneration the node would linger at the midpoint indefinitely — see Positive Feedback and Regeneration.

Edge cases

What happens if the data edge lands exactly at the theoretical balance point (

v_{0} = 0

In an idealised model resolution time

τ ln (V_{L} / v_{0})

goes to infinity, so it never resolves. In reality thermal noise supplies a tiny nonzero nudge, so it still eventually falls — but this is the worst-case, longest-resolution scenario.

t_{r} = T_{c l k} - t_{s u} - t_{p d}

comes out negative, what does the synchronizer buy you?

Nothing — negative slack means FF2 samples before FF1 could even meet setup, so the whole clock period is unavailable for resolving. The exponent goes non-positive and MTBF collapses; the design is broken and needs a slower clock or a faster path.

For a purely synchronous signal already meeting timing, what is the entry probability?

Effectively zero: it never changes inside the danger window relative to its own clock, so it never enters metastability and needs no synchronizer. The whole apparatus targets asynchronous crossings only.

What is the MTBF as

f_{d a t a} \to 0

(a signal that never toggles)?

MTBF

\to \infty

: with no data transitions there is nothing to catch mid-change, so no metastability can be entered. A truly constant signal is trivially safe.

In an ideal noiseless flip-flop sitting exactly at balance, what would happen?

It would remain metastable forever, because there is no imbalance for the positive-feedback loop to amplify. This limiting case shows resolution is not guaranteed — real devices only resolve thanks to noise and non-ideal offsets.

A FIFO passes a multi-bit pointer across domains — why sync it as Gray code, not binary?

Gray code changes only one bit per increment, so even if that single bit is caught metastable the pointer resolves to either the old or new value — both valid. A binary pointer could have several bits mid-flight resolving independently, giving a garbage value never intended.

Connections

D Flip-Flop — the bistable element under test
Setup and Hold Time — the window whose violation triggers everything above
Clock Domain Crossing (CDC) — where these traps bite in real designs
FIFO Design — Gray-code edge case
Positive Feedback and Regeneration — the "why it resolves" physics
Timing Analysis — where the sign of $t_{r}$ is decided