Clock domain crossing: Exercises — Hardware deep dive

Before we begin, one figure fixes the picture of why crossing is dangerous — glance at it whenever a problem says "the signal is unrelated to the clock".

The burnt-orange input can flip at any moment. The teal clock edge only samples at its tick. When a flip happens inside the shaded setup/hold window around the edge, the flop is told "capture" while the value is still moving — that is the birth of metastability.

Level 1 — Recognition

(Can you name the pieces and read a formula?)

Recall Solution L1.1

The time before the edge is the setup time $t_{s u}$ : the data must already be stable this long before the clock ticks.
The time after the edge is the hold time $t_{h}$ : the data must stay stable this long after the tick.

Together they form the "danger window". If the input changes anywhere inside it, the flop's capture is ambiguous → metastability. See these two times as the width of the shaded band in the figure above.

Recall Solution L1.2

Symbol	Meaning	Larger → MTBF?
$t_{s}$	settling time we allow before using the value	better (it's in the exponent, upstairs)
$τ$	regeneration time constant of the flop	worse (bigger $τ$ shrinks the exponent $t_{s} / τ$ )
$T_{0}$	measured metastability aperture / prefactor	worse (downstairs)
$f_{c l k}$	sampling clock frequency	worse (downstairs — sample more often, more chances to catch a bad edge)
$f_{d a t a}$	rate of async input changes	worse (downstairs — more transitions to catch)

The single most powerful knob is $t_{s}$ because it sits inside the exponential.

Recall Solution L1.3

(a) single strobe → two-flop synchronizer (one bit, safe to sync directly).
(b) counter/pointer → Gray code (only one bit changes per step, so a metastable bit still yields a valid off-by-one value).
(c) arbitrary 32-bit word → handshake or asynchronous FIFO (many bits change at once; never sync each bit independently).

Level 2 — Application

(Plug numbers into the formulas correctly.)

Recall Solution L2.1

First the clock period: $T_{c l k} = \frac{1}{200 MHz} = \frac{1}{2 \times 1 0 ^{8}} = 5 ns$ . $t_{s} = 5 ns + 0.3 ns - 0.2 ns = 5.1 ns .$ Why $+ t_{c q}$ and $- t_{s u}$ ? FF1's resolved value only shows up after its clock-to-Q delay, which lengthens the window; but FF2 must have stable data one setup time before its own next edge, which shortens it. Net: $5.1 ns$ .

Recall Solution L2.2

Exponent: $\frac{t _{s}}{τ} = \frac{5.1 ns}{100 ps} = \frac{5.1 \times 1 0 ^{- 9}}{100 \times 1 0 ^{- 12}} = 51.$ Denominator: $T_{0} f_{c l k} f_{d a t a} = 1 0^{- 11} \times 2 \times 1 0^{8} \times 1 0^{6} = 2 \times 1 0^{3} s^{- 1} .$

=\frac{1.40\times10^{22}}{2\times10^{3}}\approx 7.0\times10^{18}\ \text{s}.$$ That's about $2\times10^{11}$ years — vastly longer than the age of the universe. One extra flop already made this near-perfect.

Recall Solution L2.3

Only $t_{s}$ changed, and only inside the exponent. The improvement factor is

= e^{(t_{s,new}-t_{s,old})/\tau} = e^{(10.1-5.1)\text{ns}/100\text{ps}} = e^{5\text{ns}/100\text{ps}} = e^{50}.$$ $e^{50}\approx 5.18\times10^{21}$ — a twenty-one-order-of-magnitude jump for one extra flop. **Lesson:** reliability multiplies exponentially with each added stage.

Level 3 — Analysis

(Compare choices; explain why one is right and another is a trap.)

Recall Solution L3.1

In binary $0111 \to 1000$ , all four bits flip at once. Each bit's synchronizer resolves after an independent, random delay, so on the sampling edge some bits may show the new value and others the old:

Suppose bit3 resolves fast (new = 1) but bits 2,1,0 lag (old = 111).
Receiver reads $1111 = 15$ — a value the counter never produced (it went 7 → 8).

This is data incoherence. The fix is Gray code: re-encode the count so that exactly one bit changes per step. In 4-bit Gray code, the number 7 is $0100$ and 8 is $1100$ — they differ in only the top bit. So the step $7 \to 8$ is the single flip $0100 \to 1100$ . Now even if that one bit goes metastable, the receiver reads either $0100$ (old = 7) or $1100$ (new = 8) — both real counts, off by at most one.

Recall Solution L3.2

(A) adds depth → more $t_{s}$ → exponentially better MTBF. This directly attacks the physics (more time to resolve).
(B) width just moves more data per cycle. It does nothing to $t_{s}$ , $τ$ , or the probability any single bit is metastable — and worse, syncing multiple bits invites the incoherence of L3.1.

Metastability is a time problem, not a bandwidth problem. Depth (time) helps; width does not.

Recall Solution L3.3

Denominator $D = T_{0} f_{c l k} f_{d a t a} = 1 0^{- 11} \times 5 \times 1 0^{8} \times 5 \times 1 0^{7} = 2.5 \times 1 0^{5} s^{- 1} .$ Set MTBF $= 3.15 \times 1 0^{7}$ s: $e^{t_{s} / τ} = MTBF \times D = 3.15 \times 1 0^{7} \times 2.5 \times 1 0^{5} = 7.875 \times 1 0^{12} .$

t_s = 29.7\times100\text{ ps}\approx 2.97\text{ ns}.$$ So once the settling window falls below **≈ 3 ns**, this design risks a failure within a year — a signal that you need a deeper synchronizer or a slower clock.

Level 4 — Synthesis

(Assemble a working subsystem from the pieces.)

Recall Solution L4.1

Use a 4-phase handshake (Handshake protocols):

A places the 16-bit word on the bus and holds it steady. A raises req.
req (1 bit) is passed through a two-flop synchronizer into domain B.
B sees synchronized req, and because the data bus has been stable for ≥ 2 clkB cycles, B safely latches the 16 data bits directly (no per-bit synchronizer needed — they are not changing).
B raises ack; ack (1 bit) is passed through a two-flop synchronizer back to A.
A sees synchronized ack, drops req, is free to change the data. B drops ack.

Crossing with synchronizers: only the two 1-bit control signals req and ack. Crossing without synchronizers: the 16 data wires — they are held constant across the handshake, sampled only when known stable. This sidesteps incoherence entirely.

The figure below draws this exact sequence as a timeline — trace the three annotated steps.

Read the timeline top to bottom: the burnt-orange data bus stays flat (held steady) across the whole exchange; the teal req rises first and is synchronized into B; the plum ack rises only after B has safely latched the stable data. The data line never moves while either control signal is being sampled — that is the whole safety argument, made visual.

Recall Solution L4.2

Per-word latency $\approx 6 \times 10 ns = 60 ns$ .

\approx 1.67\times10^{7}\ \text{words/s}.$$ ≈ **16.7 million words/s**. This is the price of handshaking: safe but latency-bound. When you need far more throughput, move to an [[Asynchronous FIFO design|asynchronous FIFO]], which pipelines many words with Gray-coded pointers instead of one-at-a-time handshakes.

Level 5 — Mastery

(Invent, justify, and defend the tricky choices.)

Recall Solution L5.1

The full/empty flags come from comparing the crossed write pointer against the local read pointer. Correctness needs the crossed pointer to always be a value the counter genuinely held.

Binary pointer — the failure, step by step. Suppose the true write pointer advances $7 \to 8$ , i.e. binary $0111 \to 1000$ (all four bits flip). The synchronizer bits resolve on independent random delays, so on one sampling edge domain B may capture, say, $1111 = 15$ (bit3 new, rest old) — a phantom pointer the writer never held.

Say the read pointer is at $8$ . The true occupancy is $8 - 8 = 0$ (empty).
But the comparator sees write $= 15$ , read $= 8$ , and computes occupancy $15 - 8 = 7$ — it declares the FIFO 7 entries full when it is actually empty.
Downstream logic trusting "7 available" would read 7 stale/garbage entries (an under-run), or in the symmetric case a phantom low value hides real entries and the writer overruns and clobbers unread data. Either way: corrupted data from a pointer value that never existed.

Gray pointer — why it is safe. Re-encode so exactly one bit changes per increment (e.g. $7 \to 8$ becomes Gray $0100 \to 1100$ , a single top-bit flip). A metastable bit can then only yield the old pointer ( $0100$ =7) or the new one ( $1100$ =8) — both are real counts. The comparator may lag by exactly one, reporting the FIFO slightly more full than it is, which is conservative: it can stall a write briefly but never overruns and never under-runs.

So Gray coding converts a catastrophic incoherence into a harmless, conservative one-step lag. That safety margin is the whole reason async FIFOs use it.

Recall Solution L5.2

Target in seconds: $1 0^{9} yr \times 3.15 \times 1 0^{7} s/yr = 3.15 \times 1 0^{16}$ s. Denominator $D = T_{0} f_{c l k} f_{d a t a} = 15 \times 1 0^{- 12} \times 2.5 \times 1 0^{8} \times 2.5 \times 1 0^{7} = 9.375 \times 1 0^{4} s^{- 1} .$

=2.95\times10^{21}.$$ $$\frac{t_s}{\tau}\ge\ln(2.95\times10^{21})\approx 49.4 \Rightarrow t_s\ge 49.4\times80\text{ ps}\approx 3.95\text{ ns}.$$ Clock period $T_{clk}=1/(250\text{ MHz})=4\text{ ns}$. Since $t_s$ per stage $=4$ ns and we need $\ge 3.95$ ns, **one full extra period suffices → a standard 2-flop synchronizer** ($t_s=4\text{ ns}$) meets the target. No third flop required.

Recall Quick self-test (click to reveal)

The exponent in MTBF is which ratio? ::: $t_{s} / τ$ (settling time over regeneration constant) Which technique guarantees at most a one-step, conservative error on a crossed counter? ::: Gray code In a handshake, which wires get synchronizers? ::: only the 1-bit control signals req and ack Adding one flop multiplies MTBF by roughly what? ::: $e^{T_{c l k} / τ}$ Can any synchronizer make metastability impossible? ::: No — only exponentially improbable