Clock domain crossing: Foundations — Hardware deep dive

This page assumes nothing. We build every symbol the parent note uses, in an order where each idea leans only on the ones before it. Every term is anchored to a picture.

1. A wire and its two voltages

Everything in digital hardware rides on a wire — a thin metal line that carries a voltage.

In figure s01, follow the white curve as it climbs from the lower cyan band (logic 0) to the upper cyan band (logic 1). Notice how, mid-climb, it passes through the amber band in the middle — a voltage that is neither 0 nor 1, a value no gate can trust. Fix that amber band in your mind; the whole topic revolves around a signal getting stuck there.

Why the topic needs this: "metastability" (built later) is literally the signal being trapped in that amber band. You cannot understand the danger until you can see the safe bands it falls out of.

2. The clock — a heartbeat, and what an "edge" is

Two numbers describe a clock, and both appear all over the parent note:

Period $T_{c l k}$ — the time for one full tick (one low + one high). Picture the horizontal width of one bump.
Frequency $f_{c l k}$ — how many ticks happen per second. It is just the period flipped: $f_{c l k} = \frac{1}{T _{c l k}}$ .

The moment the clock jumps from 0 up to 1 is the rising edge. This instant is the "camera flash" — the moment circuits take a snapshot of their inputs.

In figure s02, the amber double-arrow measures one period $T_{c l k}$ across the top of a cyan bump, and the amber dashed lines mark each rising edge. Read the label "camera flash" pointing at one such edge — that vertical line is the single instant the circuit acts.

Why the topic needs this: CDC is about two such heartbeats that don't line up. You can't picture "unrelated clocks" until you can picture one clock and its edges. See also Clock skew and jitter for how even edges within one domain drift.

3. The flip-flop — a 1-bit memory that snapshots on the edge

Picture a camera that photographs the D wire at every rising edge and displays that frozen photo on Q until the next flash.

In figure s03, follow three stacked traces: the cyan clock on top, the white D input in the middle, and the amber Q output at the bottom. Watch how Q only changes just after the clock edge — that small lag is the clock-to-Q delay. The amber shaded strip straddling the edge is the keep-still window defined next.

Three timing numbers, all used by the parent, come from the fact that the camera needs the scene to hold still around the flash:

Deep dive: Flip-flops and setup-hold time.

Why the topic needs this: the entire danger of CDC is a signal changing inside that keep-still window. Every symbol above ( $t_{s u}, t_{h}, t_{c q}$ ) reappears in the two-flop synchronizer's settling-time formula.

A clock domain crossing is one wire generated in domain A being read by a flip-flop in domain B, where A and B are asynchronous. Because B's edge can fall anywhere relative to A's changes, sooner or later it falls inside the keep-still window — and that is unavoidable.

Why the topic needs this: this is the definition of the problem itself. It rests on "clock" (§2), "flip-flop" (§3), and "keep-still window" (§3).

5. Metastability — the signal stuck in the amber band

That teetering state is Metastability. It is never removed — only made rare by giving it time to settle.

To turn "how long does it teeter?" into a number, we need two tools: first the exponential function, which describes how the flip-flop escapes the hilltop; then a small piece of probability, which turns that escape into the odds of still being stuck after we wait. We build both, in that order.

Tool 1 — the exponential $e^{t / τ}$ : the "grows by multiplying" function

First, what is teetering, physically? Inside the flip-flop sit two cross-coupled inverters — two amplifiers wired so each one drives the other. Call the tiny voltage difference between the two internal nodes $v$ : this is the deviation from the balance point (the hilltop). When $v = 0$ exactly, the ball is perfectly balanced; any nonzero $v$ means it is already leaning one way.

Solving the equation, step by step (why the answer MUST be an exponential). We want the function $v (t)$ whose slope at every instant equals itself divided by $τ$ . Separate the two variables — put everything with $v$ on one side, everything with $t$ on the other:

$\frac{d v}{v} = \frac{d t}{τ} .$

What we just did: we split the rate equation so each side depends on only one variable. Why: now we can add up (integrate) both sides independently. Integrating the left gives the natural logarithm $ln v$ , and the right gives $t / τ$ plus a constant:

$ln v = \frac{t}{τ} + (constant) .$

To undo the logarithm, raise $e$ to both sides (this is what " $e$ to the power of" means — the exact inverse of $ln$ ):

$v = e^{t / τ} \cdot e^{(constant)} = v_{0} e^{t / τ},$

where we renamed $e^{(constant)}$ as $v_{0}$ , the value of $v$ at $t = 0$ (set $t = 0$ : $e^{0} = 1$ , so $v (0) = v_{0}$ ).

$v (t) = v_{0} e^{t / τ}$

Here $v_{0}$ = the initial imbalance, the value of $v$ at the instant $t = 0$ when metastability began (how far off-centre the ball started). The number $e \approx 2.718$ is fixed, and $τ$ is the time for the imbalance to grow by one factor of $e$ — small $τ$ means explosively fast escape.

Why THIS tool and not a straight line? A straight line grows by a constant amount each second. But here growth feeds on itself — the leaning ball rolls faster the more it has already leaned. Only the exponential captures "rate proportional to current value", which is exactly the cross-coupled feedback.

Figure s04 makes the contrast concrete. The amber curve is $v (t) = v_{0} e^{t / τ}$ ; the cyan dashed line is a straight-line guess $v_{0} (1 + t / τ)$ that grows by the same initial slope but never speeds up. Mark the vertical white line at $t = τ$ : there the amber curve has multiplied its starting height by $e \approx 2.718$ , while the straight line has merely doubled it. Every further step of $τ$ multiplies the amber curve by another $e$ — so by a few $τ$ the two are worlds apart. This gap is the whole reason a synchronizer works: waiting a few $τ$ lets the amber imbalance rocket up to a full, readable logic level.

Tool 2 — a pinch of probability: why the "still-stuck" chance decays exponentially

The flip-flop counts as resolved once the imbalance grows to a full logic swing $V_{l o g i c}$ . Let us pin that symbol down before using it:

Set $v (t_{s}) = V_{l o g i c}$ and solve for the starting imbalance that just barely resolves in the waiting time $t_{s}$ :

$V_{l o g i c} = v_{0} e^{t_{s} / τ} ⟹ v_{0} = V_{l o g i c} e^{- t_{s} / τ} .$

Read this: any start $v_{0}$ bigger than $V_{l o g i c} e^{- t_{s} / τ}$ resolves in time; only starts smaller than that (dangerously close to the exact hilltop) are still stuck after $t_{s}$ . So the flip-flop is still metastable after $t_{s}$ exactly when its initial imbalance landed in a tiny band of width $\propto e^{- t_{s} / τ}$ around zero.

Definition Why we assume

$v_{0}$ is spread evenly (and where that breaks) The incoming asynchronous edge can arrive at any time relative to the flip-flop's own edge, with no instant preferred over another — the two clocks are unrelated. Since the resulting starting imbalance $v_{0}$ depends smoothly on that arrival time, over the narrow band of near-hilltop values it is reasonable to treat $v_{0}$ as uniform (flat, every value equally likely) across that small window. Bounds and limits: this is only trusted for the tiny sliver of $v_{0}$ near zero; over a wide range the real distribution is not flat, and device non-idealities skew it further. That is why the shape $e^{- t_{s} / τ}$ is kept but the constant in front is not taken from this model — it is measured on silicon and absorbed into $T_{0}$ (defined next).

With that even-spread assumption, the probability of landing in the shrinking band is proportional to its width:

$P (still stuck after t_{s}) \propto e^{- t_{s} / τ} .$

This is why every extra sliver of waiting multiplies safety: doubling $t_{s}$ squares the smallness.

Building the failure rate, symbol by symbol

Before we can write MTBF we need two more input symbols. Define them now, in words, before they enter any formula:

Now the probabilistic argument for how often we enter metastability, spelled out:

Each clock edge has a danger slit of width $T_{0}$ (in time) around it. If an input transition lands inside that slit, metastability is triggered. For one input transition arriving at a random time, the chance it falls in the slit of one particular edge is (slit width)/(period) $= T_{0} / T_{c l k} = T_{0} f_{c l k}$ .
Input transitions arrive at rate $f_{d a t a}$ per second.
So the number of triggering events per second = (transitions per second) × (chance each one lands in a slit) = $f_{d a t a} \times T_{0} f_{c l k}$ .

$failure-entry rate \approx T_{0} f_{c l k} f_{d a t a} (events per second) .$

Every symbol here was defined above: $T_{0}$ and $f_{d a t a}$ just now, $f_{c l k}$ in §2.

From entry rate + still-stuck chance to MTBF

Two things must both happen for a failure: we must enter metastability (rate $T_{0} f_{c l k} f_{d a t a}$ ), and still be stuck after our settling time $t_{s}$ (probability $\propto e^{- t_{s} / τ}$ ). Multiply them for the failure rate (failures per second):

$failure rate \approx T_{0} f_{c l k} f_{d a t a} \cdot e^{- t_{s} / τ} .$

The Mean Time Between Failures is just one over the failure rate:

Here is every symbol in the formula, each already defined above, gathered for reference:

Symbol	Plain meaning	Picture / origin
$t_{s}$	settling time we allow before using the value	width of one extra clock period of waiting (§5)
$τ$	regeneration time constant (Tool 1)	how fast the ball rolls off the hilltop
$g_{m}$	transconductance of a transistor: how strongly its output current responds to a small input-voltage change (its "amplifying strength")	a bigger $g_{m}$ means a stronger push off the hilltop, so a smaller $τ$
$C$	load capacitance at the internal node: how much charge must be moved to change that node's voltage (its "sluggishness")	a bigger $C$ is more sluggish, so a larger $τ$ ; together $τ \approx C / g_{m}$
$V_{l o g i c}$	full logic swing that counts as "resolved" (Tool 2)	height from cyan-0 band to cyan-1 band in s01
$v_{0}$	initial imbalance at $t = 0$	how off-centre the ball starts on the hilltop
$T_{0}$	metastability aperture (measured)	width of the danger slit around each edge
$f_{c l k}$	sampling clock frequency	how often we flash the camera (§2)
$f_{d a t a}$	rate of asynchronous input changes	how often the incoming glass wobbles
MTBF	Mean Time Between Failures	average seconds (→ years) between a bad read

6. Multi-bit crossings — the extra pieces

Everything so far protects one wire. Real designs must move whole buses (many wires at once), and two more foundations make that safe. We name their symbols and close the narrative here.

Gray code — a counting scheme where consecutive numbers differ in exactly one bit. Picture a row of lights where stepping from one number to the next flips only one light. Why it matters: if only one wire can be mid-transition at a time, then even when that single wire goes metastable the receiver reads only the old count or the new count — never a garbage value that never existed. This is the standard trick for FIFO read/write pointers. Full treatment: Gray code, used inside Asynchronous FIFO design.
Handshake — a two-way "ready? / got it!" conversation carried on single control bits (a req line and an ack line). The sender parks the whole data bus, holds it perfectly still, and raises req; only that 1-bit req crosses through a synchronizer; the receiver, seeing req, safely latches the now-stable bus and raises ack, which crosses back. Because only control bits cross and the data bus is never sampled mid-change, the many-wire problem is dodged entirely. Full treatment: Handshake protocols.

Together these complete the toolbox: one bit → two-flop synchronizer (built from §1–§5); a counter → Gray code; a whole word → handshake or an async FIFO. Every symbol the parent note uses has now been built from zero.

How the foundations feed the topic

Equipment checklist

Cover the right side and answer aloud; reveal to check.

Convert

T_{c l k} = 10 ns

to a frequency

f_{c l k} = 1/ (10 \times 1 0^{- 9}) = 1 0^{8} Hz = 100 MHz

What does a rising clock edge represent physically

the single instant a flip-flop snapshots its D input, like a camera flash

Name the three timing numbers of a flip-flop

setup

t_{s u}

, hold

t_{h}

, clock-to-Q delay

t_{c q}

Define the keep-still window precisely

the interval from

t_{s u}

before a clock edge to

t_{h}

after it, during which D must not change

What is a clock domain

the set of all flip-flops driven by the same clock signal

When are two clocks asynchronous

their frequency and/or phase are unrelated, so their edges can land anywhere relative to each other

In the ball-on-hill picture, what is metastability

the flip-flop output stuck in the amber band between 0 and 1, teetering on the hilltop for a random time

What do

v

and

v_{0}

stand for

v

is the voltage imbalance from the balance point;

v_{0}

is that imbalance at the instant metastability began

Why must the solution of

d v / d t = v / τ

be exponential

only a function whose slope equals itself (scaled) can obey "growth rate proportional to current size"; separating and integrating gives

v_{0} e^{t / τ}

What does

τ

mean, and how do

g_{m}

and

C

set it

τ

is the time to grow by one factor of

e

;

τ \approx C / g_{m}

, so stronger drive

g_{m}

shrinks it and heavier load

C

enlarges it

What is

V_{l o g i c}

the full voltage swing from a valid 0 to a valid 1 that the imbalance must reach to count as resolved

Why does the still-stuck probability go as

e^{- t_{s} / τ}

only starting imbalances inside a band of width

\propto e^{- t_{s} / τ}

fail to resolve in time

t_{s}

What does

f_{d a t a}

mean

the rate at which the asynchronous input wire changes state, per second

What is

T_{0}

and how is it obtained

the metastability aperture (danger-slit width in time); measured on silicon by fitting

ln (rate)

t_{s}

, not derived

Why is the failure-entry rate

T_{0} f_{c l k} f_{d a t a}

chance one transition lands in a slit is

T_{0} f_{c l k}

, and transitions arrive at

f_{d a t a}

/s, so triggers/s

= T_{0} f_{c l k} f_{d a t a}

Why does adding one flop make MTBF explode

it adds a clock period of settling

t_{s}

, and taking

1/ rate

turns

e^{- t_{s} / τ}

into

e^{+ t_{s} / τ}

, which multiplies reliability

What special property does Gray code have

consecutive values differ in exactly one bit, so at most one wire can be mid-transition