Clock domain crossing: Worked examples — Hardware deep dive

Before we compute anything, the symbols must be crystal-clear (the parent earned them; we reuse them):

Recall What each symbol means (click)

$t_{s}$ ::: the time we allow the flip-flop to settle before its value is used — usually one destination clock period. $T$ ::: the destination clock period — the time between two rising edges of the sampling clock; equals $1/ f_{c l k}$ . $τ$ ::: the regeneration time constant — how fast a metastable voltage grows; small $τ$ = fast recovery. $T_{0}$ ::: the measured "aperture" fitting constant; how wide the danger window is per event. $f_{c l k}$ ::: how often the destination flop samples (sampling rate). $f_{d a t a}$ ::: how often the incoming asynchronous signal changes.

The scenario matrix

Every CDC problem you will ever see falls into one of these case classes. Each row is a "cell"; the last column names the example that covers it.

#	Case class	What makes it special	Covered by
A	Baseline numeric MTBF	plug-and-chug, single stage	Ex 1
B	Add a stage / more $t_{s}$	how $t_{s}$ scales MTBF	Ex 2
C	Limiting value $t_{s} \to 0$	degenerate: no settling time	Ex 3
D	Limiting value $f_{d a t a} \to 0$	degenerate: input never changes	Ex 3
E	Sign/direction: faster vs slower clock	which frequency hurts	Ex 4
F	Multi-bit wrong way	data incoherence (a bus torn apart)	Ex 5
G	Multi-bit right way (Gray)	one-bit-changes guarantee	Ex 6
H	Real-world word problem	temperature-sensor across domains	Ex 7
I	Exam-style twist (solve for $t_{s}$ )	invert the formula to hit a target MTBF	Ex 8

We now walk the cells top to bottom. Keep this table open — each example says which cell it hits.

Worked examples

Worked example

Example 1 — Cell A: baseline MTBF, one flop Given $τ = 50 ps$ , $T_{0} = 20 ps$ , $f_{c l k} = 100 MHz$ , $f_{d a t a} = 10 MHz$ , and a settling window of one period $t_{s} = T = 10 ns$ . Find the $MTBF$ .

Forecast: the exponent is $t_{s} / τ$ . Guess: is that number closer to 2, 20, or 200?

Compute the exponent $t_{s} / τ = 10 ns /50 ps = 10000/50 = 200$ . Why this step? The whole formula lives or dies on this ratio — it is the number of "time constants" of settling we bought.
Compute the denominator $T_{0} f_{c l k} f_{d a t a} = 20 \times 1 0^{- 12} \cdot 1 0^{8} \cdot 1 0^{7} = 2 \times 1 0^{4} s^{- 1}$ . Why this step? This is how many metastable events per second we start; MTBF divides the rare-survival factor by the event rate.
$MTBF = e^{200} / (2 \times 1 0^{4}) \approx 7.2 \times 1 0^{86} /2 \times 1 0^{4} \approx 3.6 \times 1 0^{82} s$ . Why this step? $e^{200}$ crushes everything; the answer dwarfs the age of the universe ( $\approx 4 \times 1 0^{17} s$ ).

Verify: units check — $e^{200}$ is dimensionless, denominator is $s^{- 1}$ , so MTBF is in seconds. ✓ Magnitude sanity: $3.6 \times 1 0^{82} s$ is $\sim 1 0^{65}$ times the universe's age — one flop is already "safe forever". ✓

Worked example

Example 2 — Cell B: one stage vs two stages of settling Same numbers as Ex 1 (which used $t_{s} = T = 10 ns$ , i.e. one period of settling). Now you add one more flop so the value gets two periods to settle, $t_{s} = 2 T = 20 ns$ . By what factor does MTBF improve?

Forecast: doubling $t_{s}$ — does MTBF double, square, or something wilder?

New exponent $t_{s} / τ = 20 ns /50 ps = 400$ . Why this step? The extra period simply adds another $200$ to the exponent (each period $T$ contributes $T / τ = 200$ ).
Improvement factor $= e^{400} / e^{200} = e^{200} \approx 7.2 \times 1 0^{86}$ . Why this step? MTBF is exponential in $t_{s}$ , so adding time multiplies, it does not add — this is the single most important intuition on the page.

Verify: the factor $e^{200}$ equals the entire Ex-1 numerator, confirming each period of settling multiplies reliability by the same huge constant. ✓ Lesson: one period is already overkill for slow clocks; a second period is astronomical overkill.

Worked example

Example 3 — Cells C & D: the two degenerate limits Using the Ex-1 setup, evaluate the formula at the boundaries: (i) $t_{s} \to 0$ (no settling time at all); (ii) $f_{d a t a} \to 0$ (input never changes).

Forecast: one of these gives MTBF $\to \infty$ (perfectly safe) and one gives the worst finite value. Which is which?

Cell C, $t_{s} \to 0$ : exponent $\to 0$ , so $e^{0} = 1$ and $MTBF \to 1/ (T_{0} f_{c l k} f_{d a t a}) = 1/ (2 \times 1 0^{4}) = 5 \times 1 0^{- 5} s = 50 μ s$ . Why this step? With no settling window, survival probability is just the raw event rate — you fail roughly every $50 μ$ s. This is the worst case, and it is why a bare wire across domains is unusable.
Cell D, $f_{d a t a} \to 0$ : the denominator $\to 0$ , so $MTBF \to \infty$ . Why this step? If the source signal never changes, it can never violate setup/hold — no events, no failures. A truly static signal needs no synchronizer.

Verify: dimensional check on (i): $1/ (2 \times 1 0^{4} s^{- 1}) = 5 \times 1 0^{- 5} s$ . ✓ Logical check on (ii): division by zero → unbounded, matching physical intuition "never toggles → never fails". ✓ These two cells bracket every real answer: any working design sits between $50 μ$ s and $\infty$ .

Worked example

Example 4 — Cell E: which clock hurts, fast or slow? Design 1: $f_{c l k} = 100 MHz$ , $f_{d a t a} = 10 MHz$ (Ex 1). Design 2: swap them — $f_{c l k} = 10 MHz$ , $f_{d a t a} = 100 MHz$ . Keep $t_{s} =$ one destination period $T$ in each. Which design is safer? ( $τ = 50 ps, T_{0} = 20 ps$ .)

Forecast: the product $f_{c l k} f_{d a t a}$ is identical in both. So the winner must come from $t_{s}$ . Guess before reading.

Denominators are equal: $T_{0} f_{c l k} f_{d a t a} = 2 \times 1 0^{4}$ both ways. Why this step? The event rate depends on the product, which swapping leaves unchanged.
But $t_{s} = T$ , one destination period. Design 1: $T = 1/100 MHz = 10 ns \Rightarrow t_{s} / τ = 200$ . Design 2: $T = 1/10 MHz = 100 ns \Rightarrow t_{s} / τ = 2000$ . Why this step? A slower destination clock gives a longer settling window — the exponent explodes.
Design 2 MTBF $= e^{2000} / (2 \times 1 0^{4})$ , vastly larger than Design 1's $e^{200} / (2 \times 1 0^{4})$ . Why this step? The exponential means the slow-destination design is $e^{1800}$ times safer despite the identical event rate.

Verify: ratio Design2/Design1 $= e^{2000 - 200} = e^{1800}$ . Look at the green (slow-clock) curve towering over the blue (fast-clock) curve in the figure — same event rate, wildly different survival. ✓ Sign lesson: it is the destination clock period $T$ , not raw frequency, that sets safety; a fast destination clock is the dangerous direction. See Clock skew and jitter for why period budgets shrink further in practice.

Worked example

Example 5 — Cell F: multi-bit done wrong (data incoherence) A 3-bit counter in domain A counts $3 \to 4$ , i.e. binary $011 \to 100$ . You "synchronize" each of the 3 bits with its own two-flop synchronizer into domain B. Bit 0 resolves fast, bit 1 slower, bit 2 slowest (random resolution times). What value can domain B read on the transition cycle?

Forecast: the true values are only 3 or 4. Can B read something that is neither?

Write the bits changing: $011 \to 100$ flips all three bits at once. Why this step? Ordinary binary can flip many bits on one increment — this is the trap.
Because each bit lands independently (old or new), any of the $2^{3} = 8$ combinations is reachable. Suppose bit 2 flipped to $1$ but bits 1,0 still show old $11$ : B reads $111 = 7$ . Another mix gives $010 = 2$ ; another $110 = 6$ ; and so on. Why this step? Independent random resolution means B can sample any mix of old and new bits — including values that never existed on the bus.
Enumerating all 8 outcomes: ${000, 001, 010, 011, 100, 101, 110, 111} = {0, 1, 2, 3, 4, 5, 6, 7}$ . Only $3$ and $4$ are legal; the other six ( $0, 1, 2, 5, 6, 7$ ) are spurious. Why this step? Listing the full set shows the corruption is not off-by-one — it spans the entire range.

Verify: old $= 3$ , new $= 4$ ; a legal glitch-free scheme must read only ${3, 4}$ . Here all $8$ codes are reachable, so $6$ of them (e.g. $7 \in / {3, 4}$ , $2 \in / {3, 4}$ ) are illegal, proving incoherence. ✓ This is exactly the mistake the parent warned against — never brute-force a bus. Use Gray code or an async FIFO.

Worked example

Example 6 — Cell G: multi-bit done right (Gray code) Same $3 \to 4$ transition, but the counter is now Gray-coded. Gray for $3$ is $010$ and for $4$ is $110$ . If exactly the one changing bit goes metastable, what can B read?

Forecast: how many bits differ between Gray- $3$ and Gray- $4$ ? That number caps the damage.

Compare $010$ (three) with $110$ (four): they differ in exactly one bit (the top bit). Why this step? This is the defining property of Gray code — consecutive codes are Hamming-distance $1$ apart.
Only the top bit is in flight. If it resolves to old $0$ , B reads $010 =$ three. If it resolves to new $1$ , B reads $110 =$ four. Why this step? With a single changing bit, both possible outcomes are valid — the old or the new value, never a phantom third.

Verify: the only reachable values are ${$ three, four $}$ — exactly the legal set, versus the corrupt full range ${0, 1, 2, 3, 4, 5, 6, 7}$ of Ex 5. The figure shows binary flipping many arrows (red, torn) vs Gray flipping one arrow (green, safe). ✓ This is why FIFO pointers are Gray-coded (Asynchronous FIFO design).

Worked example

Example 7 — Cell H: real-world word problem A temperature sensor updates a 12-bit reading in a $25 MHz$ domain. A $200 MHz$ CPU domain wants to read it. The value changes slowly (a few times per second). Design the crossing and justify each choice using our matrix.

Forecast: 12 bits — will you use 12 synchronizers? A handshake? Gray code? Decide first.

The reading is a general data word, not a monotonic counter, so Gray code does not apply (only counters step by ±1). Why this step? Cell G's guarantee needs consecutive-value, one-bit-change behaviour; arbitrary sensor jumps break it.
Multi-bit brute force (Cell F) would tear the word apart. So use a handshake: sensor domain raises a 1-bit valid, CPU synchronizes just that 1 bit, latches the (held- stable) 12-bit bus, then returns a synchronized ack. Why this step? Only control bits cross with synchronizers; the wide data bus is held still and never sampled mid-change — no incoherence possible.
Reliability of the 1-bit valid sync: with $τ = 50 ps, T_{0} = 20 ps$ , destination $f_{c l k} = 200 MHz$ (period $T = 5 ns$ ), $t_{s} = T = 5 ns$ , and $f_{d a t a} \approx 4 Hz$ (a few updates/s): exponent $= 5 ns /50 ps = 100$ , MTBF $= e^{100} / (20 ps \cdot 2 \times 1 0^{8} \cdot 4) = e^{100} / (1.6 \times 1 0^{- 2})$ . Why this step? The slow $f_{d a t a}$ (Cell D flavour) makes the event rate tiny, so even the modest exponent $100$ gives an enormous MTBF.
$e^{100} \approx 2.69 \times 1 0^{43}$ , so MTBF $\approx 1.68 \times 1 0^{45} s$ . Why this step? Confirms one synchronizer on the control bit is more than enough.

Verify: exponent $100$ ✓ ( $5 ns /50 ps$ ). Denominator $20 \times 1 0^{- 12} \cdot 2 \times 1 0^{8} \cdot 4 = 1.6 \times 1 0^{- 2} s^{- 1}$ ✓. MTBF $= 2.69 \times 1 0^{43} /1.6 \times 1 0^{- 2} \approx 1.68 \times 1 0^{45} s$ ✓. Design choice matches Cell H: handshake for a data word, exactly the mnemonic "Handshake for a word".

Worked example

Example 8 — Cell I: exam twist, solve backwards for $t_{s}$ You are told the target is $MTBF = 100$ years and given $τ = 50 ps$ , $T_{0} = 20 ps$ , $f_{c l k} = 250 MHz$ , $f_{d a t a} = 50 MHz$ . What minimum settling time $t_{s}$ do you need, and how many destination clock periods $T$ is that?

Forecast: invert the exponential with a logarithm. Roughly how many time constants — tens, or thousands?

Start from $MTBF = e^{t_{s} / τ} / (T_{0} f_{c l k} f_{d a t a})$ and solve for $t_{s}$ : $t_{s} = τ ln (MTBF \cdot T_{0} f_{c l k} f_{d a t a}) .$ Why this step? $ln$ is the tool that undoes $e^{x}$ — the only way to pull $t_{s}$ out of the exponent (just as $arctan$ undoes $tan$ ).
Compute the argument. $100$ years $= 100 \cdot 3.156 \times 1 0^{7} = 3.156 \times 1 0^{9} s$ . Event rate $T_{0} f_{c l k} f_{d a t a} = 20 \times 1 0^{- 12} \cdot 2.5 \times 1 0^{8} \cdot 5 \times 1 0^{7} = 2.5 \times 1 0^{5} s^{- 1}$ . Why this step? We need the product inside the log; keep SI units so seconds cancel.
Argument $= 3.156 \times 1 0^{9} \cdot 2.5 \times 1 0^{5} = 7.89 \times 1 0^{14}$ , and $ln (7.89 \times 1 0^{14}) \approx 34.3$ . Why this step? The log tames the huge number to a small one — this is exactly $t_{s} / τ$ .
Multiply back by $τ$ : $t_{s} = 50 ps \cdot 34.3 \approx 1.72 ns$ . The destination period is $T = 1/250 MHz = 4 ns$ , so $t_{s} / T = 1.72/4 \approx 0.43$ — less than one period. Why this step? This is the payoff of the whole example: it tells the designer that a single two-flop synchronizer, which grants a full period $T = 4 ns$ of settling, already exceeds the required $1.72 ns$ . No extra stages are needed to hit the 100-year target.

Verify: plug back — $e^{34.3} / (2.5 \times 1 0^{5}) = 7.9 \times 1 0^{14} /2.5 \times 1 0^{5} = 3.16 \times 1 0^{9} s \approx 100$ years. ✓ And $t_{s} = 1.72 ns < T = 4 ns$ confirms one period suffices. ✓ Twist mastered: the log inversion is the exam's favourite move.

Recall Matrix self-check (click)

Which cell has the worst finite MTBF and why? ::: Cell C ( $t_{s} \to 0$ ): no settling, MTBF $= 1/ (T_{0} f_{c l k} f_{d a t a}) \approx 50 μ$ s. Why does swapping clocks (Cell E) with equal $f_{c l k} f_{d a t a}$ still change safety? ::: Because $t_{s}$ = the destination period $T$ , and a slower destination clock buys a bigger exponent. For a 12-bit sensor word, why not Gray code? ::: Gray only guarantees one-bit changes for ±1 counters; arbitrary data jumps break that, so use a handshake. What single math tool inverts the MTBF formula for $t_{s}$ ? ::: the natural logarithm $ln$ , which undoes $e^{x}$ .

See also: Flip-flops and setup-hold time, Synchronous vs asynchronous circuits, Metastability, and the Hinglish version.