Clock-domain crossing verification has two distinct jobs: confirm that the implementation uses an appropriate synchronization structure, and confirm that the surrounding protocol cannot lose, duplicate, or corrupt information. Structural CDC analysis addresses the first. Assertions, simulation, and targeted formal analysis address the second.
Classify every crossing
A single-bit level, a pulse, a multi-bit control word, a streaming payload, and a reset signal require different handling. A two-flop synchronizer can reduce the probability that metastability propagates for a stable single-bit level, but it does not make an arbitrary pulse visible or preserve coherence across independently synchronized data bits.
- Stable single-bit level: synchronizer chain with source stability requirements.
- Pulse or event: pulse stretching, toggle protocol, or request/acknowledge handshake.
- Multi-bit control: bundled-data protocol with a synchronized control event and stability window.
- Streaming data: asynchronous FIFO or another protocol designed for independent clocks.
- Reset: explicit assertion and deassertion strategy for every receiving domain.
Verify the protocol around the synchronizer
For a handshake, check that a request remains asserted until acknowledged, one source event produces one destination event, acknowledgement cannot occur without a request, and neither side accepts a new transfer while the protocol forbids it. For an asynchronous FIFO, verify pointer rules, full and empty behavior, Gray-code transitions where used, and reset alignment.
Metastability is an analog phenomenon and ordinary RTL simulation does not model its probability. Simulation is still valuable for clock-ratio variation, phase variation, pulse width, backpressure, reset ordering, and protocol stress. Assertions should focus on the digital contract that must hold despite independent clocks.
Review reconvergence and reset
Two synchronized signals can arrive in different destination cycles. If they reconverge into combinational logic, the destination may observe a combination that never existed at the source. Related state should cross through one encoded event or a coherent data-transfer mechanism rather than independent synchronizers.
Reset-domain crossings deserve the same scrutiny as data crossings. Asynchronous assertion may be required, while deassertion is commonly synchronized per clock domain. Check what happens when one domain leaves reset before its peer, when clocks are absent, and when reset interrupts an in-flight transfer.
Control waivers as design decisions
A CDC waiver should identify the crossing, synchronization scheme, functional requirement, and reviewer. Wildcard waivers and hierarchy-based exclusions hide new logic. Re-run structural analysis after integration changes and verify that timing constraints preserve the intended synchronizer implementation.
A clean CDC report is necessary; a proven transfer contract is what makes it meaningful.
The closure package should pair the structural report with protocol assertions, reset analysis, relevant simulation scenarios, and reviewed waivers. That combination addresses both implementation pattern and end-to-end behavior.
Primary references
Need help applying these methods to a verification programme? Start a technical conversation.