A clock domain crossing (CDC) occurs when a digital signal is generated in one clock domain and sampled in another, where the two clocks are asynchronous or have no guaranteed phase relationship. Without proper handling, CDC can produce metastability, data corruption, or missed pulses.
In practice
CDC is common in most non-trivial embedded designs, though some systems operate largely within a single synchronous domain. A typical microcontroller SoC may run its CPU core, peripheral bus, USB PHY, and ADC from separate clock sources or divided derivatives; signals crossing between domains that lack a guaranteed phase relationship are CDC problems, though not every inter-block signal is necessarily an async CDC path. FPGAs are especially prone to CDC issues because designers freely instantiate multiple PLL outputs and independent clock networks -- the EmbeddedRelated posts "Designing a FPGA Micro Pt1 - Start The Clock" and "Designing a FPGA Micro Pt2 - Clock and Counter build and test" illustrate how quickly clock architecture decisions multiply in an FPGA design.
The fundamental hazard is metastability: a flip-flop that samples a signal too close to its setup or hold window may settle to an indeterminate logic level, and that indeterminate level can propagate through combinational logic before resolving. The standard mitigation for single-bit control signals is a two-flop synchronizer -- two back-to-back registers clocked in the destination domain -- which reduces (but does not eliminate) the probability of metastability propagating. On fast clock domains, three-flop synchronizers are sometimes used to provide more resolution time; whether two flops are sufficient depends on the flip-flop's metastability parameters, the destination clock period, and the required MTBF, not a fixed frequency cutoff alone.
Multi-bit data requires additional care. Synchronizing each bit independently is incorrect because bits can be captured across different destination-clock cycles, producing a torn value. Common solutions include gray-code encoding (valid only for counters or naturally gray-coded sequences), asynchronous FIFOs using gray-coded read/write pointers, and handshake protocols (request/acknowledge with each side held stable until the other acknowledges). Most FPGA vendors provide async FIFO IP blocks or library primitives with correct CDC behavior, and dedicated CDC lint tools (such as Mentor CDC, Cadence JasperGold CDC, or open-source alternatives) are worth running rather than relying solely on timing analysis, which typically does not flag false paths across asynchronous domains.
A common pitfall is marking CDC paths as "false paths" in constraints without actually adding synchronizers, which silences tool warnings without making the design safe. Another is assuming that two clocks derived from the same oscillator are synchronous; unless a guaranteed fixed phase relationship between them is enforced by the tool and formally closed across the boundary, they must still be treated as asynchronous.
Learn this in FPGA Fundamentals
Discussed on FPGARelated
Frequently asked
Why does a two-flop synchronizer work, and when is it not enough?
The first
flip-flop is allowed to go
metastable; the idle time between it and the second flip-flop gives the metastable node a chance to resolve before the next sample. The probability of the second flop still capturing a metastable value is exponentially smaller, not zero. At very high destination clock frequencies or with flip-flops that have a poor metastability characteristic (measured by the MTBF parameter), two stages may not provide sufficient MTBF, and a three-flop synchronizer or a slower handshake is needed. Two-flop synchronizers are also only correct for single-bit signals; multi-bit buses require gray coding, an async
FIFO, or a handshake.
Can I just run CDC analysis with my synthesis tool's timing analyzer?
Timing analysis alone is usually insufficient for CDC. Static timing analysis flags paths that violate setup/hold within a clock domain, but asynchronous paths are typically declared as false paths or are unconstrained, so the tool never checks them. A dedicated CDC analysis tool examines the structural
netlist for signals that cross clock domains and verifies that recognized synchronization structures (two-flop synchronizers, async FIFOs, handshakes) are present. Without this, CDC bugs can survive
synthesis,
simulation, and even hardware bring-up, only to appear as rare glitches in production.
Does simulation catch CDC bugs?
Ordinary
RTL simulation with a single simulation time step does not model
metastability, so it will not catch most CDC bugs. Simulation can catch structural CDC errors (a bus sampled without any synchronizer) only if you happen to exercise the exact cycle offset that causes a torn capture. Dedicated CDC simulation tools inject metastability events probabilistically to increase coverage, but formal CDC analysis is generally more thorough for finding structural violations.
What is an asynchronous FIFO and why is it the preferred solution for multi-bit data?
An asynchronous
FIFO is a buffer with separate read and write ports clocked by different domains. The read and write pointers are maintained in their respective domains and converted to gray code before being synchronized across the boundary. Because a gray-code counter changes only one bit per increment, a two-flop synchronizer on the pointer is safe: even if one transition is missed by one cycle, the worst case is a temporarily stale pointer, not a corrupt address.
FPGA vendors (Xilinx/AMD, Intel/Altera, Lattice) provide hardened async FIFO primitives with guaranteed-correct CDC behavior; using these is preferred over hand-rolling an async FIFO.
Are two clocks derived from the same crystal always synchronous?
Not necessarily. Two clocks from the same crystal are frequency-related but may have an arbitrary or variable phase relationship depending on how they are generated. If two
PLL outputs run at frequencies whose ratio is an exact rational number, they may be phase-alignable, but only if the
synthesis tool is explicitly told to treat them as synchronous and the
constraints enforce it. In general, treat any two clocks as asynchronous unless the tool and the hardware design together guarantee a fixed phase and the timing is formally closed across the boundary.
Differentiators vs similar concepts
CDC is sometimes confused with simple
clock skew or multi-cycle paths, both of which occur within a single synchronous clock domain. Clock skew is a routing delay difference between the clock signal reaching two
flip-flops sharing the same nominal clock; it is handled by the place-and-route tool within timing closure. A multi-cycle path is a deliberately relaxed timing constraint between two points in the same domain. CDC, by contrast, involves two clocks with no guaranteed phase relationship, which is a fundamentally different problem requiring synchronization structures, not just tighter or looser timing margins.
