Real-World CDC Case Studies

Scenario: A mobile SoC DDR controller (800 MHz DDR PHY clock) started failing in the field. The symptom was random memory corruption on first boot — not reproducible consistently. Roughly 1 in every 10,000 units showed the problem. All qualification testing passed.

Root cause: The power-on reset de-assertion for the DDR PHY was synchronized to the system clock (200 MHz), not the DDR PHY clock (800 MHz). The engineer assumed the system clock would always be active first, but at cold temperature the DDR PLL locked early and the PHY became active before the synchronized reset had completed two cycles on the PHY clock. The DDR PHY powered up partially initialized.

Why simulation missed it: Simulation used a fixed 4:1 clock ratio at nominal temperature. The specific PLL lock-to-reset-release timing race only occurred within a ±30ns window across PVT corners not covered in the regression suite.

// WRONG — synchronized to system clock, not DDR clock
always @(posedge clk_sys or negedge por_n)
  if (!por_n) {ddr_rst_q1, ddr_rst_q2} <= 2'b00;
  else        {ddr_rst_q2, ddr_rst_q1} <= {ddr_rst_q1, 1'b1};
assign ddr_rst_n = ddr_rst_q2;  // Released on clk_sys, not clk_ddr!

// CORRECT — must use the DDR PHY clock
always @(posedge clk_ddr or negedge por_n)
  if (!por_n) {ddr_rst_q1, ddr_rst_q2, ddr_rst_q3} <= 3'b000;
  else        {ddr_rst_q3, ddr_rst_q2, ddr_rst_q1} <= {ddr_rst_q2, ddr_rst_q1, 1'b1};
assign ddr_rst_n = ddr_rst_q3;  // 3-stage for 800 MHz domain

Scenario: An Ethernet MAC (125 MHz) transferred link-status registers to the CPU domain (400 MHz) using a req/ack handshake. The design worked perfectly in simulation and at room temperature bring-up. It failed at 85°C, causing intermittent garbage link-status readings.

Root cause: The designer's handshake FSM asserted data and req on the same clock edge. At nominal temperature: data hold time = 0.8ns, req synchronizer latency = 1.2ns — safe margin. At 85°C on this process node (below 65nm, negative temperature coefficient), transistors sped up: hold time increased to 1.1ns and synchronizer latency decreased to 0.9ns. The synchronizer captured data 0.2ns before it was stable.

Why simulation missed it: Static timing analysis was run at slow-slow corner (setup check only). The hold violation was marginal and not caught because the path was set as false_path in SDC — a common but incorrect practice for handshake data paths.

Fix: Added a one-cycle pipeline register between the data update and req assertion. Changed SDC from set_false_path to set_max_delay -datapath_only to allow hold analysis at all PVT corners.

Scenario: A video processor FIFO between a 74.25 MHz pixel clock and a 200 MHz bus clock showed occasional pixel corruption — but only at 1280×720 @ 60Hz, not at other resolutions. A coverage-driven simulation run found it pre-tape-out.

Root cause: The binary-to-Gray conversion was implemented with the XOR applied after registering the binary counter, not before. This created a 1-clock-cycle window at specific counter values (the binary 0111→1000 transition) where the Gray code output changed by 2 bits simultaneously, violating the fundamental single-bit-change property. At 1280×720, the FIFO fill level hit this exact boundary value during the horizontal blanking interval on every frame.

// WRONG — XOR after register, 2-bit glitch at counter overflow
always @(posedge clk) bin_reg <= bin_cnt;
assign gray_out = bin_reg ^ (bin_reg >> 1);  // Glitch when bin_reg updates!

// CORRECT — convert to Gray BEFORE registering
wire [W-1:0] gray_next = bin_cnt ^ (bin_cnt >> 1);
always @(posedge clk) gray_reg <= gray_next;  // Only 1 bit changes/cycle
assign gray_out = gray_reg;

// SVA to verify — add to simulation
property gray_one_bit_change;
  @(posedge clk) $onehot0(gray_out ^ $past(gray_out));
endproperty
assert property (gray_one_bit_change);

Scenario: A PCIe controller with clk_core (250 MHz) and clk_aux (100 MHz) showed green in weekly SpyGlass CDC runs for months. Two weeks before tape-out, a formal-tool sign-off run flagged an Ac_conv01 (reconvergence) violation that had been incorrectly waived in an earlier run.

Root cause: The synchronized signal link_active_sync (crossed from clk_core to clk_aux) fanned out in two directions: (a) into clk_aux logic as intended, and (b) back into clk_core combinational logic to compute link_state, which then crossed again to a different clk_aux register. For 2 clock cycles after any edge, link_active in clk_core and link_active_sync in clk_aux were in different states — a reconvergence window that could produce inconsistent behavior.

Why the waiver was wrong: An engineer added a waiver comment early in the project: "link_active is set once at startup." This was true in v1.0, but a later feature added dynamic link retraining that toggled link_active during normal operation. The waiver comment was never re-reviewed when the RTL changed.

Fix: Created a separate 2-FF synchronizer for each consumer. link_active_sync_a feeds the clk_aux enable; a new link_active_sync_b feeds the second clk_aux path. Each consumer sees a consistent value in its own domain.

Scenario: An audio DSP crossed 24-bit PCM samples from a 22.05 kHz sample-rate domain to a 100 MHz bus using a 2-FF synchronizer. Audio was perfect at room temperature. At −20°C corner simulation with metastability injection enabled, intermittent 1-sample corruptions appeared every ~90 minutes of simulated playback.

Root cause: The 2-FF synchronizer's resolution time constant τ for the specific cell library increased from 18ps at 25°C to 28ps at −20°C (low temperature slows exponential decay). The setup time also increased from 60ps to 85ps, reducing the available resolution window. The resulting MTBF calculation:

// MTBF = exp(Tw / tau) / (fc * fd)
// Tw  = 1/fc - tsu  (resolution window available)
// tau = synchronizer cell time constant (from Liberty model)
// fc  = destination clock freq,  fd = data toggle rate

// 2-FF at 100MHz  |  25°C nominal:
//   tau=18ps, tsu=60ps  →  Tw = 10ns - 60ps = 9.94ns
//   MTBF = exp(9.94e-9/18e-12) / (100e6 * 22050) ≈ 10^23 years  ✓

// 2-FF at 100MHz  |  -20°C cold:
//   tau=28ps, tsu=85ps  →  Tw = 10ns - 85ps = 9.915ns
//   MTBF = exp(9.915e-9/28e-12) / (100e6 * 22050) ≈ 1.7 hours   ✗

// FIX — 3-FF at 100MHz  |  -20°C cold:
//   Tw = 20ns - 85ps = 19.915ns  (two resolution windows)
//   MTBF = exp(19.915e-9/28e-12) / (100e6 * 22050) ≈ 10^28 years ✓

Fix: Changed from 2-FF to 3-FF synchronizer for the audio crossing. The extra stage provides a second 10ns resolution window, increasing MTBF from 1.7 hours to astronomically safe values across all PVT corners.