Metastability in
Digital Design

Metastability is a condition in which a flip-flop or latch enters an unstable, intermediate voltage state — neither a valid logic '0' nor a valid logic '1'. Instead of resolving cleanly to a known state, the output can oscillate or linger at an intermediate level for an unpredictable amount of time before eventually settling.

In a stable digital world, every flip-flop output is either HIGH or LOW. But flip-flops are built from cross-coupled inverters — an analog feedback loop. When input transitions happen too close to the clock edge, both inverters briefly "fight" each other in equilibrium. This equilibrium is the metastable state.

Every flip-flop has two timing requirements that data must satisfy relative to the clock edge:

When a signal crosses from one clock domain to another asynchronous domain, there is no timing relationship between the two clocks. The data transition can happen at any time relative to the receiving clock edge — including inside the forbidden setup/hold window. This is unavoidable.

A Clock Domain is the set of all flip-flops driven by the same clock signal. Modern SoCs contain more than 10,000 CDC signals — each one is a potential metastability hazard. A Clock Domain Crossing occurs whenever data travels from a flip-flop in Domain A to a flip-flop in Domain B where the two clocks are asynchronous (no fixed phase relationship).

Types of CDC Scenarios

The standard solution for single-bit CDC is the 2-stage (dual flip-flop) synchronizer. The idea is simple: give the metastable signal a full clock cycle to resolve before it is sampled again. The first flip-flop may go metastable, but the second flip-flop samples only after one complete CLK_B period has elapsed — dramatically reducing the probability that metastability persists.

// ─────────────────────────────────────────────────────────────
// 2-Flip-Flop Synchronizer — Standard CDC Solution
// Usage: single-bit signal crossing from async/different domain
// ─────────────────────────────────────────────────────────────

module two_ff_synchronizer #(
    parameter STAGES = 2    // increase to 3 for very high-speed designs
) (
    input  wire  clk_dest,   // destination domain clock
    input  wire  rst_n,      // active-low async reset
    input  wire  async_in,   // asynchronous input from source domain
    output reg   sync_out    // synchronized output (safe to use in dest domain)
);

    // Shift register of synchronizer flops
    reg [STAGES-1:0] sync_chain;

    // Synthesis attribute — prevents optimizer from merging FFs
    // Xilinx: (* ASYNC_REG = "TRUE" *)
    // Synopsys: set_false_path -to [get_cells sync_chain*]

    always @(posedge clk_dest or negedge rst_n) begin
        if (!rst_n)
            sync_chain <= {STAGES{1'b0}};
        else
            sync_chain <= {sync_chain[STAGES-2:0], async_in};
    end

    assign sync_out = sync_chain[STAGES-1];

endmodule

When to Use 3-Stage Synchronizer

For very high-frequency designs where the clock period is short, one cycle may not provide enough resolution time. In such cases, a 3-stage synchronizer is used — giving two full clock cycles for metastability to resolve.

MTBF quantifies how frequently a synchronizer is expected to fail (i.e., how often metastability propagates through to cause incorrect logic). A well-designed synchronizer should have an MTBF measured in thousands of years.

Worked MTBF Example

// Example: 100 MHz clock, 50 MHz data rate, τ = 30ps, T₀ = 4ps

// 2-stage synchronizer:
// t_res = T_clk - t_setup = 10ns - 0.3ns = 9.7ns
MTBF = e^(9.7e-9 / 30e-12) / (100e6 × 50e6 × 4e-12)
      = e^323 / (2e7)
      ≈ astronomically large   // ✓ Safe design

// 1-stage synchronizer (DO NOT USE):
// t_res ≈ 0 (data sampled immediately after first FF)
MTBF ≈ seconds to minutes  // ✗ Unacceptable for any real design

The 2-FF synchronizer works for single-bit signals only. Synchronizing a multi-bit bus directly is dangerous: each bit may resolve to a different value independently during metastability, resulting in a corrupt bus value that was never a valid state in the source domain.

Solution 1: Gray Code Encoding

Gray code guarantees that consecutive values differ by exactly one bit. If a single bit goes metastable, the result is either the old value or the new value — both valid states. This is the standard technique used for FIFO pointers in async FIFOs.

// Binary to Gray Code (XOR-based)
function automatic [3:0] bin2gray;
    input [3:0] bin;
    begin
        bin2gray = bin ^ (bin >> 1);
    end
endfunction

// Gray Code to Binary
function automatic [3:0] gray2bin;
    input [3:0] gray;
    integer i;
    begin
        gray2bin[3] = gray[3];
        for (i = 2; i >= 0; i = i - 1)
            gray2bin[i] = gray2bin[i+1] ^ gray[i];
    end
endfunction

Solution 2: Handshake Protocol

For arbitrary multi-bit data where Gray coding is not applicable, a request/acknowledge (req/ack) handshake is used. Only one bit (req or ack) crosses the domain boundary at a time — making it amenable to the 2-FF synchronizer.

// Source Domain: assert req when data is ready
always @(posedge clk_src) begin
    if (send_data && !req) begin
        data_reg <= data_in;   // latch data first
        req      <= 1'b1;       // then assert request
    end else if (ack_sync) begin  // ack_sync = synchronized ack from dest
        req      <= 1'b0;
    end
end

// Destination Domain: latch data when req detected
always @(posedge clk_dest) begin
    if (req_sync && !ack) begin   // req_sync = synchronized req
        data_out <= data_reg;   // safe: data stable since before req
        ack      <= 1'b1;
    end else if (!req_sync) begin
        ack      <= 1'b0;
    end
end

For high-bandwidth data transfer between clock domains, the Asynchronous FIFO (Async FIFO) is the industry-standard solution. It uses a shared dual-port RAM buffer, with write and read operations in different clock domains. Gray-coded pointers are synchronized across domains to detect full/empty conditions safely.

CDC issues are invisible to standard RTL simulation. Specialized analysis is required at multiple stages of the VLSI design flow.