Clock Domain Crossing (CDC)

Erik Seligman
CS 510, Lecture 17, March 2009
Agenda
 Introduction to Clock Domain Crossing
(CDC)
 Basic Synchronizers
 Datapaths and Reconvergence
 Handshake Synchronization
 Checking CDCs With Conformal
Agenda
 Introduction to Clock Domain Crossing
(CDC)
 Basic Synchronizers
 Datapaths and Reconvergence
 Handshake Synchronization
 Checking CDCs With Conformal
What Is A Clock Domain
Crossing (CDC)?
 Different clocks within a single design
 Many possible reasons, here are a few:
• Complying with multiple protocols
• SoC Integration: IP from many sources
• Saving area/power, limiting fast clock use
 Dangers when signals cross domains
• Incorrect functionality if not synced
• Not properly covered by validation
Review: Setup & Hold Time
 Each flop has a setup and hold time
• Setup time: Time before clk edge
• Hold time: Time after clk edge
 Data expected ready by setup time, and
stable during hold time
Problems At Asynchronous
Clock Domain Crossings
 When does new value arrive?
• Source clk not coordinated with dest clk
Chance of arriving in setup/hold window
• What does this mean?
• Possibility of ‘metastable’ (halfway) state
• Value may settle either way
• Multiple fanouts may detect different values
Why Discuss in FV Class?
 CDC is low hanging fruit for FV vendor
• Needs deeper analysis than typical linting
• But light checks compared to hardcore FV
 CDC often done with FV tools
• Mentor 0in, Cadence Conformal, RealIntent
– In other direction, Lint vendors expanding to
CDC: Synopsys LEDA, Atrenta Spyglass
 Some CDC checks may add assertions
• For checking in simulation or FV
CDC Checks in Simulation
 Simulation: inject random metastability
 Useful, but hard to get right
• Sometimes delay a value change
• Allow 1-cycle value to be missed
• Depends on # of random tests
 Technique beyond scope of this class
• Class is on formal methods!
Agenda
 Introduction to Clock Domain Crossing
(CDC)
 Basic Synchronizers
 Datapaths and Reconvergence
 Handshake Synchronization
 Checking CDCs With Conformal
How To Safely Cross
Domains?
 Require synchronizer: structure to
reduce risk of metastability
 Simplest synchronizer: two flops
• Metastability very unlikely: second flop will
choose a value if first is metastable
• One-cycle uncertainty in transition
– Account for in the logic!
Basic CDC Checks
 Structural: Identify asynchronous CDCs
• Note: synchronous signals are OK, little metastability
risk if properly timed
• But same-frequency != synchronous
• If no synchronizer, report error
 Functional: Assert signal held long enough
• Due to uncertainty of capture time
• Hold for 2+ receiver cycles: create assert
• May need longer depending on relative freq
– More detailed discussion in TOV lecture
Another Check: Combo Logic

• Why is combo logic bad on sync path?

Another Check: Combo Logic

• Why is combo logic bad on sync path?

• Remember: uncertain capture time
• Suppose f1a and f1b both transition 01
Another Check: Combo Logic

• Why is combo logic bad on sync path?

• Remember: uncertain capture time
• Suppose f1a and f1b both transition 01
• For an instant, maybe f1a!=f1b…
 f2 == 1
Danger: False Negatives!
 CDC can be a ‘noisy’ check
• Many reported unsynced crossings are OK
 Common reasons for false negatives?
Danger: False Negatives!
 CDC can be a ‘noisy’ check
• Many reported unsynced crossings are OK
 Common reasons for false negatives?
• Constant signals (VSS, VCC)
• Near-constant signals
– Parameters set during reset & never changed
– Reset pins!
• Alternate-mode signals
– Valid in only some operating modes, includes clk
– Scan and other ultra-slow interfaces
 Use your tool carefully & specify these things!
• “Blind” run rarely seen as valuable
• Don’t waste DE time reporting bogus errors
Agenda
 Introduction to Clock Domain Crossing
(CDC)
 Basic Synchronizers
 Datapaths and Reconvergence
 Handshake Synchronization
 Checking CDCs With Conformal
Datapaths & Off-By-One Issue

• What happens on transition from 000 to 111?

Datapath Problem
 Each synchronizer may be off by a cycle
• All are independent
• So during transition from 000 to 111, may
sense 001, 010, 011, … or any other value!
 Can we solve thru logic requirements?
• Need to make sure only one bit can change
• Then we know only real values are seen
 Grey Codes: A Functional
Solution
 Common solution to datapath issue
• Allow only one bit to change at a time
• Thus, any value seen *did* actually appear
• From 000, can only go to: 100,010,001
– And if the bit changes a cycle soon/late, only a
real value is seen
 2-bit grey codes example: 00,01,11,10
 Can check with generated assertions
• Functional (FPV-like) check in general
SVA Assertion: Grey Code
 “Signal foo[6:0] is grey-coded”
• Can you translate to SVA?
SVA Assertion: Grey Code
 “Signal foo[6:0] is grey-coded”
• Can you translate to SVA?

gc_assert: assert property (

$countones(foo ^ $past(foo))
<= 1);
Reconvergence Problem
 More general view of datapath issue
 Problem: reconvergence of synced bits
• CDC checks can flag cases
 Is there a better way to synchronize?
• Such that grey codes aren’t needed
 Yes!
• Have control signal coordinate data with mux
Mux-Based Sync
Agenda
 Introduction to Clock Domain Crossing
(CDC)
 Basic Synchronizers
 Datapaths and Reconvergence
 Handshake Synchronization
 Checking CDCs With Conformal
Handshake/FIFO Protocols
 Clock freq maybe configurable / unknown
• Hard to design previous syncs for all cases
• Hard to properly check for all cases
• Maybe sometimes overconservative
 Solution: handshake protocols
• Sender stores data in FIFO
• Explicit request/response for data
• More logic & harder to check, but powerful
Handshake Sync Example

(From Cadence white paper, see

References)
Agenda
 Introduction to Clock Domain Crossing
(CDC)
 Basic Synchronizers
 Datapaths and Reconvergence
 Handshake Synchronization
 Checking CDCs With Conformal
Conformal CDC Checks
 Included with Conformal license
• That’s why we have it!
 Set up env for Conformal version 8
• zsh
• source ~eseligma/startup.cadence8
 Start lec with ‘-verify’ option
• Actually runs separate core binary
• Don’t try to do FEV in same session
Sample LEC CDC Do File
(Structural Checks)
read design <RTL design>
set clock_domain rule -derived -
either_phase -extract
add synchronization rule dff_sync -dff 2
infinity -sync_chain buffer -cdc_path
buffer single_destination -from -all -to
-all
add synchronization rule all2allmux2 -mux
0 0 -cdc_path buffer single_destination
-from -all -to -all
set cdc option -convergence_check
add cdc check -structural -source -all -
destination -all -from -all -to -all
validate
Sample LEC CDC Do File
(Structural Checks)
read design <RTL design>
set clock_domain rule -derived -either_phase –
extract
add clock 0 clk1
add clock 0 clk2
set sys mode verify
add synchronization rule dff_sync -dff 2 infinity -
sync_chain buffer -cdc_path buffer
single_destination -from -all -to -all
add synchronization rule all2allmux2 -mux 0 0 -
cdc_path buffer single_destination -from -all -
to -all
set cdc option -convergence_check
add cdc check -structural -source -all -destination
-all -from -all -to -all
validate
Sample LEC CDC Do File
(Structural Checks)
read design <RTL design>
set clock_domain rule -derived -either_phase –
extract
add clock 0 clk1
add clock 0 clk2
set sys mode verify
add synchronization rule dff_sync -dff 2 infinity -
sync_chain buffer -cdc_path buffer
single_destination -from -all -to -all
add synchronization rule all2allmux2 -mux 0 0 -
cdc_path buffer single_destination -from -all -
to -all
set cdc option -convergence_check
add cdc check -structural -source -all -destination
-all -from -all -to -all
validate
Sample LEC CDC Do File
(Structural Checks)
read design <RTL design>
set clock_domain rule -derived -either_phase –
extract
add clock 0 clk1
add clock 0 clk2
set sys mode verify
add synchronization rule dff_sync -dff 2 infinity -
sync_chain buffer -cdc_path buffer
single_destination -from -all -to -all
add synchronization rule all2allmux2 -mux 0 0 -
cdc_path buffer single_destination -from -all -
to -all
set cdc option -convergence_check
add cdc check -structural -source -all -destination
-all -from -all -to -all
validate
Sample LEC CDC Do File
(Structural Checks)
read design <RTL design>
set clock_domain rule -derived -either_phase –
extract
add clock 0 clk1
add clock 0 clk2
set sys mode verify
add synchronization rule dff_sync -dff 2 infinity -
sync_chain buffer -cdc_path buffer
single_destination -from -all -to -all
add synchronization rule all2allmux2 -mux 0 0 -
cdc_path buffer single_destination -from -all -
to -all
set cdc option -convergence_check
add cdc check -structural -source -all -destination
-all -from -all -to -all
validate
Sample LEC CDC Do File
(Structural Checks)
read design <RTL design>
set clock_domain rule -derived -either_phase –
extract
add clock 0 clk1
add clock 0 clk2
set sys mode verify
add synchronization rule dff_sync -dff 2 infinity -
sync_chain buffer -cdc_path buffer
single_destination -from -all -to -all
add synchronization rule all2allmux2 -mux 0 0 -
cdc_path buffer single_destination -from -all -
to -all
set cdc option -convergence_check
add cdc check -structural -source -all -destination
-all -from -all -to -all
validate
Debugging with Tools Menu:
Clock Domain Crossing
Diagnosing A Missing Sync
Diagnosing A Convergence
Issue
References / Further Reading
 http://www.edadesignline.com/howto/2052019
13;jsessionid=Y5OIFHG055FBKQSNDLPSKH
SCJUNN2JVN?pgno=1
 http://w2.cadence.com/whitepapers/cdc_wp.pd
f
 http://www.techonline.com/article/pdf/showPDF
inIE.jhtml?id=2069034541
 http://www.design-
reuse.com/articles/9482/reducing-false-errors-
in-clock-domain-crossing-analysis.html