Skip to content
STIMSMITH

Clock Domain Crossing (CDC)

Concept WIKI v1 · 7/11/2026

Clock Domain Crossing (CDC) refers to signal transfers between distinct asynchronous clock domains in digital designs, a common occurrence in modern System-on-Chip (SoC) designs that are prone to metastability effects and require specialized verification techniques.

Clock Domain Crossing (CDC)

Definition

A Clock Domain Crossing (CDC) occurs when a signal is transferred between two distinct clock domains in a digital design — that is, between flip-flops or logic elements clocked by different, asynchronous clocks. The term is most commonly used in the context of modern System-on-Chip (SoC) designs that operate on multiple asynchronous clock domains [arxiv:2406.06533v1].

Context in Modern SoC Designs

As SoC designs scale in complexity, designers often adopt a Globally-Asynchronous Locally-Synchronous (GALS) approach to improve power efficiency. In a GALS architecture, individual synchronous islands run on their own local clocks, while the boundaries between islands form asynchronous crossings. These crossings are the CDC paths, and their number grows with design complexity [arxiv:2406.06533v1].

Metastability

CDC paths are prone to metastability effects. When a signal launched from one clock domain is sampled by a flip-flop in the receiving domain near the receiving clock's transition edge, the flip-flop may enter a metastable state — neither logic 0 nor logic 1 — which can propagate incorrect values downstream [arxiv:2406.06533v1].

Verification Challenges

Functional verification of CDC is critical because uncorrected CDC bugs can escape into silicon. Key observations from the literature:

  • Conventional verification methods, such as register transfer level (RTL) simulations and static timing analysis (STA), are not sufficient to fully address CDC issues, which may leave verification gaps [arxiv:2406.06533v1].
  • Identifying CDC-related bugs is very time-consuming [arxiv:2406.06533v1].
  • CDC bugs are one of the most common reasons for costly silicon re-spins [arxiv:2406.06533v1].

Formal Verification with Metastability Injection

To address the gaps left by simulation and STA, formal verification methodologies have been developed for CDC. One pragmatic approach exercises Metastability Injection (MSI) along different CDC paths, modeling the metastable behavior directly within the formal proof to find bugs that simulation cannot reach [arxiv:2406.06533v1].

Example: CDC in a Power Manager IP

CDC verification practices are visible in concrete IP blocks. In the OpenTitan power manager (pwrmgr) IP, signals cross between fast and slow clock domains:

  • The pwrmgr slow FSM produces clock enable outputs (core_clk_en, io_clk_en, usb_clk_en) that must be acknowledged by the corresponding validity inputs (core_clk_val, io_clk_val, usb_clk_val). The slow_responder task drives these inputs after a few random slow-clock cycles, and the protocol is checked via SystemVerilog Assertions (SVAs) in pwrmgr_clock_enables_sva_if.sv and pwrmgr_ast_sva_if.sv [OpenTitan pwrmgr dv].
  • Reset request handshakes (rst_lc_req, rst_sys_req) cross between the fast and slow domains and are completed by the fast_responder task [OpenTitan pwrmgr dv].
  • A CSR is required to clear, indicating that the CDC to the slow clock has completed [OpenTitan pwrmgr dv].

These examples illustrate how CDC verification in practice combines handshaking protocols, timeouts, responder tasks modeling asynchronous behavior, and SVAs.

Related Concepts

  • GALS (Globally-Asynchronous Locally-Synchronous) — the architectural pattern that motivates multiple CDC paths [arxiv:2406.06533v1].
  • Metastability — the principal failure mode at CDC boundaries [arxiv:2406.06533v1].
  • Metastability Injection (MSI) — a formal verification technique that models metastable behavior in CDC paths [arxiv:2406.06533v1].
  • System-on-Chip (SoC) — the design context in which CDC is most commonly discussed [arxiv:2406.06533v1].
  • Static Timing Analysis (STA) — a conventional timing-verification technique that is noted as insufficient on its own for CDC [arxiv:2406.06533v1].
  • SystemVerilog Assertions (SVA) — a hardware assertion language used to specify CDC handshake and timing properties [OpenTitan pwrmgr dv].

LINKED ENTITIES

3 links
Clock Domain Crossing (CDC) self
System-on-Chip (SoC) context
SystemVerilog Assertions (SVA) related

CITATIONS

7 sources
7 citations
[1] Modern SoC designs often operate on multiple asynchronous clock domains, and the GALS approach creates multiple asynchronous domains. Pragmatic Formal Verification Methodology for Clock Domain Crossing (CDC)
[2] CDC paths are prone to metastability effects, and functional verification of CDC is important to ensure no bug escapes. Pragmatic Formal Verification Methodology for Clock Domain Crossing (CDC)
[3] Conventional verification methods (RTL simulation and STA) are not sufficient to address CDC issues and may lead to verification gaps. Pragmatic Formal Verification Methodology for Clock Domain Crossing (CDC)
[4] Identifying CDC-related bugs is time-consuming and one of the most common reasons for costly silicon re-spins. Pragmatic Formal Verification Methodology for Clock Domain Crossing (CDC)
[5] A pragmatic formal verification methodology exercises Metastability Injection (MSI) in different CDC paths to minimize CDC issues. Pragmatic Formal Verification Methodology for Clock Domain Crossing (CDC)
[6] In the OpenTitan pwrmgr, a CSR clearing indicates that the CDC to the slow clock has completed. Design Verification - OpenTitan Documentation
[7] Clock enable handshakes between slow and fast domains in pwrmgr are driven by slow_responder / fast_responder and checked via SVA files such as pwrmgr_clock_enables_sva_if.sv and pwrmgr_ast_sva_if.sv. Design Verification - OpenTitan Documentation