Setup and Hold Time, Metastability, and the Two-Flop Synchronizer

Every sequential element has a window around its active clock edge during which its data input must be stable. The window exists for the same reason that a comparator’s output is indeterminate when its inputs are equal: the circuit resolves an input by amplifying a difference, and if the difference is small, the amplification takes longer. Digital timing analysis treats this as a hard constraint, which is correct for data that is synchronous to the clock and insufficient for data that is not.

Why there is a window rather than an instant

A flip-flop is a pair of latches — as the master-slave construction describes — and its master latch closes in response to the clock edge. Closing is a physical process with finite delay: a transmission gate or pass device must turn off, a cross-coupled pair must start regenerating, and the internal node must settle above or below the threshold where the loop’s positive feedback takes over.

If the data input settles well before the edge, the internal node is already far from the threshold when the loop closes, and regeneration is fast and deterministic. If the data input arrives very close to the edge, the internal node is near the threshold when the loop closes, and regeneration starts from a small imbalance.

Setup time is the interval before the edge during which the data must be stable so that the internal node reaches a decisive level in time. Hold time is the interval after the edge during which the data must remain stable so that the closing latch is not disturbed. The two together define the aperture, and the aperture is a property of the cell’s internal structure: a cell with a longer internal delay between the data input and the latching node has a larger setup time; a cell whose clock path is slow relative to its data path may have a negative hold time.

The dynamics of a near-threshold sample

Model the cross-coupled pair as a linear amplifier during the brief interval when both devices are conducting. A small voltage difference $v_0$ at the start of regeneration grows as

$$v(t) = v_0 , e^{t/\tau}$$

where $\tau$ is a time constant set by the node capacitance and the transconductance of the regenerating devices. Because the growth is exponential, the time needed to reach a given level grows only logarithmically with the required margin, and the failure probability falls exponentially with the time allowed.

Suppose $v$ must reach a level $V$ for the downstream logic to read it correctly, and the time available before the next element samples is $t_r$. Then the sample resolves correctly if

$$v_0 > V e^{-t_r/\tau}$$

The initial imbalance $v_0$ is a random variable determined by how close the input transition came to the sampling instant; it is roughly uniform over the range of possible offsets within the aperture. The probability that a given sample fails to resolve within $t_r$ is therefore proportional to $e^{-t_r/\tau}$.

Multiplying that per-sample probability by the rate at which samples occur gives the standard mean-time-between-failure expression for a synchronizer:

$$\mathrm{MTBF} \approx \frac{e^{,t_r/\tau}}{T_0 , f_{\mathrm{clk}} , f_{\mathrm{data}}}$$

where $f_{\mathrm{clk}}$ is the sampling clock frequency, $f_{\mathrm{data}}$ is the rate of transitions at the asynchronous input, and $T_0$ is a parameter with units of time that captures the width of the metastable window and the constants absorbed by the model. Both $\tau$ and $T_0$ are properties of the process and the cell, obtained from characterization rather than from first principles, and they are not portable between technologies.

Two consequences follow immediately. First, the failure rate is exponential in the resolution time, so adding resolution time is the only effective knob. Second, the failure rate is proportional to the clock and data frequencies, so a faster clock at the same resolution time is worse — which is why a synchronizer that was adequate in one design is not automatically adequate in a faster one.

The two-flop synchronizer

A single flip-flop sampling an asynchronous signal can go metastable, and its output can then be neither 0 nor 1 for a short interval while it resolves. Feeding that output into combinational logic is the failure mode the synchronizer prevents, because the combinational logic will see different values at different inputs at different times and can latch an intermediate state that exists for only picoseconds.

The standard remedy is two flip-flops in series on the same clock. The first flip-flop does the crossing and may be metastable at its output. Its output is the only input to the second flip-flop, so the metastable value is not read by any logic other than the second flop’s data input. The second flip-flop samples that value one clock period later, which gives the first flip-flop a full clock period — minus the second flop’s setup time — to resolve. Since failure probability falls exponentially in resolution time, one period is usually enough to make failures negligible over the life of a product, and the arithmetic of that statement is the subject of the MTBF expression above rather than of intuition.

// Two-flop synchronizer for a single-bit asynchronous input.
module sync_bit (input clk, input async_in, output reg sync_out);
  reg meta;                     // first stage: may be metastable

  always @(posedge clk) begin
    meta     <= async_in;       // crossing happens here
    sync_out <= meta;           // second stage samples one cycle later
  end
endmodule

The structure is deliberately minimal, and every deviation weakens it. Adding logic between the two stages destroys the guarantee, because the intervening logic reads a metastable value. Tripling the chain multiplies the available resolution time again and is done when the arithmetic demands it. Placing the two flops on different clocks does not synchronize anything. Splitting a multi-bit word across several independently synchronized flops does not preserve the word’s meaning, because the bits may be captured from two different source values.

Multi-bit crossings and the reconvergence problem

A synchronizer per bit is correct only when the source guarantees that at most one bit is changing. That is exactly the Gray code property, and it is why counters that cross domains are Gray-coded: a single-bit change is captured either as the old value or the new value, never as a combination that was never produced. The Gray conversion is cheap — one exclusive-OR per bit against the shifted value — and the alternative, sampling a binary counter across a domain boundary, can capture an arbitrary intermediate value such as the transition from 0111 to 1000 producing 1111 or 0000.

When the payload is genuinely multi-bit and arbitrary, single-bit synchronization is not enough, and two standard structures remain. A handshake transfers data through a register that the receiving domain knows is stable, using request and acknowledge signals that are themselves synchronized. An asynchronous FIFO writes with one clock and reads with another, using Gray-coded read and write pointers and a comparison that determines emptiness and fullness without a shared clock. Both are developed in clock domain crossing.

Reconvergence is the subtler failure. Two bits crossing on two synchronized paths of the same length can still be captured on different cycles, because the first flop of one path resolved in time and the other did not. If the two bits then feed logic that combines them, that logic sees a mixture of old and new values. The fix is structural: do not let independently synchronized bits reconverge into a decision; either synchronize them as a group with a guarantee (Gray coding, handshake) or restrict the downstream logic so that any mixture of old and new is harmless.

Reset, clock enables, and the other asynchronous edges

Metastability is a property of any near-threshold sample, not only of data crossing. Three other signals deserve the same care.

An asynchronous reset asserted to a bank of flip-flops is safe to assert at any time, because forcing the state is the intent. Releasing it is not safe: if the release reaches different flip-flops on different clock cycles, the bank spends a cycle in a state that the design’s state machine may not define. The standard remedy is a reset synchronizer: assert the reset asynchronously, then deassert it synchronously to the destination clock through two flip-flops, so all destinations leave reset on the same cycle.

A clock enable generated by combinational logic is a glitch carrier. If the enable changes close to the clock edge, the flip-flop’s clock input may see a runt pulse rather than a clean edge, and the element’s behaviour is outside its specification. Clock gating cells integrate the enable with a latch so that the gating signal can only change while the clock is inactive, which is the standard way to make the enable safe.

A signal used as a clock that is generated by logic — a divided clock, for example — has no guaranteed relationship to the clock it was derived from unless the divider is itself a register on that clock, and even then the phase relationship is only as good as the clock distribution. Designs that derive a second clock combinationally and then cross between the two domains have effectively created an asynchronous boundary whether or not they intended one, and the same synchronizer discipline applies.

What setup and hold analysis does not cover

Static timing analysis verifies that every register-to-register path meets setup and hold under the delay models it assumes. It does not verify the following, and each is a real source of failures.

Asynchronous inputs, because the tool has no constraint to check them against. A path from an input port to a flip-flop with no clock relationship is unchecked unless the designer supplies an explicit false-path or a max-delay constraint, and supplying a max-delay does not make the crossing safe; it only bounds the wire delay into the synchronizer.

Clock domain crossings, for the same reason. The tool checks each domain against its own clock and reports paths between domains as unconstrained.

On-chip variation, where two nominally identical paths on the same die have different delays because of process gradients, temperature differences, and supply droop. Hold checks in particular are sensitive to the fastest-data, slowest-clock corner, and a design that passes hold at the nominal corner can fail at that corner. The same variation shows up in the clock network as an additional skew term, which is the subject of the synchronous timing budget.

The conclusion is the same one that applies to hazards: timing analysis proves what it is given constraints for, and the constraints are the designer’s statement about the world. A synchronizer is a statement that a signal is asynchronous, and it must be made explicitly, in the netlist and in the tool’s constraint file, because the tool cannot infer intent.