Verifying CDC Reconvergence Issues with ALINT-PRO

In addition to metastability, clock domain crossing issues may cause functional instability of digital designs. The capturing edge in the receiving clock domain may occur at any time relative to the sending clock domain clock. If sending data has a glitch, it may be converted to "level" in the receiving clock domain. Also, signal change delay through a synchronizer may be unpredictable, as there is no guarantee whether or not "previous" or "next" signal levels are captured by receiving clock.

Figure 1: Functional issues caused by Clock Domain Crossings

Convergent logic in the source domain may cause a glitch to be passed to the destination clock domain. Though both flip-flops of the source clock domain may sample the output signals at the same moment, the incorrect signal may be transferred to the destination clock domain because of the propagation delay difference on the combinational logic paths:

Figure 2: Combinational Logic before synchronizer may cause glitches

It is important to exclude the probability of glitch generations at synchronizer inputs. Registering the data in sending clock domain right before the synchronizer, is the safest solution to prevent functional issues caused by glitches.

ALINT-PRO CDC verification solution ensures the absence of glitches on the inputs of synchronizer schemes.

The delay unpredictability at CDC transfer is another issue causing functional failures in digital circuits. Functional issues may occur when two or more related control signals are transferred and re-combined together in receiving clock domain. After CDC transfer, these signals may be shifted against each other by one receiving clock period. The recombination of related control signals may produce unwanted glitches (Figure 3).

Figure 3: Reconvergence issue with unwanted glitch

Let's take the following design examples to demonstrate reconvergence issues in ALINT-PRO :

Figure 4: Design example with reconvergence

The CDC analysis identifies a reconvergence issue with convergence depth of 2 at the input pin of "valid_sync" register:

Figure 5: Reconvergence Analysis with ALINT-PRO

The convergence depth of 2 indicates that both paths reconverge right after CDC synchronizer. By themselves, synchronizers are considered a first register stage, while common "valid_sync" registers are considered second register stage.

The following example demonstrates converging CDC paths at the second register stage after synchronizers, with convergence depth of 3:

Figure 6: Reconvergence Analysis with convergence depth 3

The "Convergence analysis depth" parameter inside the "Design Entry -> Constraints -> CDC window of Project Properties" indicates maximum depth to search for reconverging CDC paths. With convergence analysis depth value increase, the processing time of finding reconverging paths increases too, especially for large designs with high amounts of CDC paths. In practice, it is not advised to set this value at more than 4. For the CDC analysis of large designs, it is recommended to further decrease convergence analysis depth value to 2 (Figure 7):

Figure 7: Setting convergence analysis depth

If reconvergence is detected, the design should be reviewed to fix the dangerous CDC transfer. One of the possible solutions is to move combinational logic into source clock domain and then pass the resulting signal to the destination domain (Figure 8):

Figure 8: Fixing reconvergence issue

The reconvergence analysis within ALINT-PRO helps designers find deep CDC-related functional issues causing glitches and functional failures in hardware.