Clock Domain Crossing and Synchronisers

When a signal passes from one clock domain to another unrelated one, the receiving flip-flop can be clocked just as the signal changes — a setup/hold violation that causes metastability. Clock domain crossing (CDC) is the discipline of moving data between asynchronous clocks safely.

The two-flop synchroniser

For a single-bit level or pulse, the standard fix is a two-flop synchroniser: two flip-flops in series in the destination domain. If the first flop goes metastable, it is given a full clock cycle to settle before the second flop samples it, making the probability of a metastable value reaching the logic vanishingly small.

module sync2 (input dclk, drst_n, async_in, output reg sync_out);
  reg meta;                                   // first-stage, may go metastable
  always @(posedge dclk or negedge drst_n)
    if (!drst_n) {sync_out, meta} <= 2'b00;
    else         {sync_out, meta} <= {meta, async_in};  // shift through 2 FFs
endmodule

module tb;
  reg dclk=0, drst_n=0, async_in=0;
  wire sync_out;
  sync2 u(dclk, drst_n, async_in, sync_out);
  always #5 dclk = ~dclk;
  initial begin
    #3 drst_n = 1;
    #7 async_in = 1;                          // asserts asynchronously
    repeat (4) @(posedge dclk);
    #1 $display("async_in=%b reached sync_out=%b after 2 dclk edges (clean)", async_in, sync_out);
    $finish;
  end
endmodule

async_in=1 reached sync_out=1 after 2 dclk edges (clean)

A two-flop synchroniser is correct only for a single bit. A multi-bit bus must never be synchronised bit-by-bit — the bits can settle on different cycles and produce a value that never existed. Buses cross with a Gray-coded pointer (as in an asynchronous FIFO) or a handshake. Getting CDC wrong produces bugs that pass simulation and fail silently in silicon, which is why dedicated CDC analysis tools exist.