Three steps to complete CDC verification

Clock domain crossing (CDC) verification is a critical step in achieving first-pass silicon success with today’s designs. CDC signals must be analyzed from a variety of different perspectives. The most common bugs can be filtered out through static structural analysis of synchronization circuits and dynamic checking of transfer protocols. However, a third and important step is also required to catch the toughest CDC bugs — sequential reconvergence checking through metastability effects delay modeling.

Figure 1. Siemens workers at the control clock, circa1900 (Siemens)

Many different methods have been proposed to model metastability in RTL simulation. However, for thorough CDC verification, the metastability effects model employed must be complete and accurate. An incomplete model will allow bugs to go undetected. An inaccurate model will cause false violations, making it difficult to detect real CDC issues from among all the failures and potentially lead to over-design.

Fortunately, all CDC metastability effects in hardware can be accurately and completely modeled in RTL simulation using a circuit that pseudo-randomly injects an extra-cycle delay for register setup timing violations and removes a cycle of delay (bleed-through delay) for hold timing violations. CDC sequential reconvergence can be systematically verified, without exhaustive manual review, by using this circuit model within a three-step CDC verification methodology:

1. Static CDC reconvergence analysis
2. Simulation with CDC coverage monitors
3. Metastability effects injection in simulation

Step 1: Static CDC reconvergence analysis

In the initial static CDC reconvergence analysis step, the RTL design is synthesized into a netlist, and structural analysis identifies all CDC reconvergence points at each sequential depth (up to a user-specified maximum). Designers review the reconvergence reports, modify RTL code to remove reconvergence errors, and then rerun the analysis. During netlist analysis, CDC assertions and coverage monitors and metastability effects injectors are generated for use in subsequent steps of the methodology.

Step 2: Simulation with CDC coverage monitors

In the second Simulation with CDC coverage monitors step, verification engineers simulate existing simulation tests, but include CDC assertions and coverage monitors automatically generated during Step 1. Each coverage monitor measures the activity of a specific CDC signal and its corresponding clocks. The protocol assertions also detect localized errors in the CDC protocols. The CDC coverage information will identify ‘holes’ in the simulation tests and enable the project team to rank and order the different simulation tests according to their efficacy in verifying CDC sequential reconvergence. Additionally, the holes identified by the coverage will give the project team the opportunity to develop new tests to improve coverage.

Step 3: Metastability effects injection in simulation

In the final metastability effects injection in simulation step, verification engineers again simulate their existing tests, but using only those identified as effective in Step 2. By removing all the errors identified in Steps 1 and 2 and creating a clean simulation environment, simulation failures at this step are due to CDC reconvergence. This increases the efficiency and effectiveness of the verification effort.

Figure 2. The circuit model used by Questa CDC-FX to insert random metastability effects into CDC signals (Siemens EDA – click to enlarge)

In this step, the metastability effects injectors (automatically generated during Step 1) are enabled in the simulation runs. These injectors pseudo-randomly inject the metastability effects (of extra delay and bleed-through) into the CDC signals at appropriate times. These delay effects propagate to the rest of the design and may cause testbench failures or assertion violations, thereby detecting design errors related to (sequential) reconvergence where metastability delays that show up only in silicon would disrupt timing dependencies between those signals. The automatically generated coverage monitors continue to measure the activity of reconvergent CDC signals. As in Step 2, these coverage statistics help to detect holes in simulation runs, so designers can rank tests by their efficacy in verifying CDC sequential reconvergence and identify opportunities for new tests to remove coverage holes.

Coverage monitors

In addition to the function of metastability effects delay injection, the Questa CDC-FX components also provide coverage metrics to help gauge the completeness of reconvergence verification. The built-in coverage monitors track activity at each bit of each CDC register and provide numerous statistics, including:

• Metastable Cycles: the number of times that the metastability conditions were met. The metastability conditions include when the clocks were aligned, the tx_clk domain register was changing, and the rx_clk domain register was loading.
• Delayed Transitions: the number of extra-cycle delay events (i.e., setup violations).
• Advanced Transitions: the number of bleed-through events (i.e., hold violations).
• Inverted Bits Bitmap: bitmap of bus vector bits for which metastability was

Passing simulations using metastability delay models indicate that either a design is safe from metastability effects or that the simulation tests are not adequately exercising the reconvergence logic. Coverage statistics measure whether metastability has been effectively modeled. Coverage data is merged from multiple CDC-FX simulations to identify coverage holes. Coverage may then be improved by running more tests with CDC-FX, enhancing the test stimulus to increase the activity of the CDC signals, or modifying the phase relationships of the clocks to enable more metastability effects to be injected in simulation. Also, with the existing tests, the seed for the pseudo-random control can be varied to achieve a greater level of coverage.

CDC-FX debugging

With metastability modeling in simulation, the main indication that the design under test is intolerant to the effects of metastability is the failure of a test that otherwise passes (without metastability effects). The failure may arise in one of the checks in the test environment or in a design assertion. The debug process involves determining where the addition of metastability-effect delays lead to test failure and then tracking down the logic with improperly reconverging CDC signals. This presents a challenge for a design with many clock domains and multitudes of CDC signals. In addition to metastability effects modeling and coverage reporting, the CDC-FX metastability injectors also incorporate useful debugging features to help address this challenge.

Conclusion

The Questa CDC-FX method of metastability effects injection is complete and accurate. It works on all CDC signals, independent of the synchronization style or implementation. It injects both extra-cycle delay and bleed-through delay, and it does so only when it is realistically possible to observe meta-stable behavior in silicon. The provided coverage metrics allow for a measure of completeness, thus giving confidence in the reconvergence verification of a design and enabling verification closure.

To gain a great deal more insight into this topic, including why metastability occurs in designs with asynchronous clocks, the various methods used to verify that a design is resilient with respect to the effects of metastability, the efficacy of each method, and the behavioral model of metastability used in the Siemens EDA Questa verification solution, please read the full paper, Questa CDC-FX: Metastability effects delay modeling.

About the authors

Sulabh Kumar-Khare is a Principal Engineer in design and verification at Siemens Digital Industries Software.

Kurt Takara is Senior Principal Product Engineer for design and verification at Siemens Digital Industries Software.

Kaushal Shah is a Senior Member Technical Staff for design and verification at Siemens Digital Industries Software.