Metastability is what happens when a flip-flop or latch samples an input that changes too close to the clock edge, inside the setup and hold window. The storage element can then hang between logic 0 and logic 1 for an unpredictable time before it falls to one side. It cannot be prevented when signals cross between unrelated clocks, but its probability of causing a failure can be made vanishingly small, mainly by giving the flip-flop time to resolve with a synchroniser.
This post explains why metastability occurs, how the failure rate is calculated, and what designers actually do about it in RTL and in sign-off.
Key takeaways
- Metastability is caused by a setup or hold violation at a storage element. Any signal that is asynchronous to the sampling clock will eventually violate that window.
- The resolution time is unbounded in theory, but the probability of still being unresolved falls exponentially with the time allowed.
- Reliability is expressed as mean time between failures (MTBF), which depends on the clock frequency, the data toggle rate and two flip-flop constants, tau and T0.
- The standard fix is a two (or three) flip-flop synchroniser for single-bit signals, plus handshakes, FIFOs or Gray-coded pointers for multi-bit data.
- Metastability cannot be eliminated, only made unlikely enough for the product lifetime. Treat it as a quantified reliability figure, not a yes or no question.
What metastability is
A flip-flop is built from cross-coupled inverters that have two stable states and one balance point between them. Normally the input pushes the latch firmly to one side before the clock closes it. When the input changes inside the setup and hold window around the clock edge, the latch can be left close to the balance point. Its output is then neither a clean high nor a clean low, and it stays near the middle until thermal noise and the small imbalance in the circuit tip it over.
That intermediate output is the problem. Downstream gates may read it differently: one may see a 1 and another a 0, an output may oscillate or glitch, or the final value may arrive late and miss the setup time of the next stage. This can lead to errors and glitches in the circuit, especially if the output is used as an input to more than one logic device.
Where it occurs
Metastability is unavoidable in asynchronous systems, where the inputs are not synchronised to a common clock. Typical sources are:
- Signals crossing between clock domains (clock domain crossing, CDC).
- External inputs such as push buttons, interrupt lines and sensor outputs.
- Asynchronous reset release, if the de-assertion edge is not synchronised to the clock.
It can also happen inside a nominally synchronous design if a path has a long propagation delay or if clock skew between parts of the circuit causes a setup or hold violation. In that case it is a timing bug that static timing analysis should catch, unlike a CDC path, where violations are expected and must be handled by design.
How likely is a failure: the MTBF equation
The probability that a flip-flop is still unresolved after a time t falls off exponentially. The usual model for the mean time between synchroniser failures is:
MTBF = e^(tr / tau) / (T0 * fclk * fdata)| Symbol | Meaning |
|---|---|
| tr | Resolution time allowed: the time from the clock edge until the output must be valid at the next stage (roughly the clock period minus clock-to-Q, logic delay and setup time of the next flop) |
| tau | Regeneration time constant of the flip-flop, set by the gain and loading of its latch. Smaller is better. |
| T0 | Width of the effective metastability window of the flip-flop, a technology constant |
| fclk | Sampling clock frequency |
| fdata | Rate at which the asynchronous input changes |
The probability of entering metastability grows linearly with fclk and fdata, but the time allowed to resolve sits in an exponent. That is why adding one clock period of resolution time is so much more effective than anything else.
Worked example (illustrative numbers)
Assume tau = 50 ps, T0 = 50 ps, fclk = 500 MHz and fdata = 50 MHz. These are illustrative values, not from a real library. The denominator is 50e-12 x 5e8 x 5e7 = 1.25e6 per second.
| Design | Resolution time tr | e^(tr/tau) | MTBF |
|---|---|---|---|
| One flop, output goes straight into logic | 0.3 ns | e^6, about 403 | About 0.3 ms |
| Two-flop synchroniser | 1.8 ns | e^36, about 4.3e15 | About 3.4e9 s, roughly 110 years |
| Three-flop synchroniser | 3.6 ns | e^72, about 1.9e31 | About 1.5e25 s, far beyond any product life |
A single flop is useless here: it would fail thousands of times a second. The second stage turns that into about a century per synchroniser. Keep in mind that a chip may have hundreds of crossings and that millions of units may be in the field, so the system MTBF is the single-crossing figure divided by the number of crossings and units. That is why very fast clocks and safety-critical parts often use three stages.
What changes the numbers
The probability of metastability depends on factors such as the clock frequency, the data rate, temperature, supply voltage and the noise level. Tau gets worse at low voltage and at slow process corners, and in some processes at low temperature too, so the worst-case corner must be used. Vendors of FPGAs and standard cell libraries publish or can supply tau and T0 values, and FPGA tools such as AMD Vivado and Altera Quartus can report synchroniser MTBF directly.
How designers handle it
Synchronisers for single-bit signals
The basic synchroniser is two flip-flops in series, both clocked by the destination clock, with no logic between them. The first may go metastable; the second samples it a full clock period later, by which time it has almost certainly resolved.
// Two flip-flop synchroniser for a single-bit level signal
module sync2 (
input wire clk_dst, // destination clock
input wire rst_n, // active-low reset
input wire d_async, // signal from another clock domain
output wire q_sync // synchronised output
);
reg meta, stable;
always @(posedge clk_dst or negedge rst_n) begin
if (!rst_n) begin
meta <= 1'b0;
stable <= 1'b0;
end else begin
meta <= d_async; // first stage: may go metastable
stable <= meta; // second stage: gets a full clock period to resolve
end
end
assign q_sync = stable;
endmoduleRules that go with it:
- Drive the synchroniser input from a flip-flop in the source domain, never from combinational logic, so that glitches are not sampled.
- Place the two flops close together with no logic between them. In FPGAs, mark them (for example with the ASYNC_REG property in Vivado) so the tools keep them together and analyse MTBF.
- Synchronise each control signal in exactly one place. Two separate synchronisers on the same signal can resolve differently in the same cycle.
- A pulse shorter than a destination clock period can be missed completely. Convert it to a toggle or level, or use a handshake.
Multi-bit data
Never synchronise a bus bit by bit: each bit can resolve in a different cycle, so the destination may see a value that never existed. Use one of these instead:
- A request and acknowledge handshake, where only the control bit is synchronised and the data is held stable.
- An asynchronous FIFO with Gray-coded read and write pointers, where only one bit changes per step.
- A multiplexer recirculation scheme, with a synchronised enable selecting stable data.
Better flip-flops, and what Schmitt triggers do
Some libraries offer metastability-hardened or synchroniser flip-flops with a smaller tau, which raise MTBF for the same resolution time. Schmitt-trigger inputs are useful for cleaning slow or noisy edges from the outside world, but they do not remove metastability at a clocked sampling element.
A correction to the original version of this post: these devices do not work by increasing the setup and hold times of the inputs. A synchroniser works by allowing more resolution time after the edge, and a hardened flop works by resolving faster. The setup and hold window is still violated sometimes; the design simply makes sure the result has settled before anyone uses it.
System-level tolerance
Metastability cannot be completely eliminated, only made less likely. Designers must therefore account for the worst case and decide what MTBF is good enough for the product. Where the cost of a failure is high, they also make the system tolerant: error detection and correction on transferred data, protocols that retry, or a design that is fail-safe or fail-soft when an unexpected value appears.
Common mistakes
- Putting logic between the first and second synchroniser flops, which eats the resolution time.
- Using the output of the first flop anywhere other than the second flop.
- Synchronising a counter or bus bit by bit.
- Releasing an asynchronous reset without a reset synchroniser.
- Relying on simulation to find metastability. RTL simulation does not model it; use CDC structural checks (for example Synopsys SpyGlass CDC, Siemens Questa CDC or Cadence Conformal CDC) and MTBF analysis.
FAQ
Can metastability be eliminated completely?
No. Any bistable element sampling an asynchronous input has a finite chance of an arbitrarily long resolution. The aim is an MTBF much longer than the product lifetime.
Is two flip-flops always enough?
Often, but not always. Calculate the MTBF with real tau and T0 at the worst corner, and multiply by the number of crossings and units. High clock rates or safety-critical parts often justify three stages.
Does metastability show up in RTL simulation?
No. Simulators model a flip-flop as switching cleanly. Some gate-level flows inject X on timing violations, but CDC sign-off relies on structural checks and MTBF calculation.
Do latches suffer from it too?
Yes. A latch can go metastable when its input changes as the enable closes, for the same reason as a flip-flop.
Summary
Metastability is a fundamental challenge in digital circuit design and needs careful analysis rather than hope. It affects the performance and reliability of any system that involves communication between different clock domains or asynchronous signals. By understanding why it happens, quantifying it with MTBF and applying the right synchroniser structure for each crossing, designers can build robust and efficient circuits.
Your comments will be moderated before it appears here.