Every crossing should pass each row of the table. Each check names what to verify and why it matters.
Check | Why |
|---|---|
Every crossing signal is a single bit, a Gray-coded value, or a held-stable data bus | Anything else can be sampled in a mixed state |
Each single-bit crossing has a 2FF (or more) with no logic between the flops and only the last flop used | Settling time |
Control signals come directly from flops in the source domain | No glitches at the synchroniser input |
Data is stable for the whole window in which the destination may capture it | Hold time (handshake or counter) is stated and checked |
Open-loop pulse spacing has explicit clock/jitter/resolution assumptions, or events are acknowledged/counted/buffered | A fixed two-period heuristic alone is not deterministic lossless delivery |
A busy/ready signal stops the source from starting a new transfer too early | No overwriting |
Resets of both domains are consistent (see RDC) | No stuck handshake after reset |
No handshake can deadlock: every state has an exit | Include a timeout in robust designs |
Constraints are crossing-specific: scoped control exceptions, timed synchronizer stages, bundled-data arrival and Gray delay/skew bounds | Inspect effective per-bit timing and exception precedence; clock groups plus structural CDC checking alone do not establish bus timing |
Testbench uses a metastability-aware model and a mutation (unstable data or too-short hold) | Proves the test is sensitive |
For example, AMD documents that broad asynchronous clock groups override datapath-only maximum-delay exceptions. Use scoped exceptions that preserve the required bus checks and audit the implemented reports, not just the constraint text.
A reset in the middle of a transfer is where handshakes break most often. Define the safe state and test it directly.
If one domain is reset while a handshake is in flight, the other side may see req stuck high or an ack with no req. Define the safe state (both req and ack low) and reset both sides together.
Add a timeout or abort if the other side can disappear (a clock gated off, a domain powered down).
Test reset in the middle of a transfer; this is where handshakes break most often.
Only if the bits are truly independent: no logic in the destination depends on two of them being consistent in the same cycle. If the four bits form a mode selection, sending them separately can produce an illegal combination for a cycle.