Flip-Flop Metastability and Synchronizer Chains
Metastability is a temporary, unpredictable state in a flip-flop caused by its input changing too close to the clock edge. A metastable flip-flop may take an unusually long time to settle to a valid 0 or 1, and its eventual value cannot be predicted reliably.
Synchronizer chains reduce the chance that this unsettled value reaches the rest of a digital circuit. They do not eliminate the underlying possibility; they give the first flip-flop extra time to resolve before another flip-flop uses its output.
The timing problem
A flip-flop normally samples its input on a particular clock edge. It needs the input to be stable for a short interval around that edge:
- Setup time is how long the input must be stable before the edge.
- Hold time is how long it must remain stable after the edge.
These requirements are not merely recommendations for getting the right logical value. They are part of how the flip-flop's internal transistors make a decision.
If the input changes well outside this timing window, the flip-flop settles cleanly to 0 or 1. If the input changes inside the window, internal signals can reach a nearly balanced condition. Instead of quickly choosing one state, the flip-flop can remain at an intermediate voltage or take much longer than normal to resolve.
That condition is metastability. It is an analog behavior inside a component that the surrounding design treats as digital. The output is not reliably a 0 or a 1 during the resolution period. It might eventually become either value, and the time at which it becomes valid varies from event to event.
Metastability is not the same as a deterministic wrong value. The dangerous part is that the value and the delay are both uncertain.
Why this happens at clock-domain boundaries
The most common source is passing a signal between unrelated clock domains. Two clocks are unrelated when their edges do not have a guaranteed phase and frequency relationship. A signal generated by one clock can therefore change at any time relative to an edge of the receiving clock.
An external input, such as a button or sensor output, has the same problem. Even if it changes slowly, the receiving clock may happen to sample it at exactly the unfavorable moment.
Without a synchronizer, the receiving logic might use the first flip-flop's output immediately. If that output resolves late, it can violate the setup or hold requirements of downstream flip-flops. Different parts of the circuit can then observe different values, or a downstream flip-flop can itself become metastable. A counter might advance unpredictably, a state machine might enter an unintended state, or a one-cycle control signal might be missed or duplicated.
The failure may be rare enough to appear as an intermittent hardware bug: a device that works in the lab but fails under a particular temperature, voltage, clock rate, or workload.
How a synchronizer chain works
A basic single-bit synchronizer uses two flip-flops in the receiving clock domain:
signal from another domain ──> [first flip-flop] ──> [second flip-flop] ──> receiving logic
receiving clock receiving clock
The first flip-flop is allowed to encounter metastability. Its output is not treated as a trustworthy control signal. Instead, it feeds only the next synchronizer stage.
If the first flip-flop becomes metastable just after a clock edge, it has almost a full clock period before the second flip-flop samples it on the next edge. Usually, the first flip-flop resolves to a valid 0 or 1 during that interval. The second flip-flop then captures the resolved value and presents a normal-looking signal to the rest of the design.
There is still a small chance that the first flip-flop has not resolved sufficiently by the second edge, or that the second flip-flop samples during its own vulnerable timing window. Adding a third stage gives the signal another clock period to settle before it is used. More stages provide more protection at the cost of additional latency.
The chain must be implemented as actual, separate flip-flops clocked by the receiving clock. Physical design tools are commonly given attributes or constraints identifying synchronizer registers, so they place the stages close together and do not optimize the intended structure away. The exact syntax is device- and tool-specific.
Why the probability falls so sharply
The chance of failure depends on factors including the receiving clock frequency, how often the incoming signal changes, the flip-flop's electrical characteristics, and the time available for resolution. The probability of a metastable event is not zero, but the probability that it remains dangerous for a specified amount of time falls approximately exponentially as that time increases.
That is why one extra synchronizer stage can improve reliability by orders of magnitude rather than by merely a factor of two. A design may use two stages for ordinary control signals and more stages when its required mean time between failures is especially long.
Engineers often express the result as MTBF, or mean time between failures: an estimated average interval between synchronization failures under stated operating conditions. MTBF is a statistical reliability measure, not a guarantee that the next event cannot fail.
What synchronizers do not solve
A conventional two-flop synchronizer is for a single-bit level or control signal. It does not automatically make a multi-bit bus safe. Each bit could resolve independently, producing a combination that never existed in the source domain. Multi-bit transfers need a protocol such as a handshake, an event encoding, or an asynchronous FIFO.
Likewise, a short pulse can disappear entirely if it begins and ends between receiving clock edges. A synchronizer reduces metastability risk; it does not guarantee that the receiving domain will observe every pulse.
So when a design review, static-analysis report, or hardware incident mentions a “CDC synchronizer” or “metastability,” it is referring to this boundary between timing systems. The chain does not remove the analog uncertainty. It isolates the risky sampling event and makes the remaining probability of propagating it small enough for the system's reliability target.