AMBA AXI · Module 14

AXI Across Clock Domains

The clock-domain-crossing (CDC) problem for AXI — metastability, why multi-bit buses can't be naively synchronized, why per-signal synchronizers fail for a handshaked bus, and why async FIFOs are the safe crossing for each AXI channel.

Real SoCs have multiple clock domains — a CPU at one frequency, peripherals at another, memory at a third — and AXI interfaces frequently cross between them. Crossing a clock-domain boundary safely is the CDC (clock-domain-crossing) problem, and AXI makes it harder than a single signal because it's a multi-signal, handshaked bus: VALID, READY, ADDR, DATA, and more must cross coherently. This chapter explains the underlying hazard (metastability), why multi-bit buses can't be naively synchronized, why synchronizing each AXI signal independently is wrong, and why the safe answer is an async FIFO per channel — the foundation for the async bridges of Chapter 14.2.

1. The Hazard — Metastability

When a signal generated in one clock domain is sampled by a flip-flop in another, the source signal can change arbitrarily close to the destination clock edge — violating the flop's setup/hold window. The flop can then enter a metastable state: its output hovers between 0 and 1 for an unpredictable time before resolving randomly. If that metastable value propagates into logic, it causes unpredictable, intermittent failures.

For a single-bit signal, the standard fix is a synchronizer — two (or more) back-to-back flops in the destination domain. The first flop may go metastable, but it has a full clock period to resolve before the second flop samples it, making the probability of metastability propagating vanishingly small (quantified by MTBF). This handles control bits safely. But a synchronizer only works for one bit at a time — and that's exactly where a multi-bit bus breaks.

Figure 1 — the metastability hazard. A signal from the source domain can change near the destination clock edge, violating setup/hold and driving the sampling flop metastable (output undefined for a time). A single-bit synchronizer (2 flops) gives the metastable value a cycle to resolve, making failure vanishingly rare — but it only protects one bit.

2. Multi-Bit Buses Can't Be Naively Synchronized

The critical problem: you cannot safely synchronize a multi-bit bus (ADDR, DATA) by putting a synchronizer on each bit independently. The reason is bit skew — when the bus transitions, the bits don't all change at exactly the same instant (routing/timing differences), and each bit's synchronizer resolves its metastability independently and randomly. So on the destination side, some bits may resolve to the new value while others resolve to the old value in the same cycle — producing a garbage value that was never actually on the bus.

For example, a bus going from 0x0F to 0x10 (multiple bits changing) sampled mid-transition could resolve to 0x1F, 0x00, or any mix — a value the source never drove. Per-bit synchronizers make each bit metastability-safe but do nothing to keep the bits coherent as a word. So multi-bit data needs a fundamentally different crossing technique than control bits.

cdc-problem — multi-bit bus sampled mid-transition resolves to garbage

6 cycles

Figure 2 — cdc-problem: a multi-bit bus sampled mid-transition. As DATA changes from old to new near the destination edge, the bits resolve independently — some to old, some to new — yielding a garbage word (here neither the old 0x0F nor the new 0x10, but a mix) that was never on the bus. Per-bit synchronizers don't keep the word coherent; multi-bit data needs a different crossing.

3. Why Per-Signal AXI Synchronizers Fail

AXI compounds the problem because it's a handshaked, multi-signal protocol. Even setting aside multi-bit data skew, synchronizing each AXI signal (VALID, READY, ADDR, DATA) independently is wrong, because the synchronizers have different, independent latencies:

VALID might cross in 2 cycles while DATA (if it could even cross — it can't naively) crosses in a different number — so the receiver could see VALID asserted before the corresponding DATA is stable, latching the wrong data.
The VALID/READY handshake timing is destroyed — the carefully-coupled relationship (data stable while VALID held until READY) is broken if VALID and the payload cross with different, uncorrelated delays.

So the AXI signals must cross together, coherently — the payload (ADDR/DATA) must be guaranteed stable and associated with its VALID on the destination side. Independent per-signal synchronization gives no such guarantee. This is why a proper AXI CDC isn't "synchronize the signals" — it's a structured mechanism that crosses the data and its control as a coherent unit.

Figure 3 — why per-signal synchronization fails for AXI. Synchronizing VALID, READY, ADDR, DATA independently gives them different, uncorrelated latencies, so the receiver may see VALID before DATA is stable (wrong data latched) and the VALID/READY handshake timing is destroyed. AXI signals must cross together, coherently — payload associated with its VALID — which independent synchronizers can't guarantee.

4. The Safe Crossing — Async FIFO per Channel

The standard, safe AXI CDC is an asynchronous FIFO on each channel. An async FIFO has a write port in the source domain and a read port in the destination domain, with a dual-clock memory between them:

Data rides through memory. The payload (ADDR/DATA/etc.) is written into the FIFO in the source domain and read out in the destination domain — it's only read when the FIFO indicates it's present and stable, so the destination never samples mid-transition. The multi-bit data never needs per-bit synchronizing because it's stored, not sampled-in-flight.
Pointers cross safely via Gray code. The FIFO's write and read pointers must cross domains (to compute full/empty), and they're Gray-coded — only one bit changes per increment — so a pointer can be synchronized bit-by-bit safely (a single-bit change can't produce a garbage multi-bit value; at worst the synchronized pointer lags by a cycle, which is safe/conservative for full/empty).

So the principle is: cross the control (pointers) as single-bit-safe Gray code through synchronizers, and let the data ride through the FIFO memory, read only when safe. Each AXI channel (AW, W, B, AR, R) gets its own async FIFO, preserving the per-channel handshake across the boundary. This is exactly what the interconnect's clock converter (Chapter 12.7) implements, and it's the structure the async bridges of Chapter 14.2 detail.

Figure 4 — the async FIFO crossing. Payload data is written in the source domain and read in the destination domain through dual-clock memory — read only when present, so never sampled mid-transition (no per-bit sync needed). The write/read pointers cross via Gray code (one bit changes per increment) through synchronizers — single-bit-safe. Control crosses as Gray-coded pointers; data rides through memory. One async FIFO per AXI channel.

5. Common Misconceptions

Myths to unlearn

"Just put a 2-FF synchronizer on each AXI signal." Wrong — per-bit synchronizers don't keep a multi-bit bus coherent (bit skew → garbage), and independent latencies break the VALID/DATA association and handshake timing. AXI needs a structured crossing.
"Synchronizers fix multi-bit buses." They fix single-bit control signals only. Multi-bit data must cross via a FIFO/memory (read only when stable) or a held-stable handshake — never per-bit synchronizers.
"Metastability is rare enough to ignore." It causes intermittent, hard-to-debug failures; you design it out with synchronizers (MTBF), not ignore it. An unsynchronized crossing will eventually fail.
"The data and control can cross independently." They must cross coherently — the payload associated with its VALID — or the receiver latches wrong data. That's the whole reason for a FIFO/handshake structure.
"Gray code is just an encoding trick." It's essential: it guarantees only one bit changes per pointer increment, making the pointer safely synchronizable bit-by-bit (a multi-bit binary pointer couldn't be).
"CDC is the same per channel." Each AXI channel needs its own async FIFO; you can't share one crossing for the whole interface (the channels are independent).

6. Debugging Insight

🔍 Debugging insight — CDC bugs are intermittent and crossing-specific

CDC bugs are among the nastiest — intermittent, timing/temperature-dependent, and often invisible in simulation (which may not model metastability):

Intermittent data corruption across a clock-domain boundary? A multi-bit bus synchronized per-bit instead of crossed through a FIFO — bit skew yields garbage values. Check that ADDR/DATA cross via an async FIFO, not per-bit synchronizers.
VALID seen without stable data (wrong data latched)? The control and payload crossed with different latencies (independent synchronizers) — the VALID/DATA association is broken. The crossing must keep them coherent (FIFO).
Random hangs or protocol violations at a CDC boundary? A handshake (VALID/READY) crossing that isn't CDC-safe — the coupled timing was destroyed. Use a proper async-FIFO bridge per channel.
A pointer/counter crossing glitches? A binary (multi-bit) pointer synchronized directly — must be Gray-coded so only one bit changes per increment.
Works in sim, fails in silicon (or only at certain temps/voltages)? Classic metastability — an unsynchronized or improperly-synchronized crossing. Sim often doesn't model the metastable resolution; you find it via CDC static analysis or in hardware.

The triage: cross-domain data garbage → multi-bit-per-bit-sync; wrong-data-with-VALID → control/payload latency mismatch; CDC hang → unsafe handshake crossing; pointer glitch → non-Gray-coded; sim-passes-silicon-fails → metastability. CDC bugs need CDC-specific analysis (static CDC tools), not just functional simulation.

7. Verification Insight

✅ Verification insight — CDC needs static analysis, not just simulation

CDC correctness cannot be fully verified by functional simulation alone, because standard RTL simulation doesn't model metastability — it samples a clean 0 or 1, so an unsynchronized crossing that would fail in silicon may pass in sim. So CDC verification centers on static CDC analysis (a dedicated CDC tool): it identifies every clock-domain crossing, checks that each is structurally safe — single-bit control signals go through synchronizers, multi-bit data crosses through a FIFO/handshake (not per-bit synchronizers), pointers are Gray-coded, and the VALID/payload association is preserved — and flags any unsynchronized or improperly-synchronized crossing. This structural proof is the primary CDC sign-off, complemented by metastability injection in simulation (randomly delaying synchronized signals by a cycle to model the resolution uncertainty) to confirm the design tolerates it.

For an AXI CDC specifically, verify: each channel crosses via a correct async FIFO (functional data integrity across the boundary — every transaction's payload arrives intact in the destination domain, in order); the handshake is preserved (no transaction lost/duplicated across the crossing); Gray-coded pointers; and the full/empty logic is conservative (never overflow/underflow). Coverage includes a wide range of source/destination clock ratios (fast→slow, slow→fast, and close-but-async), since the crossing must work for any asynchronous relationship. The highest-value check is the static CDC structural analysis — it catches the metastability-prone crossings that simulation silently passes, which is exactly the class of bug that reaches silicon and causes intermittent field failures. Functional AXI verification confirms the protocol is correct; CDC analysis confirms the crossing is metastability-safe — both are required for an AXI interface that spans clock domains.

8. Interview Questions

9. Summary

Crossing an AXI interface between clock domains is the CDC problem, rooted in metastability: a signal sampled near the destination edge can hover undefined and cause intermittent failures. Single-bit control signals are crossed with synchronizers (2-FF, high MTBF), but multi-bit buses cannot be naively synchronized — per-bit synchronizers resolve independently, so bit skew produces garbage words never on the bus. AXI compounds this: synchronizing its signals independently breaks the VALID/payload association (wrong data latched) and the handshake timing (uncorrelated latencies), so the signals must cross coherently.

The safe crossing is an async FIFO per channel: the payload rides through dual-clock memory (written in the source domain, read in the destination domain only when present — never sampled mid-transition), while the Gray-coded pointers cross through synchronizers (one bit changes per increment → single-bit-safe, conservative full/empty). Control crosses as Gray pointers; data rides through memory. Each AXI channel gets its own FIFO, preserving the handshake — the interconnect's clock converter (12.7) and the async bridges (14.2). Critically, CDC needs static CDC analysis (functional sim doesn't model metastability), complemented by metastability injection — a structural proof that every crossing is safe. Next: the async bridge structure that implements this per-channel.

10. What Comes Next

You've got the CDC problem and principle; next, the bridge that implements it:

14.2 — Asynchronous AXI Bridges (coming next) — the async-FIFO bridge structure that crosses AXI between domains safely, channel by channel.
14.3 — Reset Sequencing (coming soon) — ARESETn behavior and synchronous-deassert reset discipline.

Previous: 13.6 — Identifying Performance Bottlenecks. Related: 12.7 — Clock & Reset in Interconnect for where clock converters sit in the fabric. For the broader protocol catalog, see the AMBA family overview doc.