CDC Timing Constraints

The payload of a gray-pointer FIFO or a req/ack handshake never passes through a synchronizer — only the pointer or request does. So this is not a metastability constraint, and it is reasonable to ask why such a path needs a bound at all, or why a single blanket bound covering every crossing in the design would not be enough.

The bound is needed because the protocol guarantees ordering, not arrival. The read side will not look at an entry until the write pointer has crossed, which takes SYNC_STAGES destination cycles, where SYNC_STAGES is the depth of the pointer synchronizer. Nothing in the protocol ensures the data has physically arrived within that window; that is a timing property, and only a max_delay states it. Miss it and the consumer samples the entry’s previous contents. There is no violation report and no metastability event, just wrong data.

So the requirement is data path < SYNC_STAGES * T_dst. It is not a fixed number of nanoseconds: it scales with the clock that captures the crossing, and the destination periods within one design span an order of magnitude.

That is why the bound is applied per instance rather than as one global value. A single blanket max_delay would have to be loose enough to be feasible on the slowest domains. But this would permit several times more delay than a fast crossing’s pointer scheme tolerates. To ensure that fast crossings are properly constrained, each crossing is sized from its own capturing clock.

The blanket default applied by the clock-group layer (see The two layers) deliberately applies this looser constraint. For slow domains, it is already sufficient and an explicit per-instance constraint is redundant. It is the fast crossings that need a per-instance constraint.

1.0 * T_dst is therefore conservative by a factor of two to three. It is kept simple deliberately, but if wide payloads such as AXI data will not close then raising cdc_data_delay to 2.0 * T_dst stays inside a three-stage guarantee with a cycle to spare. An adopter whose synchronizer cells use a different depth should recompute from their own SYNC_STAGES rather than inheriting this factor.

Enumeration and clock resolution run once, offline, against an elaborated design, and their output is an explicit per-block file of constraint calls that is reviewed and checked in. The flow itself does no discovery. This matters to an integrator because those files are written against the OCAH hierarchy and OCAH’s clock names. If you instantiate a block as delivered, you do not need to regenerate or hand-edit them: set ::cdc_hier_prefix to where the block sits in your hierarchy, and optionally ::cdc_clock_alias to map OCAH clock names onto your own. Regeneration is needed only when the block is reconfigured in a way that changes which CDC elements exist, since no prefix can conjure constraints for elements the file never listed (see Integration checklist item 2).

This is the most important change.

As shipped, the procs target the prim wrapper’s own port, prim_sync3/d_i. That port exists only as long as the wrapper survives as a hierarchical boundary, and a prim cell is ordinary RTL: nothing stops synthesis from ungrouping it and dissolving its ports.

$inst stays the wrapper instance path the generator recorded; you extend it down to the leaf. If your cell is instantiated in a generate loop or per bit, the path needs a glob. Note that generate scopes are separated by ., not /:

Anchoring this way makes hierarchy preservation a safety margin rather than a load-bearing dependency.

If you keep the prim wrappers unchanged, the shipped port names work as-is, but your flow must then preserve those wrapper boundaries. A destination empty warning appearing after compile where there was none at constraint-load time means a boundary was dissolved.

If you go further and replace a wrapper with a module of your own name, the enumeration that produced <block>_cdc_max_delay_generated.tcl knows nothing about it and those crossings end up with no per-instance bound at all. Nothing warns — an element that was never listed cannot report itself missing. Add the calls for it to <block>_cdc_max_delay.tcl by hand; the procs take an instance path and the capturing clock regardless of the module they were named after.

The checked-in <block>_cdc_max_delay_generated.tcl files are written against the OCAH hierarchy, with paths relative to the block’s own top and clocks named as OCAH names them. Two ways to make them apply to your design.

If you instantiate the block as delivered, reuse the files and set two variables. Both default to no-ops, so leaving them alone reproduces the shipped behaviour exactly.

The prefix is prepended to every instance path. The alias is applied wherever a clock name reaches the tool, so OCAH’s names become labels in your design. You can also skip the alias and supply the period directly with set ::cdc_clock_period(SMCCLK) <ps>, which is enough for the synchronizer constraints; the alias additionally matters for the data-path constraints, which name the destination clock as a timing endpoint and so need it to exist.

If you reconfigure the block, regenerate instead. Changing parameters that add or remove CDC elements makes the shipped file stale in the silent direction — the constraints that should exist for new elements simply will not, and nothing warns. The prefix does not help with that.

A wrong prefix fails loudly: every path resolves to nothing, so you get a warning per constraint against a zero exception count, and SUMMARY 0 exceptions is itself reported as a setup failure.

Regeneration is also the right answer whenever a parent build contains the block. Instance counts there can differ from the standalone build, so a parent’s file is not the child’s file with a prefix.

The 20 ns / -20 ns figures are a starting point. Both are info exists-guarded in flows/synth/constraints/async_clock_groups.tcl, so setting them before that file is sourced overrides without editing it. set_async_clock_groups also accepts per-call overrides, which is the cleaner way to give one block a different default:

Two constraints on the choice. The default must exceed every per-instance bound you tighten, because it also governs paths from primary inputs into synchronizers; if it is tighter than 0.5 * T_dst it becomes the binding constraint there. And tighter is not automatically better: this is a net for crossings you have not enumerated, so set it loose enough that those do not fail and rely on layer 2 for the paths that matter.

The minimum is negative deliberately. With -allow_paths a crossing has no meaningful hold relationship, and a zero floor would report hold violations where hold is not a real requirement.

Each block’s <block>_clock_groups.sdc calls cdc_apply_async_groups with its list of domain names. A domain’s group is its clock plus every generated clock registered against it with cdc_group_extra, clocks absent from the session are dropped, and the call reaches set_async_clock_groups with any -exclude pairs passed through. Both calls have to come after every create_clock and create_generated_clock they are meant to cover. Call set_async_clock_groups directly when you need globs or per-call bounds; each inner list is one asynchronous group:

-exclude takes pairs of patterns and suppresses that part of the cross product, for clock pairs that already have a -logically_exclusive or -physically_exclusive relationship that -allow_paths would contradict. Omit it unless you hit a TIM-184 conflict.

A generated clock exposes no readable period attribute in Design Compiler, so any generated clock that clocks a CDC element needs an explicit entry in <block>_cdc_max_delay.tcl:

Omitting one is loud — a no period for clock warning per affected element — so a clean run means you have them all. Keep them in step with your create_generated_clock divide factors; nothing cross-checks them.

Hierarchy preservation. The reference flow applies set_ungroup false and set_boundary_optimization false to the CDC designs before compile. How much this matters depends on item 1: with leaf cell pins it is a safety margin, with wrapper ports it is load-bearing. Either way, your flow needs the equivalent, and it needs to name your cells rather than OCAH’s.

Delay factors. 0.5 * T_dst and 1.0 * T_dst are policy, not physics. If your methodology wants more settling margin, change cdc_sync_delay and cdc_data_delay in flows/synth/constraints/cdc_max_delay_procs.tcl. Per-instance overrides are also available without editing procs: every proc takes an optional trailing delay in picoseconds, and re-stating a call in <block>_cdc_max_delay.tcl after the source wins.

Tool differences. Two Design Compiler specific choices to revisit under PrimeTime. get_attribute <pin> clocks is used because get_clocks -of_objects is PrimeTime-only, and generated clocks may expose a readable period in PrimeTime, making item 5 unnecessary.