One Flop, a Gated Clock, and Temperature-Dependent Failures
A production board carries a 50 MHz system clock and a 1 MHz asynchronous limit-switch input arriving on a long cable from a connector. The input feeds a single flip-flop in the 50 MHz domain whose output drives both a state machine and a combinational decode, clk_gated = clk AND enable, that clocks a small register block. Field returns show roughly one failure per 10^4 power cycles; the rate rises at 70 degrees C and when the 3.3 V rail sags to 3.0 V, and several units pass all tests on the bench with a scope probe attached. Static timing analysis reports no violations and the design was signed off because "the synchronizer flop is there". A junior engineer proposes adding a 100 pF capacitor on the input to slow the edge. Volume is 200,000 units and the next programming revision is six weeks away.
1. Identify the two distinct design errors and explain how each produces the observed symptoms.
Read the worked answer
Error one: a single flip-flop is a sampling stage, not a synchronizer. When the asynchronous edge lands inside the setup/hold aperture, the flop's output can hover at a mid-level for an unbounded time. That output fans out to the state machine and to other logic, so different destinations can resolve the same event to opposite values, and the state machine can enter a state that no simulation ever covers. Adding a second flop behind the first gives a full clock period for resolution and presents downstream logic with one settled value.
Error two: gating a clock with a combinational decode. The decode can glitch whenever enable changes, producing runt pulses and double-clocking, and the gated net becomes an unconstrained clock domain that static timing analysis never checked. That is why timing reports clean while hardware fails. The correct structure is a clock enable on the registers, or a dedicated clock-gating cell whose enable is captured by a latch on the opposite clock phase.
The symptoms fit both errors. Metastability probability depends on resolution time constant and aperture width, which degrade at lower supply voltage and higher temperature, exactly as reported. Passing when probed is expected: probe capacitance slows the edge, and loading changes the victim net, so the fault hides.
2. Argue quantitatively why one flop is unacceptable and state the MTBF argument you would put in the design review.
Read the worked answer
Use the standard model: MTBF = exp(t_r / tau) / (T0 * f_clk * f_data), where t_r is the resolution time available, tau the resolving time constant, T0 the metastability window width and f_data the asynchronous event rate. The exponential term dominates everything. With tau = 50 ps, increasing available settling from 1 ns to 2 ns multiplies MTBF by exp(20), about 4.9 x 10^8; halving it divides MTBF by the same factor. This is why the argument cannot be "we ran it for a week and it worked": the failure rate is exponentially sensitive to parameters that drift with voltage, temperature and process corner.
With f_clk = 50 MHz and f_data = 1 MHz, the frequency product alone is 5 x 10^13 per second times T0; the only lever with real effect is t_r. In a single-flop design the first flop's output is consumed immediately, so effective settling is a fraction of a clock period and varies per destination. A two-flop synchronizer buys roughly one full 20 ns period of resolution, and a third stage buys another. Specify a two-flop synchronizer with the ASYNC_REG attribute, no combinational logic between the pin and the first flop, no fanout from the first flop, and a false-path or max-delay datapath-only constraint so implementation does not try to time a false path. State the MTBF target and the vendor tau and T0 values used.
3. Evaluate the capacitor proposal and describe the verification you would run before the revision ships.
Read the worked answer
Reject the capacitor. It does not bound the sampling problem; it slows the edge and lengthens the time the signal spends in the receiving gate's linear region, which can make metastability more likely, not less. Its effect depends on unknown source impedance, cable length and temperature coefficient, and it varies across units, so it cannot be characterised, cannot be simulated, and cannot be signed off. It also leaves the gated clock in place, which is the error most likely to cause a systematic failure rather than a rare one.
Verification should cover both fixes. Run CDC lint and structural checks that flag gated clocks, combinational logic on asynchronous pins, and multi-bit crossings; confirm the synchronizer is recognised and constrained. Simulate with an injected edge swept in fine phase steps across the clock period, at both voltage corners, to show the state machine never enters an illegal state. Prove the gated clock is gone by netlist inspection, not by review comment.
On hardware, run a phase-sweep stress across the full temperature and supply range, with the highest asynchronous event rate the cable can deliver, over enough unit-hours to be meaningful at 200,000 units. Sample from multiple lots. Keep the scope-probe condition out of the pass criteria and add a no-probe test, since the probe is what hid the original fault.