Free CDC Checker for Verilog: Find Unsafe Clock Crossings
A clock-domain-crossing (CDC) bug is the kind that passes lint, passes a green simulation regression, and then fails intermittently on a customer’s bench. Commercial CDC tools are excellent and expensive; the good news is that the structural layer — the one that catches the most common and most dangerous bug, a crossing with no synchronizer at all — can be checked for free. This page explains what a CDC checker actually does, why your existing flow misses these bugs, and how to scan your Verilog or SystemVerilog without setting up a toolchain. For the engineering depth behind every term here, the full CDC guide covers synchronizers, metastability, and MTBF.
Why lint and simulation miss CDC
A linter reads one module at a time and reasons about syntax and style. It does not build the design-wide graph of which flops belong to which clock, which is exactly the structure a crossing lives in. A simulator models every flop as a clean, deterministic element: it resolves to a valid 0 or 1 on every edge and never goes metastable, so a signal that jumps clock domains with no synchronizer behaves perfectly in the model and breaks only in silicon. CDC is therefore its own verification activity, mostly structural, and it has to run as a distinct pass.
What a structural CDC checker flags
- No synchronizer. A signal launched in one clock domain is sampled in another with nothing in between. The single highest-value finding.
- Multi-bit bus through a 2-FF sync. Each bit resolves independently, so the receiver can observe a transient value that never existed at the source. Needs gray code, a handshake, or an async FIFO instead.
- Combinational logic in the chain. A glitchy combinational source, or a gate between the synchronizer flops, invalidates the MTBF the synchronizer was sized for.
- Reset crossing without a reset synchronizer. A reset that deasserts asynchronously across domains is itself a crossing — covered in detail under reset domain crossing.
How ChipVerify checks this
ChipVerify AI runs structural CDC analysis on uploaded RTL. It builds the clock-domain graph, identifies every signal that crosses between flops in different domains, and reports the crossings that lack a recognizable synchronizer (two-flop, gray-coded, or handshake), with the source and destination domain and the file and line. It can also generate correct-by-construction CDC primitives — two-flop and reset synchronizers, gray-coded async FIFOs — so you start from a known-good cell. This is a structural, pre-signoff check and bounded evidence: it is honest about what it cannot see (it never claims a crossing is clean just because a name looks like a synchronizer), and it is not a foundry CDC signoff or a certification.
FAQ
Can a free tool actually check CDC?
Yes, for the structural layer that catches most real bugs. A structural CDC checker statically identifies every signal that crosses between flops in different clock domains and reports whether each crossing has a recognizable synchronizer. That is the highest-value first pass and it needs no testbench. Exhaustive metastability proofs and full reconvergence analysis are deeper, but a structural scan finds the missing-synchronizer bugs that dominate.
Why doesn't lint or simulation catch CDC bugs?
Lint reads one module's syntax and style; it does not build the cross-module clock-domain graph a crossing lives in. Simulation models a flop as deterministic, resolving cleanly on every edge, so it never produces metastability — a missing synchronizer sails through a green regression. CDC needs its own structural pass.
What does a CDC checker flag?
Signals crossing clock domains with no synchronizer, multi-bit buses pushed through per-bit two-flop synchronizers (which can present transient values that never existed at the source), combinational logic in or before the synchronizer chain, and reset crossings without a reset synchronizer. A good checker names the source and destination domain and the file and line.
Related reading
- Clock domain crossing — the full guide to synchronizers, metastability, and MTBF.
- Reset domain crossing — the reset-specific cousin of CDC and its own check.
- RTL verification — where CDC sits in the wider pre-tapeout flow.
Scan your RTL for unsafe clock crossings
Sign in and ChipVerify AI runs structural CDC analysis on your Verilog or SystemVerilog, naming every crossing without a recognizable synchronizer with file-and-line evidence — pre-signoff structural analysis, not a foundry CDC signoff.