Clocking — Gating, Distribution, and CDC
Overview
Clocking is one of the most critical infrastructures in any digital system. It defines the timing of every sequential element, state machine, and communication interface. In safety‑critical designs, the clock network must be stable, deterministic, and resilient to faults such as jitter, drift, loss of lock, or domain‑crossing errors. This page covers the safety‑relevant aspects of clock gating, clock distribution, and clock domain crossing (CDC).
Clock Generation and Stability
Clock sources include oscillators, PLLs, FLLs, and external crystal drivers.
Safety Considerations
- Loss of clock: complete halt of sequential logic.
- Frequency drift: timing violations and protocol errors.
- PLL unlock: unstable or invalid clock output.
- Startup instability: unsafe behavior during power‑on.
Monitoring mechanisms typically include:
- clock‑valid signals
- PLL lock indicators
- frequency monitors
- watchdog‑based supervision
Clock Distribution
Clock distribution ensures that all sequential elements receive a clean and aligned clock.
Distribution Network
- Global clock tree
- Domain‑specific clock branches
- Clock dividers and multiplexers
- Redundant or safety‑qualified clock paths
Safety Requirements
- Low skew to avoid timing violations.
- Glitch‑free switching when selecting between clock sources.
- Deterministic propagation delay across domains.
- Isolation between unrelated clock domains.
Clock Gating
Clock gating reduces dynamic power by disabling clocks to inactive blocks.
Safety Risks
- Glitchy gating signals may introduce spurious clock pulses.
- Incorrect gating may disable safety‑critical logic.
- Clock gating during reset may block reset propagation.
Mitigation Techniques
- Use integrated clock‑gating cells.
- Synchronize gating signals.
- Validate gating logic through static timing analysis.
- Ensure safety‑critical domains are never gated unintentionally.
Clock Domain Crossing (CDC)
CDC occurs when signals move between domains with different clocks.
CDC Risks
- Metastability: unpredictable logic state.
- Data corruption: multi‑bit signals sampled inconsistently.
- Protocol violations: asynchronous timing causing invalid transactions.
CDC Mitigation
- Two‑flop synchronizers for single‑bit signals.
- Handshake protocols for control signals.
- Asynchronous FIFOs for data paths.
- Gray‑coded counters for multi‑bit transitions.
- Formal CDC verification.
Safety Monitoring
Clocking faults must be detected and escalated.
Monitoring Mechanisms
- Clock frequency monitors
- PLL lock supervision
- Redundant clock sources
- FCCU integration for critical clock faults
Reaction Mechanisms
- Switch to backup clock
- Trigger reset
- Enter safe‑state mode
- Notify PMIC or external watchdog
Design Considerations
- Keep clock routing short and shielded.
- Avoid coupling with switching power stages.
- Validate CDC paths with static and formal tools.
- Ensure deterministic behavior across temperature and voltage.
- Include clocking logic in BIST and ATPG.
