In short: Metastability happens when an asynchronous signal violates a flip-flop's setup/hold window, leaving the output stuck between 0 and 1 for an unbounded time; you can never prevent it, but a two-flip-flop synchronizer pushes the probability of a resolution failure so low (quantified by MTBF) that it practically never causes a system error.
Every FPGA engineer eventually meets the one bug that defies logic simulation, passes timing closure, and still fails one board in a hundred after three days of running. More often than not, the culprit is metastability on an asynchronous input. This article explains why it is physically unavoidable, how the classic two-stage synchronizer tames it, and how to compute a mean-time-between-failures (MTBF) number you can actually defend in a design review.
Why a flip-flop has a setup/hold window at all
A D flip-flop is not a magic latch; internally it is a pair of cross-coupled inverters that form a bistable element with two stable states, 0 and 1, and one unstable equilibrium point between them. For the loop to settle cleanly, the input data must be held steady for a short interval before the clock edge (setup time, tsu) and after it (hold time, th). On a modern FPGA fabric flop these are typically in the tens to low hundreds of picoseconds.
When the data changes inside that window, the flop samples a voltage that is neither a valid logic 0 nor a valid 1. The cross-coupled loop can land near its metastable balance point, like a pencil balanced on its tip, and sit there for an indeterminate time before tipping to 0 or 1. During that time the output may hover at an intermediate voltage, oscillate, or resolve late.
Key fact: Metastability cannot be designed away. Any time two clock domains or a free-running external signal meet a clocked register, there is a non-zero probability the edge arrives inside the aperture window. The engineering goal is not prevention but making the failure probability negligibly small.
The classic failure: a single register on an async input
Imagine an FPGA sampling a push-button, a signal from another oscillator, or a bus crossing from a 50 MHz domain into a 200 MHz domain. If you feed that raw signal straight into logic, you create a second, subtler danger beyond a single late resolution: fan-out divergence. One metastable flop driving several downstream gates can resolve to different apparent values along different paths, because each path sees the ramping voltage at a slightly different threshold. Your state machine can jump to an illegal state that never appears in simulation. This is the signature of a missing synchronizer.
The two-flip-flop synchronizer
The standard fix is deceptively simple: place two flip-flops in series, both clocked by the destination clock, with nothing combinational between them.
- FF1 samples the asynchronous input and may go metastable.
- Between the two clock edges, FF1 is given almost a full clock period to resolve back to a valid level — this is the resolution time or settling time.
- FF2 then samples FF1's (now hopefully resolved) output and presents a clean, in-domain signal to the rest of the logic.
The magic is that resolution is exponential in time. The longer you wait, the exponentially smaller the chance the flop is still undecided. By spending one clock period on settling, you convert an unbounded physical hazard into a quantifiable, vanishingly small probability.
Quantifying it: the MTBF equation
The industry-standard model for mean-time-between-failures of a synchronizer is:
MTBF = e(tr / τ) / (fclk × fdata × T0)
Where:
| Term | Meaning | Typical value (modern FPGA) |
|---|---|---|
| tr | Resolution time available for settling (≈ clock period − FF2 setup) | design-dependent |
| τ | Metastability time constant of the flop (settling speed) | ~15–50 ps |
| T0 | Width of the metastability aperture | ~1–20 ps |
| fclk | Destination clock frequency | e.g. 200 MHz |
| fdata | Rate of asynchronous input transitions | e.g. 10 MHz |
The dominant factor is the exponential e(tr/τ). Plug in realistic numbers — say a 200 MHz clock (5 ns period, giving roughly tr ≈ 4.5 ns after setup), τ = 30 ps, T0 = 10 ps, fdata = 10 MHz — and the exponent is about 150, producing an MTBF measured in astronomically large numbers of years. That is why two flops are "enough" for most designs.
Key fact: Adding a third synchronizer flop roughly squares the already-large MTBF. At very high clock rates, or for safety-critical designs, vendors like AMD/Xilinx and Intel/Altera recommend three stages — and their timing tools (Vivado, Quartus) can report a synchronizer MTBF directly once you tag the registers with the proper attributes.
Where it goes wrong in practice
- Combinational logic between the two flops. This breaks the whole scheme — FF1 must drive FF2 directly so the full period is available to settle.
- Synchronizing a multi-bit bus with parallel 2-FF chains. Different bits resolve on different edges, corrupting the word. Use a handshake, a gray-coded pointer (for FIFOs), or an MCP (multi-cycle path) formulation instead. See our companion article on clock domain crossing in FPGA for the correct multi-bit techniques.
- Letting the tool optimize the synchronizer away or replicate it. Apply the vendor's ASYNC_REG / preserve attributes so placement keeps the two flops adjacent and the chain intact.
- Forgetting reset recovery/removal. An asynchronous reset release is itself an async event that can cause metastability — a reset synchronizer is as important as a data one. Our reset synchronization in FPGA guide covers this.
Tool and verification workflow
Treat CDC (clock domain crossing) as a first-class verification item, not an afterthought. Static CDC checkers — Synopsys SpyGlass CDC, Siemens Questa CDC, and Cadence Conformal — will flag any async crossing that lacks a recognized synchronizer structure, missing attributes, or an unsafe multi-bit path. In the FPGA flow, Vivado's report_cdc and Quartus's CDC/metastability analyzer complement these by estimating MTBF from the placed-and-routed design. For hardware teams building production silicon, a structured review of every crossing is what separates a robust design from an intermittent-failure nightmare — the kind of discipline taught in professional VLSI programs at ChipXpert's RTL and verification training.
Want to master CDC, synchronizers, and timing closure hands-on with Vivado and Quartus? Explore the FPGA and digital design tracks in our CourseTron course catalog and build these circuits yourself.
Frequently Asked Questions
Can metastability ever be eliminated completely?
No. It is a fundamental property of bistable elements sampling asynchronous events. You can only make the probability of an unresolved failure arbitrarily small by allowing more settling time — typically through a two- or three-flop synchronizer — which pushes the MTBF to effectively infinite values.
Why not just use a single flip-flop to resynchronize?
A single flop can itself go metastable and pass that indeterminate state straight into your logic, where it can fan out to different values on different paths. The second flop exists purely to give the first one almost a full clock period to settle before anything downstream samples it.
When do I need a third synchronizer stage?
At very high destination clock frequencies, when τ is large relative to the clock period, or in safety-critical systems where you need an MTBF of many thousands of years with margin. A third stage roughly squares the MTBF for a modest latency cost of one extra clock cycle.
Does a two-FF synchronizer work for multi-bit buses?
No. Independent per-bit synchronizers let bits resolve on different clock edges, so the received word can be momentarily wrong. Use gray-coded pointers for FIFOs, or a request/acknowledge handshake with the data held stable, for correct multi-bit crossing.