Latches, flip-flops and metastability at the circuit level

Combinational gates compute; storage elements remember. Every register, state machine and pipeline stage in a processor depends on latches and flip-flops, and their timing parameters, setup time, hold time and clock-to-output delay, appear in every timing calculation. CMP-240 treated flip-flops as logic symbols with ideal behaviour. This lesson opens them up to show how two cross-coupled inverters store a bit, how transmission gates build latches and flip-flops, where setup and hold times come from, and why a flip-flop sampling an asynchronous signal can hang between 0 and 1 for an unpredictable time.

Bistability: two inverters in a loop

Connect the output of one inverter to the input of a second and the output of the second back to the first. The loop has two stable states, one with the first output high and the second low, and the reverse. Each inverter's high gain near the switching threshold, which lesson 4 measured at more than 30, pushes any small disturbance back toward one of the rails. The loop also has a third equilibrium where both nodes sit at the switching threshold V_M. That point is unstable: like a ball balanced on a hilltop, the slightest push sends it rolling to one side. This unstable point is the root of metastability.

Plotting the transfer curve of one inverter together with the mirrored transfer curve of the other gives the butterfly diagram used to analyze SRAM cells in lesson 9. The two curves cross at three points: the two stable states near the corners and the metastable point in the middle. The size of the eyes between the curves measures how much noise the loop can tolerate before it flips.

Latches

A storage loop is useful only if it can be written. The SR latch built from two cross-coupled NOR gates sets when S is high and resets when R is high; asserting both at once is forbidden because releasing them together leaves the latch in a race. A gated D latch removes the forbidden state. In CMOS it is usually built with transmission gates: when the clock is high, one transmission gate passes the D input to the storage node and the latch is transparent, with Q following D; when the clock falls, that gate opens and a second transmission gate closes the feedback loop, so the value present at the moment of the clock edge is held.

The master-slave flip-flop

An edge-triggered D flip-flop chains two latches with opposite clock phases. The master latch is transparent while the clock is low and follows D; the slave latch is opaque and holds the previous output. When the clock rises, the master closes and holds the value of D at that instant, while the slave opens and passes the held value to Q. The output therefore changes only just after the rising edge. Because the two latches are never transparent at the same time, data cannot race straight through, provided the clock edges are clean and the two clock phases do not overlap significantly.

The timing parameters follow directly from this structure. The setup time is how long D must be stable before the clock edge so that the master's storage node has charged fully to the new value before its input gate closes. The hold time is how long D must stay stable after the edge, because the input transmission gate takes a little time to turn off and a change arriving in that window could still leak through. The clock-to-Q delay is the time for the slave to pass the stored value through its transmission gate and output inverter. All three depend on voltage, temperature and process corner like any other delay.

The second inequality is the hold constraint. It does not involve the clock period at all, so a hold violation cannot be fixed by slowing the clock: if data from one flip-flop can race through a very short path and arrive at the next before that flip-flop has finished capturing the previous value, the circuit fails at every frequency. Clock skew, the difference in arrival time of the clock at the two flip-flops, worsens hold problems when the capturing flip-flop's clock arrives late. Tools fix hold violations by inserting delay buffers in the short paths.

Metastability

Setup and hold times are promises the designer makes to the flip-flop. When data comes from a different clock domain, or from the outside world, such as a push button, a radar module's interrupt line or a UART receive pin, no such promise is possible. Sooner or later an input edge will arrive inside the tiny window around the clock edge, and the master latch will close with its storage node partway between 0 and 1, near the unstable equilibrium. The loop then sits there while its gain slowly amplifies the small difference between the two nodes, and the output can remain at an invalid level, oscillate, or resolve to either value after a delay much longer than the normal clock-to-Q.

Near the metastable point, the cross-coupled pair behaves like a linear amplifier with positive feedback. A small voltage difference grows exponentially with a time constant τ set by the node capacitance divided by the transconductance of the inverters, typically tens to a couple of hundred picoseconds depending on the process. The probability that the flip-flop has still not resolved after a time t therefore falls as e^(−t/τ). That exponential is both the bad news and the good news: no finite wait guarantees resolution, but each additional multiple of τ cuts the probability of failure by a factor of e.

Mean time between failures

The standard model gives the mean time between synchronizer failures in terms of the resolution time allowed, the time constant τ, an aperture T_w that measures how wide the dangerous window is, the clock frequency and the rate of asynchronous data edges.

The exponential makes the result sensitive to the clock period. Running the same flip-flops at 200 MHz leaves only 4.2 ns to resolve and the MTBF falls to a couple of centuries; at 300 MHz it falls to under a day. Fast processes have much smaller τ, so real high-speed designs are not that bad, but the lesson holds: at high clock rates or in safety-critical systems, designers use three-stage synchronizers or flip-flops specially characterized for synchronization.

Crossing clock domains safely

A two-flip-flop synchronizer is correct for a single, slowly changing control bit. It is wrong for a multi-bit bus, because each bit may resolve differently and the receiving domain can see a mixture of old and new values. Safe multi-bit crossings use one of a few patterns. A handshake sends a single request bit through a synchronizer, the receiver captures the stable data bus and returns an acknowledge through another synchronizer. An asynchronous FIFO passes its read and write pointers between domains in Gray code, in which consecutive values differ in only one bit, so a pointer caught mid-change is either the old or the new value, never a wild one. A pulse in a fast domain may be too short for a slow domain to see, so it is first stretched into a level or converted into a toggle.

Resets need care as well. A reset that is asserted asynchronously works immediately, even with no clock, but releasing it asynchronously can put flip-flops in different states if the release lands near a clock edge. The standard practice is asynchronous assertion with synchronous deassertion: the reset signal passes through a small synchronizer so that its release is aligned with the clock, and every flip-flop leaves reset in the same cycle.

Computing MTBF with code

The code evaluates the MTBF formula for the three synchronizer depths and then for a two-stage synchronizer as the clock frequency rises. Because the result spans more than a hundred orders of magnitude, it prints short times in seconds and long ones in years.

# Metastability: mean time between synchronizer failures
import math

def mtbf(t_res, tau, t_w, f_clk, f_data):
    return math.exp(t_res / tau) / (t_w * f_clk * f_data)

tau, t_w = 150e-12, 100e-12      # resolution time constant and aperture of the flip-flop
f_clk, f_data = 48e6, 10e3       # sampling clock and rate of asynchronous input edges
T = 1 / f_clk
t_cq, t_su = 0.5e-9, 0.3e-9
year = 365.25 * 24 * 3600

cases = [("one flop, 2 ns of slack to logic", 2e-9),
         ("two flops, one full cycle to resolve", T - t_cq - t_su),
         ("three flops, two cycles to resolve", 2 * (T - t_cq - t_su))]
for name, t_res in cases:
    m = mtbf(t_res, tau, t_w, f_clk, f_data)
    if m < year:
        print(f"{name}: MTBF {m:.3g} s ({m/3600:.1f} hours)")
    else:
        print(f"{name}: MTBF {m/year:.3g} years")

# how the two-flop result degrades at a faster clock
for f in (48e6, 100e6, 200e6, 300e6):
    t_res = 1 / f - t_cq - t_su
    m = mtbf(t_res, tau, t_w, f, f_data)
    print(f"{f/1e6:6.0f} MHz clock: resolution {t_res*1e9:5.2f} ns, MTBF {m/year:.3g} years")

one flop, 2 ns of slack to logic: MTBF 1.29e+04 s (3.6 hours)
two flops, one full cycle to resolve: MTBF 6.64e+48 years
three flops, two cycles to resolve: MTBF 6.68e+106 years
    48 MHz clock: resolution 20.03 ns, MTBF 6.64e+48 years
   100 MHz clock: resolution  9.20 ns, MTBF 1.37e+17 years
   200 MHz clock: resolution  4.20 ns, MTBF 229 years
   300 MHz clock: resolution  2.53 ns, MTBF 0.00228 years

The table of results makes the exponential concrete. Moving from one stage to two improves reliability by more than fifty orders of magnitude at 48 MHz, while raising the clock from 100 to 300 MHz with the same flip-flops undoes almost all of that improvement. The model's parameters τ and T_w come from characterization of the specific flip-flop; the values here are illustrative.