{"id":12255,"date":"2016-07-21T06:00:13","date_gmt":"2016-07-21T13:00:13","guid":{"rendered":"https:\/\/blogs.mentor.com\/verificationhorizons\/?p=12255"},"modified":"2026-03-27T08:37:25","modified_gmt":"2026-03-27T12:37:25","slug":"how-to-avoid-metastability-on-reset-signal-networks-aka-reset-check-is-the-new-cdc","status":"publish","type":"post","link":"https:\/\/blogs.sw.siemens.com\/verificationhorizons\/2016\/07\/21\/how-to-avoid-metastability-on-reset-signal-networks-aka-reset-check-is-the-new-cdc\/","title":{"rendered":"How to Avoid Metastability on Reset Signal Networks, a\/k\/a Reset Check is the New CDC"},"content":{"rendered":"<p>It\u2019s axiomatic that digital circuitry must initialize properly before it\u2019s used. Once upon a time, verifying a design\u2019s reset signaling was a pretty straightforward process \u2013 simply confirm the continuity of reset signal from the pad ring to all the IPs and instances inside the DUT. Fast forward to the present, and previously unheard of bugs on reset signal networks are being created via:<\/p>\n<p>* SoCs comprised of many IPs, where 3rd party IPs can handle clocking and reset differently<\/p>\n<p>* Multiple power shutoff domains, where each domain has its own reset signaling<\/p>\n<p>* Aggressive optimization of reset signaling networks to reduce power and area overhead.<\/p>\n<p>To illustrate, consider the following cases where reset and clock signaling are not always in the same domains, potentially leading to big trouble for the second flip flop (dff2):<\/p>\n<p><a href=\"https:\/\/blogs.sw.siemens.com\/wp-content\/uploads\/sites\/54\/2016\/07\/questa-reset-check-2dff-example.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"size-medium wp-image-12259 aligncenter\" src=\"https:\/\/blogs.sw.siemens.com\/wp-content\/uploads\/sites\/54\/2016\/07\/questa-reset-check-2dff-example-520x219.jpg\" alt=\"questa reset check 2dff example\" width=\"520\" height=\"219\" \/><\/a><\/p>\n<p><strong>Case 1:<\/strong> rst1 &amp; rst2 are different asynchronous reset signals despite same clock \/ <u>same<\/u> clock domain (i.e. clk1 = clk2)<\/p>\n<p><strong>Case 2:<\/strong> rst1 &amp; rst2 are different asynchronous reset signals and clk1 and clk2 are in <u>different<\/u> clock domains<\/p>\n<p>Alternatively, to borrow from <a href=\"https:\/\/goo.gl\/plz6A3\" target=\"_blank\" rel=\"noopener\">the DVCon USA 2016 paper on this subject, <em>Reset and Initialization, the Good, the Bad and the Ugly<\/em> by Ping Yeung of Mentor Graphics and Kaowen Liu of MediaTek<\/a>, design registers can be sorted into three types: GOOD registers (those that are initialized properly), BAD registers (those that are not initialized) and UGLY registers (those that are initialized, but are subsequently corrupted).<\/p>\n<p>The bottom line is that independent \u201creset domains\u201d can give rise to metastability and signal reconvergence issues similar to clock domain crossing (CDC) bugs. The proliferation of reset domains, and the increasing complexity of rest signaling topologies, means that manual inspection &amp; verification is unsafe, creating considerable risk of unpredictable chip behavior when samples come back. Even worse, like with CDC, the metastability induced by mixing independent reset domains cannot be modeled accurately in simulation.<\/p>\n<p>So what can be done?<\/p>\n<p>\u201cSimple\u201d: leverage time-tested structural and formal CDC analysis techniques!<\/p>\n<p>First, reset signaling networks look a lot like clock trees, giving rise to the concept of reset domains like is done for multiple clock signals in a CDC analysis. Plus, as with CDC verification, automated, exhaustive formal analysis can be applied. Building on over a decade of experience with formal-based CDC verification, Mentor has developed a fully automated formal solution that exhaustively verifies your reset signaling network.<\/p>\n<figure id=\"attachment_12258\" aria-describedby=\"caption-attachment-12258\" style=\"width: 603px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/blogs.sw.siemens.com\/wp-content\/uploads\/sites\/54\/2016\/07\/Questa-Reset-Check-app-block-diagram.png\"><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-12258\" src=\"https:\/\/blogs.sw.siemens.com\/wp-content\/uploads\/sites\/54\/2016\/07\/Questa-Reset-Check-app-block-diagram-520x230.png\" alt=\"Questa Reset Check app block diagram\" width=\"603\" height=\"261\" \/><\/a><figcaption id=\"caption-attachment-12258\" class=\"wp-caption-text\"><strong><em>Questa Reset Check app block diagram<\/em><\/strong><\/figcaption><\/figure>\n<p>Specifically, taking RTL as input, the <a href=\"https:\/\/www.mentor.com\/products\/fv\/questa-reset-check\" target=\"_blank\" rel=\"noopener\">Questa Reset Check app<\/a> automatically performs an exhaustive, bottom-up reset tree analysis \u2013 inferring all the reset structures of a design, including gating and control logic. The app then automatically generates and proves assertions that cover numerous reset-specific structural checks. No knowledge of formal or property specification languages is required.<\/p>\n<p>The results include reports on the synchronicity, polarity and set\/reset functionality of all reset tree register nodes; any reset domain crossing (RDC) signals of adjacent registers within the same clock domain; and the complete matrix of clock and reset signals\u2019 relationships.<\/p>\n<p>Back to our original example above, consider the following results where the detected violations are tabulated by the app:<\/p>\n<p><a href=\"https:\/\/blogs.sw.siemens.com\/wp-content\/uploads\/sites\/54\/2016\/07\/Questa-Reset-Check-results-example.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-medium wp-image-12257\" src=\"https:\/\/blogs.sw.siemens.com\/wp-content\/uploads\/sites\/54\/2016\/07\/Questa-Reset-Check-results-example-520x151.png\" alt=\"Questa Reset Check results example\" width=\"520\" height=\"151\" \/><\/a><\/p>\n<p>The first class of error shown is the case where the IPs are in the same clock domain, but they are connected to different asynchronous reset signals. This is \u201cBAD\u201d and will lead to chip killing metastability on the reset signals.<\/p>\n<p>Another violation reported by the tool in the lower part of the image are the cases where asynchronous and synchronous resets are wired up in the same clock domain. Depending on the design configuration, this might not be a bad thing \u2013 if this is OK the tool supports the creation of a \u201cwaiver\u201d so this connection is no longer marked as an error.<\/p>\n<p>Like with CDC verification\u2019s many layers of complexity, these two cases are only the starting point of a proper reset signaling analysis &#8212; there are many other second order effects that <a href=\"https:\/\/www.mentor.com\/products\/fv\/questa-reset-check\" target=\"_blank\" rel=\"noopener\">Questa Reset Check<\/a> detects and reports. Only an exhaustive formal analysis can verify all of this with mathematical certainly, and thus the <a href=\"https:\/\/www.mentor.com\/products\/fv\/questa-reset-check\" target=\"_blank\" rel=\"noopener\">Questa Reset Check app<\/a> was created to help customers address these challenges.<\/p>\n<p>&nbsp;<\/p>\n<p>Are you seeing \u201creset domain crossing&#8221; (RDC) verification issues appearing in your SoC projects?\u00a0 Please share your thoughts in the comments below, or contact me offline.<\/p>\n<p>Until next time, may your coverage be high and your power consumption be low,<\/p>\n<p>Joe Hupcey III<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><strong>References:<\/strong><\/p>\n<p><a href=\"https:\/\/goo.gl\/plz6A3\" target=\"_blank\" rel=\"noopener\">DVCon USA 2016: <em>Reset and Initialization, the Good, the Bad and the Ugly<\/em>, Ping Yeung Design &amp; Verification Technology Mentor Graphics, Fremont, U.S.A. Kaowen Liu Design Technology Division MediaTek Inc, San Jose, U.S.A.<\/a><\/p>\n<p>&nbsp;<\/p>\n<p><a href=\"https:\/\/goo.gl\/VFRhhu\" target=\"_blank\" rel=\"noopener\">DVCon USA 2015: <em>Addressing the Challenges of Reset Verification in SoC Designs<\/em>, Chris Kwok, Priya Viswanathan, Ping Yeung, Design Verification and Technology, Mentor Graphics Corporation<\/a><\/p>\n<p>&nbsp;<\/p>\n<p><a href=\"https:\/\/verificationacademy.com\/sessions\/dac-2016\/Orange-is-the-New-Black-Reset-Verification-is-the-New-CDC\" target=\"_blank\" rel=\"noopener\">Video from Verification Academy at DAC 2016: <em>Orange is the New Black, Reset Verification is the New CDC<\/em><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>It\u2019s axiomatic that digital circuitry must initialize properly before it\u2019s used. Once upon a time, verifying a design\u2019s reset signaling&#8230;<\/p>\n","protected":false},"author":71594,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"spanish_translation":"","french_translation":"","german_translation":"","italian_translation":"","polish_translation":"","japanese_translation":"","chinese_translation":"","footnotes":""},"categories":[1],"tags":[376,377,593,667,683],"industry":[],"product":[],"coauthors":[],"class_list":["post-12255","post","type-post","status-publish","format-standard","hentry","category-news","tag-cdc-analysis","tag-cdc-verification","tag-metastability","tag-questa-reset-check","tag-reset-domain"],"_links":{"self":[{"href":"https:\/\/blogs.sw.siemens.com\/verificationhorizons\/wp-json\/wp\/v2\/posts\/12255","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.sw.siemens.com\/verificationhorizons\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.sw.siemens.com\/verificationhorizons\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.sw.siemens.com\/verificationhorizons\/wp-json\/wp\/v2\/users\/71594"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.sw.siemens.com\/verificationhorizons\/wp-json\/wp\/v2\/comments?post=12255"}],"version-history":[{"count":1,"href":"https:\/\/blogs.sw.siemens.com\/verificationhorizons\/wp-json\/wp\/v2\/posts\/12255\/revisions"}],"predecessor-version":[{"id":19822,"href":"https:\/\/blogs.sw.siemens.com\/verificationhorizons\/wp-json\/wp\/v2\/posts\/12255\/revisions\/19822"}],"wp:attachment":[{"href":"https:\/\/blogs.sw.siemens.com\/verificationhorizons\/wp-json\/wp\/v2\/media?parent=12255"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.sw.siemens.com\/verificationhorizons\/wp-json\/wp\/v2\/categories?post=12255"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.sw.siemens.com\/verificationhorizons\/wp-json\/wp\/v2\/tags?post=12255"},{"taxonomy":"industry","embeddable":true,"href":"https:\/\/blogs.sw.siemens.com\/verificationhorizons\/wp-json\/wp\/v2\/industry?post=12255"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/blogs.sw.siemens.com\/verificationhorizons\/wp-json\/wp\/v2\/product?post=12255"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blogs.sw.siemens.com\/verificationhorizons\/wp-json\/wp\/v2\/coauthors?post=12255"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}