Clock Domain Crossing for Tear-Free FPGA LED Updates

An LED scanner often runs from a deterministic display clock while pixels arrive from a CPU bus, DMA engine, USB bridge, or network clock. Passing a “new frame” pulse or a multibit control word directly between those domains can cause lost events, metastability, and torn frames. This tutorial builds a safe frame-swap handshake.

Synchronizers solve only single-bit sampling

A two-register chain in the destination domain reduces the probability that metastability escapes into user logic. It does not make a changing multibit bus coherent, and a narrow source pulse can disappear entirely between destination clock edges.

(* ASYNC_REG = "TRUE" *) logic req_meta, req_sync;

always_ff @(posedge scan_clk) begin
    req_meta <= swap_request_toggle;
    req_sync <= req_meta;
end

Use a toggle for an event

The producer flips a bit after finishing the back buffer. The scanner synchronizes that bit and compares it with the last value it serviced. The event persists until observed, regardless of the relative clock rates.

logic serviced_toggle;
logic swap_pending;

always_ff @(posedge scan_clk) begin
    if (rst) begin
        serviced_toggle <= 1'b0;
        swap_pending     <= 1'b0;
    end else begin
        if (req_sync != serviced_toggle)
            swap_pending <= 1'b1;

        if (frame_done && swap_pending) begin
            front_bank      <= ~front_bank;
            serviced_toggle <= req_sync;
            swap_pending    <= 1'b0;
            ack_toggle      <= ~ack_toggle;
        end
    end
end

Synchronize ack_toggle back into the producer domain. The producer must not overwrite the completed back buffer until it observes the acknowledgement.

Move multibit data safely

• Use a dual-clock FIFO for a stream of pixels or commands.
• Use dual-port memory plus ownership handshakes for framebuffers.
• For a stable configuration bus, hold the bus unchanged from request through acknowledgement and capture it only after the synchronized request.
• Never synchronize each bit of a bus independently; different bits can settle on different cycles.

Constraints and structural checks

Mark recognized synchronizer registers with the vendor-supported attribute, declare asynchronous clock relationships correctly, and run the tool’s CDC report. A false-path constraint hides timing analysis; it does not create safe hardware. Review every reported crossing and confirm the RTL structure matches the protocol.

Verification strategy

• Run source and destination clocks at non-integer ratios.
• Randomize request timing around destination edges.
• Assert every accepted request receives exactly one acknowledgement.
• Assert bank ownership never overlaps.
• Assert front_bank changes only on frame_done.

Official references

• AMD UG949: Clock Domain Crossing
• Intel: Metastability Analysis