Setup and Hold: Why Metastability Cannot Be Fixed
A clock promises an ideal moment: at this instant the flip-flop takes the value from its input. Silicon does not keep that promise, and every flip-flop datasheet defines two windows around the clock edge inside which the data must not be touched. Violating those windows is the only situation in a digital circuit where an input can produce a result that was never on it. Below is what the windows actually promise, what a violation does, and why the standard fix is two extra flip-flops. How this window fits into the wider field is explained on the Circuit Design page.
A clock is a moment, not a time
First, the detail that causes the whole problem. A clock edge is drawn in a datasheet as a vertical line, and it is easy to take it for a moment with no duration. In reality an edge takes finite time: fractions of a picosecond in fast circuits, single-digit nanoseconds in slow ones. While it is in progress, the signal has not reached any definite level, and "at this moment the circuit must read a zero" means nothing, because there is no moment.
Everything else follows from that rule: data has to be stable not at the edge but in a window around it. Breaking the window at its boundary is as bad as breaking it in the middle, because the edge duration is what defines where the boundary lies.
Two windows around the edge
A flip-flop has two parameters, and they answer different questions. Setup is how long the data has to be ready before the clock edge. Hold is how long it has to stay ready after the edge. Both values are given in the datasheet and usually fall anywhere from fractions of a picosecond to single-digit nanoseconds depending on the cell; the exact numbers always have to be looked up for your part.
| Parameter | Which question it answers | What a violation causes |
|---|---|---|
setup | How long the data must be ready before the clock edge | The flip-flop may take the old value or the new one |
hold | How long the data must stay ready after the edge | The flip-flop may take the new value even though the old one was there at the edge |
| Clock period | How much time the whole combinational section between registers is given | The signal has not settled and lands in the undefined range too |
| Timing margin | How far the total delay stays below the clock period | Intermittent failures that only show up on a particular build |
Look at the third row. What can be violated is not only a flip-flop input but also the time given to the combinational part: if the signal has not settled by the edge, it lands in exactly the same window, except the input signal is not at fault, the clock period is simply too short. This gives a practical rule: the clock period is chosen not by the speed of the flip-flop but by the total delay of all the gates between the registers, with a margin. How much delay a single gate adds is covered in the article on propagation delay.
Metastability: what actually breaks
Violating a window does not mean "the opposite value comes out". It means "the value has no meaning", and the difference matters. Inside a flip-flop the signal passes through several inverters, and when the data changes at the wrong moment, the voltage on an internal node stops between a logic zero and a logic one. Such a node belongs to neither state, and the time the circuit spends there is random.
Three practical consequences follow, and they explain why the topic feels heavier than it should. First, the output may show a value that was never on the input, and that value may last longer than one clock cycle. Second, there is no way to predict in advance which value it will be. Third, and most important, trying again on the next clock does not help, because the next edge arrives at the same awkward moment relative to that data. Metastability is not cured by re-reading: it can only be detected and given time to resolve.
Engineering practice is built entirely on that. Engineers compute a mean time between failures: given a frequency and a given duration of the undefined window, how often will the flip-flop leave the metastable state in an unexpected way. Usually that is rare enough to treat the event as negligible, and the whole construction reduces to one idea: give it time. One cycle is enough in the overwhelming majority of cases; two cycles is practically always enough.
Two flip-flops in a row: the standard fix
A synchroniser is two D flip-flops clocked by the same signal, with a chain of logic containing no flip-flops between them. It works like this: the first flip-flop may output a value that was not on its input, but unlike a lone flip-flop that time is bounded and ends within one cycle. The second flip-flop reaches a stable state during that cycle, and everything reading further downstream gets correct data.
Why not one? Formally you can rely on a single stage, but then the probability of a metastable value reaching the logic downstream stops being negligible. Why not three? A third flip-flop adds almost nothing and costs an extra cycle of latency and area: if two cycles were not enough, three will not help either, because the cause is the window and not the number of stages. Two flip-flops is exactly as many as are needed for the resolution time to be guaranteed.
The synchroniser goes at the boundary between clock domains: where clock signals of different frequencies or phases meet. Inside a single clock domain metastability does not arise, and putting one there is pointless. For signals with no clock at all, clocked from an external source, or simply very rare, one flip-flop is not enough and level handshake is used instead: the event sets a flag, and the flag is read synchronously, which removes both the metastability and the risk of losing events. Interrupt flags are built that way.
How this looks in the simulator
There is no metastability in the simulator of this course, and it is worth being blunt about that rather than hunting for it in a circuit. The simulation has three phases: first every node computes its new value, then every state is committed, then the changes propagate. A flip-flop at the commit phase takes whatever sits on its input at that moment, and no "between zero and one" ever appears. In a behavioural model, a setup violation does not look like an undefined value but like a decision: the flip-flop faithfully takes the new value, because by commit time it has already arrived.
What that is good for. The model correctly shows the main rule of synchronous design: a register takes a value from its input only at the clock, so any input change between clocks is invisible to it. The model does not reproduce the "read too early" failure, and that is its virtue: it forces you to solve the problem properly by adding a register instead of chasing a rare glitch. The price is that timings cannot be checked in the simulator at all: that needs static timing analysis, and on programmable logic the tool does this work for you by estimating delays and then picking a safe clock period. How that is set up on Tang Nano is covered in the Tang Nano guide.
The summary is simple: check the logic in the simulator, check the windows in the datasheet, and check the timing in hardware or with a static analysis tool. Checking in only one of the three places produces a circuit that works for you and not for anyone else.
What are setup time and hold time?
Setup is how long the data on a flip-flop input must be stable before the clock edge. Hold is how long it must stay stable after the edge. Both values come from the datasheet. If the data changes inside these windows, the flip-flop does not promise a correct output: the value becomes undefined.
What is a metastable state?
It is a state in which a voltage inside the flip-flop sits between a logic zero and a logic one and corresponds to neither. The output may show a wrong value for a while, the time taken to leave the state is random, and the error may last longer than one clock cycle. Metastability cannot be eliminated, only detected and given time to resolve.
Why put another flip-flop in front of a flip-flop?
To give the metastable state time to resolve. The first flip-flop may output a value that was never on its input, but that time is bounded and ends within one cycle. The second flip-flop, clocked by the same signal, reaches a stable state within that time, so everything reading further downstream gets correct data. That is why a synchroniser is built from two flip-flops and not from one.
How do I avoid metastability in a single-clock design?
Inside one clock domain metastability does not arise: the combinational signal settles well before the edge as long as the clock period has enough margin. The problem appears where there are several clocks or where a signal comes from outside, and that is where a two-flip-flop synchroniser goes. For events with no clock of their own, level or edge handshake is used so that events are neither lost nor duplicated.
Check yourself
Why can you not fight metastability by reading the value again on the next clock?
Because the cause repeats. The data comes from another clock domain, and if the edge landed inside the window once, on the next cycle the edge will again be at an awkward moment relative to that data: the offset between the domains is not required to be a multiple of the period. Reading again helps not because "the data has been computed by now" but because a cycle has passed and the resolution time has elapsed. That is why what matters in a synchroniser is the second flip-flop, not the number of attempts.
What happens if the second flip-flop of a synchroniser is clocked from a different clock signal?
The whole point of the synchroniser disappears. It relies on both flip-flops looking at the same input data at different moments of the same clock: the difference between those moments is the resolution time. With different clocks, the second stage cannot guarantee that the first stage has settled, and metastability can pass to the next stage. A shared clock for the whole chain is not a formality but a condition for it working.
Why does one not have to compute setup and hold by hand when designing for a programmable logic device?
Because the cell library is fixed and described by the vendor, while routing and delays are decided by the tool. It estimates the longest delay path, compares it with the clock period, and picks a safe frequency or, on the contrary, reports that the design does not fit and needs a pipeline. The windows still apply at the boundaries where external signals arrive: wherever an asynchronous input becomes synchronous, a synchroniser is still required and is still placed by hand.
How the flip-flop itself works and why it listens only to the clock is covered in the article on the clock and the D flip-flop, how to read the diagram itself is in the material on the timing diagram, and why a processor is cut into registers and combinational sections at all is in the article on combinational and sequential logic.