Metastability
A flip-flop asked to sample a signal that changes at the same moment can end up between its two states, and it will leave, but not by any deadline. This is not a defect anyone can remove. What a designer can do is give it more time, and the equation for how much that buys has been known since 1973. It buys a great deal, and it never buys certainty.
New to clocked logic? Start here
A flip-flop is the smallest piece of memory in a digital circuit. On each tick of a clock it looks at its input and holds whatever it saw until the next tick. Everything synchronous is built from that one habit.
It works because the input is expected to be steady when the tick arrives. A signal from somewhere with its own clock has no reason to be, and if it changes at the same moment it is sampled the flip-flop can be left between its two states. It always leaves. It just cannot be held to a deadline, and that is what this page puts numbers on.
Everything is a switch
Underneath all of it is one part: a switch that is either on or off, and that can be operated by another switch rather than by a finger. That is the whole of the hardware vocabulary. AND is two switches in a row, so both must be on. OR is two side by side, so either will do. NOT turns the answer around.
There is nothing else in the box. Adding, remembering, choosing and counting are all arrangements of those three, and the machines in this topic are those arrangements, in the order somebody had to think of them.
The machine for this idea on its own is Flip-Flop, if you would rather press it than read about it.
Catch it at the wrong instant and it cannot promise when it decides
1 The equation's parameters, and the mean time between failures they produce
The equation is MTBF = exp(t / tau) divided by T0 x fc x fd. Give the circuit more time to settle and the failures become rarer, exponentially. These are the parameters; change them and every number below is recomputed.
2 What each additional flip-flop buys, and the constant factor it buys it by
What each additional flip-flop buys. The settling column is the time the chain gives the circuit to make up its mind; the last column is how often it fails to.
| flip-flops | settling time | mean time between failures |
|---|
3 The same figure across a fleet, which is the rate somebody actually experiences
The same chain, multiplied by how many of the thing you ship. A mean time between failures is per device, so a fleet fails that many times as often, and this is the column a support desk actually experiences.
| devices in the field | a failure somewhere every |
|---|
These ran in this browser when the page loaded. Each claim, whether it held, and the number behind it.
| claim | held | measured |
|---|---|---|
| each extra flip-flop multiplies the mean time between failures by the same factor | yes | the gain is 10^4.34 per stage, and the differences between five computed rows agree with it to 0.0e+0 in the exponent |
| one flip-flop fails in a fraction of a second where four lasts ninety thousand years | yes | 1 stage: 0.267 s; 2 stages: 1.63 hours; 4 stages: 9.05e+4 years. Nothing changed but the number of flip-flops |
| solving the equation backwards returns the settling time it started from | yes | 5 stage counts round-tripped through MTBF and back, worst disagreement 0.0e+0 ps |
| no number of stages makes it impossible, only rarer | yes | the equation is an exponential, so it has no zero; every row here is a finite time, including the ones longer than the universe |
| shipping a million of them divides that time by a million | yes | one device: 4.11 years; a million devices: 2.16 minutes, which is the number that matters to whoever supports them |
| doubling the clock does far worse than halving the time between failures | yes | 500 MHz: 1.63 hours; 1 GHz: 0.134 s. The period shrinks inside the exponent and the rate rises in the divisor, so the loss is a factor of 10^4.6, not of two |
| computed the obvious way this equation returns Infinity, which would read as a guarantee | yes | at tau = 10 ps the exponent is 990 and exp() in a double gives up past about 710, returning Infinity; in log space it is 10^425 seconds, which is a large number rather than a promise |
| the flip-flop here is a model, not a part you can buy | yes | tau 200 ps and T0 100 ps are of the order published for CMOS flip-flops; they are not a datasheet, and attaching a real vendor's numbers to an invented circuit would be the more precise-looking lie |
What is real here, and what is not
The flip-flop is a model, not a part you can buy
Tau at 200 picoseconds and T0 at 100 picoseconds are of the order published for CMOS flip-flops, and both are adjustable here. They are not a datasheet for any real component. Attaching a specific vendor's measured constants to an invented circuit would look more precise and be less true, and the shape of the answer, which is the subject, does not depend on them.
Nothing on this page shows a metastable state resolving
The usual illustration is a waveform wobbling before it settles, and it gives the wrong idea. Metastability is not a slow visible event you could catch on a scope if you looked at the right moment; it is a probability distribution over resolution times with no upper bound. There is nothing to animate, so this page does not animate it.
MTBF is a mean, and a mean is not a schedule
A mean time between failures of four years does not mean four good years and then a fault. Failures arrive at random, and the distribution is memoryless: GIVEN that it has not failed yet, the next month is exactly as likely to be the one as the first month was. That condition matters and an outside review was right to catch this page dropping it. Unconditionally the fiftieth month is far less likely than the first, because to fail in the fiftieth it has to survive the other forty-nine. The number tells you a rate, and treating it as a deadline is the most common way to misread it.
Every value here is held as a logarithm
The exponential in this equation passes what a double-precision number can hold at around e^710, which is reached by entirely ordinary parameters. Computing it directly returns Infinity, and Infinity displayed as a mean time between failures reads as a guarantee. The arithmetic is done on the exponent throughout and converted only for display.
A real synchroniser has constraints this page ignores
The chain here is n flip-flops on one clock. Real designs have to worry about the data being sampled more than once, about signals that must arrive together staying together, and about buses where a synchroniser per bit is the wrong answer entirely. The equation is right; it is not the whole of the discipline.
Which of these sources were actually read
Both citations were verified against Crossref for title, authors, volume, issue, pages and date, and neither was read here: IEEE served nothing for either DOI. The equation on this page comes from its standard published form rather than from those papers, and the parameters are a model. That is a weaker footing than this site prefers and it is better said than hidden.
Sources
- Thomas J. Chaney and Charles E. Molnar, Anomalous Behavior of Synchronizer and Arbiter Circuits, IEEE Transactions on Computers C-22(4):421-422, April 1973.
- Harry J. M. Veendrick, The behaviour of flip-flops used as synchronizers and prediction of their failure rate, IEEE Journal of Solid-State Circuits 15(2):169-176, April 1980.
- Logical Art, the studio this belongs to.