How should clock modeling rigor differ for a safety-critical versus a consumer design?
From PDVerse PrimeTime STA Interview Guide · pdVerse Mentor Guide
Ten-second Interview Answer
The clock mechanics are identical; what differs is exhaustiveness, margin justification and traceability. Safety-critical adds evidenced completeness verification, conservative documented margins, individually justified reviewed clock groups, an auditable clock spec and independent review.
Complete Technical Explanation
Both designs use the same commands and the same modelling; the difference is how much you must prove. For safety-critical work, drive clock rigor to the maximum. Completeness is exhaustively verified as a mandatory, evidenced gate - zero unclocked registers, every generated clock defined and confirmed, every clock-group relationship justified and reviewed. Margins are conservative and justified: uncertainty, OCV and jitter margins chosen deliberately and documented, dynamic jitter modelled, worst-case early and late latency applied. Relationship discipline is rigorous, because clock groups are where silent gaps live: every asynchronous or exclusive group is individually justified, since an over-broad group hides real crossings and that is unacceptable here, and every synchronizer at an asynchronous crossing is verified to exist. The clock spec is traceable - which definitions and relationships were used for each qualified signoff, provably consistent with the fabricated clock tree, retained as certification evidence. The clocking gets independent review, and signoff is propagated against the real tree with no ideal shortcuts. The framing is that the clocks are part of the safety case: a clock error is a potential undetected hazard, and skew-driven hold errors especially so. A consumer design uses the same methodology with proportionate rigor - complete, propagated, correctly related clocks with verification - but lighter formal justification, traceability and independent review, optimizing cost and schedule, because there a clock error is a quality and rework risk rather than a hazard.
In Pd / Signoff
This decides what your signoff package contains, not how you run PrimeTime. On a safety-critical block you archive the exact clock constraints per qualified run, a written justification for every set_clock_groups declaration, check_timing evidence of zero unclocked registers, and proof the propagated latency came from the fabricated tree. On a consumer block you run the same checks but do not build the evidence trail.
Common Trap
Assuming safety-critical rigor means bigger margins. The distinctive requirement is provable completeness and justified relationships - and the specific hole is an unjustified or over-broad asynchronous or exclusive clock group, which check_timing will never flag because the exclusion looks deliberate.
Expect Next
Why is clock-group discipline especially critical in a safety-critical design?
Topic And Primetime Commands
Clocks / Generated Clocks. set_clock_groups, check_timingKeep building interview depth
Continue practising STA
Continue learning free
Get a practical low-power chapter
Receive the existing “Low Power and Multivoltage Fundamentals” PDF chapter and its download link by email.
Continue practising