L1/10 — The clock: generation and distribution

Background

Everything in this layer is measured against clock edges, so something must make them. On many chips the making is on-die and analog — a ring oscillator disciplined by a PLL — which drags a deliberately non-synchronous circuit into the netlist and forces an excision-and-contract treatment. This design keeps the analog problem off the die: the core clock arrives at a pad, generated by the board (a crystal oscillator module or an FPGA host), and the chip only distributes it. The generation contract still exists — edges must keep coming, within a stated period interval, with bounded jitter — but it moves wholesale into the environment's promises (P6's family, a board-level X4-class datasheet claim), where a purchased oscillator module's numbers are exactly the evidence the contract wants. What remains on-die is the distribution problem, plus one new participant most flat designs lack: clock gates.

The jitter physics is worth keeping in view even with generation off-die: an oscillator has no sense of absolute time. Amplitude disturbances die out, but a disturbance along the cycle — arriving a femtosecond early stays a femtosecond early forever — is never corrected, so thermal noise accumulates in the phase as a random walk. The model downstream is built to be immune to this (it indexes by edge number and constrains only edge-to-edge intervals, so the divergent absolute phase never appears in any hypothesis), and the residue appears wherever the chip must agree about time with the outside world — the UART's baud budget, chiefly.

The distribution side has its own vocabulary. The clock reaches thousands of flops through a clock tree of buffers, built by a synthesis step called CTS (clock tree synthesis); insertion delay is the source-to-flop travel time through the tree, and skew is the difference in insertion delay between two flops — the quantity the hold check consumes, since a race between two flops is run against their relative edge timing. The trap this chapter defuses: it is tempting to file the clock tree under "plumbing that preserves function," and it is not — modern flows deliberately unbalance the tree ("useful skew") and insert thousands of pure delay buffers to fix hold; the tree is a load-bearing participant in correctness, and the arrival function it realises is a first-class object of the proof.

Statement

Produce the clock arrival function arr : Flop → interval that 03 presupposes, with the generation contract imported from the environment and the gating conditions made explicit.

Generation — imported, not excised

The clock source contract, stated at the pad:

  1. Frequency: consecutive rising edges are separated by a period in a stated interval — the board oscillator's datasheet promise (X4-class), plus the pad and receiver path's contribution.
  2. Jitter: cycle-to-cycle deviation bounded, accumulated phase unconstrained — consumed only by L5's absolute-time interfaces (the UART budget; the start-bit resync re-anchors each frame).

No on-die oscillator means no excision, no limit-cycle proof on the critical path, and no software-reachable frequency knob — the sharpest configuration threat most chips carry is absent by construction (L5/05). The clock_tap output pad closes a loop most chips leave open: the internal clock is observable, so the generation contract is bench-checkable against the die itself.

Distribution

The clock network is CTS output: buffers, inverters, delay buffers for hold repair (the flow inserts thousands — the measured census lands in findings when the flow's layout is final), and — new relative to a flat design — integrated clock-gate cells, one per generated gating domain, driven by the RTL's gating wrappers (L3/02's primitive).

Cleanliness. Every flop's clock pin is reachable from a clock source through clock-cell types only, with no data-dependent logic except declared gating. A mechanical reachability check on the netlist, and the licence for L2's deletion of the entire network into the sentence "all flops whose gate is enabled update together." The check enumerates the gating cells rather than assuming them absent, because they are present by design here: each adds a conditional-arrival term and an enable-stability check — the gate's enable must be stable across the clock's high phase, which is precisely what the ICG's internal latch guarantees if the latch's own timing is met; the obligation composes the cell-level contract with tree-level arrival.

Arrival enclosure. STA over the clock network's own arcs yields per-flop insertion delay intervals; arr(f) is that interval widened by the imported jitter bound. Skew — the difference between two flops' arrivals — is what the hold inequality consumes, and CPPR (09) exists precisely because launch and capture share a tree prefix whose variation cancels.

CTS is not logically neutral. This deserves its own emphasis because the L1-era intuition "place-and-route preserves function" fails here: hold correctness depends on skew, useful-skew methodology deliberately unbalances the tree, and this flow's hold repair inserts delay buffers by the thousand — cells that exist purely to shape arr.

What arr's width is made of

arr(f) = nominal insertion delay
         ± tree variation (corner + OCV tiers, 03)
         ± imported source jitter (the pad contract, above)
         ± duty/pulse-width effects for the flop's min-pulse checks
         (+ the gating condition, for flops behind a clock gate)

Recovery/removal checks on asynchronous set/reset pins, and minimum-pulse-width checks, are the same window rule as setup/hold with different table entries — they ride along in 08 once arr is available; no new theory.

Ordinal time, and where the period claim actually lands

03 indexes the semantics by the realised edge sequence, so phase diffusion is quotiented out and the per-interval deviation T_n − T_nom splits three ways with three fates:

  1. Stochastic period jitter: picoseconds against a 50 ns period — a Gaussian-tail term, discharged P3-style, not carried.
  2. Accumulated jitter over bounded horizons: enters only L5's absolute-time interface claims (the UART frame budget — negligible; the start-bit resync re-anchors each frame).
  3. Deterministic period offset: the SDC's create_clock -period is a claim about the board's oscillator that nothing on the die enforces. Closure is valid only if the delivered period ≥ the signoff period — an environment condition (P6/V-family), stated in L5's operating conditions as the board's obligation, not a software-reachability question, because no on-die register can change the frequency.

Obligations

  1. The cleanliness check as a tool run against the hardened netlist, including the gating-cell census and per-gate enable-stability obligations.
  2. arr as a derived object: clock-network STA + imported jitter, with the CPPR-relevant tree structure preserved rather than flattened.
  3. The pad-clock contract statement — period interval + jitter bound — as the formal import boundary, with the board oscillator's datasheet as its X4 evidence.
  4. The secondary clock pins (jtag_TCK, the serial link clock) each get the same treatment at lower stakes — their domains' trees, gates, and contracts (04's completeness table).

First experiments

  • Run the cleanliness reachability check; count and locate the gating cells. Cheap, and it converts "clock network clean" from assumption to measurement — the same upgrade W1–W4 made for well-formedness.
  • Extract per-flop insertion delays from the flow's timing reports and plot the skew distribution — the shape of the hold-repair problem made visible.

Effort

The checks: weeks. The gating obligations are the one genuinely new piece relative to a flat ungated design, and they are cell-contract compositions, not new theory.