A timing review of an APB block is not a vibe check on slack numbers — it is a categorised walk of every path in the design, where each path is either given a real SDC constraint, bounded in combinational depth, or deliberately excluded, and the single most consequential item is the one path you must never let STA close: the metastable arc inside the CDC synchronizer. You have spent this module learning how PREADY extends a transfer, how the manager samples it on one edge per access, and why a logically-correct ready can still be electrically wrong. This chapter turns that knowledge into a sign-off instrument: an STA-time checklist a reviewer runs against an APB subordinate before it goes to place-and-route sign-off. The single idea to carry: a timing review is path enumeration — you name every APB path, attach the constraint or check it needs, and the review is done when nothing is unconstrained by accident and nothing is excluded without a written reason.

1. Problem statement

The problem is converting the AMBA APB protocol into a finite, categorised set of static-timing checks — so that a reviewer can look at an APB block's constraints and reports and say, with evidence, "every path that must close is closed, every path that must be cut is cut, and nothing was left to the tool's defaults."

Static timing analysis is exhaustive over the paths it is told about, and blind to the rest. That makes a timing review a completeness problem, not a slack-hunting problem. Three requirements define a good APB timing checklist:

• It must cover every APB path, not just the obvious ones. The read-data mux, the address decode feeding PSEL, the ready path back to the manager, the port boundaries, the reset, and the clock-domain crossings are all distinct paths with distinct checks. Miss the decode-into-ready cone and a fast clock silently fails setup on the one path that decides completion.
• Each item must be a concrete SDC action or a concrete report to read. "Check the clock" is not a review item; create_clock -period T [get_ports pclk] with the correct period and set_clock_uncertainty is. Every row must map to a constraint you can grep for or a report you can open.
• It must distinguish paths that close from paths that are excluded. A false path and a multicycle path are legitimate, but each is a claim that STA should not verify a path — and a wrong exclusion hides a real violation forever. The synchronizer arc is the canonical case: it must be excluded, and excluding it wrongly (or forgetting to) is the difference between a robust CDC and a mean-time-between-failure bomb.

So the job is not "run STA and look at the worst slack" — it is to render the APB protocol as a checklist of constraints and exclusions, category by category, so the review is auditable and complete.

2. Why previous knowledge is insufficient

This module taught the behaviour of the APB timing signals; a sign-off review needs the constraints that make a tool verify that behaviour, and those are a different artifact.

• Chapter — PREADY timing taught the combinational-versus-registered choice and the sample-window glitch in full. That is the design knowledge; here it becomes a review item — a setup path you open in a slack report and a decode cone you inspect for depth. Knowing the glitch exists does not tell you which SDC path to read or what slack margin to demand.
• Chapter — PRDATA read-data timing taught that the read-data mux must settle before the sampling edge. The review turns that into a bounded-depth check on the mux-to-flop path, and pairs it with the causality point that PREADY must not lead the settled data.
• Chapter — signal-stability requirements taught that PADDR, PWDATA, and control must hold through a transfer. Stability is a protocol property checked by assertions; the review's job is the physical neighbour — the input and output delays on those same ports (PWDATA in particular, whose write-data path is drilled in PWDATA timing) so STA models the board and neighbouring blocks correctly.
• The phase chapters — setup-phase timing and access-phase timing — established that the manager samples on the PCLK rising edge in access; the review consumes that single sample edge as the capture point every path is timed against, and the reset behaviour of a subordinate is what the recovery/removal check on PRESETn deassert protects.

The gap is this: prior chapters taught what should happen in time. A timing review is the act of proving a tool has been told to check it — with real SDC on real ports, with the right exclusions, and with the reset and CDC paths that behavioural chapters barely touch. Assembling that into a categorised checklist is this chapter; carrying the resulting sign-off into a verification plan that also proves it in simulation is the work of the APB assertions chapter.

3. Mental model

The model: an APB timing review is a walk from every launch flop to every capture flop, sorting each path into one of three buckets — constrain it, bound it, or cut it — with a clock defined first and the CDC arc as the one path that is always cut.

Think of it as the officiating of the timing sign-off. Before you judge any path you define the clock (create_clock on PCLK) — no clock, no timing. Then every path lands in exactly one bucket:

• Constrain it. Real register-to-register and port paths that must meet setup and hold: the ready path to the manager, the read-data path, the decode into PSEL. These get a clock, port delays, and you read their slack.
• Bound it. Combinational depth that must settle inside a cycle: the PRDATA mux to the sampling flop, the PADDR decode into a combinational PREADY. These are the setup-slack fights on a fast bus, and the review checks the cone is shallow enough — or registered.
• Cut it. Paths STA must not verify: the metastable arc of a two-flop synchronizer feeding PREADY/PSLVERR, and the asynchronous assert edge of PRESETn. These get set_false_path (or set_max_delay for the sampled-bus skew), and cutting the wrong one is the most dangerous mistake in the review.

Three refinements sharpen it:

• A false path is a claim, and a wrong claim is invisible forever. set_false_path tells STA "never report this path." If you cut a real functional path by mistake, no slack report will ever flag it — the violation ships silently. Exclusions are the highest-scrutiny items in the review.
• The synchronizer arc must be cut, but the design still has to be right. Excluding the metastable first-stage-to-second-stage arc from STA does not make CDC safe — it only stops STA from timing a path that cannot be timed. Safety comes from the two-flop structure and the MTBF it buys; STA's job is merely to not pretend to verify the un-verifiable, and to bound the skew on the bus the synchronizer samples with set_max_delay.
• Reset needs recovery and removal, not just a false path. The asynchronous assert of PRESETn is false-pathed, but the synchronous deassert edge is a real timing check — recovery and removal against PCLK — and forgetting it is how a design comes out of reset into a metastable state on a fast clock.

4. Real SoC implementation

The checklist is the deliverable. Below it is stated as categorised tables — Category, Check, Why / failure caught — followed by a representative SDC slice with real port names. Run the tables top to bottom against an APB block and every path is accounted for.

Clock, ports, and paths that must close:

Exclusions, CDC, reset — the paths that must be cut or specially checked (highest scrutiny):

Representative SDC for an APB subordinate on PCLK — clock, uncertainty, port I/O delays, the reset false path, and the synchronizer-arc exclusion:

# ---- Clock definition (item 1): PCLK is the only clock of the APB block ----
create_clock -name pclk -period 10.0 [get_ports pclk]      ;# 100 MHz control bus
set_clock_uncertainty 0.30 [get_clocks pclk]               ;# jitter + on-chip skew margin
 
# ---- Port I/O delays (items 8-9): model the interconnect / neighbour blocks ----
set_input_delay  -clock pclk 4.0 [get_ports {psel penable paddr pwrite pwdata}]
set_output_delay -clock pclk 4.0 [get_ports {pready prdata pslverr}]
 
# ---- Reset timing (item): async assert is false, deassert is a real recovery/removal edge ----
set_false_path -from [get_ports presetn]                   ;# async ASSERT arc: do not time it
# (the synchronous DEASSERT edge is left timed -> recovery/removal checked against pclk)
 
# ---- CDC constraint (item): 2-flop synchronizer feeding PREADY / PSLVERR ----
# Cut the metastable arc: source flop -> first synchronizer flop must NOT be timed.
set_false_path -to [get_pins u_sync_pready/sync_ff0_reg/D]
# Bound the skew on the multi-bit status bus the synchronizer samples (do NOT rely on
# the false_path alone for a bus):
set_max_delay 5.0 -to [get_pins u_sync_status/sync_ff0_reg*/D]
 
# ---- Multicycle (item): ONLY where the FSM proves data is stable for N cycles ----
# set_multicycle_path 2 -setup -to [get_pins u_slow_capture_reg*/D]  ;# with written proof

Two facts anchor these. First, the clock is item one and everything else is meaningless without it — a block with no create_clock on PCLK reports zero timing paths and looks perfect, which is the most common way a "clean" report is a lie. Per AMBA APB (IHI 0024C) §2.1, every APB signal is referenced to the rising edge of PCLK, so PCLK is the single reference the whole SDC is built on. Second, the exclusions carry the risk, not the closed paths. A path that closes with positive slack is self-evidently fine; a set_false_path is a silent promise that a path never needs checking, and the synchronizer arc plus the reset assert are the only two that legitimately earn it. Every other exclusion is guilty until a written functional reason proves it innocent.

5. Engineering tradeoffs

The checklist rows above are the deliverable; this section names the judgement calls a reviewer makes while running them — the places where "which check" is a real decision.

The throughline: the registered-vs-combinational PREADY decision is a timing tradeoff, and the CDC and multicycle exclusions are risk tradeoffs. Registering PREADY costs one cycle of latency on every transfer (the throughput accounting is in APB latency anatomy, and how a low PREADY then extends the access is the transfer-extension mechanics) and buys a closed, glitch-free path — cheap on a sparse control bus, and the safe default. The exclusions cost nothing in slack and risk everything in correctness: a wrong set_false_path or set_multicycle_path is not a style choice but a hole, because STA will never report the path again. Spend the review's scrutiny where the risk is — on the exclusions — not on re-reading the paths that already close.

6. Common RTL mistakes

7. Debugging scenario

Pick the false-path-through-the-synchronizer mistake, because it is the most dangerous item on the checklist: it makes a report cleaner, so it is never questioned, and it hides a metastability crossing that surfaces only in the lab.

• Observed symptom: an APB status peripheral whose PSLVERR/status bits come from a slower always-on domain passes STA sign-off cleanly and passes RTL regression, then in the lab intermittently reports a spurious error or a corrupted status word — roughly once every few million reads, never reproducible on demand, worse when the two clocks are near a specific ratio.
• Timing-report clue: the SDC contains a blanket set_false_path on the entire synchronizer instance (set_false_path -through [get_cells u_sync_status/*]). That cut removed not only the un-timeable async-to-first-flop arc but also the multi-bit bus skew the synchronizer samples — and, worse, a stray functional path where a raw (un-synchronized) status bit reaches the PSLVERR cone was swept under the same blanket exclusion, so STA never timed it and never flagged that a real crossing was un-synchronized.
• Root cause: two errors under one over-broad exclusion. The metastable arc should be cut — that part is correct — but the blanket -through also (a) left the multi-bit status bus with unbounded skew, so on some edges the manager captured bits from two different source values, and (b) masked a genuinely un-synchronized functional path into PSLVERR, an actual metastability crossing that a targeted false-path would have left timed and screaming.
• Correct SDC: cut only the metastable arc, bound the bus, and let every real path stay timed:

  Azvya Education Pvt. Ltd.VLSI Mentor

  Snippet Copy

  # cut ONLY the async source -> first synchronizer flop arc
  set_false_path -to [get_pins u_sync_status/sync_ff0_reg*/D]
  # bound skew on the sampled multi-bit bus so bits are captured coherently
  set_max_delay 4.0 -to [get_pins u_sync_status/sync_ff0_reg*/D]
  # the raw functional path into PSLVERR is NOT excluded -> STA now flags it,
  # forcing it through a proper synchronizer before it gates the error bit

• Verification check (STA can't see it, simulation must): STA, even corrected, cannot model metastability resolution — it only stops timing the arc. A gate-level or CDC simulation with metastability injection on the crossing must prove the status word is coherent and PSLVERR never asserts spuriously. A structural CDC lint (Spyglass-CDC style) must independently prove no un-synchronized path reaches the PREADY/PSLVERR cone — the check the blanket false-path had blinded STA to:

  Azvya Education Pvt. Ltd.VLSI Mentor

  Snippet Copy

  // ready-implies-synchronized: PSLVERR/PREADY must never depend on a raw crossing.
  // (simulation + CDC-lint check; STA cannot express this)
  assert property (@(posedge pclk) disable iff (!presetn)
    (psel && penable && pready) |-> !$isunknown(pslverr) && status_bus_coherent);

• Debug habit: when a CDC-adjacent block is cleaner in STA than you expected, treat the cleanliness as a suspect, not a comfort. Grep the SDC for every set_false_path/set_multicycle_path, and for each ask "what real path did this also cut?" A blanket -through on a synchronizer is the classic over-cut — replace it with a targeted arc exclusion plus a bus-skew bound, and re-run CDC lint to expose any crossing the blanket had hidden.

8. Verification perspective

A timing review proves paths are constrained; it cannot prove they are functionally correct — so every STA item has a simulation or lint counterpart that catches what static timing structurally cannot see.

• STA cannot see a glitch or a metastable resolution — simulation must. The combinational-PREADY glitch off a rippling decode (Figure 2) is invisible in zero-delay RTL and only appears in gate-level or delay-annotated simulation; STA reports the path is long but cannot show the transient landing in the sample window. Add a gate-level glitch guard-band check that PREADY does not transition within a window before the PCLK edge, and a metastability-injection CDC sim on the synchronizer arc — because set_false_path stops STA timing the arc but says nothing about whether the resolved value is right.
• STA cannot see readiness causality — an assertion must. The checklist's "PRDATA settled before PREADY asserts" row is a causal property, not a slack fact: STA can close both the mux path and the ready path and still let readiness lead the settled data by a cycle. Bind (psel && penable && pready && !pwrite) |-> data_valid_q to catch the asserted-too-early bug that no slack report will ever show.
• STA cannot prove an exclusion was legitimate — CDC lint and a traceability audit must. A set_false_path is a claim STA takes on faith; only a structural CDC linter proves no un-synchronized crossing reaches the PREADY/PSLVERR cone, and only a review audit proves every exclusion has a written functional reason. The sign-off rule: every set_false_path/set_multicycle_path names the arc it cuts and why, and CDC lint independently confirms no real crossing was swept under it.

The point: a timing review and a verification plan are complementary halves — STA proves the paths close or are cut, simulation and CDC lint prove the behaviour on those paths is correct, and the glitch, the metastable resolution, the readiness lead, and the legitimacy of every exclusion are exactly the four things STA cannot express and must hand to simulation.

9. Interview discussion

"How would you run a timing review on an APB block?" is a staff-level screening question, because a weak answer opens the slack report and reads the worst number, while a strong answer names the categories and, critically, the paths that must be cut rather than closed — which is where the real risk lives.

Lead with the structure: a timing review is path enumeration, not slack hunting — define the clock (create_clock on PCLK, correct period, set_clock_uncertainty) first, then walk every path into one of three buckets: constrain it (the ready path, the read-data path, the decode into PSEL, with real set_input_delay/set_output_delay on the ports), bound its combinational depth (the PRDATA mux, the PADDR decode into a combinational PREADY), or deliberately cut it (the synchronizer's metastable arc, the async reset assert). Then land the depth points: the exclusions carry all the risk — a set_false_path is a promise STA will never check a path again, so a wrong cut ships a violation silently; the synchronizer arc must be cut but that does not make the CDC safe — you still need the two-flop structure, a set_max_delay/skew bound on the sampled bus, and CDC lint proving no raw crossing reaches PREADY/PSLVERR; and reset is async-assert-false-pathed but sync-deassert is a real recovery/removal check. Close with "and the mistake I look for first is a CDC block that's too clean in STA — a blanket false-path through the synchronizer that also cut the bus skew and masked a real crossing," which signals you have debugged a lab-only metastability escape, not just read an SDC.

10. Practice

1. Define the clock, then audit. Given an APB block whose STA report shows "0 paths," state the single most likely SDC omission and the create_clock line that fixes it, and why a zero-path report is more dangerous than a failing one.
2. Bucket the paths. For the ready path to the manager, the PRDATA mux, the PADDR decode into PSEL, the synchronizer arc, and the async reset assert, assign each to constrain / bound / cut and name the SDC command.
3. Cut the arc, not the block. Given set_false_path -through [get_cells u_sync/*], explain what real path that blanket cut also removes and rewrite it as a targeted arc exclusion plus a bus-skew bound.
4. Justify a multicycle. State the FSM condition that must be proven before set_multicycle_path 2 -setup is legitimate, and the failure mode if you apply it without that proof.
5. Split the reset. Explain why the PRESETn assert edge is false-pathed while the deassert edge is a real recovery/removal check, and the silicon symptom of skipping the deassert check on a fast clock.

11. Q&A

12. Key takeaways

• A timing review is path enumeration, not slack hunting. Define create_clock on PCLK with the right period and set_clock_uncertainty first, then walk every path into constrain / bound / cut — the review is done when nothing is unconstrained by accident and nothing is excluded without a written reason.
• The completion-critical paths are the ready path, the PRDATA mux, and the decode into PSEL. Register PREADY or keep its cone shallow; bound the read-data mux and PADDR decode depth; and put real set_input_delay/set_output_delay on every APB port so the boundary requirement is modelled.
• The exclusions carry all the risk. A set_false_path is a promise STA will never check a path again — cut a real functional arc and the violation ships silently. The synchronizer metastable arc and the async reset assert are the only two exclusions that legitimately earn a false-path; every other one needs a written functional reason.
• Cutting the synchronizer arc does not make the CDC safe. It only stops STA timing an un-timeable path; safety is the two-flop structure and its MTBF, plus a set_max_delay/skew bound on any multi-bit bus the synchronizer samples, plus CDC lint proving no raw crossing reaches the PREADY/PSLVERR cone.
• Reset is two edges: the async assert is false-pathed, the sync deassert is a real recovery/removal check against PCLK — skip it and the block can leave reset metastable on a fast clock.
• STA and verification are complementary halves. STA proves paths close or are cut; simulation and CDC lint prove the behaviour is correct — the glitch, the metastable resolution, the readiness lead, and the legitimacy of every exclusion are the four things STA structurally cannot express and must hand to the assertion and simulation plan.