reset sync design logic

synchronising an async signal requires at least two stages of sampling. When you say it should be one register then you are not looking at the issue of edge violation but you are only thinking of sampling.

The first register will be violated from time to time but it is hoped that its Q output will settle before next register samples. However the second register may be violated (this is very low probabilty given by MTBF). Three stages will improve MTBF dramatically such that a failure may occur once every million years? just guessing but it should be that far.

To synchronise an async signal there are two designs, type1 passes signal directly through D register of first stage (such as dc fifo pointers being passed from one clock domain to another while data itself is left in memory cell or register till pointer arrives then sampled).

Type2 is the one you posted. It is used for reset (and is called reset synchroniser). The difference is that the async signal is not passed through D input of first stage but rather it is used as async reset for both stages and the first stage samples from constant logic '1'. This is believed to be more safe and the explanation given by various sources is vague but my thoughts are as follows:

In type1 the second register may be unlucky and get violation if its first register did not settle within one clock period.

In type2 imagine reset violated register1, its input is not changing (constant '1') but its output needs to change state and so will get violated.

reset and clock then travel together to second register (before data arrives) and it does not change state as input is '0' and output is '0' and so will not be violated (but will be violated if data is too early-unlikely). on the next clock edge the first register will sample safely its constant input and so will the second register