For solving metastability caused by different clock domains in Verilog, double-register method is used.
But as far as I know, the final output of metastability is undetermined. Output is independent of input.
So, my question is how to guarantee the correctness of output using double-register method?
Thanks.
You cannot be completely sure that you avoided metastability. As you mentioned, the output of a metastable flip-flop is unpredictable so you can potentially propagate a wrong value when you have metastability even with the 'two-register' approach.
This method however never intended to solve metastability but tries to reduce the probability that a metastable value enters your circuit. What is called here MTBF (Mean Time Between Failure). To reduce the MTBF you can even chain more that 2 registers.
Even if this does not solve the unpredictive-ness of a value, it is interesting to use these double registers because when a value is metastable, it will oscillate until it stabilize to 0 or 1.
This oscillation will make your circuit toggle and then use a lot of energy for nothing as each transition consumes energy. That for this reason that it is important to use double registers for clock-domain crossing.
To ensure that you data is valid though, you can use a request-acknowledge mechanism between the two clock-domains.
Quick example:
This protocol is called a 4-phase protocol. You can find a lot of documentation about it on the web as it is a classic protocol for asynchronous designs.
It is quite simple to understand and to implement. Keep in mind though that it will generate an overhead in area that can be quite important.
Hope it helps.