reset in fpga
A reset must always be asynchronous, you just can't wait for a stable clock for deassertion even if you assert it asynchronously. If you do, you need to make sure that oscillator is stable. Although if the clock never becomes stable, holding system in set or reset mode wouldn't matter much.
See below excerpt from NASA's WIRE failure:
This section is a shortened transcription of the failure investigation report, RD5, for the Wide- Field Infrared Explorer (WIRE) spacecraft. There are several other findings in the aforementioned report that are not covered in this document since being outside its scope.
The NASA WIRE spacecraft was launched in 1999 and a problem was detected during its second pass over the ground station, when the spacecraft was observed to be spinning. It was determined by the failure review board that the cover was ejected at approximately the time that
the WIRE pyro box was first powered on. The instrument's solid hydrogen cryogen supply started to sublimate faster than planned, causing the spacecraft to spin up to a rate of sixty revolutions per minute once the secondary cryogen vent was open. Without any solid hydrogen
remaining, the instrument could not perform its observations.
The probable cause of the WIRE mishap is logic design error. The transient performance of components was not adequately accounted for in the design. The failure was caused by two distinct mechanisms that, either singly or in concert, resulted in inadvertent pyrotechnic device
firing during the initial pyro box power-up. The control logic design utilized a synchronous reset to force the logic into a safe state. However, the start-up time of the crystal clock oscillator was not taken into consideration, leaving the circuit in a non-deterministic state for a significant period of time. Likewise, the start-up characteristics of the FPGA were not considered. These devices are not guaranteed to follow their truth table until an internal charge pump starts the part and the uncontrolled outputs were not blocked from the pyrotechnic devices' driver circuitry. A contributing factor to the mishap was the lack of documentation for the FPGA's power-up transient characteristics in the device data sheet. This information is however available in the FPGA data book and design guide in two application notes.
At least three conclusions can be drawn from the WIRE mishap:
• the design should never rely on the default value of the device output during power-up
• the designers should continuously collect and read all available device documentation
• there should be a direct asynchronous path from the reset input for initialising the device state, being independent of any clock activity