System-on-a-chip designs typically employ multiple clock domains to interface several externally clocked circuits operating at different frequencies and to reduce power and area by breaking large clock trees into multiple small ones. The principal challenge of such globally asynchronous locally synchronous architectures is the need to reliably communicate between the different clock domains. To achieve high reliability margins in high-frequency designs implemented in modern process technologies, multistage synchronizers are often used. In this paper, we develop analytical formulas to calculate the probability of failure and the number of stages to use in such synchronizers. We compare our model with those reported in previous publications and show that most existing models underestimate mean time between failures (MTBF). Our model calculates an MTBF lower bound with significantly smaller margins. The concept of an effective resolution time constant for multistage synchronizers is introduced and the important effects of clock duty cycle and process variability are addressed. These process variability effects can be minimized by use of simple design rules for the synchronizer. For safety-critical applications, calculation of the probability of a failure-free lifetime for all products in a production run is developed and a simple lower bound is derived.