Modular Redundancy in a GALS System Using Asynchronous Recovery Links

In this paper we describe a new design approach for fault-tolerant globally asynchronous locally synchronous (GALS) systems using triple modular redundancy. The paper proposes a recovery and voting mechanism that relies on asynchronous, delay-insensitive links for state exchange. Thereby the replicated module copies remain fully timing-independent and only need to be locally synchronized. This allows for extremely flexible module partitioning and placement: Triplicated modules could be arranged on a single die, or be mapped to three separate chips to minimize the risk of two copies failing at the same time. In the first part of the paper we discuss the general concept of the recovery mechanism and the requirements for the design of the GALS modules to ensure replica determinism. The second part of the paper then presents the implementation of a lightweight recovery controller, which consists of both synchronous and asynchronous components. To access the internal state of a module we re-use the scan chains, which are typically included in every synchronous circuit for testing purposes. The robustness of our solution is verified by exhaustive fault-injection experiments.