SAP-LCLS: Converting Structural Slack Into Commit-Time Recovery Budget for Heterogeneous Loosely-Coupled Lockstep

Abstract

Automotive functional-safety systems require high fault-detection and recovery capability under constrained core cost, but DCLS remains fail-silent on faults and TCLS requires the cost of a third physical core. This paper reuses the Hardware Security Module (HSM)-side auxiliary core available in modern automotive MCUs as a safety-execution resource and constructs heterogeneous LCLS; in our RTL platform, this role is implemented with SCR1. In such core pairs with different ISAs, microarchitectures, and performance characteristics, completion-time skew arises structurally. This paper proposes SAP-LCLS, which converts the Structural Slack induced by this performance asymmetry into a Preemptive Recovery Budget. The proposed Lockstep Management Unit (LMU) bounds commit-time decision latency to payload-length-independent $O(1)$ through streaming CRC signatures and accepts re-execution results without additional payload SRAM beyond the baseline DMR result window through a Signature-Preserving and Payload-Overwriting Policy. It also aborts unnecessary re-execution early on the normal path. If HSM/SCR1-side delay prevents primary 3-way evidence from being available by the latest safe decision point, the LMU permits a limited Temporal Dual Modular Redundancy (T-DMR) degraded commit only when the Leader first-run and re-execution signatures match. RTL evaluation under the stated single-task commit model and a single effective transient fault that propagates to a commit-target payload mismatch shows that SAP-LCLS on an Arm Cortex-M3/RISC-V SCR1 platform reduces normal-path decision latency by 13.1% on average and fault-recovery latency by 27.2% on average, with a maximum reduction of 43.4%, compared with the SW full-compare baseline. The core LMU control logic synthesizes to 23.1% of the area of a Cortex-M3-class core. These results show that SAP-LCLS can jointly provide commit-path scalability, reduced recovery latency, and limited hardware overhead in cost-constrained automotive MCUs.