  We present concept and implementation of a self-stabilizing Byzantine
fault-tolerant distributed clock generation scheme for multi-synchronous GALS
architectures in critical applications. It combines a variant of a recently
introduced self-stabilizing algorithm for generating low-frequency,
low-accuracy synchronized pulses with a simple non-stabilizing high-frequency,
high-accuracy clock synchronization algorithm. We provide thorough correctness
proofs and a performance analysis, which use methods from fault-tolerant
distributed computing research but also addresses hardware-related issues like
metastability. The algorithm, which consists of several concurrent
communicating asynchronous state machines, has been implemented in VHDL using
Petrify in conjunction with some extensions, and synthetisized for an Altera
Cyclone FPGA. An experimental validation of this prototype has been carried out
to confirm the skew and clock frequency bounds predicted by the theoretical
analysis, as well as the very short stabilization times (required for
recovering after excessively many transient failures) achievable in practice.
