Autonomous N-modular redundant fault tolerant clock system

摘要

A fault tolerant clock system in which synchronization of the clocks continuing to operate after a fault occurs is maintained within a skew limit. The clock system includes a plurality of clock channels (10), each including a clock unit (12) and an isolation port (14). A local clock signal produced by a crystal oscillator (16) is enabled to provide a clock channel output signal while a counter (24) in the clock unit accumulates a predetermined number of local clock pulses. After the predetermined number is reached, the counter disables the clock channel output signal and produces a sync pulse, which is input to a voter block (48). In response to the second sync pulse to be received from each of the clock channels, each voter block produces a load pulse signal that is input to the isolation port of that clock channel. Corresponding isolated load signals are produced by the isolation port and provided to voter blocks (72) in each of the clock units. The voter blocks respond to the second isolated load signal to be received, producing a load enable signal that is input to the counter. Upon receipt of the load enable signal, the counter resumes counting and again enables the clock channel output signal, in synchronization with the other clock channel output signals. Up to N simultaneous faults may be sustained in the clock system, without loss of synchronization in the clock channels that continue to operate properly, so long as 2N+1 clock channels are provided.