A fault-tolerant clock system for providng digital timing signals (system clock signals) is provided by a plurality of clock sources. Each clock source receives as inputs the generated clock signals from all the other clock sources and contains receiver circuitry to derive a system clock signal from said clock sources which is the consensus clock signals of the other sources. Each clock source generates and distributes to the other clock sources a clock signal which is phase locked to the derived system clock from its clock receiver. In a system of (2r+2) clock sources (r+2) of them will remain phase locked to each other despite up to r clock source failures. Any clock receiver responsive to any (2r+1) of the clock sources can therefore derive a correct system clock despite up to r clock source failures.
A synchronous clock circuit is provided on each module of an electronic digital system formed of a plurality of modules. Each clock circuit has two control pins which are used by control logic to determine whether or not the clock on a particular module is disabled, is operating as the master clock for the system, or is providing a backup function for the master clock. The common clock line is supplied through a buffer to the components on the module which require clocking. Logic circuitry on the backup clock mode insures the backup clock is in a ready condition in case there should be either failure of the master clock oscillator or if the master clock module is removed from the unit. All of the clock circuits of the different modules may be constructed in an identical manner, with the control of the function of the circuitry being provided simply by control of the logic level on the two terminals. A clock detecting time-out circuit is provided on each of the modules, which has a timing period which is slightly longer than the clock period. If the master clock fails to produce a clock pulse at the time that it should, the clock detect timing circuit, which is coupled to the buffer of the backup module, will sense that a failure has occurred and will control the turn-on of the clock circuit for the backup module.
A multiple redundant clock system comprises at least n=4 clocks and is self-synchronizing and fault tolerant against the failure of at the most 1/2(n-1) clocks. Each clock comprises an oscillator circuit which activates a dividing circuit at the end of each period in order to form its own clock signal on the output of the dividing circuit. Each clock furthermore comprises a deviation-determining device which compares the own clock signal with the clock signals originating from the other clocks in the system. When an excessively large number of the other clock signals deviate during the first half of the (own) period, the own oscillator circuit is decelerated. When an excessively large number of the other clock signals deviate during the second half of the own period, the own oscillator circuit is accelerated.
A switching device for transmitting one only of two incoming digital trains in response to a switching demand signal, the digital trains containing identical data signals and clock signals at the same frequency, comprising a switching circuit for the data signals and a switching circuit for the clock signals, and a circuit for controlling the switching circuits which delivers a signal whose changes of state occur, after a change of state of the switching demand signal, only from the moment when the two clock signals are in the same logic state.
A storage cell of an integrated circuit is operable in a radiation environment to capture and store at predetermined time intervals a time sample of a data input signal. A signal representative of the stored data sample for each time interval is generated at an output of the storage cell. At least three data capturing circuits operate to capture and store a time sample of the data input signal at each predetermined time interval, the stored data sample of each circuit being generated correspondingly at an output thereof. Coupled to the outputs of the data capturing circuits is a circuit for generating a signal representative of a stored data sample selected from at least two of the circuit outputs. Also coupled to the data capturing circuits is a circuit for causing each data capturing circuit to capture a different time sample of the input data signal from the other data capturing circuits over each predetermined time interval.
A system for steering mutually phase-locked time-of-day (TOD) clocks in unison to a higher-precision reference clock. Periodically the count stored by a TOD counter responsive to one of the TOD clocks is compared with a reference count to provide an error signal. A proportional correction signal derived from the error signal is applied together with an offset to each of the TOD clocks to adjust the clock frequencies and thereby steer the TOD count toward the reference count. The steering offset is dynamically adjusted in such a manner that, when the offset signal is applied alone as a correction signal, the frequencies of the TOD clocks track that of the reference clock.
