Merging Redundant Crystal Oscillators into a Fault-Tolerant Clock

Having a precise and stable clock that is still fault tolerant is a fundamental prerequisite in safety critical real-time systems. However, combining redundant independent clock sources to form a single clock supply is non-trivial, even if only a single clock output is desired. Often there is a need for having redundant clock outputs like for the replicated nodes within a TMR architecture that fail independently but still stay tightly synchronized. This problem is even harder to solve. In this paper we present solutions for the latter. We elaborate a solution for producing tightly synchronized clock outputs in a fault-tolerant fashion. This approach extends an existing, ring-oscillator like distributed clock generation scheme by augmenting each of its constituent nodes with a stable clock reference. We illustrate in theory and by simulation experiments that the four clock outputs of our circuit do not share a single point of failure, have small and bounded skew, remain stabilized to one crystal source during normal operation, do not propagate glitches from one failed clock to a correct one, and only exhibit slightly extended clock cycles during a short stabilization period after a component failure.