Single chip fault tolerant clock for integrated modular avionics

This paper presents the design and validation testing of a Fault Tolerant Clock ASIC (FTCA) that achieves exact synchronization and features automatic fault detection and reconfiguration capability. The FTCA employs a floating hot spare in addition to the triply redundant core modules to tolerate two sequential faults. We will point out the problem of loose synchronization that requires 3m+1 modules for m faults and illustrate that a 2m+1 system with tightly synchronous inputs can tolerate any malicious fault. The FTCA has on-chip oscillators and features independent channel power supplies, separated I/O pad rings, and isolated core modules with guard rings for latchup protection. Applications for the FTCA include commercial integrated avionics systems, spacecrafts, nuclear power plants and other critical applications requiring high reliability and availability