Fault-tolerant real time clock

Claim 1

A fault-tolerant real time clock for triple modular redundant computer systems comprising: three substantially identical subcircuits that have separate power supplies and are interconnected to assure outputting of voted real time clock pulses from all three and continued operation with failure of one subcircuit, each subcircuit including a majority voted master clock which generates voted high frequency master clock pulses and has, as inputs, its own output signal and the output signals from the other two subcircuit master clocks; counter means to which said voted master clock pulses are gated for producing sets of real time clock pulses that have different time periods; power up timeout means having inputs from all of said subcircuits and that temporarily inhibits gating of said voted master clock pulses to said counter means until each subcircuit produces a power up timeout signal and an output signal is generated indicating that all of said power supplies are turned on and stabilized, and means for latching said last-mentioned output signal so that loss of a subcircuit power supply other than its own will not disable said counter means; means for outputting said voted master clock pulses to a processor to use said master clock as a processor clock; means for selecting one of said sets of real time clock pulses; and a real time clock majority voter to generate said voted real time clock pulses that are outputted to said processor and which has as inputs its own selected real time clock pulses and those outputted by the other subcircuits.