Most of the published work on massive redundancy makes one crucial assumption: the redundant modules are synchronized. There are three ways of achieving synchronization in redundant systems-independent accurate clocks, a common external reference, and mutual feedback. The use of a common external reference is currently the most widely used technique, but suffers from vulnerability to common-point failures. We introduce a novel mutual feedback technique, called "synchronization voting," that does not have this drawback. A practical application of synchronization voting is described in the appendix—a fault-tolerant crystal-controlled clock.

A recent paper1has proposed the design of asynchronous sequential machines with an internal fault detection mechanism. The "hard core" circuitry in these machines can be eliminated by the use of self-checking checkers.

The effects of transient failures in sequential modules in systems using triple modular redundancy (TMR) cannot be neglected. A transient may place a sequential machine in an erroneous state, and the state may remain erroneous long after the transient has disappeared. We show that the state of a sequential machine can be restored after a transient if and only if the machine has a synchronizing sequence. If synchronizing sequences occur periodically during normal operation of the system, then multiple transients spaced out in time can be tolerated. System structures that have synchronizing sequences are discussed.

We show that a low-cost arithmtetic code with group length n detects all unidirectional multiple errors that affect fewer than n bits, as well as a larger class of such errors confined to a restricted set of bit positions.

A new class of circuits called "partially self-checking circuits" is described. These circuits have one mode of operation called secure mode in which every fault is tested in normal operation and no fault can cause an undetected error. They also have an insecure mode of operation in which undetected errors can occur; however, every fault that can cause an error in insecure mode is tested by some input in secure mode. One application of these circuits is in the arithmetic and logic unit (ALU) of a computer with data encoded in an error-detecting code. While there is no code simpler than duplication which detects single errors in logical operations such as AND and OR, it is shown that there exist partially self-checking networks to perform these operations. A commercially available medium-scale integration (MSI) chip, the 74181 4-bit ALU, can be used in a partially self-checking network to perform arithmetic and logical operations.