A fail-operational/fail-operational fault tolerant clock includes a voting core comprised of triple redundant clock modules (30, 40, 50) and a floating hot spare module (60). Each module includes a voter (84) and fault detection, identification and reconfiguration circuitry (82) which operates to substitute the floating hot spare module produced clock signal for a failed voting core module signal without the introduction of transients or an asynchronous voted output. The modules (30, 40, 50, 60) are all preferably formed on a single semiconductor chip which includes isolation guard rings (32, 42, 52, 62) and independent power leads (34, 44, 54, 64) in addition to isolation buffering and point-to-point wiring to enhance fault tolerance.