Abstract: A clock signal generator for providing redundant clock signals includes two clock modules that utilize phase-locked loop oscillators for generating clock and reference signals and for diagnosing malfunctions of the generated clock and reference signals. One clock module is selected as the master, and the other clock module is the slave, being phase and frequency locked to the master. Switching the master between the clock modules may be externally initiated by select signals and also is automatically initiated when malfunctions are detected. The master and slave clock modules are always phase and frequency locked to one another, even if both clock modules are malfunctioning. When both clock modules experience simultaneous malfunctions, the master is selected in accordance with the externally generated select signals. Since the master and slave clock modules are always phase and frequency locked, switching the master is transparent to clock signal utilization circuitry.