We propose an optimal convergence function for achieving fault-tolerant, internal clock synchronization in the presence of arbitrary process and clock failures. The differential fault-tolerant midpoint convergence function guarantees an optimal maximum correction, an optimal maximum drift rate, and an optimal maximum deviation. The proposed convergence function is simple and easy to compute. It bounds the maximum drift rate of correct clocks by the maximum drift rate of a correct hardware clock. The maximum correction is limited by the maximum drift between two correct hardware clocks during one round. The maximum deviation is approximately 4/spl Lambda/+4/spl rho/r/sub max/, where /spl Lambda/ is the maximum remote clock reading error, /spl rho/ is the maximum drift rate of a correct hardware clock and r/sub max/ is the maximum duration of a synchronization round.