This paper provides description and analysis of a new clock
synchronization algorithm for partially synchronous systems with
unknown upper and lower bounds on delays.  Unlike existing solutions,
it relies upon a hybrid failure model incorporating both process and
link failures, in both time and value domain, and works during both
system startup and normal operation: Whereas bounded precision (=
mutual deviation of any two clocks) can always be guaranteed,
accuracy (= clocks being within a linear envelope of real-time) and
hence progress is only guaranteed when sufficiently many correct
processes are eventually up and running. Detailed formulas for
resilience, precision and envelope bounds of our algorithm are
also determined.