A scheme is presented that makes a remote procedure call (RPC) mechanism fault-tolerant to hardware failures. Fault tolerance is provided by replicating the procedure at a group of nodes, called a cluster. The copies in a cluster are linearly ordered. A call to a procedure is sent to the first copy in the cluster and is propagated internally to all other copies. In the event of failures, the first copy in the cluster that has not failed returns the result to the caller. The scheme is transparent to the user and supports nested procedure calls. It has been implemented on a network of Sun workstations making use of Sun's existing RPC mechanism.