faults being introduced by the passage of a single charged particle through sensitive device structures. As with all system engineering and design processes, there exist images of both bottom- up and top-down approaches to the practice of fault tolerance. The bottom-up approach entails designing an infrastructure of autonomously operating fault tolerance provisions within individual components and subsystems and integrating this infrastructure with limited global fault tolerance provisions. The top-down approach allows a system to be built using off-the- shelf components that have little or no fault tolerance provisions, and integrating the system with a robust global monitoring provision to implement fault tolerance. Examination of both approaches makes a case for the long-range merits of the bottom-up approach, providing detection and recovery at the lowest level possible. The ability to detect at the lowest level possible, with error containment to the minimal number of components and subsystems, enables simpler and more effective recovery provisions. The prevailing practice is best described as middle-out in which fault tolerance provisions are included in components where possible and cost effective, and applications techniques are utilized to implement fault tolerance provisions where component level capability does not exist or is not cost effective. The development of fault tolerance in systems requires the inclusion of considerations that address faults, errors, and detection and recovery provisions in the specification, architecture development and system partitioning, subsystem design, system integration, validation and verification, and modification activities. System requirements and specifications must address mission phases, performance and availability requirements, operational modes, and external support capabilities which relate to the fault tolerance characteristics of the system. Support provisions from external agents such as ground operational intervention, including periodic or on-demand ac