n-line processor as simple as an "I'm OK" message or heartbeat monitor which the watchdog expects to receive within a prescribed window. If not received within the valid window, the watchdog interprets this result that the on- line processor control flow is disrupted and asserts interrupt or reset of the on-line processor. The watchdog may execute concurrently with the on-line processor, or it may operate off-line and pre-compute results for subsequent acceptance testing. It invokes decisions on the integrity of the system based on assertions about the main process, assuming that faults either disrupt program control flow, corrupt database contents, or produce incorrect numerical results. The purpose of the watchdog is not to take over execution from the on-line processor, but to assist other low-level fault tolerance provisions within the system by providing improved fault detection capabilities. There are generically four classes of assertions that can be implemented in a watchdog coprocessor: inverses, transformations, range, and state checks. Their respective usefulness must be matched with the nature of the process being executed by the on-line system, numeric mathematical computations versus database applications. The inverse assertion takes the output results and infers the nature of the input variables that would be necessary to produce the result and verifies consistency between the actual inputs and the inverse inferred values. transformation assertion operates by converting the problem to a simpler one and computes estimates of the expected output and comparing the results with the approximated results established by the coprocessor. The on-line system may be performing a Kalman filtering process, whereas the shadow processor might use a moving average to estimate the expected results from the on-line processor. Range assertions uses pre-established limits on the range of allowable values which outputs may assume using knowledge of the problem, but not the specific values of the input variables. State 