tivities in support of diagnosis and recovery actions are defined. The acceptability of different modes of operation including reduced capabilities and degraded levels of service, safe shutdown, and emergency modes of operation must be defined. System architecture and partitioning defines error containment boundaries, establishes the system-wide strategy for coordinated error detection and recovery, and the redundancy provisions which support fault tolerance are determined. Establishing a fault tolerance hierarchy defines detection and recovery functions for individual local subsystems, shared functions over a group of subsystems, and system-wide or global functions. Utilization of redundancy methods, including hardware redundancy (spatial) or time redundancy (temporal) in the error detection and recovery processes may be utilized. Classical fault tolerant systems utilize design diversity as a provision for detection and recovery for specification and design defect related fault conditions. If present to address these fault classes, they represent useful redundancy for detection and recovery from single event upset and transient fault conditions. Fault tolerant subsystem design includes error detection and recovery provisions for faults within the subsystem as well as support for interfaces with other subsystems and global detection and recovery provisions. Detection and recovery may be either concurrent with normal system operation or preemptive in which case normal system operation is suspended until completion of the recovery activities. Error detection provisions must be capable of identifying undesired states caused by single event upset or transient fault conditions, including the presence of dormant or latent faults in spare or redundant circuitry and stored information. Correction provisions may be real-time; recovery operations may be either backward (rollback to a previous error-free state) or forward, constructing a valid error free new state from existing protected information. The recovery sequence i