tly, and do not result in long lasting affects upon system operation. This category may result from fault masking or other provisions already present within the design, or single event effects may affect data or other information determined to be non-critical. This classification usually does not require the inclusion of additional fault tolerance provisions in the design. The most serious category may be termed critical, or error- critical, and represents those effects which present unacceptable compromise to the operation of the system. Significant reduction to the rate of occurrence through fault masking provisions and the use of other detection and recovery provisions are necessary in addressing these functions. Typically one or two levels of classification are provided between these two extremes. These signify the level of criticality and response which must be present in fault tolerance provisions designed to deal with these functions. Fault tolerance in the form of detection which signifies compromised operation of the function may be adequate; limiting the duration of compromised operation by periodic reset or initialization may be adequate for these functions. 6.6.2 Validation and Verification of Fault Tolerance [Kanawati95] [Karlsson94] [Hseuh97] [Clark95] Several approaches have been proposed and utilized to study the effects of faults processor systems and for validating fault handling mechanisms, including analytical modeling, experimental techniques (hardware pin faults, memory corruption, and ion irradiation), simulation modeling (register transfer level, gate level, and op-code level simulation) and fault emulation (memory, bus, and register transfer level). Analytical modeling is extremely difficult due to the very large nature of the problem, and the simplifying assumptions which make the analysis tractable are regarded as compromising the usefulness of the technique and the validity of the results. Experimental techniques involve monitoring the behavior of a system until faults occur and record