tent state that existed before it failed. A checkpoint is then defined as a consistent state from which the execution can be restarted. Backward error recovery is implemented by saving checkpoints for each processor of the architecture and by using these checkpoints to restart execution after a failure. A shared memory architecture can be used to implement checkpointing. One method is to allow cache memory to hold modified data until a cache line write must be performed, thus establishing a new checkpoint condition in system main memory. 6.5.4.3 Fault Containment To minimize the impact to system operations, to minimize the extent of recovery operations, and to enhance the probability of successful system recovery, errors must be confined to the maximum extent possible to the module or subsystem in which the fault occurred. Typically, error containment boundaries are hierarchically defined, with errors confined at the lowest level possible. Containment boundaries can be established by subsystems checking either their own outputs, or by validating all input information. If error detection is activated but error recovery is not supported, the subsystem process is typically halted to prevent error propagation. 6.5.4.4 Reconfiguration and Recovery Having detected an error condition in an individual subsystem, reconfiguration and recovery must be performed. One strategy often utilized is to include redundant modules and to utilize a replacement unit to take over for the failed subsystem until it can be reinitialized and returned to an error free condition. Replacement units can be either "hot" spare, "cold" spare, or some condition in between. A hot spare in tightly coupled systems concurrently performs the same operations as the on-line subsystem, requiring little or no initialization to replace the failed subsystem. A cold spare must be initialized to perform the tasks of the on-line subsystem and the time necessary to complete the initialization and the completeness of the operation dictate the opportunity for syste