er is capable of responding to the initial failure by removing the voting rights of the failed module and imposing majority voting rules, a second SEU event could be tolerated by the remaining TMR structure. This would be the case if during or before recovery from the initial failure a second SEU event would occur in one of the modules. This capability to change the nature of the modular voting scheme is termed dynamic redundancy. In general, dynamic redundancy consists of three actions, detection of error, location of the error, and reconfiguration of the structure to perform in an optimum manner. The costs of fault tolerance using spatial modular redundancy include the cost of additional modules, the size, weight, and power necessary to operate the additional circuitry, and increased failure rate (reduced reliability) associated with the utilization of additional hardware elements and interconnect structures. If real-time continuous operation of the function is not required and error detection with some other recovery capability can be imposed, dual modular redundancy may be adequate. In this case the voter performs only a checking function and thus becomes only a comparator. Permanent or hard failure in either of the modules results in the comparator producing continuous error assertion. The capabilities of other elements of the system to discern which of the modules is performing properly and to disable the error output and to force the checker to pass the output of the properly functioning module are necessary to resolve this condition. If there exists a highly probable condition in which failures in both modules would produce identical module output conditions, the redundant module could potentially contain complementary function instead of an identical copy of the primary module. In this case the dual of the primary module is utilized in the design of the redundant module. Such complementary logic may be used with dual-rail codes in performing error detection. This technique is regarded as most applicable 