, these considerations should be addressed in the context of the system design, development and manufacture of high reliability space systems. Prevention of component failure due to total ionizing and displacement damage dose effects or due to destructive single event effects was discussed in a previous section. The language of fault tolerant systems identifies a fault as the initiating event (in this case a charged particle induced single event upset or transient); errors are the undesired states caused by the fault. If error detection and recovery do not take place in a timely manner, a failure could occur that will be manifested by the denial or an undesirable change in the capability of the system to provide service. Fault tolerance is the capability of a system to recover from a fault or error without exhibiting failure and compromised availability. A fault in a system does not necessarily result in an error; a fault may be latent in that it exists but has not resulted in an error; the fault must be sensitized by a particular system state and input conditions to produce an error. A complete fault tolerant system design requires careful study of design, causes of failure, characteristics of the failures, and system response in the failed condition. The principles of fault tolerant systems include fault avoidance, fault masking, detection of erroneous or compromised system operation, containment of error propagation, and recovery to normal system operations. Component complexity affects the ability to accomplish error detection. Errors occurring in data storage elements, such as registers or memory, and during transfer over buses or interfaces are more easily detected than errors occurring in complex devices such as microprocessors, microcontrollers, and high complexity application specific (ASIC) devices. Consideration must also be given to the likelihood that faults will occur as single, statistically independent events, or whether multiple faults may be present due to high charged particle flux or multiple 