nd to be compromised, a spatially or temporally redundant copy of the module or application is chosen and subjected to the same acceptance test provisions. Acceptance tests usually involve techniques such as range and bounds checking, consistency with previous module or application results, and attachments to the result which indicate normal flow through module or application processes. 6.5.4.2 Check-Pointing and Roll-Back Recovery [Peercy93] When a fault is detected, computation is rolled back several cycles (micro-rollback) to compensate for the latency between fault occurrence and detection. All computations since that which caused the fault are performed again, and some state repair is done as well. Specific design attributes of the processor are necessary to support the use of micro-rollback, such as the use of delayed write buffers, that are registers which hold data across cycle boundaries. These buffers must be deep enough to span the longest roll-back necessary to execute roll-back recovery in the architecture. If an unmasked fault has propagated in a system, a recovery period is needed to correct the system. The elapsed time between the introduction of the fault and detection of an error, is in all probability an indicator of the extent of propagation of the error and the extent of recovery which will be required. Most recovery schemes restore system operation to a previous correct state or recovery point. A processor is rolled back to a recovery point by restoring the processor state and key variables to a known good condition, invalidating cache memory (which is likely to have been corrupted by error propagation) and forcing cache data to be restored from protected main memory. A checkpoint is a copy of an application's state which is stored in a protected region of the system. When a failure is detected, the application's state is rolled back to the saved previous checkpoint and execution resumed at that point. Backward Error Recovery can be defined as the capability of a system to return to a consis