bility to recover the faulty processor to a known-good condition SO that its outputs may again be utilized in detection and correction operations. Often the recovery operation in the faulty processor requires recovery of data and control states and resynchronization processes that cannot be performed concurrent with normal processor operations. The faulty processor must be removed from the redundancy configuration until the recovery operation is performed, resulting in susceptibility of a second fault compromising operation of the system during this interval; error detection continues to be provided, but no source of correction process is available. To eliminate this vulnerability as well as to provide detection and correction capability in the case of intermittent or permanent faults in individual processors, some architectures use a fourth processor in a quad-redundant configuration to assure the performance of the fault tolerance provisions. Additionally, synchronization of the outputs of COTS processors or devices using tight coupling and fault tolerant clocking schemes is not easily accomplished. An alternative to tight coupled lock-step operation is the use of loosely coupled or synchronized units. In this case, only process-critical outputs of the individual processors are evaluated by the voter to identify a failed processor. Another obvious concern in modular redundant schemes is the protected integrity of the comparison and voting circuitry. The use of single event upset hardened technology, circuit design, and application techniques such as modular redundancy in the comparison and voting circuits to eliminate susceptibility of single event upset or single point failures must be utilized to assure the integrity of the fault tolerance provision. 6.4.2.2 Temporal Redundancy An alternative to spatial redundancy is temporal redundancy in which the same hardware or software elements are used in consecutive operations, using diversity in time to provide results which may be compared using similar comparator/d