We describe methods for achieving an acceptable level of fault-tolerance in a multiprocessor designed for the execution of critical flight tasks on commercial aircraft. The SIFT (Software Implemented Fault-tolerant) system differs from other reliable computer architectures in the manner of utilization of redundant resources. The SIFT system is designed to cope with hardware faults by detecting discrepancies in the results computed by separately executed versions of critical programs. When such a discrepancy occurs we identify the processor/memory unit, bus unit, or processor/bus interface that has failed. A reconfiguration of task execution among the available resources is carried out to avoid the use of hardware units that have been identified as faulty or unreliable. We explain how the identification of faulty units can be effected, how the system may be reconfigured to avoid use of faulty units, and show that these reconfiguration policies are "safe" with respect to faults that do not occur in separated units during the short interval required to carry out the reconfiguration of tasks.

The consecutive retrieval (CR) property has been defined as the property of a query that can be answered by the retrieval of consecutive records in a file. In this correspondence we add some observations about boundary conditions to Gosh's study of the CR property.