Constraint Satisfaction as a

We present a method for the design of nonmasking fault-tolerant programs. In our method, a set of constraints is associated with each program. As long as faults do not occur, the constraints are continually satissed under the execution of program actions. Whenever some of the constraints are violated, due to certain faults, all constraints are eventually reestablished by subsequent execution of the program actions. To design programs thus, two types of program actions are distinguished: \closure" actions and \conver-gence" actions. Closure actions are the actions that perform the intended computation of the program when all of the constraints are satissed. Convergence actions are the actions that reestablish the constraints when they have been violated. Suucient conditions for the validation of closure and convergence actions are formalized in terms of a \constraint graph". These conditions are illustrated by designing nonmasking fault-tolerant programs for diiusing computations, atomic actions, and token rings.