formance penalties by either requiring excessive coordina-It is desirable to use redundant components to minimize the time required to accomplish a mission while at the same time ensuring that the mission will be completed in spite of failures. This characteristics is a fundamental requirement of the inherent fault tolerance approach. We first define inherently fault tolerant (a) programs and then review some theoretical aspects, namely, the correctness proof and existence conditions for IFT programs. We then present two general classes of decentraked processcontrol system that are amenable to IFT solutions. Index Terms. Decentralized processcontrol systems, inherent fault tolerance, self-stabilizing system, bucket brigade model, parallel brigade model. 267 0-8186-3126-1/93 $03.00 0 1993 B E E