MULTICS survivability