fault-tolerant design