fault-tolerant operation