Fault-tolerant design