Fault tolerant design