A fault-tolerant design detects, contains, masks, or reconfigures around faults so operation remains within stated correctness, capacity, timing, and safety limits, sometimes at a deliberately degraded service level.
The requirement must define which faults, combinations, and durations the system should tolerate. Designs may use replication, voting, error correction, independent power or communication paths, diverse implementations, state reconciliation, and graceful degradation, supported by monitoring and repair.
Key points
Define correct serviceSpecify essential functions, permitted degradation, fault assumptions, detection time, recovery behavior, and the point at which safe shutdown is preferable to continued operation.
Create independenceSeparate replicas and supporting power, networks, identities, administration, and locations where the threat model requires it; consider diversity against common defects.
Protect stateControl replication, ordering, quorum, consistency, corruption detection, and reintegration so redundant components do not spread bad data or create conflicting actions.
Important limitationRedundancy alone is not fault tolerance. Common-mode failures, shared dependencies, design defects, correlated attacks, exhausted capacity, and incorrect failure detection can defeat every replica, while added complexity can introduce new faults.