# Strategies and Methods for the Fault-Tolerant Function Development of Multi-Domain Systems +
## 3 State of the Art
### Fault-Tolerant Design  
In order to fully understand the scope and potential of fault-tolerant design, it is sensible to investigate the general idea and concept of fault-tolerant control, which is a connected and established research area. In control engineering, faults are defined as temporary deviations of certain system properties from their nominal range and it is concluded that, in complex machinery and vehicles, faults cannot be completely avoided [18]. Today, several research groups worldwide are investigating the possibility of accommodating faults by means of robust control design or active fault-tolerant control. In this context, the accommodation of faults can be defined as the presence of characteristics or activities of the technical system which contribute to reducing or eliminating the consequences of faults on the system's performance, reliability, or safety. Current research topics in this area include, amongst others, output-feedback fault-tolerant control approaches for multiple faults [19], consensus control for multi-agent systems [20], and algorithms for scheduling the tasks of multiple automated guided vehicles [21]. Despite the incontestable appeal of these approaches, they do not answer the question of how system design can contribute to the intended accommodation of faults. The possibilities for this accommodation are many fold; the most frequent example is redundancy, such as in the engines of a multi-engine plane. A systematic approach for this kind of design is explored using the notion of \"fault-tolerant design\" [3] based on earlier investigations in certain fields of application [22; 23; 24]. This systematic approach relies, amongst others, on a distinction between elementary fault accommodation approaches based on the level of abstraction of the product models they are applied to. Figure 2 gives an overview of these levels of abstraction and the respective fault accommodation approaches. The most abstract level of product models is the requirement level; the enormous importance of conscious requirements clarification has been emphasised in numerous research works and elaborate strategies, methods, and tools for requirement management are proposed and implemented in industry (e.g., ref. [25]). On this  
Figure 2: Fault-tolerant design on different levels of product model abstraction. promising approach for fault-tolerant design is the conscious exploration of possible faults and the consequences of these faults. In control engineering, a clear distinction between fault and failure is proposed. As stated above, a fault is (only) a deviation from nominal conditions, while a failure is a possible catastrophic event, which will prevent a system fulfilling its intended function [18]. For the exploration of possible faults, it is advisable to investigate both possible failures and faults by using techniques such as Fault Tree Analysis (FTA--[26]), Event Tree Analysis (ETA--[27]), and Failure Mode and Effects Analysis (FMEA--[28]). The central characteristics of these quantitative risk analysis methods are summarised in Table 2.  
Currently, further developments of these methods are being realised, such as in the development of hybrid FMEA applications incorporating fuzzy logic [29] or the development of an FMEA light [30]. Quantitative risk analysis methods are also applied as reliability analysis methods [26], i.e., the assessment of the probability that the technical system can continue carrying out its functionalities over time. The application of further reliability analysis methods, such as root cause analysis or reliability block diagrams, may also lead to the identification of further possible failures and faults. As emphasised before, conscious requirement clarification is a crucial element of successful engineering design. Consequently, the extent to which the developed system should be able to tolerate faults should also be consciously determined, because an unlimited capability to tolerate faults is not sensible or even possible due to technological and economic restrictions.