# Strategies and Methods for the Fault-Tolerant Function Development of Multi-Domain Systems +
## 5 Countermeasures for Faults  
In general, countermeasures for faults, i.e., entities or processes to accommodate faults, are possible on the geometry and material level, the physical level, as well as the functional level of product models (see Figure 2). On the requirements level, only objectives can be formulated but no countermeasures should be described in order to remain \"solution-neutral\" (see, e.g., ref. [64]). The focus of this paper is the most abstract level for countermeasures: How can conscious function development be applied to counteract faults which occur in the multi-domain interplay of the components of complex systems? It is important to point out that these countermeasures are not limited to a certain physical domain but may include solutions involving different physical domains (mechanical, electrical, software, etc.) and even solutions in the fields of controlled product operation, user involvement, user feedback and warnings, as well as legislation and supply chain management issues. One example could be the case that a certain operation condition is detected as harmful for the system and the control systems of the product limit the time this condition is present (e.g., a time-limited over-boost). Another example could be the case that a system fails to be in accordance with certain laws (e.g., emission laws for street-legal vehicles); then, a certain operation condition can be prevented completely by the control and diagnosis system. Solution concepts for countermeasures can be found in all domains and are frequently a combination of mechanical, electrical, and software elements; most importantly, the solution elements may stretch beyond a pure technological solution [7]. The main challenge is that design engineers and system architects need to be aware of the potential of multi-domain solutions and of the possible components of a multi-domain solution and that they need to be able to apply them in a systemic manner, which means that they need to be aware of the multitude of consequences in a complex system with its environment and to realise a systematic application. It is apparent that design engineers and system architects need to understand the interconnected functionality of all subsystems in their product. A profound knowledge of functional analysis and modelling methods (such as the integrated function modelling framework (IFM--[5; 52]) is one prerequisite for identifying fault countermeasures in a systemic manner. In the function analysis of faults, their consequences, and possibilities to accommodate them, control and diagnosis functionalities deserve special attention. Especially helpful can be the application of a relation-oriented function modelling technique, which distinguishes between useful and harmful functions, such as one of the function modelling methods proposed in the TIPS/TRIZ (theory of inventive problem solving/teoriya resheniya izobretatelskikh zadach) community (see, e.g., ref. [65]). The syntax of function modelling for this specific modelling method is shown in Figure 6, together with a simplified example based on one of the product development examples in Section 6 (balanced two-wheel scooter). It is clearly evident in this kind of function model that the fault \"electro-magnetic irradiation\" is a harmful function which may cause another harmful function \"inclination angle disturbance\". It is possible to document that the fault accommodation solution \"shield electronics\" is introduced as a useful function to eliminate the effects of this fault. Design engineers and system architects who want to realise a holistic accommodation of faults need to know about solution possibilities in many domains. They may be assisted by an abstract database of solution elements with a description of certain functional characteristics and by methods to model functional redundancies [7]. Such methods can be based on the function failure identification and propagation (FFIP) method [55]. Initially, the most important functions are analysed.