# Strategies and Methods for the Fault-Tolerant Function Development of Multi-Domain Systems +
## 5 Countermeasures for Faults
During the product development, they can be allocated to system components. The functions are then connected by function flow paths. These paths can then be analysed showing present and potential functional redundancies. This can be accompanied by an assessment of the probabilities of certain flows. For the representation of flows in function models, several possibilities are available. The most discussed possibility has been that proposed, amongst others, by the German engineering design scientists [PERSON] and [PERSON] [66]; they propose a flow-oriented function model without explicitly representing the states of operands. However, a representation of the states of operands may be sensible [42]; this was, amongst others, realised in the function model proposed by [PERSON] and [PERSON] [67]. It is important to note that this kind of function model uses certain symbols for certain operations (such as convert, store, or magnify) and that a logical link via auxiliary states is possible to auxiliary flows. In recent years, in a guideline for practical application, [PERSON] et al. have quite recently proposed a simplified function model with a combination of state and flow descriptions. The different function models are shown in Figure 7.  
The advantages of this kind of simplified model are that the contents are readily understandable for engineers in different domains, that complex function models can easily by represented with tools such as Mermaid [68], and that the contents are interpretable by machines. This kind of simplified model can, therefore, be recommended for application in the development of multi-domain systems, taking into consideration that it might in future easily be interpreted by artificial intelligence in large language models. Figure 6: Accommodation of the fault ”inclination angle disturbance”. In many cases, several possible countermeasures and combinations of countermeasures in different domains may be available. Design engineers and system architects need to be able to analyse these different countermeasures and to establish a domain-spanning evaluation based on criteria such as the following:  
* achievable degree of fault accommodation (how good can the consequences of the fault be prevented? ),
* resulting fault accommodation range (can the consequences of slightly different faults also be prevented? ),
* resulting user information (will the user be informed concerning the emergence of the fault? ),
* resulting legal information (will diagnosis systems, which are legally required (for instance, in the case of street-legal vehicles), capture the emergence of the fault? ),
* resulting additional system cost and weight, etc. A concise systematic guideline describing how entities or processes to accommodate faults may be developed is the object of on-going research. A preliminary list of concrete measures in a systematic context may contain the following elements:  
* Function analysis: Design engineers and system architects should be aware of the function flows of the multi-domain system and should use means to model them in a sensible manner; one possibility is that of flow-oriented function models [3]. * Redundancy: The most straightforward measure is the integration of redundant function flow paths through a combination of redundant system elements (such as additional sensors, actuators and communication lines), which can replace missing elements in the case of a fault, physically diverse redundant entities, and combinations of hardware and software function carriers. The most abstract form of redundancy can be referred to as \"functional redundancy\", which characterises the application of two or more functionally different entities (sensor, actors, process components, or algorithms) in order to allow the highest level of independence [3]. * Monitoring on different levels: Many complex systems have some kind of system monitoring the states of certain parameters and the functioning of the main system itself.