# Strategies and Methods for the Fault-Tolerant Function Development of Multi-Domain Systems +
## 5 Countermeasures for Faults
In the case of a fault, default values, fall-back functions, limitations of the  
Figure 7: Historic and current function models. performance might be applied, or warnings for the user or service and maintenance personnel might be generated. * Analytical redundancy: The electronic control unit (ECU) can use models which describe the behaviour of the system. These models can either be physics-based, or be based on artificial intelligence, such as neuronal networks, or combinations thereof. Comparisons of the result of these models with sensor readings can allow the detection of faults at an early stage. * Diagnosis on different levels: Based on a monitoring system, a diagnosis system can detect and identify faults. This kind of system can be based on residuals generated using analytical redundancy. Diagnosis can be implemented in sub-systems, but can also concern the complete system. * Cascaded control loops: Some entities of multi-domain systems need to be controlled very precisely for optimum performance, such as the mixture within the combustion chamber of an engine. Frequently, the elements of very precise control are more susceptible to faults. In such cases, it is sensible that an additional rough control loop with robust components is present to provide a fall-back solution in case of a fault. * Tolerance analysis: Tolerance analysis essentially means to combine the dimensions and tolerances of the assembly components and their assembly sequence in an analytical model that allows determination of the tolerance ranges of certain product aspects which are important for the product assembly feasibility or product function (see, e.g., ref. [69]). As several faults may be the consequences of sub-optimum tolerance chains, these can be investigated using tolerance analysis and accommodation possibilities can be found. * Robust design: Generally, robust design aims to create products that are insensible to uncontrollable variations and are based on the identification of an optimal parameter set which includes a small variance of the target values (product performance objectives) as a constraint [70]. As some smaller faults might have similar effects to those variations, robust design can also be understood as one measure for fault-tolerant design. * Resilient design: Resilient design seeks to create technical systems which are able to adapt to changing environmental conditions, to support system and design engineers in the development of more resilient technical systems, and to enable the process of creating the information which can ensure the safe and efficient operation of a technical system even in the case that certain risks are present. The difference from fault-tolerant design (FTD) is only that for FTD the origin of the risk is within the system; therefore, the strategies and methods of resilient design can be easily adopted [34]. * Testing: An elaborate testing program including the probable fault conditions can be one cornerstone in the development of fault-tolerant products. * Multi-domain simulation: Countermeasures for faults often concern several domains; for a holistic analysis, the domains cannot be simulated independently, but a multi-domain co-simulation is inevitable. This multi-domain co-simulation can be based on functional mock-up interfaces (FMIs); FMIs provide a standardised interface for data exchange and allow the creation of functional mock-up units (FMUs), which enable co-simulation in appropriate environments [71]. * Constraints: One possibility for limiting the effect of faults is the employment of \"hard-programmed\" constraints for certain parameters, i.e., fixed limits for certain actuators, which can be accompanied by additional mechanical limit stops. Also, within the design process, constraints concerning what methods might be used can be applied (design constraints).