# Strategies and Methods for the Fault-Tolerant Function Development of Multi-Domain Systems +
## 3 State of the Art
### Fault-Tolerant Design
This activity, which can be referred to as \"definition of the fault-tolerance specification\" (see Figure 2), needs to be based on knowledge gathered concerning possible faults. The extent of the ability to tolerate faults can be assessed using the criteria of reliability, availability, maintainability, and safety [22; 31; 32]. In recent years, further criteria have been proposed, such as resilience [33; 34], robustness [35], and survivability [36]. The most concrete level of product models (see Figure 2) is the geometry and material level. On this level, a large collection of rather concrete possible methods for both analysis and synthesis is available. Most prominently, fault-tolerant design can be realised by means of the conscious application of redundancy, i.e., to provide additional entities which would not be necessary in fault-free environments [22]. A well-known example of redundancy is airplanes with multiple engines, but there are many more examples, which may concern additional active components (active redundancy) and stand-by systems (passive redundancy), as well as multiplication of computation or data transmission (time redundancy) [22]. The fault accommodation capability of technical systems can also be enhanced by the conscious and sensible placement of both sensors and actuators. Several powerful algorithms and methods for optimised sensor and actuator placement have been developed in recent years (e.g., ref. [37; 38]). Furthermore, fault-tolerant design can be realised by means of conscious application of over-actuation (stronger actuators than are needed for nominal operation), overlap (sensors and actuators which can measure or influence the same system segment), and inherently fault-tolerant design (design variants which prevent any influence of a possible fault) [3]. A smaller volume of research is focused on fault accommodation on the abstract physical level (see Figure 2). On this level of product models, optimised physical behaviour and its effects may lead to improved fault accommodation, e.g., the choice of stronger physical effects may lead to a system that is less susceptible to the effect of faults. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Method** & **Central Aspect** & **Main Emphasis** & **Contribution to Fault Diagnosis** \\ \hline Fault tree analysis (FTA—[26]) & Fault/failure & Failure logic & Fault hierarchy \\ \hline Event tree analysis (ETA—[27]) & Event & Consequence of initiating event & Probability of catastrophic effects \\ \hline Failure mode and effects analysis (FMEA—[28]) & Fault/failure & Risk priority & Causes and consequences of faults \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Quantitative risk analysis methods. Currently, an increasing interest in understanding and documenting the abstract physical relationships in a technical system can be observed. Even without an explicit intention to increase fault-tolerance, many system designers ensure physical diversity, i.e., they use actuators and sensors based on different physical effects within one system; in aircraft design, this is even mandatory. An increased independence is achieved when system elements are applied which differ completely in the applied physical effects for achieving specific objectives, e.g., hydraulic actuators in addition to electrical actuators. Most current multi-domain systems are not only complicated in the sense that they have many components (see [39]) but are also complex in the sense that multiple connections exist between those components and that there is uncertainty (see [39]). Multi-domain systems, such as modern cars, consist of several subsystems, such as sensors, electronic control units, and actuators, which need to interact to allow certain functions. For several reasons, such as the limitations of physical models, the outcome of certain processes in not fully predictable [39]. Development engineers need to be able to cope with this complexity in order to be able to realise fault-tolerant design.