Format fault-tolerance-model.md