failure-tolerant design