Verfying the Design of Fault Tolerant Systems