Levi S-T, Agrawala AK.  1994.  Fault tolerant system design. :440.