Interesting thing from this is that he says they should have used more formal analysis to build failure and fault tolerant systems. But how do you formally ver

Interesting thing from this is that he says they should have used more formal analysis to build failure and fault tolerant systems. But how do you formally verify/analyze a system for fault and failure tolerance if the methods of detecting failure and other faults are themselves not enough? e.g. The slide about COM/MON, which I admit I didn't fully understand, seems to be that the solution picked wasn't the very best possible one due to constraints and that failures were not detected that the point they were expected to. I guess you at least would know those are failure/fault points which can not be tolerated or handled somehow and should be watched.