Various redundancy tactics can be modeled at the design stage of safety—critical system s thereby providing a set of fault—tolerance guidelines for subsequent development activities．However,existing approaches usually interweave redundancy tactics i