Fault tolerant mechanism design