This paper deals with a two-level framework for the analysis, design, and operation of a fault tolerant system, where the upper level is a stochastic discrete state continuous time system describing a slower failure process, and the lower level is a conventional deterministic continuous state system in which top level states are embedded as parameters. The significance of the model presented in this paper is two-fold: it provides a well-defined guideline when served as a design criterion for a fault control system; and it provides a principle for operation, which is retrofittable to any existing designs. By using coverage as a decision criterion, risks associated with prenature decisions, such as fals alarm and missed detection, are eliminated.