An ACL for Specifying Fault-Tolerant Protocols