Incremental design is the widest applied methodology for VLSI design since, it allows one to produce early versions of the system that, even if not satisfying all requirements, allow one to verify its applicability in the field. The migration from, a system version to a more powerful one is based on the substitution of a module with a more powerful module, which implements new features. This upgrade can introduce errors, which are difficult to be identified during the design since the standard concept of equivalence checking cannot be applied in this context. In fact, the original and the redesigned module can implement different specifications or can achieve the same results under different timing constraints. The paper analyzes this problem and proposes a fault tolerant incremental design methodology able to reduce or avoid such errors