The systematic development of fault-tolerant real-time systems with guaranteed timeliness requires an appropriate system architecture and a rigorous design methodology. Those services of the architecture that help to simplify the work of the real-time programmer are described, taking the MARS architecture as an example. Programming in the large activities, i.e., the systematic derivation of task timing parameters from the requirements specification, are then addressed. Programming to meet a time budget is discussed, and the programming interface, the programming environment, and the testing and support tools are presented. The architecture and most of the tools have been implemented and can be demonstrated on a fault-tolerant prototype application.>

The authors propose a system architecture, MARS, which supports a strict separation of the issues of synchronization and timeliness, data transformation, and the dependability aspects (e.g., error detection, error handling, and redundancy management. The systematic development of fault-tolerant real-time systems with guaranteed timeliness requires an appropriate system architecture and a rigorous design methodology. The authors propose a system with strict separation of the issues of synchronization, dependability aspects, and data transformation. Dependability aspects are handled by the architecture. Synchronization and programming in the large are handled at the design level. The programmer only has to be concerned with a sequential program for which he has to meet a so-called time budget. The architecture and many tools have been implemented and can be demonstrated on a fault-tolerant prototype application.>

The author analyzes variants of the MARS architecture for their handling of reliability, safety, and availability requirements. In order to provide these requirements, different strategies for tuning the MARS system have been applied: the installation of shadow components for reducing the probability of spare exhaustion failures, studies of the impact of the maintenance intervals on the system's dependability, and increasing the error detection coverage by time redundant execution of application tasks and by checking signatures of received messages. The results have shown that the fail-silent coverage of components is the most sensitive parameter, and a coverage value close to one is a necessary prerequisite for this type of architecture. The use of general purpose hardware does not provide a sufficient fail-silent behavior, even if sophisticated error detection mechanisms at the operating system level and application software level are used.>