Assumption coverage under different failure modes in the time-triggered architecture

The Time-Triggered Architecture (TTA) is a distributed computer architecture for highly dependable real-time systems. The core building block of the TTA is the communications protocol TTP/C. This protocol has been designed to provide non-faulty nodes with consistent data in the presence of faulty nodes. To achieve this consistency the protocol assumes that a fault is either a reception fault or a consistent send fault of some node. Although the communications protocol of the TTA uses this rather optimistic failure mode assumption, the TTA can isolate and tolerate a broader class of faults. This is possible by making intensive use of the static knowledge present in a TTA distributed computer system. This off-line available knowledge allows to build interconnection networks which transform failure modes of nodes into failure modes the communications protocol can deal with. This paper will discuss three alternative implementations of interconnection networks for the TTA which have been designed to meet different failure mode assumptions.