Fault-tolerant communication for distributed embedded systems

Fault-tolerant communication is a crucial point in building distributed safetycritical real-time systems, as they are used today e.g. in the automotive and avionics domain. To argue about the timing properties of a distributed system and to show the fault-tolerance of its communication, a predictable timing of the system is needed. This can be solved using the time-triggered paradigm. In accordance with this paradigm, a time-triggered communication protocol, FlexRay, and an operating system OSEKtime with corresponding communication layer FTCom for the fault-tolerant communication were introduced by the FlexRay Consortium and OSEK/VDX respectively. In this chapter we present the formal specifications of FlexRay and FTCom that allow us not only to argue about their properties in a precise, formal manner and to infer the dependences between their properties, but also to prove the correctness of the implementation formally.