In the design process of distributed real-time systems a way must be found to cope with the complexity inherent to these systems. An established technique for this purpose is the decomposition of the system into smaller subsystems with well-defined, stable interfaces among them.In this paper we propose a design method for the development of distributed real-time systems that are intended for safety critical applications. The method is devised for the Time-Triggered Architecture, which constitutes such a real-time system. For the purpose of decomposition we introduce a special type of interface, the so-called temporal firewall. In the Time-Triggered Architecture there are three interfaces of this type, the Communication Network Interface, the Controlled Object Interface, and the Gateway Interface, which partition the real-time system into autonomous subsystems.The design method clearly separates system and subsystem issues and focuses on the definition of the three interfaces between the subsystems. The feasability and relevance of our design method is demonstrated by means of a small example from the automotive industry.