Programming Fault-Tolerant Applications Using Two Orthogonal Object Levels