A fault-tolerant computer is capable of performing a data flow control process in a short period of time. The fault-tolerant computer includes a pair of duplicate systems each having a CPU subsystem and an IO subsystem. The IO subsystems of the duplicate systems are connected to each other through a cross link. The CPU system has an inbound reception buffer which receives data sent from the IO subsystem, and when the amount of the received data reaches a first threshold value, sends a first signal to the IO subsystem, and when the amount of the received data reaches a second threshold value greater than the first threshold value, sends a second signal to the IO subsystem. The IO subsystem has an IO I/F controller to stop sending data to the CPU subsystem when the IO I/F controller receives the first signal and the second signal, and a flow controller to send the second signal to the IO I/F controller of the paired IO subsystem through the cross link after the flow controller receives the second signal.