A control computer system comprising at least two modules (1, 2, 1001, 1002, 1003, 1004, 1021, 1071) which are designed to be redundant with respect to one another. The control computer system having at least one comparison unit (20, 21, 91, 92, 1011, 1012) for monitoring the synchronization state of the at least two redundant modules (1, 2, 1001, 1002, 1003, 1004, 1021, 1071) and for detecting a synchronization error at least one peripheral unit (95, 96, 1022, 1030, 1031, . . . , 1038). At least one switching matrix (21, 1013, 1063) which is set up to allow or block access to the at least two redundant modules or access to the peripheral unit (95, 96, 1022, 1030, 1031, . . . , 1038) by the at least two redundant modules, and an error-handling unit (44, 1080) which is set up to receive signals from the at least one comparison unit (20, 21, 91, 92, 1011, 1012) and to drive the at least one switching matrix (1013, 1063) in order to completely or selectively prevent access to the at least two redundant modules or access to the peripheral unit by the at least two redundant modules.