Method for isolating a defective computer in a fault-tolerant multiprocessor system

In a multi-computer system, in particular a 2-out-of-3 computer system, a computer recognized as defective should be isolated in compliance with the "fail-safe" principle so that the non-defective computer can continue to operate. According to the defective computer receives from the non-defective computers a command (102) to shut down completely and thus set data output. If the defective computer does not comply with this command and continues to output data, the non-defective computers shut themselves down (104). As a result, the system assumes a secure state, since due to system-internal adjustment processes, a computer alone can not make any effective expenditure. The solution according to the invention is therefore particularly suitable for the "fail-safe" principle obeying control systems, as required, for example, when securing railway infrastructure or when monitoring nuclear power plants. The method can be completely realized as software; hitherto necessary relay switches are superfluous.