Redundant control system - with an actuator, - with a first control computer which is connected by way of a first bus to an interface module of a first peripheral station containing at least one periphery module, and - with a second redundant control computer which is connected by way of a second bus to an interface module of a second peripheral station likewise containing at least one periphery module, wherein - the actuator is connected to mutually decoupled signal outputs (16, 17) of two periphery modules, each forming an output module (12, 13), of the two peripheral stations (8, 9), - each of the interface modules (10, 11) is designed to transmit output values received for the actuator from the respective control computer (2, 3) by way of the bus (6, 7) to the output module (12, 13) for output to the actuator, characterised in that - on detection of a fault on the part of the bus, each of the interface modules (10, 11) is furthermore designed to transmit a command to the output module (12, 13) and all other output modules of the peripheral station (8, 9) to output substitute values at their signal outputs (16, 17), and - the two output modules (12, 13) with signal outputs (16, 17) to which the actuator is connected are interlinked by way of a communication link and are designed to exchange information about the receipt of a command for the output of a substitute value and to implement this command only if the other output module concerned has also received such a command. - with an actuator, - with a first control computer which is connected by way of a first bus to an interface module of a first peripheral station containing at least one periphery module, and - with a second redundant control computer which is connected by way of a second bus to an interface module of a second peripheral station likewise containing at least one periphery module, wherein - the actuator is connected to mutually decoupled signal outputs (16, 17) of two periphery modules, each forming an output module (12, 13), of the two peripheral stations (8, 9), - each of the interface modules (10, 11) is designed to transmit output values received for the actuator from the respective control computer (2, 3) by way of the bus (6, 7) to the output module (12, 13) for output to the actuator, characterised in that - on detection of a fault on the part of the bus, each of the interface modules (10, 11) is furthermore designed to transmit a command to the output module (12, 13) and all other output modules of the peripheral station (8, 9) to output substitute values at their signal outputs (16, 17), and - the two output modules (12, 13) with signal outputs (16, 17) to which the actuator is connected are interlinked by way of a communication link and are designed to exchange information about the receipt of a command for the output of a substitute value and to implement this command only if the other output module concerned has also received such a command. - the actuator is connected to mutually decoupled signal outputs (16, 17) of two periphery modules, each forming an output module (12, 13), of the two peripheral stations (8, 9), - each of the interface modules (10, 11) is designed to transmit output values received for the actuator from the respective control computer (2, 3) by way of the bus (6, 7) to the output module (12, 13) for output to the actuator, - on detection of a fault on the part of the bus, each of the interface modules (10, 11) is furthermore designed to transmit a command to the output module (12, 13) and all other output modules of the peripheral station (8, 9) to output substitute values at their signal outputs (16, 17), and - the two output modules (12, 13) with signal outputs (16, 17) to which the actuator is connected are interlinked by way of a communication link and are designed to exchange information about the receipt of a command for the output of a substitute value and to implement this command only if the other output module concerned has also received such a command.