A computer system installed on board a carrier, communicating in a network with a data concentrator and with a monitor, and implementing at least one service that is critical for the operating safety of the carrier, the critical service being redundant in at least two instances (δ 1,..., δ m) on different respective computers (C 1,..., C m) connected to said network, each computer (C k) implementing at least one software task implementing an instance (δ k) of the critical service and being configured to implement the critical service through time-triggering by using: - an increasing sequence of task activation dates (R n) and a sequence of corresponding task latest end dates (D n), relating to the starting of the system, with an interval between an end date and the corresponding activation date above or equal to a threshold corresponding to an estimate of the execution time or of the response time of the task (WCET); - a backup of an internal state (s n) of the computer between two successive activations of the service by way of modelling by recording the memory states of the task; - an update of the internal state (s n+1) of the computer on each activation (n) of the service, starting after the corresponding activation date (R n), reads the input data (i n) of the service and computes the output data (o n) of the service and provides them to the data concentrator, the dependency between firstly the updated internal state and the computed output data (s n+1, on) and secondly the previous internal state and the read input data (s n, i n) being represented by a transfer function (f); and - a relay server (SR k) configured to compute a signature ( h n + 1 k), which is characteristic of the execution of the instance (δk) of the service from the initial activation of the system to the current latest end date (D n), by way of a hash chain dependent on a hash function on nb bits, and to transmit the signature ( h n + 1 k) to the monitor; the monitor detecting a fault by analysing the signatures ( h n + 1 1,..., h n + 1 m) of the instances (δ 1,..., δ m). each computer (C k) implementing at least one software task implementing an instance (δ k) of the critical service and being configured to implement the critical service through time-triggering by using: - an increasing sequence of task activation dates (R n) and a sequence of corresponding task latest end dates (D n), relating to the starting of the system, with an interval between an end date and the corresponding activation date above or equal to a threshold corresponding to an estimate of the execution time or of the response time of the task (WCET); - a backup of an internal state (s n) of the computer between two successive activations of the service by way of modelling by recording the memory states of the task; - an update of the internal state (s n+1) of the computer on each activation (n) of the service, starting after the corresponding activation date (R n), reads the input data (i n) of the service and computes the output data (o n) of the service and provides them to the data concentrator, the dependency between firstly the updated internal state and the computed output data (s n+1, on) and secondly the previous internal state and the read input data (s n, i n) being represented by a transfer function (f); and - a relay server (SR k) configured to compute a signature ( h n + 1 k), which is characteristic of the execution of the instance (δk) of the service from the initial activation of the system to the current latest end date (D n), by way of a hash chain dependent on a hash function on nb bits, and to transmit the signature ( h n + 1 k) to the monitor; - an increasing sequence of task activation dates (R n) and a sequence of corresponding task latest end dates (D n), relating to the starting of the system, with an interval between an end date and the corresponding activation date above or equal to a threshold corresponding to an estimate of the execution time or of the response time of the task (WCET); - a backup of an internal state (s n) of the computer between two successive activations of the service by way of modelling by recording the memory states of the task; - an update of the internal state (s n+1) of the computer on each activation (n) of the service, starting after the corresponding activation date (R n), reads the input data (i n) of the service and computes the output data (o n) of the service and provides them to the data concentrator, the dependency between firstly the updated internal state and the computed output data (s n+1, on) and secondly the previous internal state and the read input data (s n, i n) being represented by a transfer function (f); and - a relay server (SR k) configured to compute a signature ( h n + 1 k), which is characteristic of the execution of the instance (δk) of the service from the initial activation of the system to the current latest end date (D n), by way of a hash chain dependent on a hash function on nb bits, and to transmit the signature ( h n + 1 k) to the monitor; the monitor detecting a fault by analysing the signatures ( h n + 1 1,..., h n + 1 m) of the instances (δ 1,..., δ m).