A fault-tolerant distributed real-time computer system for controlling a physical system, in particular a machine or a motor vehicle, which comprises following components: - node processors (241, 242, 243, 244), - distribution units (232, 234), - intelligent sensors (111, 112, 113) as well as - intelligent actuators (121, 122, 123), wherein these components have access to a global time of a known precision, and wherein the node processors and intelligent sensors and the intelligent actuators exchange periodic time-triggered messages and event-controlled messages via the distribution units, wherein functions, in particular all functions of the application software, are contained in real-time software components - RTSWC - and the periodic time-triggered data transfer between the RTSWCs is predefined, and wherein, in active local allocation plans for each RTSWC, - the allocation of the RTSWC to a time-triggered virtual machine - TTVM - of a node processor - the following parameters of the TTVM ∘ start time and end time of a service interval -SI- ∘ storage areas for calculations of the RTSWC ∘ executable code of the RTSWC ∘ the schedules for a time-triggered communication of this RTSWC are predefined, and wherein, in active local allocation plans for each distribution unit, the schedules for the time-triggered communication are contained in this distribution unit, and wherein a global allocation plan consists of the sum of the coordinated local allocation plans of all RTSWCs and all distribution units of the application software, and wherein a monitor component periodically receives a copy of messages of the node processors in order to determine a current operational state of the node processors, characterized in that after the permanent failure of one or more RTSWCs, the monitor component activates a passive global allocation plan, which specifies the allocation of the RTSWCs and their data supply on newly installed TTVMs on the node processors that are still operational, and wherein the RTSWCs are implemented at a specified periodic restart time according to the selected passive global allocation plan on the newly configured TTVMs, and wherein a restart time of an RTSWC lies in a periodically recurring ground-state interval, wherein the ground-state interval is an interval between the end of an SI and the start of a following frame, and wherein a priori a periodic global restart time lies in a global ground-state interval, during which ground-state interval all RTSWCs and all distribution units remain in their ground state. - node processors (241, 242, 243, 244), - distribution units (232, 234), - intelligent sensors (111, 112, 113) as well as - intelligent actuators (121, 122, 123), wherein these components have access to a global time of a known precision, and wherein the node processors and intelligent sensors and the intelligent actuators exchange periodic time-triggered messages and event-controlled messages via the distribution units, wherein functions, in particular all functions of the application software, are contained in real-time software components - RTSWC - and the periodic time-triggered data transfer between the RTSWCs is predefined, and wherein, in active local allocation plans for each RTSWC, - the allocation of the RTSWC to a time-triggered virtual machine - TTVM - of a node processor - the following parameters of the TTVM ∘ start time and end time of a service interval -SI- ∘ storage areas for calculations of the RTSWC ∘ executable code of the RTSWC ∘ the schedules for a time-triggered communication of this RTSWC are predefined, and wherein, in active local allocation plans for each distribution unit, the schedules for the time-triggered communication are contained in this distribution unit, and wherein a global allocation plan consists of the sum of the coordinated local allocation plans of all RTSWCs and all distribution units of the application software, and wherein a monitor component periodically receives a copy of messages of the node processors in order to determine a current operational state of the node processors, characterized in that after the permanent failure of one or more RTSWCs, the monitor component activates a passive global allocation plan, which specifies the allocation of the RTSWCs and their data supply on newly installed TTVMs on the node processors that are still operational, and wherein the RTSWCs are implemented at a specified periodic restart time according to the selected passive global allocation plan on the newly configured TTVMs, and wherein a restart time of an RTSWC lies in a periodically recurring ground-state interval, wherein the ground-state interval is an interval between the end of an SI and the start of a following frame, and wherein a priori a periodic global restart time lies in a global ground-state interval, during which ground-state interval all RTSWCs and all distribution units remain in their ground state. ∘ start time and end time of a service interval -SI- ∘ storage areas for calculations of the RTSWC ∘ executable code of the RTSWC ∘ the schedules for a time-triggered communication of this RTSWC