Distributed maintainable real-time computer system, for example for controlling and/or monitoring a plant, wherein the real-time computer system comprises at least two central computers (110, 120; 200) and one, two, or more, in particular a plurality of, peripheral computers (151, 152, 153, 154), wherein for example using the one, two, or more peripheral computers the plant is controlled and/or monitored, in particular each peripheral computer controlling and/or monitoring a part of the plant, wherein the central computers have access to a global time and the central computers are provided with identical hardware and identical software and use startup data, each functioning central computer periodically sending life-sign messages to the other central computers according to a schedule defined a priori in its startup data, wherein the peripheral computers (151, 152, 153, 154) are able to exchange messages with the central computers (110, 120), and wherein at any time one central computer is in the active state and the other central computers are in the non-active state, and wherein after, in particular immediately after, the apparent absence of a life-sign message of the active central computer expected at a scheduled reception time, a non-active functional central computer takes over the function of the active central computer, and wherein each central computer (110, 120; 200) comprises three independent subsystems, an application computer, a storage medium containing startup data characteristic of the central computer, and an internal monitor, wherein the internal monitor periodically verifies the correct operation of the application computer, and wherein upon detection of a failure the monitor initiates a hardware reset and restart of the application computer, and wherein preferably the active central computer initiates, upon an apparent failure to receive life-sign messages expected at scheduled reception times from a non-active central computer, a maintenance action that can lead to the repair or replacement of a permanently failed central computer, wherein from a value of an indicator it is derived which of the different startup data sets contained in the software of a central computer is used in this central computer, and wherein in the time-triggered life-sign messages of a central computer the value of the indicator characterizing that startup data set which is currently being used in this central computer is contained, characterized in that the global time is sparse, the life-sign messages are time-triggered multi-cast life-sign messages, and the central computers use different start-up data, and each central computer has a different start-up timeout, wherein the start-up timeout indicates the time interval of how long a central computer has to wait at least after its power-up before it is allowed to send a first life-sign message, and wherein the non-active functional central computer that takes over the function of the active central computer is the non-active functional central computer that has the shortest start-up timeout of all non-active functional central computers, and wherein from a central computer that is newly added the life-sign messages of all functional central computers are received after loading its software with different start-up data sets, and from these life-sign messages it is derived which start-up data sets are already in use, and the newly added central computer sets its indicator such that the first start-up data set not used at the current time is used in the newly added central computer.