Method for establishing an interactive consistency property between receivers (RCV1, RCV2, RCV3) of messages (MSGA, MSGB) in a computer system, in particular a distributed computer system, wherein said messages (MSGA, MSGB) are transmitted to said receivers (RCV1, RCV2, RCV3) by a sender of said computer system over a communication network connecting the receivers (RCV1, RCV2, RCV3) and the sender, wherein said communication network comprises communication paths for connecting the receivers (RCV1, RCV2, RCV3) to the sender, wherein each of the receivers (RCV1, RCV2, RCV3) is connected to the sender with at least two disjoint communication paths, wherein each of said disjoint communication paths comprises at least one switch (SWA, SWB; SWA1, SWA2, SWB1, SWB2) and communication links (110, 210; 111, 112,113, 211, 212, 213), wherein a communication link (111, 112,113, 211, 212, 213) is connecting a receiver (RCV1, RCV2, RCV3) to a switch (SWA, SWB; SWA1, SWB1) of a disjoint communication path and a communication link (110, 210) is connecting the sender to a switch of said disjoint communication path, and wherein (a) the switches (SWA, SWA1, SWB, SWB1) are equipped with local clocks, wherein local clocks of non-faulty switches of said switches (SWA, SWB, SWA1, SWB1) are synchronized to each other with a maximum error (precision), and the sender and all receivers (RCV1, RCV2, RCV3) are equipped with local clocks, wherein the local clocks of a non-faulty sender and non-faulty receivers are synchronized to the local clocks of the switches with a known error (precision), and the sender sends the redundant copies (MSGA, MSGB) of a message according to a communication schedule and the receivers know when to expect a message according to said communication schedule, and wherein (b) the receivers (RCV1, RCV2, RCV3) are configured to detect failures of switches (SWA, SWA1, SWB, SWB1), and wherein (c) redundant copies (MSGA, MSGB) of a message are forwarded by the sender to each of the receivers (RCV1, RCV2, RCV3), wherein each of the redundant copies (MSGA, MSGB) designated for a receiver (RCV1, RCV2, RCV3) is forwarded across a different disjoint communication path connecting the sender with said receiver (RCV1, RCV2, RCV3), and wherein (d) at least one switch of each disjoint communication path from the sender to the receivers (RCV1, RCV2, RCV3) is configured such that the redundant copies (MSGA, MSGB) of the message are forwarded to each receiver (RCV1, RCV2, RCV3) with a temporal distance, CON, between the disjoint communication paths, wherein the temporal distance, CON, is selected such that all non-faulty receivers of the receivers (RCV1, RCV2, RCV3) will receive the redundant copies (MSGA, MSGB) in the same receive order, when the switches and communication links of the disjoint paths do not exhibit a failure, and wherein (e) each receiver (RCV1, RCV2, RCV3) concludes at least from the receive order of the redundant copies (MSGA, MSGB) of the message whether and which redundant copy (MSGA, MSGB) to accept to satisfy the interactive consistency property, and if the conclusion yields to accept a specific copy (MSGA, MSGB) of the received redundant copies of the message, said specific message is accepted by the receiver, and if the conclusion yields to not accept any copy of the receive redundant messages, no copy is accepted by the receiver (RCV1, RCV2, RCV3). (a) the switches (SWA, SWA1, SWB, SWB1) are equipped with local clocks, wherein local clocks of non-faulty switches of said switches (SWA, SWB, SWA1, SWB1) are synchronized to each other with a maximum error (precision), and the sender and all receivers (RCV1, RCV2, RCV3) are equipped with local clocks, wherein the local clocks of a non-faulty sender and non-faulty receivers are synchronized to the local clocks of the switches with a known error (precision), and the sender sends the redundant copies (MSGA, MSGB) of a message according to a communication schedule and the receivers know when to expect a message according to said communication schedule, and wherein (b) the receivers (RCV1, RCV2, RCV3) are configured to detect failures of switches (SWA, SWA1, SWB, SWB1), and wherein (c) redundant copies (MSGA, MSGB) of a message are forwarded by the sender to each of the receivers (RCV1, RCV2, RCV3), wherein each of the redundant copies (MSGA, MSGB) designated for a receiver (RCV1, RCV2, RCV3) is forwarded across a different disjoint communication path connecting the sender with said receiver (RCV1, RCV2, RCV3), and wherein (d) at least one switch of each disjoint communication path from the sender to the receivers (RCV1, RCV2, RCV3) is configured such that the redundant copies (MSGA, MSGB) of the message are forwarded to each receiver (RCV1, RCV2, RCV3) with a temporal distance, CON, between the disjoint communication paths, wherein the temporal distance, CON, is selected such that all non-faulty receivers of the receivers (RCV1, RCV2, RCV3) will receive the redundant copies (MSGA, MSGB) in the same receive order, when the switches and communication links of the disjoint paths do not exhibit a failure, and wherein (e) each receiver (RCV1, RCV2, RCV3) concludes at least from the receive order of the redundant copies (MSGA, MSGB) of the message whether and which redundant copy (MSGA, MSGB) to accept to satisfy the interactive consistency property, and if the conclusion yields to accept a specific copy (MSGA, MSGB) of the received redundant copies of the message, said specific message is accepted by the receiver, and if the conclusion yields to not accept any copy of the receive redundant messages, no copy is accepted by the receiver (RCV1, RCV2, RCV3).