A method and redundant control system for an actuator in which two redundant control computers are connected via buses to a respective peripheral station containing an interface module and at least one periphery module, wherein the actuator is connected to mutually decoupled signal outputs of two periphery modules, each forming an output module, of the two peripheral stations, where output values generated by the two redundant control computers for the actuator are transmitted by the interface modules to the output modules, wherein upon detection of a bus fault, the respective interface module transmits a command to all downstream output modules to output substitute values, and where output modules to which the actuator is connected exchange information about receipt of the command via a communication link and implement it only if another output module concerned has also received the command so as to prevent failure modes in redundant operation.

A method and redundant control system for an actuator in which two redundant control computers are connected via buses to a respective peripheral station containing an interface module and at least one periphery module, wherein the actuator is connected to mutually decoupled signal outputs of two periphery modules, each forming an output module, of the two peripheral stations, where output values generated by the two redundant control computers for the actuator are transmitted by the interface modules to the output modules, wherein upon detection of a bus fault, the respective interface module transmits a command to all downstream output modules to output substitute values, and where output modules to which the actuator is connected exchange information about receipt of the command via a communication link and implement it only if another output module concerned has also received the command so as to prevent failure modes in redundant operation.