A steam turbine system operative to receive motive steam and drive an electric generator and produce electric power, said turbine comprising a plurality of turbine sections, a plurality of throttle and governor valves for directing steam through said turbine sections, and a control system including at least a first digital computer and a second digital computer, means for generating input signals representing predetermined process variables associated with said steam turbine including speed and load, means for coupling the input signals to both of said computers, each of said computers having means for controlling its sequential programmed operation and including substantially identical means for generating control outputs for operating said throttle and governor valves of said steam turbine as a function of the input signals, said control output generating means including means for generating a speed or load reference, means for generating a speed or load demand from the speed or load reference and the actual speed or load, means responsive to the speed or load demand for generating the control outputs for the valves and substantially satisfying the speed or load reference, means for sensing predetermined control system malfunctions, means for coupling the outputs of one of said computers to operate said steam turbine valves, means for substantially conforming the structure of the other computer to the structure of said one computer in real time including means for generating predetermined turbine control outputs in the other computer substantially equal to corresponding ones from said one computer, means for data linking said computers, each of said computers including means for initializing itself after a stoppage including means for transferring the status of predetermined initialization variables over said data link means from one of said computers in control to the other computer being initialized, and means for executing a transfer in the control of the steam turbine from said one computer to said other computer substantially without disturbing the power generation when said sensing means detects a control system malfunction and after said other computer is initialized.