Fault-tolerant method for recognizing errors in an electronics system for operating a controlled object

A method for operating a controlled object that is embedded in a changing environment, wherein the electronic system that implements the control system includes sensors, actuators, and node computers, which exchange data via a real-time communication system, the method comprising:

• periodically observing the controlled object and its environment using sensors and in each frame, at least three independent data flow paths, DFP, are executed based on the data recorded though the observation of the controlled object and its environment, wherein, for each DFP, the observation is carried out via different sensors;
• determining, by a first DFP from the data recorded by the observation of the controlled object and its environment via a complex software, a model of the controlled object and of the environment of the controlled object and, on the basis of this model, carries out a trajectory planning in order to create one or a plurality of possible trajectories that, under the given environmental conditions, correspond to a specified task assignment;
• determining, by a second DFP from the data recorded by the observation of the controlled object and its environment via a diversitary complex software program, a model of the controlled object and of the environment of the controlled object and, on the basis of this model, determines a safe space-time domain, SRZD, within which SRZD all safe trajectories must be located;
• and
• determining, by a third DFP from the data recorded by the observation of the controlled object and its environment, a model of the controlled object and its environment and, on the basis of this model, calculates an emergency trajectory,
• wherein in normal operation a deciding instance verifies whether the emergency trajectory is located within the safe space-time domain (SRZD).