Fault-tolerant method for operating an autonomous controlled object

An electronic system for operating a controlled object that is embedded in a changing environment, wherein the electronic system that implements a control system comprises sensors, actuators, and node computers, which all exchange data via a real-time communication system, the system comprising:

• wherein the sensors are configured to periodically observe the controlled object and its environment, wherein in each frame, at least two independent data flow paths (“DFPs”) are configured to be executed based on data recorded though the observation of the controlled object and its environment, wherein the observation is configured to be carried out for each of the at least two independent DFPs via different sensors;
• a first DFP configured to determine, from the data recorded by the observation of the controlled object and its environment via complex software, a model of the controlled object and its environment, and on the basis of this model, carry out a trajectory planning in order to create one or more possible trajectories that, based on the environment, correspond to a specified task assignment;
• and
• a second DFP configured to determine, from the data recorded by the observation of the controlled object and its environment via a diversitary complex software, a model of the controlled object and its environment, and on the basis of this model, determine a safe space-time domain (“SRDZ”), within which all safe trajectories of the one or more possible trajectories must be located,
• wherein results of the first DFP and the second DFP are configured to be transmitted to a deciding instance, wherein the deciding instance is realized via simple software, wherein the deciding instance is configured to verify whether at least one of the one or more possible trajectories determined by the first DFP is safe, meaning located within the SRZD that was determined by the second DFP, wherein, in where there is a match, one of the safe trajectories determined by the first DFP is selected, and the deciding instance transmits target values corresponding to the selected trajectory to an actuator control, wherein, in instances where there is not a match, the deciding instance waits for results of at least one following frame, and wherein, in the case that there is no safe trajectory available in the following frame or the frame after that, the deciding instance switches to an emergency trajectory.