Fault-tolerant method for recognizing errors in an electronics system for operating a controlled object

Abstract

The invention relates to a method for operating a controlled object, that is embedded in a changing environment, wherein the controlled object and its environment are periodically observed using sensors, and, in each frame, at least three independent data flow paths (DFPs) are executed based on the data recorded through the observation of the controlled object and its environment. A first DFP determines from the data collected through the observation of the controlled object and its environment via complex software a model of the controlled object and of the environment of the controlled object and conducts a trajectory planning, in order to create one or a plurality of possible trajectories, that, under the given environmental conditions, correspond to a specified task assignment; and a second DFP, from the data collected through the observation of the controlled object and its environment via preferably diversitary, complex software, determines a model of the controlled object and of the environment of the controlled object and specifies a safe space-time domain, SRZD, within which SRZD all safe trajectories must be located; a third DFP determines from the data collected through the observation of the controlled object and its environment a model of the controlled object and its environment and, based on this model, calculates an emergency trajectory, and wherein in normal operation a deciding instance verifies whether the emergency trajectory is located within the safe space-time domain (SRZD).