Fault-tolerant method for operating an autonomous controlled object

1. A method for operating a controlled object that is embedded in a changing environment, wherein an electronic system that implements a control system comprises sensors, actuators, and node computers, which all exchange data via a real-time communication system, the method comprising:

periodically observing the controlled object and its environment using the sensors;

executing, in each frame, at least two independent data flow paths (“DFPs”) based on data recorded though the observation of the controlled object and its environment, wherein the observation is carried out for each of the at least two independent DFPs via different sensors;

determining, by a first DFP of the at least two independent DFPs from the data recorded by the observation of the controlled object and its environment via complex software, a model of the controlled object and its environment, and on the basis of this model, carrying out a trajectory planning in order to create one or more possible trajectories that, based on the environment, correspond to a specified task assignment; and

determining, by a second DFP of the at least two independent DFPs from the data recorded by the observation of the controlled object and its environment via a diversitary complex software, a model of the controlled object and its environment, and on the basis of this model, determining a safe space-time domain (“SRZD”) within which all safe trajectories of the one or more possible trajectories must be located,

wherein results of the first DFP and the second DFP are transmitted to a deciding instance, wherein the deciding instance is realized via simple software, wherein the deciding instance verifies whether at least one of the one or more possible trajectories determined by the first DFP is safe, meaning located within the SRZD that was determined by the second DFP, wherein, in instances where there is a match, one of the safe trajectories determined by the first DFP is selected, and the deciding instance transmits target values corresponding to the selected trajectory to an actuator control, wherein, in instances where there is not a match, the deciding instance waits for results of at least one following frame, and wherein, in the case that there is no safe trajectory available in the following frame or the frame after that, the deciding instance switches to an emergency trajectory.

2. The method according to claim 1 , wherein calculations of the deciding instance are executed on triple modular redundancy (“TMR”) hardware.

3. The method according to claim 1 , wherein calculations of the deciding instance are executed simultaneously on two independent, self-checking hardware modules.

4. The method according to claim 1 , wherein a third independent DFP calculates the emergency trajectory, which is sent to the deciding instance.

5. The method according to claim 1 , wherein the deciding instance checks whether the emergency trajectory is safe after determining that one of the one or more possible trajectories calculated by the first DFP is safe, and in instances where the emergency trajectory is not available or safe, delivers an alarm message to a user of the controlled object.

6. The method according to claim 1 , wherein the controlled object is a vehicle.

7. The method according to claim 1 , wherein the sensors comprise a plurality of sensors, the actuators comprise a plurality of actuators, and the node computers comprise a plurality of node computers.

8. An electronic system for operating a controlled object that is embedded in a changing environment, wherein the electronic system that implements a control system comprises sensors, actuators, and node computers, which all exchange data via a real-time communication system, the system comprising:

wherein the sensors are configured to periodically observe the controlled object and its environment, wherein in each frame, at least two independent data flow paths (“DFPs”) are configured to be executed based on data recorded though the observation of the controlled object and its environment, wherein the observation is configured to be carried out for each of the at least two independent DFPs via different sensors;

a first DFP configured to determine, from the data recorded by the observation of the controlled object and its environment via complex software, a model of the controlled object and its environment, and on the basis of this model, carry out a trajectory planning in order to create one or more possible trajectories that, based on the environment, correspond to a specified task assignment; and

a second DFP configured to determine, from the data recorded by the observation of the controlled object and its environment via a diversitary complex software, a model of the controlled object and its environment, and on the basis of this model, determine a safe space-time domain (“SRDZ”), within which all safe trajectories of the one or more possible trajectories must be located,

wherein results of the first DFP and the second DFP are configured to be transmitted to a deciding instance, wherein the deciding instance is realized via simple software, wherein the deciding instance is configured to verify whether at least one of the one or more possible trajectories determined by the first DFP is safe, meaning located within the SRZD that was determined by the second DFP, wherein, in where there is a match, one of the safe trajectories determined by the first DFP is selected, and the deciding instance transmits target values corresponding to the selected trajectory to an actuator control, wherein, in instances where there is not a match, the deciding instance waits for results of at least one following frame, and wherein, in the case that there is no safe trajectory available in the following frame or the frame after that, the deciding instance switches to an emergency trajectory.

9. The system according to claim 8 , wherein calculations of the deciding instance are executed on triple modular redundancy (“TMR”) hardware.

10. The system according to claim 8 , wherein calculations of the deciding instance are executed simultaneously on two independent, self-checking hardware modules.

11. The system according to claim 8 , wherein a third independent DFP is configured to calculate the emergency trajectory, which is sent to the deciding instance.

12. The system according to claim 8 , wherein the deciding instance is configured to check whether the emergency trajectory is safe after determining that of the one or more possible trajectories calculated by the first DFP is safe, and in instances where the emergency trajectory is not available or safe, delivers an alarm message to a user of the controlled object.