A method for reducing false negatives in fail-safe trajectory planning for a moving entity, where the method uses at least three subsystems (COM, MON, DECIDE), wherein a first of said subsystems, the so-called commander, implements at least a sensor fusion stage and a trajectory planning stage (TRJ-PLN), and wherein a second of said subsystems, the so-called monitor implements at least a sensor fusion stage and a safe envelope generating stage and wherein sensors (SENS1-SENS3, SENSk, SENSk1) are monitoring the surrounding of the moving entity, and wherein said sensor fusion stages (SF1, SF2) of the commander and the monitor accept raw and/or preprocessed sensor data from the monitoring by said sensors (SENS1-SENS3, SENSk, SENSk1) as input, and wherein based on said input the sensor fusion stages (SF1, SF2) of the commander and the monitor produce as output real-time images (COM-OBJ1, COM-OBJ2, MON-OBJ1, MON-OBJ2) of objects (OBJ1, OBJ2) detected due to the monitoring by the sensors, and wherein the trajectory planning stage (TRJ-PLN) of the commander generates one or more trajectories (COM-TRJ1, COM-TRJ2) based at least on the output of the sensor fusion stage of the commander, and wherein said safe envelope generating stage of the monitor generates a safety envelope based at least on the output of the sensor fusion stage of the monitor, and wherein a trajectory verification stage (TRJ-VRFY) of the monitor and/or a trajectory verification stage (TRJ-VRFY) of a decision subsystem (DECIDE) verifies a trajectory (COM-TRJ1, COM-TRJ2) generated by the commander if and only if said trajectory (COM-TRJ1, COM-TRJ2) is completely located inside said safety envelope generated by the safe envelope generating stage of the monitor, and wherein a moving entity uses a trajectory (COM-TRJ1, COM-TRJ2) generated by the commander only when said trajectory is verified by the monitor and/or by the decision subsystem (DECIDE), wherein the commander implements an information merging stage that takes as information at least parts of the output (COM-OBJ1, COM-OBJ2) of the sensor fusion stage of the commander and at least parts of the output (MON-OBJ1, MON-OBJ2) of the sensor fusion stage of the monitor and combines said information to generate output (MRG-OBJ1, MRG-OBJ2), and wherein the trajectory planning stage (TRJ-PLN) of the commander uses said generated output (MRG-OBJ1, MRG-OBJ2) of said information merging stage when generating one or more trajectories (COM-TRJ1, COM-TRJ2), wherein the information merging stage uses a set-theoretic superset operation to combine the outputs (COM-OBJ1, COM-OBJ2, MON-OBJ1, MON-OBJ2) from the sensor fusion stages (SF1, SF2) to produce output (MRG-OBJ1, MRG-OBJ2), or in the case that the sensor fusion stages (SF1, SF2) produce a free space as output, the information merging stage uses a set-theoretic cut-set operation to combine the outputs (COM-OBJ1, COM-OBJ2, MON-OBJ1, MON-OBJ2) from the sensor fusion stages (SF1, SF2), or where the commander implements an information agreement stage, the so-called first information agreement stage, wherein said first information agreement stage takes as information at least parts of the raw and/or preprocessed sensor data from sensors (SENS1-SENS3, SENSk, SENSk1) and in addition takes information indicating which raw and/or preprocessed sensor data the monitor accepts from the monitoring of said sensors (SENS1-SENS3, SENSk, SENSk1) as input in its sensor fusion stage, based on which input the commander and the monitor produce as output real-time images, wherein said first information agreement stage provides at least parts of the raw and/or preprocessed sensor data from sensors (SENS1-SENS3, SENSk, SENSk1) and in addition takes information indicating which sensor data the monitor will use in its sensor fusion stage to the trajectory planning stage (TRJ-PLN), and wherein said trajectory planning stage (TRJ-PLN) uses said information from said first information agreement stage to add safety margins around the real-time images (COM-OBJ1, COM-OBJ2) provided from the sensor fusion stage of the commander, and wherein said trajectory planning stage (TRJ-PLN) produces trajectories (COM-TRJ1, COM-TRJ2) that do not intersect neither with the real-time images (COM-OBJ1, COM-OBJ2) produced by the sensor fusion stage of the commander nor with said safety margins around them.