A method for controlling a controlled object, for example a vehicle, which is embedded in a changing environment, wherein an electronic system carrying out the control comprises sensors , particularly a multiplicity of sensors, actuators, particularly a multiplicity of actuators, and node computers (251, 252, 253; 351, 352), particularly a multiplicity of node computers, which exchange data by means of a real-time communication system , wherein the method provides that the controlled object and the environment thereof are monitored periodically using sensors , and at least two independent data flow paths DFP are executed in each frame based on the data recorded by means of the monitoring of the controlled object and the environment thereof, wherein the monitoring takes place by means of different sensors for each DFP for example, and wherein • a first DFP determines a model of the controlled object and the environment of the controlled object by means of complex software from the data recorded by means of the monitoring of the controlled object and the environment thereof and carries out trajectory planning on the basis of this model, in order to create one or more possible trajectories, which correspond to a predetermined task under the given environmental conditions, and wherein • a second DFP determines a model of the controlled object and the environment of the controlled object by means of complex software , which is different from the complex software of the first DFP, from the data detected by means of the monitoring of the controlled object and the environment thereof, and, on the basis of this model, determines a safe space-time domain SRZD, inside which SRZD all safe trajectories must lie, and wherein the first DFP and the second DFP are executed on an independent fault containment unit (FCU) in each case, and wherein the results of the first and the second DFP are transferred to a decision instance , wherein the decision instance is realized by means of simple software, which is executed on fault-tolerant hardware and, by contrast with more complex software, can be formally checked or exhaustively tested, and wherein the decision instance checks whether at least one of the trajectories determined by the first DFP is safe, i.e. lies inside the SRZD, which was determined by the second DFP , and wherein, in the event that this is the case, a safe trajectory determined by the first DFP is selected, and wherein the decision instance transfers the set-point values corresponding to the selected trajectory to an actuator control , and wherein, in the event that this is not the case, the results of at least one following frame are awaited, and wherein, in the event that no safe trajectory is present also in the next or next but one frame, switching takes place from the decision instance to an emergency trajectory. • a first DFP determines a model of the controlled object and the environment of the controlled object by means of complex software from the data recorded by means of the monitoring of the controlled object and the environment thereof and carries out trajectory planning on the basis of this model, in order to create one or more possible trajectories, which correspond to a predetermined task under the given environmental conditions, and wherein • a second DFP determines a model of the controlled object and the environment of the controlled object by means of complex software , which is different from the complex software of the first DFP, from the data detected by means of the monitoring of the controlled object and the environment thereof, and, on the basis of this model, determines a safe space-time domain SRZD, inside which SRZD all safe trajectories must lie, <EOS>