Method, software program product and apparatus for secure-steering speed monitoring

Abstract

The invention relates to a method for securely guided speed monitoring of an autonomous mobile unit, and to a software program product and to a device. A solution is proposed to reliably determine the speed of an autonomous mobile unit AMR without any additional special hardware. In the proposed solution, only components that would otherwise be needed for AMR are used. These components or data determined by the components are now suitably incorporated into corresponding software using a programmable controller, so that the current speed can be reliably determined substantially without the use of additional hardware.

Description

Technical Field

[0001] The invention relates to a method for safety-guided speed monitoring of an autonomous mobile unit, as well as a software program product and an apparatus. Background Art

[0002] Autonomous mobile units, such as autonomous mobile robots (AMRs for short) and other driverless vehicles, such as forklifts, are increasingly used for material transport in industrial environments. The Type C standards ISO 3691-4:2020 (Industrial trucks - Safety requirements and verification - Part 4: Driverless industrial trucks and their systems) and EN 1525:1997 (Safety of industrial trucks - Driverless industrial trucks and their systems) provide guidelines intended to ensure personal protection of people working in the environment. When implementing safety devices, so-called safety-oriented controllers (SSPS or F-SPS) are used more and more frequently. Safety-oriented or fail-safe means that a person is reliably detected in the area and the vehicle is safely shut down when this person enters the area.

[0003] The EN 61508 series "Functional safety of electrical / electronic / programmable electronic systems" is a basic safety standard that is independent of use and covers the functional safety of electrical, electronic and programmable electronic systems. It is therefore the central standard for the subject of functional safety of control systems.

[0004] Safety-oriented laser scanners are usually used for personal protection, which are connected to emergency stop switches and actuators by means of safety-oriented control units.

[0005] The monitoring area of ​​such safety-oriented laser scanners is usually static, which results in a maximum speed limitation. It is also possible to adaptively switch the size of the monitoring area based on the speed and direction of the vehicle.

[0006] Figure 1A scenario with an autonomous mobile unit (100) is shown, which has a safety-oriented controller 110 and an optical sensor LS. The autonomous mobile device 100 moves in different directions of movement depending on the drive type; Vx points forward; the figure shows a minimum speed Vmin, a maximum speed Vmax, and intermediate speeds V1, V2. The rotation speed Vw enables the mobile device to rotate in other directions and must also be taken into account in further considerations. The encoder ENG monitors the movement of the wheels; it is understood to mean an encoder that forms a signal from the movement; the encoder usually operates in an optical, magnetic or mechanical contact manner. These are measuring sensors or input devices that are able to detect the current position of a shaft or drive unit and output the current position as an electrical signal. Encoders are divided into two types: rotary encoders, which are mounted on a rotating component, for example on a motor shaft. Linear encoders are typically mounted on a component with a linear movement.

[0007] For example, DE 10 2019 111 642 B3 shows a similar device: a vehicle with a safety system having a motion sensor for monitoring speed and a photoelectric safety sensor for monitoring the environment. Movement information related to the vehicle is used to compare the speed value from the first sensor with the movement value from the second sensor.

[0008] What is now to be prevented is that a person (or another vehicle) P moves at its own speed 102 into the safety area of ​​the mobile device 100 .

[0009] For vehicles with a differential drive (two drives) or a kinematic mechanism with only a steering axis and a swivel axis, like conventional forklifts, the calculation workload for the safety-oriented speed is not a problem.

[0010] However, in vehicles with omnidirectional drive (eg Mecanum drive), ie vehicles equipped with Mecanum wheels, the computational workload increases in the safety-oriented part of the programmable logic unit.

[0011] The velocity vectors Vx, Vy and the rotation W depend on the individual velocities of wheels V1, V2, V3 and V4. In this case, R represents the radius of the Mecanum wheel. The following formulas illustrate the calculation of the forward kinematics.

[0012]

[0013] In addition to the increased computing workload, which is computationally intensive and therefore cost-intensive in the safety-oriented controller, safety-oriented encoders are required on each of the four axes. These require space and a safety-oriented connection to the safety-oriented controller.

[0014] Errors such as wheel slip cannot be excluded. This means that, despite the use of safety-oriented encoders, errors such as further sliding during braking or wheel slip during acceleration cannot be excluded.

[0015] Currently, safety-oriented encoders are used on the axles of the vehicle. The rotational speed is evaluated by a safety-oriented computing unit (F-PLC) to enable calculations of the forward kinematics. Based on the speed and direction of travel, the laser scanner field can be switched to avoid collisions with people.

[0016] For this purpose, safety-oriented controllers and safety-oriented encoders have been provided to be able to calculate the speed and direction and switch the monitoring area accordingly. However, in this case, the type of kinematic mechanism cannot be freely defined but can only be used for common kinematic mechanisms, such as differential kinematic mechanisms.

[0017] An exemplary structure can be Figure 2 , which has a safety-oriented controller 203. A safety-oriented encoder ENG monitors the movement of the drive 200. Optical sensors LS1, LS2 monitor monitoring areas 201, 202 of the respective driving directions of the autonomous mobile device. These may be laser scanners, lidars, 1D, 2D, 3D cameras or similar devices. Figure 2 Not shown is an emergency stop button that is mounted on the mobile device and that can manually trigger an emergency stop. Summary of the invention

[0018] The object of the present invention is therefore to enable a standardized implementation of safety-oriented speed detection for more complex vehicles.The computational effort of safety-oriented calculations should be reduced as much as possible.

[0019] The object is therefore achieved by a method having the features of independent claim 1. The object is also achieved by a computer program product for executing the steps of the method according to the features of one of claims 1 to 16. The object is also achieved by a device according to the features of claim 17.

[0020] In the claimed method for safety-oriented speed monitoring of an autonomous mobile unit, which has at least one movement device with a movement detection system (encoder) and at least one environment detection system (camera, laser scanner, lidar or similar device) on board the autonomous mobile unit, the method comprises the following steps:

[0021] - determining a first movement vector based on measurements of a movement detection system from first data relating to the mobile unit using a first method,

[0022] - determining a second motion vector of the mobile unit from the second data based on the measurements of the environment detection system using a second method, and

[0023] The first movement vector and the second movement vector are checked by cross comparison and a statement about the validity and the output of the movement vector regarded as safety-oriented is made as a result.

[0024] The object is also achieved by a device for safety-oriented speed monitoring of an autonomous mobile unit, which has

[0025] at least one motion device (encoder) with a motion detection system, wherein a first motion vector can be determined based on the measured values ​​of the motion detection system, and

[0026] at least one environment monitoring system located on board an autonomous mobile unit, wherein a second movement vector of the mobile unit can be determined from the second data based on the measurements of the environment monitoring system, and

[0027] - having a diagnostic unit for checking the first data and the second data

[0028] - a programmable controller for checking the first movement vector and the second movement vector by cross comparison, and

[0029] Based on the inspection results obtained from the diagnostic unit, safety-oriented decisions are made for the mobile unit, wherein

[0030] As a result, a statement of validity can be output as well as a movement vector that is considered to be safety-oriented.

[0031] Further advantageous exemplary embodiments of the invention are described in the dependent claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In addition, the present invention is further explained in more detail by the accompanying drawings, which show

[0033] Figure 1 An exemplary application scenario with AMR is shown.

[0034] Figure 2 shows an exemplary structure of a known AMR,

[0035] Figure 3 shows an overview of the method according to the invention,

[0036] Figure 4 shows a plausibility check according to the method of the invention,

[0037] Figure 5 A method with coordinate system dynamization is shown, and

[0038] Figure 6 This method and the special case of safe start-up after shutdown are shown. DETAILED DESCRIPTION

[0039] A solution is proposed to safely determine the speed of an autonomous mobile device (AMR) without the need for additional dedicated hardware. In the proposed solution, only components necessary for AMR applications are used. These components include:

[0040] - A programmable controller (PLC, Programmable Logic Controller PLC), capable of making safety-oriented decisions. This is necessary for the AMR to stop safely, for example to avoid a collision with an obstacle.

[0041] - Optical systems / optical sensors for scanning obstacles. Such systems are now commonly found in AMRs in order to determine the position in space (non-safety-oriented) within the context of navigation. Optical sensors can perform one-dimensional detection, two-dimensional detection or three-dimensional detection.

[0042] These include, for example, various types of cameras, stereo cameras (2D, 3D), in particular movably mounted laser scanners or lidars, which generate so-called point clouds during the detection.

[0043] - A system for measuring the movement of the wheels of the AMR (odometry). This also includes the mentioned encoders. This system requires controlling the drive anyway (in a non-safety-oriented manner).

[0044] There are other ways to determine the speed of a vehicle, such as:

[0045] - Calculate velocity by visual odometry from a camera pointed at a fixed location, such as the floor or ceiling

[0046] - calculate velocity by visual odometry of a 3D camera pointed in space,

[0047] - Calculate the velocity by the position and time difference of two positioning tags of the Cartesian 3D positioning system.

[0048] The principle presented here allows any two methods to be combined. A prerequisite for safety is the use of physically different measuring principles in the two channels.

[0049] These components or the data determined by the components are now suitably linked to one another by the programmable controller in corresponding software, so that the current speed can be determined safely overall, in particular without the use of additional hardware.

[0050] Figure 31 shows how the above components are arranged. In the exemplary embodiment, the optical sensor 301 (laser scanner, possibly multiple laser scanners (LS, LS1, LS2)) periodically provides a point cloud 311 of all detected obstacles to the software module "Scan Matcher" 303. Each generated point cloud is provided with a time stamp in this way. By comparing with the point cloud of the previous cycle, the scan matcher calculates the velocity vector 313 (x component, y component and current rotation speed w).

[0051] At the same time, for example, the movement sensor 302 (rotary encoder, Encoder) provides the current position of one or more axes monitored by the AGV to the software component 304 "forward transformation". By referring to the axis position of the previous cycle, the forward transformation also calculates the velocity vector (vx, vy, w). In this case, the movement of the motion device 200 is detected by synchronously detecting the respective axis positions of the motion device at at least two points in time with the help of a rotary encoder or other movement sensor, especially in real time, and providing the axis position with a timestamp. The movement vector is calculated by the forward transformation 304 from at least two axis positions determined relative to the time point.

[0052] Optical sensors, motion sensors (distance), scan matching and forward transformation do not need to be implemented in a safety-oriented manner. In particular, existing components can be used for this purpose.

[0053] Two separate velocity vectors are determined or calculated in different ways by independent and different measuring methods and are now compared. Errors affecting both channels can lead to different error results, which can be detected by the subsequent comparison. In addition, the calculation paths are completely separate in terms of software, but can be run on the same hardware, so further measures must be taken to detect systematic errors in both calculations.

[0054] The two velocity vectors calculated in different ways as well as the raw input data (e.g. point cloud determined by optical sensor + axis increments determined by mobile sensor) are passed to the safety diagnostics 305. This is implemented using safety technology and a plausibility and consistency check is performed. If the check is successful, the output is now considered to be a safety-oriented velocity vector 316 and can be used for safety-oriented decisions 306. If an error is detected, the output "isValid" 317 is deleted and / or a safe alternative value is provided (e.g. the maximum possible velocity Vmax, in order to thus activate the maximum protective field, see Figure 1 ).

[0055] If the current speed is output or the output "isValid" 317 is deleted, the system is considered safe. If an incorrect speed is output and at the same time the output "isValid" 317 is set, the system is potentially unsafe.

[0056] In order to reduce the likelihood of potentially unsafe outputs, the following diagnostic measures are recommended and will be performed using safety techniques in the diagnostic unit 305. These will be described in more detail below:

[0057] Reasonableness check (PC) 321, 323

[0058] Cross Comparison (CC) 322

[0059] Diversified Coordinate System (DC)

[0060] Dynamic Coordinate System (DYC)

[0061] Safe Start after Shutdown (SVS)

[0062] 1. Plausibility Check 321, 323, Plausibility Check (PC)

[0063] In an advantageous embodiment, the plausibility checks 321 , 323 include at least one of the following checks:

[0064] - the determined speed lies within the previously set value range,

[0065] - the determined acceleration lies within the previously set value range,

[0066] - there is noise in the determined values,

[0067] The determined movement corresponds to the desired movement pattern.

[0068] The two input channels 311, 315 are advantageously checked for plausibility independently of one another, ie see Figure 4 Specifically, the following checks can be performed, for example:

[0069] Is the determined speed of the AMR within a specified range, for example, is it less than the maximum speed Vmax of the AMR? Serious errors such as confusing speed with other process values ​​can be detected.

[0070] The construction of the first derivative makes it possible to determine whether the acceleration or deceleration is within a specified range. In the absence of a fault, there is no sudden and unexpected drop of the velocity to zero, for example due to mass inertia. This therefore makes it possible to detect a fault in the sensor quite simply in an advantageous manner.

[0071] In the error-free case, noise can also be detected in the raw measured values ​​from optical sensors and / or motion sensors (e.g. point clouds or axis increments), i.e. there are always certain differences between the measurement results at different points in time. If this is not the case, this is also regarded as a fault of the corresponding sensor (frozen sensor).

[0072] During operation, the AMRs only move briefly at a constant speed as they brake at a corner, turn, and then accelerate again. If the speed of the lane does not change significantly for a longer period of time, it is also assumed that the sensor is frozen.

[0073] Failure of the clock used to generate the time stamp in the laser scanner can be detected by comparison with a fail-safe clock in the diagnostic unit.

[0074] All plausibility checks are implemented in a safety-oriented manner. Therefore, failure of the test itself does not have to be expected. If at least one test fails, the output isValid, 317 is deleted or a safe substitute value is provided as the velocity vector.

[0075] 2. Cross-Check (CC)

[0076] In the simplest case, the cross comparison 322 consists of three pairwise comparisons of the components vx, vy, w of the velocity vectors. (i.e., the values ​​of the first movement vector 313 and the second movement vector 314 are compared in pairs, as well as the possible rotation angles.) Their difference must be numerically smaller than a threshold value t previously set according to the technical key data of the AGV being checked.

[0077] |vxl-vx2| <t1

[0078] |vyl-vy2| <t2

[0079] |wl-w2| <t3

[0080] The values ​​of t1, t2, and t3 also determine the accuracy of the output speed in the absence of errors.

[0081] In an advantageous embodiment, the Euclidean distance of the Cartesian vectors vx and vy provided by the two channels is calculated to increase the accuracy:

[0082] sqrt[(vx1-vx2) 2 +(vy1-vy2) 2 ] <t4

[0083] |w1-w2| <t3

[0084] In a further advantageous embodiment, the faster channel is purposefully buffered in order to enable a comparison of the speeds detected simultaneously by the sensors, since it cannot be expected that both channels will have identical reaction times.

[0085] A small measurement error in position may lead to a relatively large error in the calculated velocity, thus causing noise in the velocity value. This noise can be reduced by filtering (eg FIR filter), but it must be taken into account that such filtering will correspondingly prolong the reaction time.

[0086] The cross comparison or plausibility check 321 , 323 is carried out in a fully or at least partially functionally safe manner.

[0087] The cross comparison itself is carried out in a safety-oriented manner (F-CPU); if it fails, the output isValid and therefore the statement about validity 317 are deleted.

[0088] The cross-compare detects any errors that affect only one of the two channels.

[0089] 3. Diverse Coordinate Systems (DC)

[0090] Figure 5 Other advantageous embodiments are shown. Random hardware errors that affect the output of the scan matcher 303 and the output of the forward transform in the same way cannot usually be discovered by cross comparison. For example: if the value vx is overwritten by the same value in both cases, this cannot be detected by cross comparison.

[0091] Therefore, the sensor data (point cloud) 311 from the sensor 301 undergoes a coordinate system transformation before being processed by the scan matcher. This can include, for example:

[0092] -Translate all points by vector (tx, ty),

[0093] - Rotate all points around the point (rx, ry) by angle α,

[0094] - scale all points along the X axis sx,

[0095] - scale all points along the Y axis sy,

[0096] - A combination of the above mentioned transformations.

[0097] Transformations can be time-independent (constant) or time-dependent.

[0098] A time-independent rotation about the angle α results in the results vx', vy' also having to (always) be interpreted as a rotation about the angle α.

[0099] A time-dependent transformation means that the change is time-dependent, ie, for example, a rotation angle will always increase. For example, a time-dependent rotation about an angle α(t) will result in w' which must be interpreted as increasing by the corresponding value.

[0100] This transformation results in a purposeful modification of the input of the scan matcher 303. The modification is undone by the diagnosis unit 305 before the cross comparison is performed.

[0101] By targeted modification, random hardware errors that affect the scan matcher output and the forward transform output can be detected in the same way by cross comparison. For example: if the values ​​vx and vx' are overwritten with the same value, this will lead to different fault syndromes in both channels after undoing the modification. This leads to detection in the cross comparison.

[0102] 4. Dynamization of Coordinate Systems (DYC)

[0103] Figure 5 A further measure is shown including the dynamization of the diverse coordinate system. This means that the coordinate system used in channel 1 of the sensor 311 is changed at regular time intervals. This can advantageously ensure that freezing or undesired delays in this channel are reliably detected.

[0104] For example, the diagnosis unit changes the correspondingly effective transformation at fixed time intervals. This can use a predetermined calculation scheme or a random selection.

[0105] The diagnostic unit continuously sends 356 the currently valid transformation τ to the decorator 351. In addition, a sequence number S is sent, which will be passed on in all subsequent working steps. Finally, the transformed result (vx', vy', w') arrives at the diagnostic unit 305 together with the sequence number S.

[0106] The sequence number provides information about the type of coordinate system transformation currently being used.

[0107] Based on the serial number, the diagnostic unit is able to decide which modifications need to be undone.

[0108] Furthermore, the diagnostic unit can use the sequence number to detect whether outdated data is present at the input or whether an impermissibly long time is required in a channel.

[0109] By dynamizing the coordinate system, impermissible delays in calculations, for example, in the scan matcher 303 can be detected.

[0110] 5. Safe Vehicle Stop (SVS)

[0111] Figure 6 The special case of a vehicle being stationary for a relatively long time is discussed. This can lead to a potentially dangerous accumulation of errors. For example, channel 1 (first sensor) can first freeze at a zero value. Since this corresponds to reality at standstill, this error cannot be detected. If channel 2 (second sensor) is now also frozen at a zero value, the error still cannot be detected. However, during the next start-up, both channels provide the erroneous zero value, which can lead to dangerous errors (underestimation of the vehicle speed).

[0112] This error scenario can be controlled by the following measures:

[0113] If the vehicle is stationary for a certain time T1 (e.g. T1 = 5 seconds), the diagnostic unit 305 activates the safe standstill monitoring on all axes. During the start-up, the diagnostic unit must be informed by the input "Movingoff" 601. In this case, the diagnostic unit ends the safe standstill monitoring and starts the time limiter T2 (e.g. 3 seconds).

[0114] In a first channel 602 , values ​​such as vx′, vy′, w′, S can be obtained by a dynamic coordinate system. In a second channel 603 , the coordinates vx, vy, w in the example are received accordingly.

[0115] The diagnostic unit checks whether the start was actually carried out. If this is the case, this ensures that no errors have accumulated in both channels during the stop. If the timer T2 expires before the start is detected, this may be due to an accumulation of errors in the channels. In this case, the output "isValid" 604 is deleted. Alternatively, in this case, the safe stop monitoring can also be reactivated in the axis. If the vehicle has indeed moved unnoticed, it will therefore be stopped safely.

[0116] Corresponding commands 605 , 606 , 607 are sent to drive units D1 , D2 , D3 .

Claims

1. A method for safety-oriented speed monitoring of an autonomous mobile unit (100), the autonomous mobile unit having: - at least one movement device (200) with a movement detection system (ENC), and - at least one environment detection system (LS) located on board said autonomous mobile unit (100), in, - determining a first movement vector (313) from first data (311) relating to the mobile unit (100) based on measurements from the movement detection system (ENC) using a first method (301), - determining a second movement vector (314) of the mobile unit from second data (315) based on measurements from the environment detection system (LS) using a second method (302), and - checking the first movement vector (313) and the second movement vector (314) by means of a cross comparison (322) and outputting as a result a statement about the validity (317) and the movement vector (316) considered to be safety-oriented, characterized in that A plausibility check (321, 323) is performed in advance on the first data (311) and / or the second data (315), wherein the plausibility of the first data and the second data (311, 315) are checked independently of one another.

2. The method according to claim 1, characterized in that The second method (302) uses at least one optical sensor (LS, LS1, LS2) to scan an environment (201, 202).

3. The method according to claim 1 or 2, characterized in that: The optical sensors (LS, LS1, LS2) perform one-dimensional detection, two-dimensional detection, or three-dimensional detection.

4. The method according to claim 3, characterized in that The optical sensor is a camera, a stereo camera, in particular a movably mounted laser scanner or a lidar.

5. The method according to any one of the preceding claims, characterized in that During scanning, a point cloud is generated by the optical sensor (LS, LS1, LS2) for each scanning cycle, and a time stamp is provided for each point cloud generated in this way.

6. The method according to any one of the preceding claims, characterized in that The first method (301) detects the movement of the movement device (200) by isochronously, in particular in real time, detecting the position of an axis of the movement device at at least two points in time by means of a rotary encoder (ENC) and providing a time stamp for the axis position.

7. The method according to claim 6, characterized in that The displacement vector is calculated from at least two determined axis positions relative to a point in time by means of a forward transformation.

8. The method according to claim 7, characterized in that The rationality check (321, 323) includes at least one of the following checks: - the determined speed lies within the previously set value range, - the determined acceleration lies within the previously set value range, - there is noise in the determined values, - The determined movement corresponds to the expected movement pattern.

9. The method according to claim 3 or 8, characterized in that: The cross comparison or the plausibility check (321, 323) is carried out in a fully or partially functionally safe manner according to ISO 3691-4:2020, EN 1525:1997 and IEC 61508.

10. The method according to any one of the preceding claims, characterized in that The plausibility check fails and the statement about validity (317) is then deleted.

11. The method according to any one of the preceding claims, characterized in that The values ​​of the first motion vector (313) and the second motion vector (314) are compared in pairs during the cross comparison (322) to determine whether a predetermined difference size is exceeded.

12. The method according to any one of the preceding claims, characterized in that - determining the first movement vector from the first data (311) by the first method (301) at a first determined frequency, and - determining the second movement vector from the second data (315) by means of the second method (302) at a second determined frequency, and Data originating from at least one determination of the first method or of the second method are buffered at a higher determination frequency.

13. The method according to any one of the preceding claims, characterized in that The second data (315) is subjected to a coordinate system transformation based on the measurements from the environment detection system (LS) before processing, and the resulting movement vector is inversely transformed before the cross comparison.

14. The method according to any one of the preceding claims, characterized in that The second data (315) are generated based on measurements from the environment sensing system (LS) before being processed using a sequence number (356) which provides information about the type of coordinate system transformation currently used.

15. A method according to any one of the preceding claims, wherein: The autonomous mobile unit (100) should be restarted after a stop, characterized in that a check is performed to determine whether the speed has changed within a predetermined period of time, and if the check produces a negative result, the statement about the validity (317) is deleted.

16. A computer program product for performing the method according to any one of claims 1 to 15.

17. A device for safety-oriented speed monitoring of an autonomous mobile unit (100), comprising: - at least one movement device (200) with a movement detection system (ENC), wherein A first movement vector (313) can be determined based on measurements from the movement detection system (ENC), and at least one environment detection system (LS) located autonomously on board said mobile unit, wherein a second movement vector (314) of said mobile unit can be determined from second data (315) based on measurements from said environment detection system (LS), and - a diagnostic unit (305) for checking said first data and said second data, - a programmable controller for checking the first movement vector (313) and the second movement vector (315) by cross comparison (322), and for making safety-oriented decisions for the mobile unit based on the inspection results obtained from the diagnostic unit, wherein: A statement about the validity (317) and a movement vector (316) deemed to be safety-oriented can be output as a result, which is characterized in that A plausibility check (321, 323) is performed in advance on the first data (311) and / or the second data (315), wherein the first data and the second data (311, 315) are checked for plausibility independently of one another.

18. The device according to claim 17, characterized in that The environment inspection system (LS) uses at least one optical sensor to scan the environment.

19. The device according to claim 17 or 18, characterized in that The optical sensors (LS, LS1, LS2) perform one-dimensional detection, two-dimensional detection, or three-dimensional detection.

20. The device according to claim 19, characterized in that The optical sensor is a camera, a stereo camera, in particular a movably mounted laser scanner or a lidar.

21. The device according to any one of claims 17 to 20, characterized in that During scanning, at least one of the optical sensors (LS) generates a point cloud for each scanning cycle, and each generated point cloud can be provided with a time stamp in this way.

22. The device according to any one of the preceding claims 17 to 21, characterized in that The movement detection system (ENC) detects the movement of the movement device (200) by a first method (301) which detects the axis position of the movement device isochronously, in particular in real time, at at least two points in time respectively by means of a rotary encoder (ENC) and provides a time stamp for the axis position.

23. The device according to any one of the preceding claims 17 to 22, characterized in that A calculation unit (304) calculates a movement vector from at least two determined axis positions relative to a point in time by means of a forward transformation.

24. The device according to claim 23, characterized in that The diagnostic unit (305) is configured such that the rationality check (321, 323) includes at least one of the following checks: - the determined speed lies within the previously set value range, - the determined acceleration lies within the previously set value range, - there is noise in the determined values, - The determined movement corresponds to the expected movement pattern.

25. Device according to any one of the preceding claims 17 to 24, characterized in that The cross comparison or the plausibility check (321, 323) is carried out in a fully or partially functionally safe manner according to ISO 3691-4:2020, EN 1525:1997 and IEC 61508.

26. Device according to any one of the preceding claims 17 to 25, characterized in that If the plausibility check fails, the diagnostic unit (305) is configured to delete the statement about the validity (317).

27. The device according to any one of the preceding claims 17 to 26, characterized in that The diagnosis unit (305) is configured to compare the values ​​of the first movement vector (313) and the second movement vector (314) in pairs for the cross comparison (322) and to check whether a predetermined difference size is exceeded.

28. The device according to any one of the preceding claims 17 to 27, characterized in that - first data (311) obtained by the environment detection system (LS) is determined at a first determined frequency, and - second data (315) obtained by said movement detection system (ENC) are determined at a second determined frequency, and The diagnosis unit (305) is configured to buffer at least data from the method at a higher determination frequency.

29. The device according to any one of the preceding claims 17 to 28, characterized in that The computing unit (304) is configured to perform a coordinate system transformation on the second data (315) according to the measurement values ​​from the environment detection system (LS) before processing.

30. The device according to claim 29, characterized in that The diagnostic unit (305) is configured to generate a serial number based on the measured values ​​from the environment detection system (LS) before processing, the serial number providing information about the type of coordinate system transformation currently used.

31. The device according to any one of the preceding claims 17 to 30, wherein: The autonomous mobile unit (100) should be restarted after a stop, characterized in that the diagnostic unit (305) is configured to check whether the speed has changed within a predetermined time period and to delete the statement about the validity (317) if the check produces a negative result.

Images