Method, software program product and device for safety-oriented speed monitoring of an autonomous mobile unit

Abstract

The invention relates to a method for the safety-oriented speed monitoring of an autonomous mobile unit, and to a software program product and a device. A solution for reliably determining the speed of an autonomous mobile unit AMR which does not require any additional special hardware, is proposed. The proposed solution uses only components that are already required for the use of an AMR. These components, or the data determined by the components, are now suitably combined with one another using the programmable controller, in the corresponding software, so that overall the current speed can be determined reliably without the use of additional hardware.

Description

[0001] Description

[0002] Method, software program product and device for safety-related speed monitoring of an autonomous moving unit

[0003] The invention relates to a method for safety-related speed monitoring of an autonomous moving unit, as well as a software program product and a device.

[0004] Autonomous movement units, for example autonomous mobile robots, or AMRs for short, and other driverless vehicles such as forklifts are also being used more and more in industrial environments for material transport. The Type C standards ISO 3691-4:2020 (Industrial trucks - Safety requirements and verification - Part 4: Automated guided vehicle (AGV) and their systems) and EN 1525:1997 (Safety of industrial trucks - Automated guided vehicle (AGV) and their systems) set out specifications to ensure the protection of people working in the area. So-called safety-related controls (SSPCs or F-PLCs) are being used more and more frequently in the implementation of safety devices. Safety-related, or fail-safe, means that a person is reliably detected in an area and that the vehicle is safely switched off when that person enters the area.

[0005] The EN 61508 series "Functional Safety of Electrical / Electronic / Programmable Electronic Systems" is the basic safety standard that covers the functional safety of electrical, electronic, and programmable electronic systems, regardless of the application. It is therefore the central standard for the functional safety of control systems. Safety-related laser scanners are typically used for personnel protection. These are connected to the emergency stop switches and actuators via a safety-related control unit.

[0006] The monitoring fields of such safety-oriented laser scanners are often static, which leads to a limitation of the maximum speed. Adaptive switching of the monitoring field size depending on the vehicle's speed and direction is also possible.

[0007] Figure 1 shows a scenario with an autonomous movement unit (100) which has a safety-related controller 110 and an optical sensor LS. The autonomous movement device 100 moves in different directions depending on the type of drive, Vx points forwards, and the minimum speed Vmin, maximum speed Vmax and speeds V1, V2 which are in between are shown. The rotational speed Vw also allows the movement device to rotate in other directions and must also be taken into account in the further analysis. An encoder ENG monitors the movement of the wheels. This is understood to be an encoder for generating signals from movements. This usually works optically, magnetically or mechanically with contacts. These are measuring sensors or input devices which detect the current position of a shaft or a drive unit and output it as an electrical signal.There are two types of encoders: Rotary encoders, also called shaft encoders, are mounted on rotating components, such as a motor shaft. Linear encoders are typically mounted on components with linear motion.

[0008] A similar device is shown, for example, in DE 10 2019 111 642 B3: a vehicle with a safety system that includes a kinematic sensor for monitoring speed and an optoelectronic safety sensor for monitoring the environment. The vehicle's movement information is used to compare the speed value of the first sensor with the movement value of the second sensor.

[0009] It is now intended to prevent a person (or another vehicle) P from moving into the safety area of ​​the movement device 100 at its own speed 102.

[0010] For vehicles with differential drive (two drives) or kinematics with only one steering and rotation axis, as is common with forklift trucks, the calculation effort for the safety-related speed is unproblematic.

[0011] However, the computational effort in the safety-related part of a programmable logic increases for vehicles with omnidirectional drives such as a Mechanum drive, i.e. a vehicle that is equipped with Mechanum wheels.

[0012] The velocity vector Vx, Vy and the rotation W depend on the individual velocities of the wheels VI, V2, V3 and V4. R stands for the radius of the mechanism wheels. Folder Forward Kine

[0013] In addition to the increased computational effort, which is computationally intensive and therefore costly on a safety-related controller, a safety-related encoder is required on each of the four axes. These require corresponding space and a safety-related connection to the safety-related controller.

[0014] Errors such as wheel slippage cannot be ruled out. This means that, despite safety-related encoders, errors caused by, for example, continued slipping during braking or wheel spin during acceleration cannot be ruled out.

[0015] Currently, safety-related encoders have been used on the vehicle's axles. The rotational speed is evaluated by a safety-related processing unit (F-PLC), allowing the forward kinematics to be calculated. Depending on the speed and direction of travel, the laser scanner fields can then be switched to avoid collisions with people.

[0016] Safety-related controllers and safety-related encoders are already available for this purpose, allowing the speed and direction to be calculated and the monitoring fields to be switched accordingly. However, the type of kinematics is not freely definable, but is only available for common kinematics, such as differential kinematics.

[0017] An example structure can be seen in Figure 2, with a safety-related controller 203. Safety-related encoders ENG monitor the movement of the drive 200. Optical sensors LSI, LS2 monitor a monitoring field 201, 202, each in the direction of travel of the autonomous movement device. These can be laser scanners, lidar, ID, 2D, 3D cameras, or similar. Not shown in Figure 2 are also emergency stop buttons attached to the movement device, which make it possible to trigger an emergency stop manually.

[0018] The object of the invention is therefore to implement safety-related speed detection for more complex vehicles in accordance with standards. The computational effort required for the safety-related calculation should be minimized.

[0019] The problem is therefore solved by a method having the features of independent patent claim 1. The problem is further solved by a computer program product for carrying out the steps of a method according to the features of one of patent claims 1 to 16. The problem is also solved by a device according to the features of patent claim 17.

[0020] The claimed method for safety-oriented speed monitoring of an autonomous movement unit with at least one movement device with a movement detection system (encoder) and at least one environment detection system (camera, laser scanner, lidar, or similar) located on the autonomous movement unit, with the following steps:

[0021] - by means of a first method, a first motion vector is determined from first data of the motion unit on the basis of measured values ​​of the motion detection system,

[0022] - by means of a second method ( 302 ), a second movement vector of the movement unit is determined from second data on the basis of measured values ​​of the environment detection system, and

[0023] - a check of the first and second movement vector is carried out by means of a cross-comparison and as a result a statement about the validity as well as a movement vector that is considered to be safety-related is issued.

[0024] The problem is further solved by a device for safety-related speed monitoring of an autonomous movement unit with

[0025] - at least one locomotion device with a motion detection system (encoder), whereby a first motion vector can be determined on the basis of measured values ​​of the motion detection system and

[0026] - at least one environment detection system located on the autonomous movement unit, wherein a second movement vector of the movement unit can be determined from second data on the basis of measured values ​​of the environment detection system, and

[0027] - with a diagnostic unit for checking the first and second data

[0028] - a programmable controller for carrying out a test of the first and second movement vector by means of cross-comparison and for making safety-related decisions for the movement unit on the basis of a test result received from the diagnostic unit, whereby a statement on the validity and a movement vector deemed to be safety-related can be output as a result.

[0029] Further advantageous embodiments of the invention are described in the subclaims.

[0030] The invention is further illustrated in more detail by the figures, in which

[0031] Figure 1 shows an exemplary application with an AMR, Figure 2 shows an exemplary structure of a known AMR, Figure 3 shows an overview of the method according to the invention, Figure 4 shows the plausibility check of the method according to the invention,

[0032] Figure 5 the procedure with dynamization of the coordinate system, and

[0033] Figure 6 the procedure and the special case of safe starting after standstill.

[0034] A solution is proposed for reliably determining the speed of an autonomous motion device (AMR) that does not require any additional specialized hardware. The proposed solution uses only components that are already necessary for the use of an AMR. These include:

[0035] - A programmable logic controller (PLC) that can make safety-related decisions. This is necessary anyway to safely stop the AMR, for example, to avoid a collision with an obstacle.

[0036] - An optical system / optical sensor for scanning obstacles. Such a system is typically present in AMRs today to determine the spatial position (non-safety-related) as part of navigation. The optical sensor can perform one-dimensional, two-dimensional, or three-dimensional detection.

[0037] This includes, for example, all types of cameras, stereo cameras (2D, 3D), a particularly movably mounted laser scanner or lidar, which generate a so-called point cloud during detection.

[0038] - A system for measuring the movement of the AMR's wheels (odometry). This also includes the aforementioned encoders. This system is required anyway for (non-safety-related) drive control. There are other ways to determine a vehicle's speed, e.g.:

[0039] - Calculation of speed by visual odometry of a camera directed at a fixed location such as the floor or ceiling

[0040] - Calculation of speed by visual odometry of a 3D camera directed into the room,

[0041] - Calculation of the speed using position and time delta of two tracking tags of a Cartesian 3D localization system.

[0042] For the principle proposed here, any two methods can be combined. A prerequisite for reliability is that physically different measurement principles are used in both channels.

[0043] These components, or rather the data determined by the components, are then suitably combined with one another using the programmable controller and the corresponding software, so that overall a reliable determination of the current speed is possible without the use of additional hardware.

[0044] Figure 3 shows how the above-mentioned components are to be arranged. In the exemplary embodiment, the optical sensor 301 (laser scanner, possibly also several laser scanners (LS, LSI, LS2)) cyclically delivers a point cloud 311 of all detected obstacles to a "Scan Matcher" software module 303. Each point cloud thus generated is provided with a time stamp.

[0045] By comparing it with the point cloud from the last cycle, the scan matcher calculates a velocity vector 313 (x-component, y-component, and current rotational velocity w). At the same time, a motion sensor 302 (rotary encoder), for example, supplies the current positions of the monitored axis or axes of the AGV to the "forward transformation" software component 304. By referring to the axis positions from the last cycle, the forward transformation also calculates the velocity vector (vx, vy, w). The movement of the locomotion device 200 is recorded by recording an axis position of the locomotion device isochronously, in particular in real time, at at least two points in time using a rotary encoder or other motion sensor, and this is provided with a time stamp.

[0046] The motion vector is calculated from the at least two determined axis positions relative to points in time by a forward transformation 304.

[0047] The optical sensor, motion sensor (odometry), scan matcher, and forward transformation do not need to be implemented in a safety-oriented manner. In particular, existing components can be used for this purpose.

[0048] Using independent and different measurement methods, the two individual velocity vectors are determined or calculated in a diverse manner and are then compared. An error affecting both channels leads to different, incorrect results, which can be detected by the subsequent comparison. Furthermore, the calculation paths are completely separate from the software, but can run on the same hardware, so further measures must be taken to detect systematic errors in both calculations.

[0049] Both diversely calculated velocity vectors, as well as the original input data (e.g., the point cloud determined by the optical sensor + the axis increments determined by the motion sensor) are passed on to the safe diagnostics 305. This is implemented using safe technology and performs a plausibility and consistency check. If the check is successful, a velocity vector 316, which is now considered safety-related, is output and can be used for a safety-related decision 306. If an error is detected, the "isValid" output 317 is cleared and / or safe substitute values ​​are supplied (e.g., the maximum possible velocity Vmax, in order to activate the largest protective fields, see Fig. 1).

[0050] The system is considered safe if either the actual speed is output or the "isValid" 317 output is cleared. The system is potentially unsafe if an incorrect speed is output and the "isValid" 317 output is set at the same time.

[0051] To minimize the likelihood of a potentially unsafe output, the following diagnostic measures are proposed, which are executed safely on the diagnostic unit 305. These are described in more detail below:

[0052] Plausibility check ( PC ) 321 , 323 Cross-comparison (CC ) 322 Diverse coordinate systems , ( DC ) Dynamization of the coordinate system , ( DYC ) Safe start after standstill ( SVS )

[0053] 1. Plausibility check, 321, 323, Plausibility Check (PC)

[0054] In an advantageous embodiment, the plausibility check 321, 323 comprises at least one of the following checks: - the determined speed is within a previously defined value range,

[0055] - the determined acceleration is within a previously defined range of values,

[0056] - there is noise in the determined values, the determined movement corresponds to an expected movement pattern.

[0057] Both input channels 311, 315 are advantageously checked independently for plausibility, see also the illustration in Figure 4. In detail, the following checks can be implemented:

[0058] Is the measured speed of the AMR within the specified range, e.g., is it lower than the maximum speed Vmax of the AMR? This can detect major errors, such as swapping the speed with another process value.

[0059] By calculating the first derivative, it can be determined whether the acceleration or deceleration lies within a specified range. In a fault-free case, for example, the velocity does not suddenly and unexpectedly drop to zero due to inertia. This advantageously makes it easy to detect a sensor failure.

[0060] In an error-free case, noise will also be detectable in the original measured values ​​from the optical and / or motion sensor (e.g., point cloud or axis increments), i.e., there will always be a certain discrepancy between the measurement results at different points in time. If this is not the case, this is also considered a failure of the respective sensor (frozen sensor).

[0061] During operation, AMRs only travel at a constant speed for short periods, as they decelerate at corners, turn, and then accelerate again. If the speed of a channel does not change significantly over an extended period, it is also assumed that the sensor is frozen.

[0062] The failure of clocks used in the laser scanner to generate timestamps can be detected by comparing them with the fail-safe clock in the diagnostic unit.

[0063] All plausibility checks are implemented with safety in mind. Therefore, failure of the tests themselves is not to be expected. If at least one test fails, the output isValid, 317 is cleared, or a safe substitute value is returned as a velocity vector.

[0064] 2. Cross Comparison, 322 , Cross Check (CC )

[0065] In the simplest case, the cross-comparison 322 consists of three pairwise comparisons of the components vx, vy, w of the velocity vector (i.e., the values ​​of the first 313 and second motion vector 314 ) are compared pairwise, as well as, if applicable, the angle of rotation ). Their difference must be smaller in magnitude than a threshold value t previously defined depending on the key technical data of the AGV being tested.

[0066] | vxl-vx2 | < tl | vyl-vy2 | < t2 | wl-w2 | <t3

[0067] The values ​​for tl , t2 , t3 also determine the accuracy of the output speed in the error-free case.

[0068] In an advantageous embodiment, the Euclidean distance of the Cartesian vectors vx and vy supplied by the two channels is calculated to increase the accuracy: sqrt [ (vxl-vx2 ) 2 + (vyl-vy2 ) 2 ] < t4 | wl-w2 < t3 In a further advantageous embodiment, the faster channel is buffered specifically to ensure that speeds detected by the sensors at the same time are compared. Since it cannot be expected that both channels have an identical reaction time

[0069] Small measurement errors in position can lead to a comparatively large error in the calculated velocity, resulting in noise in the velocity value. This noise can be reduced by filtering (e.g., FIR filters), although it must be noted that this filtering increases the response time accordingly.

[0070] The cross-comparison or the plausibility check 321 , 323 are implemented in a functionally safe manner in whole or at least in part.

[0071] The cross-comparison itself is implemented in a safety-related manner (F-CPU); if it fails, the output i sValid and thus the statement about the validity 317 is deleted.

[0072] The cross-comparison detects all errors that affect only one of the two channels.

[0073] 3. Diverse coordinate systems (DC)

[0074] Figure 5 shows further advantageous embodiments.

[0075] Random hardware errors that affect the output of the scan matcher 303 and the output of the forward transformation in the same way could normally not be detected by a cross-comparison. For example, if the value vx were to be overwritten by the same value in both cases, this cannot be detected by the cross-comparison. Therefore, the sensor data (point cloud) 311 from the sensor 301 is subjected to a coordinate system transformation before being processed by the scan matcher. This can, for example, consist of:

[0076] - a translation of all points by a vector ( tx, ty) ,

[0077] - a rotation of all points around a point ( rx , ry) by the angle a,

[0078] - a scaling of all points along the x-axis sx,

[0079] - a scaling of all points along the Y-axis sy,

[0080] - a combination of the transformations mentioned above.

[0081] The transformations can be time-independent ( constant ) or time-dependent .

[0082] A time-independent rotation by the angle a means that the result vx ' , vy ' must also always be interpreted as rotated by the angle a.

[0083] A time-dependent transformation means that the change changes over time, so that, for example, the angle of rotation becomes increasingly larger. For example, a time-dependent rotation by the angle a(t) results in w' being interpreted as being increased by a corresponding value.

[0084] The transformation results in the input of the scan matcher 303 being specifically modified. The modification is reversed by the diagnostic unit 305 before the cross-comparison is performed.

[0085] Through targeted modification, random hardware errors that affect the scan matcher output and the forward transform output in the same way can be detected by cross-comparison. For example, if the value vx and vx ' were overwritten by the same value, this would result in a different error syndrome in the two channels after reversing the modification. This leads to detection by cross-comparison.

[0086] 4. Dynamization of the coordinate system, Dynamization of Coordinate Systems (DYC)

[0087] Figure 5 shows a further measure, which consists in the dynamization of the diverse coordinate system. This means that the coordinate system used in channel 1 of sensor 311 changes at regular intervals. This advantageously allows for reliable detection of freezing or unwanted delays in this channel.

[0088] The diagnostic unit changes the currently valid transformation, e.g., at fixed time intervals. This can be selected based on a predefined calculation scheme or randomly.

[0089] The diagnostic unit 356 continuously sends the currently valid transformation T to the modifier 351. A sequence number S is also sent, which is passed on in all subsequent steps. Finally, the transformed result (vx ', vy ', w ') is sent to the diagnostic unit 305 together with the sequence number S.

[0090] The sequence number indicates the type of coordinate system transformation currently in use.

[0091] Based on the sequence number, the diagnostic unit can decide which modification needs to be undone.

[0092] In addition, the diagnostic unit can use the sequence number to detect whether outdated data is present at the input or whether the calculation in the channel took an inadmissibly long time. By making the coordinate system dynamic, for example, unacceptable delays in the calculation in the scan matcher 303 can be detected.

[0093] 5. Safe starting after standstill, Safe Vehicle Stop (SVS)

[0094] Figure 6 deals with the special case where the vehicle is stationary for an extended period. This can lead to a potentially dangerous accumulation of errors. For example, channel 1 (the first sensor) could initially freeze at the value zero. Since this corresponds to reality when stationary, this error cannot be detected. If channel 2 (the second sensor) also freezes at the value zero, no error is detected. However, the next time the vehicle starts moving, both channels will return the incorrect value of zero, which could lead to a dangerous error (the vehicle's speed is underestimated).

[0095] This error scenario can be controlled by the following measure:

[0096] If the vehicle remains stationary for a specific time TI (e.g., TI = 5 seconds), the diagnostic unit 305 activates safe standstill monitoring on all axles. When starting up, the diagnostic unit must be informed via the "MovingOff" input 601. In this case, the diagnostic unit terminates safe standstill monitoring and starts a time limiter T2 (e.g., 3 seconds).

[0097] In a first channel 602, the values ​​can be obtained, for example, using a dynamic coordinate system, vx', vy', w', S. In a second channel 603, the coordinates vx, vy, w in the example are received accordingly. The diagnostic unit checks whether a start-up has actually occurred. If this is the case, this guarantees that no errors have accumulated in either channel during the standstill. If the time limiter T2 expires before a start-up is detected, this could be due to an error accumulation in the channels. In this case, the "isValid" output 604 is cleared. Alternatively, the safe standstill monitoring in the axles can be reactivated in this case. If the vehicle has actually started moving unnoticed, it is safely stopped.

[0098] Corresponding commands 605, 606, 607 are sent to the drive units D1, D2, D3.

Claims

Patent claims 1. Method for safety-oriented speed monitoring of an autonomous motion unit (100) with - at least one locomotion device (200) with a motion detection system (ENC) and - at least one environment detection system (LS) located on the autonomous motion unit (100), in which - by means of a first procedure (301) from first data (311) of the motion unit (100) , based on measured values ​​of the motion detection system (ENC), a first motion vector (313) is determined, - by means of a second method (302) from second data (315) based on measured values ​​of the environmental detection system (LS) a second motion vector (314) of the motion unit is determined, and - a check of the first (313) and second motion vector (314) is carried out by means of cross-comparison (322) and as a result a statement about the validity (317) as well as a motion vector (316) considered to be safety-oriented is output, characterized in that a plausibility check (321, 323) is carried out beforehand on the first data (311) and / or on the second data (315), wherein the first and second data (311, 315) are checked for plausibility independently of each other.

2. Method according to claim 1, characterized in that the second method (302) uses at least one optical sensor (LS, LSI, LS2) for scanning the environment (201, 202).

3. Method according to claim 1 or 2, characterized in that The optical sensors (LS, LSI, LS2) perform one-dimensional, two-dimensional or three-dimensional detection.

4. Method according to claim 3, characterized in that the optical sensors are a camera, a stereo camera, a laser scanner mounted in a movable manner or a lidar.

5. Method according to one of the preceding claims, characterized in that a point cloud is generated by the optical sensors (LS, LSI, LS2) during scanning per scanning cycle, and each point cloud generated in this way is provided with a timestamp.

6. Method according to one of the preceding claims, characterized in that the first method (301) detects the movement of the locomotion device (200) by isochronously, in particular in real time, detecting an axis position of the locomotion device at at least two times by means of a rotary encoder (ENC), and providing this with a timestamp.

7. Method according to claim 6, characterized in that the motion vector is calculated from the at least two determined axis positions relative to time points, by a forward transformation.

8. Method according to claim 7, characterized in that the plausibility check (321, 323) comprises at least one of the following tests: - the measured speed is within a previously defined range of values, - the measured acceleration is within a previously defined range of values, - The determined values ​​contain noise, The detected movement corresponds to an expected movement pattern.

9. Method according to claim 3 or 8, characterized in that the cross-comparison or plausibility check (321, 323) is implemented in whole or in part in a functionally safe manner in accordance with ISO 3691-4:2020, EN 1525:1997 and IEC 61508.

10. Method according to one of the preceding claims, characterized in that the plausibility check fails and the statement about validity (317) is subsequently deleted.

11. Method according to one of the preceding claims, characterized in that in the cross-comparison (322) the values ​​of the first (313) and second motion vector (314) are compared pairwise to see if a predetermined difference is exceeded in absolute value.

12. Method according to one of the preceding claims, characterized in that - which is determined from the first data (311) using the first method (301) at a first determination frequency, and - which is determined by means of the second method (302) from second data (315) at a second investigation frequency, and the determined data of at least the first or second method are buffered with the higher investigation frequency.

13. Method according to one of the preceding claims, characterized in that the second data (315) are subjected to a coordinate system transformation based on measured values ​​of the environmental detection system (LS) prior to processing and the re- The resulting motion vector is subjected to a reverse transformation before cross-comparison.

14. Method according to one of the preceding claims, characterized in that the second data (315) is generated on the basis of measured values ​​of the environmental detection system (LS) prior to processing with a sequence number (356) which provides information about the type of coordinate system transformation currently used.

15. Method according to one of the preceding claims, wherein the autonomous motion unit (100) is to be restarted after a standstill, characterized in that it is checked whether a change in speed has occurred within a specified period of time, and if the check produces a negative result, the statement about the validity (317) is deleted.

16. Computer program product v for carrying out a method according to the features of one of claims 1 to 15.

17. Device for safety-oriented speed monitoring of an autonomous motion unit (100) with - at least one locomotion device (200) with a motion detection system (ENC) wherein a first motion vector (313) can be determined on the basis of measured values ​​of the motion detection system (ENC) and - at least one environment detection system (LS) located on the autonomous motion unit, wherein a second motion vector (314) of the motion unit can be determined from second data (315) based on measured values ​​of the environment detection system (LS), and - with a diagnostic unit (305) for checking the first and second data - a programmable controller for performing a test of the first (313) and second motion vector (315) by means of cross-comparison (322) and for making safety-related decisions for the motion unit based on a test result obtained from the diagnostic unit, wherein a statement about the validity (317) as well as a motion vector (316) considered to be safety-related can be output as a result, characterized in that a plausibility check (321, 323) is performed beforehand on the first data (311) and / or on the second data (315), wherein the first and second data (311, 315) are checked for plausibility independently of each other.

18. Device according to claim 17, characterized in that the environmental detection system (LS) uses at least one optical sensor for scanning the environment.

19. Device according to claim 17 or 18, characterized in that the optical sensors (LS, LSI, LS2 ) perform one-dimensional, two-dimensional or three-dimensional detection.

20. Device according to claim 19, characterized in that the optical sensors are a camera, a stereo camera, a laser scanner mounted in a movable manner or a lidar.

21. Device according to one of claims 17 to 20, characterized in that the at least one optical sensor (LS) generates a point cloud during scanning per scanning cycle, and each point cloud generated in this way can be provided with a timestamp.

22. Device according to one of the preceding claims 17 to 21, characterized in that the motion detection system (ENC) detects the movement of the locomotion device (200) by means of a first method (301) by isochronously, in particular in real time, detecting an axis position of the locomotion device at at least two times by means of a rotary encoder (ENC), and providing this with a timestamp.

23. Device according to one of the preceding claims 17 to 22, characterized in that the motion vector is calculated by a computing unit (304) from the at least two determined axis positions relative to time points, by a forward transformation.

24. Device according to claim 23, characterized in that the diagnostic unit (305) is configured to perform the plausibility check (321, 323) comprising at least one of the following tests: - the measured speed is within a previously defined range of values, - the measured acceleration is within a previously defined range of values, - The determined values ​​contain noise, - the detected movement corresponds to an expected movement pattern.

25. Device according to one of the preceding claims 17 to 24, characterized in that the cross-comparison or plausibility check (321, 323) is implemented in whole or in part in a functionally safe manner in accordance with ISO 3691-4:2020, EN 1525:1997 and IEC 61508.

26. Device according to one of the preceding claims 17 to 25, characterized in that the diagnostic unit (305) is set up to delete the statement about validity (317) if the plausibility check fails.

27. Device according to one of the preceding claims 17 to 26, characterized in that the diagnostic unit (305) is configured to compare the values ​​of the first (313) and second motion vector (314) pairwise for cross-comparison (322) and to check whether a predetermined difference is exceeded in absolute value.

28. Device according to one of the preceding claims 17 to 27, characterized in that - the first data (311) acquired by means of an environmental detection system (LS) are determined at an initial detection frequency, and - second data (315) acquired by means of a motion detection system (ENG) are determined at a second acquisition frequency, and the diagnostic unit (305) is set up to buffer the data of at least the procedure with the higher acquisition frequency.

29. Device according to one of the preceding claims 17 to 28, characterized in that the computing unit (304) is configured to subject the second data (315) based on measured values ​​of the environmental detection system (LS) to a coordinate system transformation prior to processing.

30. Device according to claim 29, characterized in that the diagnostic unit (305) is configured to generate a sequence number based on measured values ​​of the environment- bungs acquisition system (LS) prior to processing, which provides information about the type of coordinate system transformation currently used.

31. Device according to one of the preceding claims 17 to 30, wherein the autonomous motion unit (100) is to be restarted after a standstill, characterized in that the diagnostic unit (305) is configured to check whether a change in speed has occurred within a specified period of time, and if the check produces a negative result, to delete the statement about the validity (317).

Images