Method, computing unit and computer program for creating a measuring system

Abstract

The invention relates to a method for creating a measuring system (230) having at least two measuring devices (210, 220), comprising: identifying (100) at least one environmental condition which influences a function of the at least two measuring devices (210, 220) of the measuring system (230); the method is characterized in that, taking into account a positive and / or negative error correlation between the at least two measuring devices (210, 220), determining (120; 140) a probability of failure of the measurement system (230); adjusting (130) at least one of the at least two measuring devices (210, 220) in such a way that a negative error correlation between the at least two measuring devices (210, 220) is increased; and creating (160) the measuring system (230) having the at least two measuring devices (210, 220).

Description

Technical Field

[0001] The invention relates to a method for producing a measuring system as well as to a computing unit for carrying out the method and to a computer program for carrying out the method. Background Art

[0002] A common solution for making a measuring system fault-tolerant is to use a redundancy concept. Here, the selected processing channel (e.g., a measuring device) is executed twice and the consistency of its results is checked. As a result, an error in one of these processing channels can be identified and the system can react accordingly. However, these redundancy concepts only work if it is ensured that these processing channels are independent of each other. In conventional measuring systems, their failures are mainly caused by hardware errors, such as heating of electrical components or failure of the voltage supply device, which may be a common cause of failure ("Common Cause"). In order to avoid this common cause, in relevant safety standards, such as ISO 26262, which is the global standard for road vehicle safety, it is recommended to perform a so-called "Dependent Failure Analysis".

[0003] For highly complex measurement systems such as perception systems for highly automated driving, the ISO 21448 standard additionally requires the evaluation of external influences or foreseeable misuses on the system functionality ("triggering conditions"). External influences can be, for example, weather influences, lighting conditions, etc., which can lead to the fact that the perception or evaluation algorithm used is no longer able to robustly identify objects. Here, the focus is usually also on avoiding common cause failures, i.e. trying to avoid positive correlations in redundant perception devices or designing these perception devices to be independent of each other. Summary of the invention

[0004] According to the invention, a method for creating a measuring system with at least two measuring devices, a computing unit for carrying out the method and a computer program for carrying out the method are proposed with the features of the independent patent claim. Advantageous embodiments are the subject matter of the dependent claims and the subsequent description.

[0005] The method according to the invention uses in particular negative error correlations between the measuring devices of the measuring system and brings about these negative error correlations, thereby making it possible to achieve a lower overall probability of failure than by pure independence of the measuring devices. In this case, possible external influences (environmental conditions) on the measuring system are taken into account, so that the robustness of the measuring system can be increased. In addition, by taking into account the negative error correlations, the number of redundant measuring devices can be reduced without sacrificing safety.

[0006] The invention is particularly advantageous for measuring systems in vehicles, since the highest possible fail-safety is sought there, in particular for critical measuring systems, in particular such measuring systems whose failure could result in a risk to personnel. The invention is particularly suitable for perception systems as measuring systems, which have a perception device as a measuring device for detecting the environment as measurement information. The invention can advantageously be used for vehicle-bound and non-vehicle-bound perception systems, for example for such perception systems for monitoring infrastructure such as road intersections or for monitoring in general.

[0007] If the measuring system PS comprises, for example, a first and a second measuring device PV1, PV2 for detecting measurement information, the probability of failure of the entire measuring system PS can be determined as follows by combining the probability of failure of the two measuring devices PV1, PV2:

[0008] P(PS)=P(PV1 ∪PV)=P(PV1)*P(PV2|PV1) (1)

[0009] If the failure probabilities of the two measuring devices PV1, PV2 are independent of one another, then:

[0010] P(PV2|PV1)=P(PV2) (2)

[0011] However, the conditional probability term of the second measuring device PV2 can also be divided into two ranges, which respectively have a positive or negative correlation with the failure probability of the first measuring device PV1 .

[0012] Here, the range of the positive correlation of the second measuring device PV2 with the first measuring device PV1 can be defined as follows:

[0013] P(PV2) <P(PV2|PV1)<1 (3)

[0014] Thus, if the first measuring device PV1 has failed, the second measuring device PV2 has a higher probability of failure. This can occur, for example, when the two measuring devices PV1, PV2 contain sensors of the same type, which differ only in their measurement tolerances. In this case, if the first measuring device PV1 fails, for example due to currently occurring environmental conditions such as weather or lighting conditions, the probability that the second measuring device PV2 will also fail increases.

[0015] However, correspondingly, the range of the negative correlation between the second measuring device PV2 and the first measuring device PV1 can also be defined:

[0016] 0 <P(PV2|PV1)<P(PV2) (4)

[0017] In this case, if the first measuring device PV1 has failed, the probability of failure of the second measuring device PV2 is reduced. This can occur, for example, when the two measuring devices PV1, PV2 contain different types of sensors, one of which reacts negatively and one of which reacts positively to the currently occurring environmental conditions.

[0018] The measurement system to be created includes at least two measurement devices, which can be, for example, camera devices, radar devices, lidar devices, ultrasonic devices, or any other suitable devices for detecting measurement information of interest. The measurement system can especially include a plurality of measurement devices. Here, each measurement device can include at least one sensor (for example, a camera, a radar sensor, a lidar sensor, or an ultrasonic sensor, etc.) and a corresponding evaluation unit. The evaluation unit can be set up to calculate at least one evaluation algorithm to derive the required measurement information from the sensor signal. The evaluation algorithm can, for example, include AI (KI) functions, which are trained using a large amount of environmental data of the vehicle. Each measurement device can include its own evaluation unit, or there can be a common evaluation unit for multiple / all measurement devices in the measurement system. In particular, the at least two measurement devices can be redundant, that is, the at least two measurement devices can detect a common area in the environment of the vehicle.

[0019] In the method according to the invention, at least one environmental condition is identified which influences the function of at least two measuring devices of the measuring system ("common cause"). The environmental condition may be, for example, weather conditions (rain, fog, snow, direct sunlight, etc.) or time / space-dependent changes in lighting conditions (time of day, tunnel travel, etc.) which interact with the sensors of the measuring devices. For example, the at least one environmental condition may be identified based on expert knowledge stored in a database. Alternatively or additionally, the at least one environmental condition may be identified with the aid of corresponding algorithms (e.g. correlation coefficients, causal reasoning, etc.) based on vehicle data measured in advance and stored in a database. In particular, a plurality of environmental conditions which influence the function of the at least two measuring devices may be identified.

[0020] After identifying the at least one environmental condition, the failure probability of the measuring system in the presence of the environmental condition is determined, wherein positive and / or negative error correlations between at least two measuring devices of the measuring system are taken into account. To this end, the failure probability of the measuring system can, for example, first be determined assuming an error correlation between the at least two measuring devices. For example, if a positive error correlation exists under the identified environmental condition, the failure probability can also be determined under a negative error correlation in order to determine the potential for reducing the failure probability. On the other hand, if a negative error correlation already exists, the failure probability can be determined using a positive error correlation in order to determine the influence of the positive error correlation on the potential increase of the failure probability. The process can be repeated for each identified environmental condition.

[0021] According to one embodiment, the failure probability of the measuring system can be determined with the aid of a probability oriented model (PGM). In particular, a Bayesian network can be created for this purpose, which maps the measuring system having the at least two measuring devices and the at least one environmental condition. Here, the structure of the Bayesian network can be created, for example, with the aid of corresponding algorithms (such as structure learning, causal discovery, etc.) based on expert knowledge stored in a database or based on vehicle data measured in advance and stored in a database. Similarly, the model can be parameterized based on expert knowledge (expert judgment) or in a data-based manner (for example, with the aid of parameter learning). By applying the Bayesian network, it can be determined in particular: what optimization potential exists in the measuring system by introducing / increasing the negative error correlation between the at least two measuring devices.

[0022] According to the invention, at least one of the at least two measuring devices is adjusted in such a way that the negative error correlation between the at least two measuring devices is increased. In other words, the measuring devices can be designed in particular so that a failure of the first device under the influence of the identified environmental conditions does not lead to an increased probability of failure of the second device, but rather to a reduced probability of failure of the second device.

[0023] According to one embodiment, the negative error correlation between the at least two measuring devices can be increased by using a first sensor in the first measuring device and a second sensor different from the first sensor in the second measuring device. The first and second sensors can differ, for example, in their physical measurement principles (acoustic, electromagnetic, optical, etc.). For example, the first sensor can be an imaging sensor (e.g. a camera) and the second sensor can be a distance sensor (e.g. a radar or lidar sensor). Alternatively or additionally, the first sensor can be an active sensor and the second sensor can be a passive sensor. When using two distance sensors, the two distance sensors can differ, for example, in their wavelengths (infrared radiation, visible radiation, radar waves).

[0024] Alternatively or additionally, the negative error correlation between the at least two measuring devices can be increased by installing an interface in the measuring system, by means of which external (non-system) sensor signals can be received. The interface can be contained, for example, in one or more evaluation units of the measuring system. This makes it possible to access or use sensor signals provided, for example, by infrastructure (for example by roadside units) or other vehicles. In this case, in particular, such signals that differ from the signals of the system's own measuring devices can be accessed in order to cause negative error correlations. For example, the radar signal of a roadside unit can be received as a redundant signal for the camera signal of a vehicle. By installing an interface in the measuring system, the probability of failure of the measuring system can be reduced during operation based on other external measuring devices available in the system environment.

[0025] Alternatively or additionally, the negative error correlation between the at least two measuring devices can be increased by adjusting the evaluation algorithm in at least one of the at least two measuring devices; or the evaluation algorithms of the at least two measuring devices are different. This can be done, for example, by selecting the evaluation algorithm accordingly. If, for example, an algorithm based on artificial intelligence (AI) is used, the data set or hyperparameters of the evaluation algorithm can be adjusted to establish or increase the negative error correlation between the at least two measuring devices. For example, the at least two measuring devices or their evaluation algorithms can be trained using different data sets, in which the first data set has a larger number of data points under a first environmental condition (e.g., daytime) and the second data set has a larger number of data points under a second environmental condition (e.g., nighttime). Thus, the measuring device trained with the first data set has a higher accuracy when the first environmental condition exists and a lower accuracy when the second environmental condition exists. On the other hand, the measuring device trained with the second data set has a higher accuracy when the second environmental condition exists and a lower accuracy when the first environmental condition exists, thereby generally achieving a negative correlation in the two measuring devices.

[0026] In addition to the above-mentioned adjustments to the evaluation algorithm itself or its architecture, the negative error correlation between the at least two measuring devices can be increased by adjusting at least one parameter of the evaluation algorithm in at least one of the at least two measuring devices; or at least one parameter of the evaluation algorithm of the at least two measuring devices is different. For example, the contrast of the camera and / or the detection threshold of the AI ​​function can be increased or decreased. In this way, a negative error correlation between the measuring devices can be achieved even when using the same sensor or sensor type. When using neural networks, for example, the layer depth and layer size of these neural networks can be adjusted.

[0027] The influence of the individual measures described above on the probability of failure of the measuring system can be examined, for example, with the aid of a Bayesian network, ie the Bayesian network can be reparameterized according to the selected adjustments and the probability of failure can be re-determined.

[0028] According to one specific embodiment, at least one of the at least two measuring devices is adjusted if—and in particular only if—the determined probability of failure, in particular the probability of failure determined using the existing error correlation, has a predetermined value. For example, if a positive error correlation between the at least two measuring devices exists under the identified environmental conditions, the additionally determined probability of failure can be used in the case of a negative error correlation in order to use the potential of the negative error correlation to reduce the probability of failure.

[0029] Furthermore, according to the invention, a measuring system is created with the at least two measuring devices. This is to be understood in particular as meaning that a design or construction plan of the measuring system is provided. Alternatively or additionally, this includes the actual physical production of the measuring system.

[0030] According to one specific embodiment, the measuring system is created if—and in particular only if—the determined probability of failure is below or at least does not exceed a predetermined value.

[0031] According to one embodiment, the measuring system can be created when - and in particular only when - the probability of failure for all relevant or identified environmental conditions is below or at least does not exceed the predetermined value. With these embodiments, a measuring system with a desired maximum probability of failure is obtained.

[0032] According to one embodiment, the determination of the probability of failure may include: determining a marginal total probability of failure of the measurement system; and determining a conditional total probability of failure of the measurement system. In this case, a first predetermined value of the marginal total probability of failure and a second predetermined value of the conditional total probability of failure may be specified, and the measurement system may be created only when, for example, the two predetermined values ​​are below. Alternatively, the measurement system may be created when at least one of the two predetermined values ​​is below.

[0033] In this case, for example, a marginal total probability of failure can be determined by means of a belief propagation algorithm or a variable elimination algorithm. In particular, a conditional total probability of failure of the measuring system can be determined for all identified environmental conditions. In this way, it can be assessed whether a sufficiently low marginal total probability of failure has been achieved and, in addition, whether a significant increase due to the identified environmental conditions has not been achieved. This assessment enables the measuring system to be classified as sufficiently safe for highly automated driving.

[0034] The creation of the measuring system can here particularly include the selection / programming and parameterization of redundant measuring devices (sensors and evaluation units) which are adjusted as described above in order to increase their negative error correlation and in combination fall below a predetermined value for the probability of failure.

[0035] In other words, with the aid of the described method, the architecture of a measuring system can be created / designed / optimized and subsequently set up. Some embodiments of the method also provide the possibility of reducing the probability of failure of the measuring system even during operation of the measuring system. For example, the parameters of individual measuring devices (e.g. the contrast of a camera or the detection threshold of an AI function in an evaluation algorithm) can be adjusted based on new data in the installed state of the measuring system.

[0036] The computing unit according to the invention having a processor is configured, in particular programmed, to carry out the method according to the invention. The computing unit may in particular comprise an input device, a computing device and an output device. The computing device may comprise the processor as well as a working memory (RAM) and a read-only memory (ROM) and may be configured to model a measuring system having at least two measuring devices. In particular, the computing device may be configured to calculate the probability of failure of the measuring system by means of a probability-oriented model (PGM), in particular a Bayesian network.

[0037] The input device of the computing unit may include: a keyboard for manual input; and one or more data interfaces for receiving data from an external database (environmental data for training AI functions, recorded vehicle data, expert knowledge, etc.). In particular, the input device may be connected to the external database by means of a wired connection and / or a radio connection.

[0038] Alternatively, the databases may be contained in the computing unit so that the computing device may directly access the data stored therein.

[0039] The output device of the calculation unit can include a screen on which the calculation results are displayed, with the help of which the measuring devices can be appropriately selected / parameterized. In addition, the output device can include one or more data interfaces, with the help of which, for example, the calculation results can be sent to an external output unit. This can be done by means of a wired connection and / or a radio connection. For example, the calculation results of the PGM can be sent to the output unit in production in order to adjust the parameterization of the produced measuring system there.

[0040] The calculation unit can be one or more independent calculation units. Alternatively or additionally, the calculation unit can be integrated in the vehicle control device so that the parameters of the evaluation algorithm can be adjusted even when the vehicle is in operation. For example, when the vehicle is in operation, environmental data of the vehicle can be continuously or temporarily collected, based on which, for example, new environmental conditions can be identified. With the help of the PGM, the selection probability of the measurement system can be determined when new environmental conditions exist, and the parameters of one or more redundant measurement devices can be adjusted so that even under these environmental conditions, there is a negative error correlation between these measurement devices and the predetermined value of the failure probability is not exceeded. In this regard, for example, multiple parameter sets of the measurement devices can be stored in the vehicle control device according to the identified environmental conditions. These parameter sets can include in particular the parameters of the evaluation algorithm, but can also include setting parameters of the sensors of the measurement device.

[0041] In particular, when the executed control device is also used for other tasks and thus always exists, the implementation scheme in the form of a computer program or computer program product with a program code for executing all method steps according to the method of the present invention is also advantageous, because this causes particularly low costs. Finally, a machine-readable storage medium is provided, on which a computer program as described above is stored. In particular, storage media or data carriers suitable for providing the computer program are magnetic storage, optical storage and electrical storage, such as hard disks, flash memories, EEPROMs, DVDs and others, etc. It is also feasible to download the program via a computer network (Internet, intranet, etc.). Here, this download can be implemented in a wired manner or in a cable manner or in a wireless manner (for example, via a WLAN network, 3G, 4G, 5G or 6G connection, etc.).

[0042] Further advantages and embodiments of the invention are apparent from the description and the accompanying drawings.

[0043] The invention is schematically illustrated in the drawings based on exemplary embodiments and is described below with reference to the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 A flow chart with method steps according to an exemplary embodiment of the present invention is shown.

[0045] Figure 2a and Figure 2b A Bayesian network is schematically shown, with which the failure probability of a sensing system with two redundant sensing devices according to an embodiment of the present invention can be determined.

[0046] Figure 3a and Figure 3b Schematically shows the Figure 2a and Figure 2b Bayesian network with modified parameters in . DETAILED DESCRIPTION

[0047] In the drawings, the same elements are provided with the same reference numerals, and thus, repeated descriptions are omitted when necessary.

[0048] Figure 1 A flow chart is shown having method steps for creating a perception system of a vehicle as a measuring system according to an exemplary embodiment of the present invention.

[0049] The perception system has at least two perception devices, which, as measuring devices, can be, for example, camera devices, radar devices, lidar devices, ultrasonic devices, or any other suitable devices for detecting the environment of the vehicle. In particular, the at least two perception devices can be redundant, that is, the at least two perception devices can detect a common area in the environment of the vehicle. Here, each perception device can include at least one sensor (such as a camera, a radar sensor, a lidar sensor or an ultrasonic sensor, etc.) and a corresponding evaluation unit. Each perception device can include its own evaluation unit, or there can be a common evaluation unit for multiple / all perception devices in the perception system.

[0050] In a first step 100 of the method shown, at least one environmental condition is identified, which influences the function of at least two perception devices of the perception system ("common cause"). The environmental condition may be, for example, a weather condition (rain, fog, snow, direct sunlight, etc.) or a time / space-dependent change in the lighting conditions (time of day, tunnel travel, etc.), which interacts with the sensors of the perception devices. For example, the at least one environmental condition may be identified based on expert knowledge stored in a database. Alternatively or additionally, the at least one environmental condition may be identified based on vehicle data measured in advance and stored in a database by means of corresponding algorithms (e.g. correlation coefficients, causal reasoning, etc.).

[0051] In order to determine the failure probability of the perception system having at least two perception devices, in a next step 110 a probabilistic directional model, in particular a Bayesian network, may be created, which maps the perception system having the at least two perception devices and the at least one environmental condition.

[0052] By means of the Bayesian network, in a further step 120, a failure probability of the perception system can be determined when the environmental condition is present, wherein positive and / or negative error correlations between at least two perception devices of the perception system are taken into account. For this purpose, the failure probability of the perception system can, for example, first be determined assuming an error correlation between the at least two perception devices. For example, if a positive error correlation is present under the identified environmental condition, the failure probability can also be determined in the case of a negative error correlation in order to determine the potential for reducing the failure probability.

[0053] Based on the potential determined in this way, in step 130, the perception system can be optimized by adjusting at least one of the perception devices in such a way that a negative error correlation between the at least two perception devices is caused or increased under the identified environmental conditions. For this purpose, for example, different sensors can be used in the perception devices, which sensors differ, for example, in their physical measurement principle (acoustic, electromagnetic, optical, etc.). For example, the first sensor can be an imaging sensor (e.g. a camera) and the second sensor can be a distance sensor (e.g. a radar or lidar sensor).

[0054] Furthermore, the negative error correlation between the at least two perception devices can be increased by installing an interface in the perception system, by means of which external sensor signals can be received. This makes it possible to access or use sensor signals provided, for example, by infrastructure (for example by roadside units) or other vehicles. Here, in particular, such signals that differ from the signals of the vehicle's own perception devices can be accessed in order to cause negative error correlation. Furthermore, the negative error correlation between the at least two perception devices can be increased by adjusting the perception algorithm or parameters of the perception algorithm in at least one of the at least two perception devices. For example, the contrast of the camera and / or the detection threshold of the AI ​​function can be increased or decreased. Thereby, a negative error correlation between the perception devices can be achieved even when using the same sensor / sensor type.

[0055] In a further step 140 , the influence of the individual measures mentioned above on the failure probability of the perception system can be checked with the aid of a Bayesian network, ie the Bayesian network can be reparameterized according to the selected adjustments and the failure probability can be re-determined.

[0056] If the determined failure probability is below a predetermined value, branch "1", the method moves to step 160 and creates the perception system. In the other case, branch "0", the method jumps to step 150, where the architecture of the perception system is modified, for example by adding additional perception devices.

[0057] The method then starts again at step 100 and the optimization measures are repeated until the determined probability of failure ( 140 ) is below the predetermined value.

[0058] Steps 110 to 140 can be repeated for a plurality of environmental conditions identified in step 100. In this case, if a negative error correlation between the at least two sensing devices has been induced or optimized for all identified environmental conditions, the system can be created (160). For this purpose, for example, a plurality of parameter sets of the sensing devices can be stored depending on the identified environmental conditions. These parameter sets can include in particular parameters of the sensing algorithm, but can also include setting parameters of the sensors of the sensing devices.

[0059] Figure 2a and Figure 2b A Bayesian network is schematically shown, with which the failure probability of a measuring system with two redundant measuring devices according to an embodiment of the present invention can be determined. The Bayesian network shown comprises: four nodes 201 to 204 with random variables; and four edges 301 to 304, which represent the error correlation between these random variables. The first node 201 contains a first environmental condition, here for example the time of day; the second node 202 contains a first measuring device 210; the third node 203 contains a second measuring device 220; and the fourth node 204 contains a measuring system 230 composed of a fusion of the two measuring devices 210, 220. The failure probability of the two measuring devices 210 and 220 depends on the time of day, so the first node 201 is connected to the second and third nodes 202, 203 by means of edges 301, 302. The selection probability of the measuring system 230 depends in turn on the failure probability of the two measuring devices 210, 220, from which the edges 303 and 304 are generated.

[0060] Each of these measuring devices 210, 220 has a 10% probability of failure (false negative, FN, symbol ) and 90% functional probability (true positive, sign ), from which it follows that the total probability of failure of the measuring system 230 is 10%*10%=1% when these measuring devices 210 , 220 are independent. The time of day, as an environmental condition, influences both measuring devices 210 , 220 .

[0061] exist Figure 2a In , the positive error correlation between these measuring devices 210, 220 is modeled, which leads to a higher total false negative failure probability P(FN) (P(FN) = 1.25% > 1%) compared to the case of independent measuring devices 210, 220. On the other hand, in Figure 2bIn the example, a negative error correlation between these measuring devices 210, 220 is modeled, which results in a lower overall probability of failure (P(FN) = 0.75% < 1%) compared to the case of independent measuring devices 210, 220. In both examples, the marginal probability of failure of each measuring device 210, 220 remains unchanged at 10%.

[0062] Figure 3a and Figure 3b Schematically shows the Figure 2a and Figure 2b Here, the corroborative evidence for the time of day is introduced into the Bayesian network with positive error correlation ( Figure 3a ) and the Bayesian network with negative error correlation ( Figure 3b ). Figure 3a , 3b In the diagram, the failure probability for the time of day "day" (symbol "sun" = 100%) is indicated at the top, and the failure probability for the time of day "night" (symbol "moon" = 100%) is indicated at the bottom.

[0063] Obviously, in the case of positive error correlation, the failure probability of the two measuring devices 210, 220 increases or decreases synchronously ( Figure 3a ). This could be the case, for example, if the same type of sensors, such as cameras, are included in the measuring devices 210, 220, which both have a lower probability of failure during the day than at night (5% during the day and 15% at night). From this, the total probability of failure in the case of a positive error correlation varies greatly depending on the environmental condition "time of day" (0.25% during the day and 2.25% at night), from which it can be inferred that the risk increases systematically when the environmental conditions change.

[0064] In contrast, in the case of a negative error correlation, the two measuring devices 210, 220 behave in opposite ways ( Figure 3b). This can be achieved, for example, by including different types of sensors in the two measuring devices 210, 220, for example a camera in 210 and a radar sensor in 220. Thus, during the day, the probability of failure of the first measuring device 210 is 5%, and the probability of failure of the second measuring device 220 is 15%. At night, due to the sensor characteristics, the probability of failure is reversed, and the probability of failure of the first measuring device 210 is 15%, and the probability of failure of the second measuring device 220 is 5%. In the present example, by this complementary increase / decrease in the probability of failure of the two measuring devices 210, 220 in the case of a negative error correlation, the total probability of failure is constant and the risk of failure of the total measuring system can be reduced when the ambient conditions change.

Claims

1. A method for creating a measuring system (230), the measuring system having at least two measuring devices (210, 220), the method comprising the following steps: identifying (100) at least one environmental condition that affects the function of at least two measuring devices (210, 220) of the measuring system (230); determining (120; 140) a probability of failure of the measuring system (230) when at least one identified environmental condition is present, taking into account a positive and / or negative error correlation between the at least two measuring devices (210, 220); adjusting (130) at least one of the at least two measuring devices (210, 220) so as to increase the negative error correlation between the at least two measuring devices (210, 220); and The measuring system (230) having the at least two measuring devices (210, 220) is created (160).

2. The method according to claim 1, wherein: A negative error correlation between the at least two measuring devices (210, 220) is increased by using a first sensor in a first measuring device (210) of the at least two measuring devices (210, 220) and using a second sensor different from the first sensor in a second measuring device (220) of the at least two measuring devices (210, 220).

3. The method according to claim 1 or 2, wherein: The negative error correlation between the at least two measuring devices (210, 220) is increased by installing an interface in the measuring system (230), by means of which an external sensor signal can be received.

4. A method according to any one of the preceding claims, wherein: A negative error correlation between the at least two measuring devices (210, 220) is increased by adjusting an evaluation algorithm in at least one of the at least two measuring devices (210, 220).

5. The method according to claim 4, wherein: A negative error correlation between the at least two measuring devices (210, 220) is increased by adjusting at least one parameter and / or type of the evaluation algorithm in at least one of the at least two measuring devices (210, 220).

6. A method according to any one of the preceding claims, wherein: The probability of a failure of the measuring system (230) is determined (120; 140) using a probability-oriented model.

7. A method according to any one of the preceding claims, wherein: The determination of the failure probability includes: determining a marginal total failure probability of the measurement system (230); and determining a conditional total failure probability of the measurement system.

8. The method according to any one of the preceding claims, further comprising: If the determined probability of failure exceeds a predetermined value, at least one of the at least two measuring devices (210, 220) is adjusted (130).

9. The method according to claim 8, further comprising: If the determined probability of failure is below the predetermined value, the measurement system (230) is created (160). 10 . A computing unit which is configured to carry out all method steps of the method according to claim 1 . 11 . A computer program which, when executed on a computing unit, causes the computing unit to execute all method steps of the method according to claim 1 .

12. A machine-readable storage medium having stored thereon the computer program according to claim 11.

Images