Method, computing unit and computer program for creating a measurement system

Abstract

The invention relates to a method for creating a measuring system (230) comprising at least two measuring devices (210, 220), comprising identifying (100) at least one environmental condition which influences a function of the at least two measuring devices (210, 220) of the measuring system (230); determining (120; 140) the probability of failure of the measuring system (230) when the at least one identified environmental condition is present, taking into account a positive and / or a negative error dependency between the at least two measuring devices (210, 220); adjusting (130) at least one of the at least two measuring devices (210, 220) such that the negative error dependency between the at least two measuring devices (210, 220) is increased; and creating (160) the measuring system (230) with the at least two measuring devices (210, 220).

Description

The present invention relates to a method for creating a measurement system and to a computing unit and a computer program for carrying out the method.BACKGROUND OF THE INVENTIONA solution which is often used to make measuring systems fault-tolerant is the use of redundancy concepts. In this case, selected processing channels (e.g. measuring devices) are executed twice and their results are checked for consistency. This allows errors in one of the processing channels to be identified and the system can react accordingly. However, these redundancy concepts only function if independence of the processing channels from one another is ensured. In conventional measurement systems, the failures of which arise mainly as a result of hardware errors, for example, heating of electrical components or a failure of the voltage supply can lead to a common cause of failure (common cause). In order to avoid these, the execution of a so-called "dependent failure analysis" is recommended in the relevant safety standards, for example in ISO 26262 as a global standard for the safety of road vehicles.For highly complex measurement systems such as a perception system for highly automated driving, the standard ISO 21448 additionally requires an evaluation of external influences or predictable abuse ("triggering conditions") on the functionality of the system. The external influences can be, for example, weather influences, light conditions, etc., which result in the perception or evaluation algorithm used no longer being able to recognize objects in a robust manner. Here too, the focus is usually placed on avoiding common-cause failures, i.e. attempts are made to avoid positive dependencies in redundant perception devices or to configure these independently of one another.Disclosure of the InventionAccording to the invention, a method for creating a measurement system having at least two measurement devices, and a computing unit and a computer program for carrying out the method having the features of the independent patent claims are proposed. Advantageous embodiments are the subject matter of the dependent claims and of the following description.The method according to the invention uses, in particular, negative error dependencies between measuring devices of a measuring system or brings them about, as a result of which lower total failure probabilities are made possible than by pure independence of the measuring devices. Possible external influences (environmental conditions) on the measurement system are taken into account in this case, so that its robustness can be increased. Furthermore, by taking account of negative error dependencies, a number of redundant measuring devices can be reduced without loss of safety.The invention develops particular advantages in measuring systems in vehicles, since the highest possible level of reliability is sought there, in particular in critical measuring systems, in particular those whose failure leads to a risk for persons. The invention is particularly suitable for perception systems as measurement systems with perception devices as measurement devices for detecting an environment as measurement information. The invention can be used advantageously for vehicle-bound and non-vehicle-bound perception systems, e.g. for those which monitor an infrastructure, e.g. a road intersection etc., or generally serve for monitoring.If a measurement system PS contains, for example, a first and a second measurement device PV 1, PV 2 for acquiring measurement information, a probability of failure of the entire measurement system PS can be determined by combining the probability of failure of the two measurement devices PV 1, PV 2 as follows:If the probability of failures of the two measuring devices PV 1, PV 2 are independent of one another, the following applies:The term of the conditional probability of the second measuring device PV 2 can, however, also be divided into two regions, each of which has a positive or a negative dependence on the probability of failure of the first measuring device PV 1.In this case, the region for a positive dependence of the second measuring device PV 2 on the first measuring device PV 1 can be defined as follows:It follows from this that the probability of failure of the second measuring device PV 2 is higher if the first measuring device PV 1 has already failed. This can occur, for example, when both measuring devices PV 1, PV 2 contain sensors of the same type that differ only with regard to their measurement tolerances. In this case, if the first measuring device PV 1 fails, for example due to currently occurring environmental conditions such as weather or lighting conditions, the probability increases that the second measuring device PV 2 likewise fails.Accordingly, however, a region for a negative dependence of the second measuring device PV 2 on the first measuring device PV 1 can also be defined:In this case, the probability of failure of the second measuring device PV 2 falls if the first measuring device PV 1 has already failed. This can occur, for example, if both measuring devices PV 1, PV 2 contain sensors of different types, one of which responds negatively and one positively to the currently occurring environmental conditions.The measurement system to be created contains at least two measurement devices, which can be, for example, a camera device, a radar device, a lidar device, an ultrasonic device or any other suitable device for capturing the measurement information of interest. In particular, the measuring system can contain a plurality of measuring devices. Each measuring device can comprise at least one sensor (e.g. a camera, a radar, lidar or ultrasonic sensor, etc.) and a corresponding evaluation unit. The evaluation unit can be configured to calculate at least one evaluation algorithm in order to derive the required measurement information from the sensor signals. The evaluation algorithm can contain, for example, AI functions which have been learned with a multiplicity of environmental data of the vehicle. Each measuring device can comprise its own evaluation unit or a common evaluation unit can be present for a plurality / all measuring devices in the measuring system. In particular, the at least two measuring devices can be redundant, i.e. they can detect a common area in the environment of the vehicle.In the method according to the invention, at least one environmental condition is identified which influences a function of the at least two measuring devices of the measuring system (common-cause). The environmental condition can be, for example, a weather condition (rain, fog, snow, direct solar radiation, etc.) or a change in lighting conditions (time of day, tunnel travel, etc.) which is caused in time / location and interacts with the sensors of the measuring devices. The identification of the at least one environmental condition can be carried out, for example, on the basis of expert knowledge stored in a database. Alternatively or additionally, the at least one environmental condition can be identified based on vehicle data measured in advance and stored in a database using corresponding algorithms (e.g. correlation coefficient, causal inference, etc.). In particular, a plurality of ambient conditions can be identified which influence the function of the at least two measuring devices.After identification of the at least one environmental condition, a failure probability of the measurement system is determined in the presence of the environmental condition, wherein a positive and / or a negative error dependence between the at least two measurement devices of the measurement system is taken into account. For this purpose, the probability of failure of the measurement system can be determined, for example, initially on the assumption of the present error dependence between the at least two measurement devices. If, for example, a positive fault dependency is present in the identified environmental condition, then the probability of failure can additionally be determined in the case of a negative fault dependency in order to ascertain a potential for reducing the probability of failure. If, in turn, there is already a negative error dependence, the probability of failure can be determined with a positive error dependence in order to determine its influence on a potential increase in the probability of failure. This procedure may be repeated for each identified environmental condition.According to one specific embodiment, the probability of failure of the measurement system may be determined by means of a probabilistically directed model (PGM). In particular, a Bayesian network can be created for this purpose, which maps the measurement system with the at least two measurement devices and the at least one environmental condition. A structure of the Bayesian network can be created, for example, on the basis of expert knowledge stored in a database or on the basis of vehicle data measured in advance and stored in a database by means of corresponding algorithms (e.g. structure learning, causal discovery, etc.). Likewise, the model can be parameterized either on the basis of expert knowledge (expert judgement) or on the basis of data (e.g. by means of parameter learning). By applying the Bayesian network, it is possible in particular to determine which optimization potential is present in the measurement system by introducing / increasing the negative error dependence between the at least two measurement devices.According to the invention, at least one of the at least two measuring devices is adapted in such a way that the negative error dependence between the at least two measuring devices is increased. In other words, the measuring devices can be configured in particular such that a failure of a first device under the influence of the identified environmental condition does not lead to an increased, but rather to a reduced failure probability of a second device.According to an embodiment, the negative error dependence between the at least two measuring devices can be increased by using a first sensor in a first measuring device and a second sensor different from the first in a second measuring device. The first and second sensors may differ, for example, with regard to their physical measuring principle (acoustic, electromagnetic, optical, etc.). For example, the first sensor may be an imaging sensor (e.g., a camera) and the second sensor may be a range-finding sensor (e.g., a radar or lidar sensor). Alternatively or additionally, the first sensor may be an active sensor and the second sensor may be a passive sensor. When two range-finding sensors are used, these may differ, for example, in their wavelength (infrared radiation, visible radiation, radar waves).Alternatively or additionally, the negative error dependence between the at least two measuring devices can be increased by arranging an interface in the measuring system, by means of which interface external (non-system) sensor signals can be received. The interface can be contained, for example, in one or more evaluation units of the measurement system. This enables access to sensor signals or use of sensor signals which are provided, for example, by an infrastructure (for example road side units) or other vehicles. In this case, in particular, signals which differ from the signals of the system's own measuring devices can be accessed in order to bring about a negative error dependency. For example, a radar signal of a road side unit may be received as a redundant signal to a camera signal of the vehicle. By attaching an interface in the measuring system, its probability of failure during operation can be reduced depending on external further measuring devices available in the system environment.Alternatively or additionally, the negative error dependence between the at least two measuring devices can be increased by adapting an evaluation algorithm in at least one of the at least two measuring devices or by the evaluation algorithms of the at least two measuring devices differing. This can be effected, for example, by a corresponding selection of the evaluation algorithm. If, for example, artificial intelligence (AI)-based algorithms are used, a data set or hyperparameter of the evaluation algorithm can be adapted in order to establish or increase a negative error dependence between the at least two measuring devices. For example, the at least two measuring devices or their evaluation algorithms can be trained with different data sets, of which a first has a larger number of data points in a first environmental condition (e.g. day) and a second has a larger number of data points in a second environmental condition (e.g. night). As a result, the measuring device that was trained with the first data set has a higher accuracy in the presence of the first environmental condition and a lower accuracy in the presence of the second environmental condition. The measuring device that was trained with the second data set, on the other hand, has a higher accuracy in the presence of the second environmental condition and a lower accuracy in the presence of the first environmental condition, whereby, in total, a negative dependency can be achieved in the two measuring devices.In addition to the above-described adaptation of the evaluation algorithm itself or its architecture, the negative error dependence between the at least two measuring devices can be increased in that at least one parameter of the evaluation algorithm is adapted in at least one of the at least two measuring devices, or that at least one parameter of the evaluation algorithm of the at least two measuring devices differs. For example, a contrast of a camera and / or a detection threshold of an AI function may be increased or decreased. This makes it possible to achieve negative error dependencies between the measuring devices even when identical sensors or sensor types are used. When neural networks are used, their layer depth and layer size can be adapted, for example.The effects of the individual measures described above on the probability of failure of the measurement system can be checked, for example, by means of the Bayesian network, i.e. the Bayesian network can be reparameterized according to the selected adaptation and the probability of failure determined again.According to one embodiment, the at least one of the at least two measuring devices is adapted if-and in particular only if-the determined probability of failure, in particular the probability of failure determined with the present fault dependency, exceeds a predetermined value. If, for example, a positive fault dependence is present between the at least two measuring devices in the identified environmental condition, then the additionally ascertained probability of failure in the case of a negative fault dependence can be used to use its potential for reducing the probability of failure.Furthermore, according to the invention, the measuring system is created with the at least two measuring devices. This is to be understood in particular as defining a design or construction plan of the measurement system. Alternatively or additionally, this comprises an actual physical production of the measurement system.According to one specific embodiment, the measuring system is created if-and in particular only if-the determined probability of failure falls below a predetermined value or at least does not exceed it.According to one specific embodiment, the measuring system may be created when-and in particular only when-the probability of failure for all relevant or identified environmental conditions falls below or at least does not exceed the predetermined value. With these embodiments, a measurement system having a desired maximum failure probability is obtained.According to one specific embodiment, the determination of the probability of failure may include a determination of a marginal total probability of failure and a determination of a conditional total probability of failure of the measurement system. In this case, a first predetermined value for the marginal total failure probability and a second predetermined value for the conditional total failure probability can be established, and the measurement system can be created, for example, only if the two predetermined values are undershot. Alternatively, the measurement system can be created if at least one of the two predetermined values is undershot.In this case, the marginal total failure probability can be determined, for example, by means of the belief propagation algorithm or the variable elimination algorithm. The conditional total failure probability for the measurement system can be determined in particular for all identified environmental conditions. In this way, it can be assessed whether a sufficiently low marginal total failure probability and additionally no significant increase by the identified environmental conditions has been achieved. This evaluation makes it possible to classify a measurement system as sufficiently safe for highly automated driving.The creation of the measurement system can in this case in particular comprise a selection / compilation and parameterization of redundant measurement devices (sensor and evaluation unit), which have been adapted as described above in order to increase their negative error dependencies and to fall below the predetermined value of the probability of failure in combination.In other words, an architecture for a measurement system can be created / designed / optimized by means of the described method and subsequently produced. Some embodiments of the method also offer the possibility of reducing the probability of failure of the measurement system even during its operation. For example, the parameters of individual measuring devices (e.g. a contrast of a camera or a detection threshold of an AI function in an evaluation algorithm) can be adjusted based on new data in the installed state of the measuring system.A computing unit according to the invention having a processor is configured, in particular by programming, to carry out a method according to the invention. The computing unit can in particular contain an input device, a computing device and an output device. The computing device may include the processor as well as a random access memory (RAM) and a read only memory (ROM) and be configured to model a measurement system with at least two measurement devices. In particular, the calculation device can be configured to calculate failure probabilities of the measurement system by means of a probabilistically directed model (PGM), in particular a Bayesian network.The input device of the computing unit may include a keyboard for manual input as well as one or more data interfaces for receiving data (environmental data for training AI functions, recorded vehicle data, expert knowledge, etc.) from external databases. In particular, the input device can be connected to the external databases by means of a wired connection and / or a radio connection.Alternatively, the databases may be included in the computing unit so that the computing device can directly access the data stored therein.The output device of the computing unit can comprise a screen on which calculation results are displayed, by means of which the measuring devices can be selected / parameterized in a suitable manner. Furthermore, the output device can comprise one or more data interfaces, by means of which calculation results can be sent, for example, to external output units. This can be done by means of a wired connection and / or a radio connection. For example, calculation results of the PGM may be sent to an output unit in a production to adapt a parameterisation of the produced measurement systems there.The computing unit can be one or more separate computing units. Alternatively or additionally, the computing unit can be integrated in a vehicle control device in order to be able to adapt parameters of the evaluation algorithms even during the running operation of the vehicle. For example, during vehicle operation, environment data of the vehicle may be continuously or temporarily collected, based on which, for example, a new environment condition may be identified. By means of the PGM, the selection probability of the measurement system can be determined when the new environmental condition is present and the parameters can be adjusted by one or more redundant measurement devices in such a way that a negative error dependence between them is present even in this environmental condition and a predetermined value of the failure probability is not exceeded. In this context, for example, a plurality of parameter sets for a measuring device can be stored in the vehicle control unit depending on the identified environmental conditions. The parameter sets can in particular comprise parameters of the evaluation algorithm, but also setting parameters of the sensors of the measuring device.The implementation of a method according to the invention in the form of a computer program or computer program product with program code for carrying out all method steps is also advantageous since this causes particularly low costs, in particular if an executing control device is also used for further tasks and is therefore present in any case. Finally, a machine-readable storage medium is provided with a computer program stored thereon, as described above. Suitable storage media or data carriers for providing the computer program are, in particular, magnetic, optical and electrical memories, such as hard disks, flash memories, EEPROMs, DVDs, among others. Download of a program via computer networks (Internet, intranet, etc.) is also possible. Such a download can be effected in a wired or wired or wireless manner (e.g. via a WLAN network, a 3G, 4G, 5G or 6G connection, etc.).Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawing.The invention is schematically illustrated in the drawing on the basis of exemplary embodiments and is described below with reference to the drawing.Brief Description of the DrawingsFIG. 1 shows a flow chart with method steps according to an exemplary embodiment of the invention. FIGS. 2 aand 2 bschematically show a Bayesian network, with which a failure probability of a perception system having two redundant perception devices may be determined according to an embodiment of the invention. FIGS. 3 aand 3 bschematically show the Bayesian network of FIGS. 2 aand 2 b, with changed parameters.Embodiment(s) of the InventionIn the figures, the same elements are provided with the same reference numerals. Therefore, repetitive description is omitted as appropriate.FIG. 1 shows a flow chart with method steps for creating a perception system for a vehicle as a measurement system according to an exemplary embodiment of the invention.The perception system has at least two perception devices as measuring devices, which can be, for example, a camera device, a radar device, a lidar device, an ultrasonic device or any other suitable device for detecting the environment of the vehicle. In particular, the at least two perception devices can be redundant, i.e. they can detect a common area in the surroundings of the vehicle. Each perception device can in this case comprise at least one sensor (e.g. a camera, a radar, lidar or ultrasonic sensor, etc.) and a corresponding evaluation unit. Each perception device can comprise its own evaluation unit or a common evaluation unit can be present for a plurality / all perception devices in the perception system.In a first step 100 of the method shown, at least one environmental condition is identified which influences a function of the at least two perception devices of the perception system (common cause). The environmental condition can be, for example, a weather condition (rain, fog, snow, direct solar radiation, etc.) or a change in lighting conditions (time of day, tunnel travel, etc.) due to time / location, which interacts with the sensors of the perception devices. The identification of the at least one environmental condition can be carried out, for example, on the basis of expert knowledge stored in a database. Alternatively or additionally, the at least one environmental condition can be identified based on vehicle data measured in advance and stored in a database using corresponding algorithms (e.g. correlation coefficient, causal inference, etc.).In order to determine a probability of failure of the perception system using the at least two perception devices, a probabilistically directed model, in particular a Bayesian network, can be created in a next step 110, which model maps the perception system using the at least two perception devices and the at least one environmental condition.In a further step 120, a failure probability of the perception system in the presence of the environmental condition can be determined by means of the Bayesian network, wherein a positive and / or a negative error dependence between the at least two perception devices of the perception system is taken into account. For this purpose, the probability of failure of the perception system can be determined, for example, first on the assumption of the present error dependence between the at least two perception devices. If, for example, a positive fault dependency is present in the identified environmental condition, then the probability of failure can additionally be determined in the case of a negative fault dependency in order to ascertain a potential for reducing the probability of failure.Based on the potential determined in this way, the perception system can be optimized in step 130 by at least one of the perception devices being adapted in such a way that a negative error dependence between the at least two perception devices is brought about or increased in the identified environmental condition. For this purpose, for example, different sensors can be used in the perception devices, which differ, for example, with regard to their physical measuring principle (acoustic, electromagnetic, optical, etc.). For example, the first sensor may be an imaging sensor (e.g., a camera) and the second sensor may be a range-finding sensor (e.g., a radar or lidar sensor).In addition, the negative error dependence between the at least two perception devices can be increased by arranging an interface in the perception system, by means of which interface external sensor signals can be received. This enables access to sensor signals or use of sensor signals which are provided, for example, by an infrastructure (for example road side units) or other vehicles. In this case, in particular, signals which differ from the signals of the vehicle-mounted perception devices can be accessed in order to bring about a negative error dependence. Moreover, the negative error dependence between the at least two perception devices may be increased by adjusting a perception algorithm or parameters of the perception algorithm in at least one of the at least two perception devices. For example, a contrast of a camera and / or a detection threshold of an AI function can be increased or decreased. This makes it possible to achieve negative error dependencies between the perception devices even when identical sensors / sensor types are used.In a further step 140, the effects of the individual measures described above on the probability of failure of the perception system can be checked by means of the Bayesian network, i.e. the Bayesian network can be reparameterized according to the selected adaptation and the probability of failure determined again.If the determined probability of failure falls below a predetermined value, branch "1", the method proceeds to step 160 and the perception system is created. Otherwise, branch "0", the method jumps to step 150 in which revision of the architecture of the perception system takes place, for example by adding an additional perception device.Subsequently, the method begins anew in step 100 and repeats the optimization measures until the determined probability of failure ( 140) falls below the predetermined value.Steps 110 through 140 may be repeated for a plurality of environmental conditions identified in step 100. In this case, the system may be created ( 160) if the negative error dependence between the at least two perception devices has been induced or optimized for all identified environmental conditions. For this purpose, for example, a plurality of parameter sets for a perception device can be stored depending on the identified environmental conditions. The parameter sets can in particular comprise parameters of the perception algorithm, but also setting parameters of the sensors of the perception device.FIGS. 2 aand 2 bschematically show a Bayesian network, with which a failure probability of a measurement system with two redundant measurement devices may be determined according to an embodiment of the invention. The illustrated Bayesian network comprises four nodes 201 to 204 with random variables and four edges 301 to 304 representing the error dependencies between the random variables. The first node 201 contains a first environmental condition, here e.g. the time of day, the second node 202 contains a first measuring device 210, the third node 203 contains a second measuring device 220 and the fourth node 204 contains a measuring system 230 consisting of a fusion of the two measuring devices 210, 220. The probability of failures of the two measuring devices 210 and 220 depends on the time of day, so the first node 201 is connected to the second and third nodes 202, 203 by means of the edges 301, 302. The selection probability of the measuring system 230 is in turn dependent on the probability of failure of the two measuring devices 210, 220, resulting in the edges 303 and 304.Each of the measuring devices 210, 220 has a failure probability (false negative, FN, symbol "⊗") of 10% and a function probability (true positive, symbol "≅") of 90%, resulting in a total failure probability of the measuring system 230 of 10%*10%=1% if the measuring devices 210, 220 are independent. The time of day influences both measuring devices 210, 220 as the environmental condition.In FIG. 2 a, a positive error dependence between the measuring devices 210, 220 is modeled, which leads to a higher total false-negative failure probability P(FN) than would be the case with independent measuring devices 210, 220 (P(FN)=1.25% >1%). In FIG. 2 b, on the other hand, a negative error dependence between the measuring devices 210, 220 is modeled, which leads to a lower total failure probability than would be the case with independent measuring devices 210, 220 (P(FN)=0.75%<1%). The marginal failure probability of the individual measuring devices 210, 220 remains unchanged 10% in both examples.FIGS. 3 aand 3 bschematically show the Bayesian network of FIGS. 2 aand 2 b, with changed parameters. Hard evidences for the time of day are introduced into the Bayesian network with the positive error dependence (FIG. 3 a) and the Bayesian network with the negative error dependence (FIG. 3 b), respectively. In both FIGS. 3 a, 3 b, the failure probabilities for the time of day "day" (symbol "sun"=100%) are respectively indicated at the top and the failure probabilities for the time of day "night" (symbol "moon"=100%) are indicated at the bottom.It becomes clear that, in the case of a positive error dependence, the probability of failures of both measuring devices 210, 220 synchronously increase or decrease (FIG. 3 a). This can be the case, for example, if sensors of the same type, e.g. cameras, are contained in the measuring devices 210, 220, which sensors both have a lower probability of failure during the day than during the night (5% during the day vs. 15% during the night). As a result, the total failure probability is greatly different depending on the environmental condition "time of day" with a positive error dependence (0.25% in day vs. 2.25% in night), from which it can be concluded that the risk is systematically increasing with changing environmental conditions.In contrast, in the case of a negative error dependence, there is an opposite behavior of the two measuring devices 210, 220 (FIG. 3 b ). This can be achieved, for example, by including sensors of different types in the two measuring devices 210, 220, e.g., a camera in 210 and a radar sensor in 220. As a result, the probability of failure of the first measuring device 210 during the day is 5% and that of the second measuring device 220 is 15%. At night, due to the sensor characteristics, the failure probabilities rotate, and the failure probability of the first measuring device 210 is 15% and that of the second measuring device 220 is 5%. Due to this complementary increase / decrease of the failure probabilities of the two measuring devices 210, 220 in the case of a negative error dependence, the total failure probability is constant in the present example and the risk of a failure of the entire measuring system in the case of changing ambient conditions can be reduced.

Claims

Method for creating a measurement system (230) having at least two measurement devices (210, 220), comprising the steps of: identifying (100) at least one environmental condition which influences a function of the at least two measurement devices (210, 220) of the measurement system (230); determining (120; 140) the probability of failure of the measurement system (230) when the at least one identified environmental condition is present, taking into account a positive and / or a negative error dependence between the at least two measurement devices (210, 220); adapting (130) at least one of the at least two measurement devices (210, 220) such that the negative error dependence between the at least two measurement devices (210, 220) is increased; and creating (160) the measurement system (230) with the at least two measurement devices (210, 220).The method of claim 1, wherein the negative error dependence between the at least two measurement devices (210, 220) is increased by using a first sensor in a first measurement device (210) of the at least two measurement devices (210, 220) and a second sensor different from the first in a second measurement device (220) of the at least two measurement devices (210, 220).Method according to Claim 1 or 2, wherein the negative error dependence between the at least two measuring devices (210, 220) is increased by the fact that an interface is provided in the measuring system (230), by means of which external sensor signals can be received.Method according to one of the preceding claims, wherein the negative error dependence between the at least two measuring devices (210, 220) is increased by adapting an evaluation algorithm in at least one of the at least two measuring devices (210, 220).Method according to claim 4, wherein the negative error dependence between the at least two measuring devices (210, 220) is increased by adjusting at least one parameter and / or a type of the evaluation algorithm in at least one of the at least two measuring devices (210, 220).Method according to one of the preceding claims, wherein the determination (120; 140) of the probability of failure of the measurement system (230) is effected by means of a probabilistically directed model.Method according to one of the preceding claims, wherein the determination of the probability of failure comprises a determination of a marginal total probability of failure and a determination of a conditional total probability of failure of the measurement system (230).The method of any preceding claim, further comprising: adjusting (130) the at least one of the at least two measurement devices (210, 220) when the determined probability of failure exceeds a predetermined value.The method of claim 8, further comprising: creating (160) the measurement system (230) if the determined probability of failure is below the predetermined value.Computing unit which is configured to carry out all method steps of a method according to one of the preceding claims.A computer program that causes a computing unit to perform all method steps of a method according to any one of claims 1 to 9 when executed on the computing unit.A machine readable storage medium having stored thereon a computer program according to claim 11.

Images