JPH02137035A - Computer system failure diagnosis device - Google Patents

Abstract

PURPOSE:To improve the trouble diagnostic accuracy and at the same time to shorten the diagnostic time by updating the assurance degree of diagnostic rule based on the diagnostic result information. CONSTITUTION:When the abnormality 1 to be diagnosed occurs, the state of occurrence of the abnormality 1 is automatically detected by an abnormality detector 4c. Then the detector 4c collects and stores the relevant data. Based on this data, a diagnostic part 3 reports the diagnostic result to a user 6 via a knowledge base 5 and the freeze data secured at detection of the abnormality 1. In the case other abnormality analysis data are required as a result of the initial diagnosis, the part 3 gives a request to an automatic data collection part 4 to collect the necessary data in the order of higher assurance degrees of the items conceivable as the factors of the abnormality 1. Thus the part 4 fetches the analysis data on a diagnostic subject 1. The collected data are stored in an abnormality result data base 7 and also sent to a knowledge data production part 4a. The part 4a produces the new knowledge data based on those collected data to add the new data to the base 5 and also to report it to the part 3. The part 3 receives the additional report from the base 5 and carries out a factor estimating process.

Description

[Detailed Description of the Invention] [Industrial Application Field] The present invention relates to failure diagnosis of a system composed of a single computer or a plurality of computers, such as a control computer system or a general-purpose computer system. The present invention relates to a fault diagnosis device that is equipped with a device that updates confidence in a knowledge base each time.

[Conventional technology]

The computer system failure diagnosis using conventional knowledge processing has the following configuration. In other words, when an abnormality occurs in the system, initial abnormality data is frozen, diagnostic inference is performed to list items that may be the cause of the system abnormality from this data, and based on the results of this inference, necessary Collect data and derive more accurate diagnostic inference results.

It provides guidance to the user. On the other hand, when an abnormality occurs, in order to find the cause, certainty is introduced into the knowledge base as an expression of uncertain knowledge. However, since the confidence level is determined by the intuition of the knowledge base builder, inference results that do not match reality may be obtained.

On the other hand, there is also a method that gives priority to rule execution according to the frequency of use of production rules (Japanese Patent Application Laid-Open No. 1989-1999).
-24646).

[Problem to be solved by the invention]

In the above-mentioned method of using confidence in the conventional technology, the set confidence does not necessarily match the actual phenomenon. Therefore, due to improper setting of the confidence level input by the operator, an accurate diagnosis result may not be obtained, or it may take a long time to obtain an inference result. but,
With current diagnostic equipment, it is difficult to discover what is causing the failure to match reality, so it is rare to change the certainty (8 degrees) once set, and even if the certainty is modified, it is based on intuition. I had no choice but to rely on him.

Furthermore, the method of updating the rule execution order based on the usage frequency of production rules is to give higher execution priority to rules that have been used more frequently in the past.
A problem with a fault diagnosis device such as the present invention is that the priority of a rule does not simply depend on the frequency of execution of a rule in the past.

An object of the present invention is to improve the precision of inference results and shorten the inference time by updating the corresponding confidence level each time a failure occurs.

[Means to solve the problem]

In order to achieve the above object, the present invention has the following configuration.

First, when inference is performed based on collected data, the rules are executed starting from the rule with the highest degree of certainty, and the inference is discontinued when the degree of certainty becomes less than a certain value -L. Each time a failure occurs, the cause of the failure is determined according to the guidance output by the diagnostic device. When the cause of the failure is finally determined, the conclusion is input into the failure diagnosis device to re-determine the corresponding confidence in the knowledge base based on the past history of failure occurrences. Here, the past failure history is appropriately reflected in updating the certainty factor, and a moving average value is used, which has a fast computer processing speed.

This makes it possible to make the confidence level indicating the relationship between the situation and the cause more realistic, improve the accuracy of failure diagnosis, and shorten the diagnosis time.

[Effect]

With this configuration, the confidence in the knowledge base, which was originally determined by the intuition of the knowledge constructor, is updated based on the actual history of occurrence each time a fault is diagnosed, so initially incorrect inference results may occur. By issuing , the long inference time will be improved and more accurate inference results will be obtained in a shorter time.

〔Example〕

The present invention will be specifically described with reference to examples of failure diagnosis.

First, it is assumed that the attribute relationship between the causes of abnormalities that may occur in the system and the situations that may occur as a result is obtained as a pre-order for diagnosing the abnormality of the subject.

FIG. 1 shows the software configuration of this diagnostic device.

In the figure, when an abnormality 1 that is a target of 1 diagnosis occurs, the abnormality detector 4c automatically detects the occurrence situation, collects and saves (freezes) data regarding the corresponding abnormality location. Based on this data, the diagnostic unit 3 performs an initial diagnosis of the abnormality using the knowledge base 5 and the freeze data at the time of abnormality detection.

The results of the initial diagnosis are reported to the user 6 via the man-machine interface 2. As a result of this initial diagnosis, if other abnormality analysis data is required.

This means that the confidence level of items that are considered to be the cause of the abnormal situation is below a certain value, but the diagnosis unit 3 sends the items that are considered to be the cause of the abnormal situation to the automatic data collection unit 4 in order of their confidence level. requests for data collection. The automatic data collection unit 4 takes in data for analysis of the diagnostic object 1 via the data communication path of the system. The collected data is stored in the abnormal performance database 7 and at the same time is transferred to the knowledge data creation section 4a.Based on this data, the knowledge data creation section 4a creates new knowledge data and adds it to the knowledge base 5. and report it to the diagnostic department 3. Upon receiving the additional report from the knowledge base 5, the diagnostic unit 3 executes a process of estimating the cause based on the new information.

In the above cause estimation process, if the possibility of the cause, specifically the certainty of the item that is the cause of the abnormality, exceeds a certain value, the diagnosis unit 3 uses the above inference result via the man-machine interface 2. The cause of the abnormality and its countermeasures are output to the user 6. If there are multiple causes of anomaly whose confidence exceeds a certain value, the multiple causes of anomaly and their countermeasures are listed in descending order of confidence. User 6 implements countermeasures according to this result. Also, if there are no longer data that can be automatically collected and inference rules that can be executed,
The above inference results, specifically, a list of possible causes of anomalies and countermeasures for the anomalies are output to the user 6 in descending order of confidence obtained so far. At this point, the user judges the situation based on the above diagnosis results, and if a more thorough diagnosis is to be performed, manually sets a new situation via the human output section 2a of the man-machine interface 2. As a result, the processing path is executed again, making it possible to more accurately estimate the cause of the abnormality. Further, the result of estimating the cause of the abnormality is stored in the abnormality record database 7 as historical data for learning rules. User 6 takes measures to recover from the abnormality based on the inference results.
When the cause of the failure is finally determined, the learning unit 8 re-determines the reliability of the depression-cause rule in the knowledge base 5 by inputting the conclusion.

FIG. 2 shows the operating order of this diagnostic process. Blocks 10 and 20 in FIG. 2 are block 4c in FIG. 1, and blocks 30 and 40 in FIG. 2 are block 3 in FIG. Block 50 in FIG. 2 is block 4b in FIG. 1, block 6 in FIG.
0 and 60a correspond to blocks 4a and 3.0 in FIG. Blocks 70 and 80 of FIG. 2 are performed at block 2b of FIG. 1, and blocks 140 to 170 of FIG. 2 are performed at 8 of FIG. 1, respectively.

Blocks 1o to 90 in FIG. 2 represent the processing flow of the automatic diagnosis section.

When an abnormality occurs in the system, the diagnostic process recognizes the location where the abnormality has occurred and executes abnormality information freeze 20. This saves the instantaneous data when an abnormality occurs, and prevents data from being destroyed due to runaway of the part where the abnormality has occurred, and data from changing over time. When the collection of this abnormality information is completed, abnormality cause estimation 30 is executed using the frozen information at the time of abnormality occurrence, cause rules, and factual knowledge on the knowledge base. Specifically, the degree of certainty that all possible abnormal causes from the group of abnormal situations based on the freeze information are the causes of the group of abnormal situations is determined by using the situation-cause rule with a high degree of certainty. The one with the highest degree is considered the causal hypothesis. If the certainty of the cause hypothesis is below a certain value based on this inference result, data collection 50 for abnormality diagnosis is executed via the data communication path of the system.

Here, possible related situations are extracted from the cause hypothesis using cause-situation rules, and data that is not included in the freeze information is collected as collected data items related to these situations. Specifically, this includes fixed data, extended information, and data related to the abnormal location. Based on the factual information of the collected data, an abnormal performance database update 60 is executed.

This knowledge is created as factual knowledge data in a form similar to existing factual knowledge data.

After repeating the above process, if the confidence level of even one cause hypothesis exceeds a certain value, or if the possibility cannot be sufficiently supported by the information that can be automatically collected, a diagnostic report 70 is sent to the user. conduct. This lists the abnormality cause hypotheses obtained up to this point, the degree of certainty as the cause of the abnormal situation, and countermeasures in descending order of degree of certainty. The confirmation of the abnormality cause hypothesis output in this report (7 degrees, depending on the countermeasure method, the user decides whether to re-diagnose or terminate the diagnosis.As an aid to this decision, the user has collected the The data is referenced via a man-machine interface.If re-diagnosis is decided, new factual data for re-diagnosis, specifically information containing ambiguous elements based on the user's visual perception, is input. By doing so, the abnormality cause estimation 30 is executed again, and a more thorough diagnosis result can be obtained.

Next is the learning section, which executes the process of changing the rule confidence based on the estimation result at the time when the result finally determined to be the cause of the abnormality among the results output by the automatic diagnosis section is input into the diagnostic device. be done.

Here, the situation-cause rule 110 and the estimated result 120 are used.

The situation-cause rule 110 is expressed in the following form.

[Conditional part] If situation X is observed, [Inference part] A is the cause. Confidence level aIB is the cause. Confidence level a2 C is the cause. , a2. a3. a4 is given a constant value (initial value) at the time of initial operation of the diagnostic system.

Normally, this initial value is calculated based on past experience data, but if there is no experience data at all, a mere estimated value may be used.

Here, it is assumed that causes A, B, C, and D have the same degree of certainty regarding situation X based on past cases.

In addition, when the cause cannot be easily determined, the following cause-situation rules are available to support the above certainty.

[Conditional part] If cause A exists, [Inference part] The situation is It 1llll+ Confidence level b
1 Situation M is observed Confidence level b2 Situation N is ll122II11 Confidence level b3 When the system is operated and a failure in situation is output to the estimation result file 120.

[Result 1] At: is the cause of situation X with the confidence of icl.

[Result 2] B is the cause of situation X with certainty of c2.

[Result 3] C is the cause of situation X with certainty of c3.

These result confidence levels cl, c2. 'c3 is cause A.

It is calculated using the certainty of B and C and the certainty of the prisoner-situation rule for D, which is supported by the collected data. These are the following functions (combine functions)
It can be found by using

(1) If a and b are positive values, c = a + b - (a * b) (2) If either a or b is a negative value, c =
(a + b)/ (1-+++in(l a
l Book 1 b 1 ) (3) When a and b are negative values, c = a + b + (a * b) This serves to combine multiple confidence levels into one.

Here, the confidence of the result cl, c2. It is assumed that c3 has the following relationship.

c 1 > c 2 > c 3 and cl) The constant value learning unit determines the probability of the corresponding rule (4 degrees (
al, a2. a3) is updated 150.

This update method uses a moving average value (moving average value).
ge) is used. The reasons for adopting this method are that the number of steps in the computer program is relatively small compared to other methods, and the execution time is short.

Confidence group a l + a 2 + a of inference rule part
3 is calculated as a simple average from past viewing results as follows.

i=1 Σcl a= ...Formula (1) N
= Number of times an abnormality due to the corresponding cause was observed CI = Result confidence level i a = Average confidence level of the cause.

Therefore, when updating the confidence level a1 using the current result 120, the following formula is used.

at"at-t+ (aet-at-n)"
'Equation (2) aj = Current cause certainty (updated value) at-1'' Previous cause certainty aet = Current cause certainty (estimated value) at-1 = n
The ael that appears in the previous result confidence n = moving average value window width (2) is calculated from the current result confidence. Since cause certainty is proportional to result certainty, this is calculated using the following formula.

t-1 ct = Current result confidence Qt-1 = Previous result confidence By using the moving average value obtained by formula (2) as the certainty of the situation-cause rule, the inference rule reflects the current situation. This will more accurately represent the current situation.

The feature of this learning part is that if n in Equation 1 (2) is made smaller, it becomes more sensitive to new information and quickly follows the latest state (
learn. On the other hand, if n is set to a large value, past information will also be given weight, and the learning speed will be slow, but the fault diagnosis will include conventional thinking and analysis methods.

The graph of FIG. 3 shows the results of a simulation in which n in equation (2) was varied from 2 to 5. This confidence update is
This is an update of the confidence level of the rule that ultimately led to the correct inference result.

As can be seen from this graph, the smaller n is, the faster the rule confidence update (learning) is, and it is understood that the latest state can be followed appropriately.

However, when n=2, the amount of variation is large, and when n≧5, the learning speed becomes extremely slow. Therefore.

n=3 provides the smoothest tracking.

The graph in FIG. 4 shows the number of hits for deriving the correct cause from the situation by using n=3 in the rule learning formula and inputting past failure data. Here n=3 and n=
We compared the results of the learning method No. 5 and the results without learning. As can be seen here, the hit rate at the start of the test is the same for both the learning and non-learning methods, but as the number of diagnoses increases, the difference in hit rate becomes clearer. In the learning formula for learning n = 3,
In the 10th test, the hit rate for the cause was 94%,
While one complete causal inference is performed, diagnosis without learning results in a hit rate of about 50%, which is the same as at the start of the simulation.

Another feature of the present invention is that the number of inference rules can be limited by the set value of the confidence level that is considered to be the cause of an abnormality.

This is because when even one item's confidence level (confidence level as an inference result) that causes an abnormality exceeds a certain value, the inference to pursue the cause is stopped and a report is sent to the system user.

The certainty of cause items can be classified as follows.

Confidence level Probability 1.0 to 0.7 Highly likely to be the cause of situation X 0.7 to 0.3 Possible to be the cause of situation X 0, 3 to -0.3 Neither I can't say -0,3~
-0.7 Possibly not the cause of situation X -0.7~-
1.0 There is a high possibility that this is not the cause of situation X. Therefore,
If you want to know the cause with very high confidence, setting the result confidence high (e.g. 0.9) will take some time for the fault diagnosis system to infer, but the cause reported to the user will have a very high probability. The true cause of the failure will be compensated.

Conversely, if the result certainty is set low (for example, 0.6), the inference time of the fault diagnosis system will be shortened, but multiple items that may be the cause will be obtained.

Which one to adopt depends on the scale of the system. When the confidence of the situation-cause rule is updated, the rules are sorted in descending order of confidence (160°).The purpose of this process is to give priority to execution of rules with high confidence the next time based on the learning results. be. This makes it possible to reduce inference time.

〔Effect of the invention〕

The present invention combines a fault diagnosis section and a rule learning section.

By automatically adjusting rules based on diagnosis results,
It is expected to bring about the following effects in system failure diagnosis.

(1) By updating (learning) the confidence level of the diagnostic rule from the diagnostic result information, it is possible to fine-tune the diagnostic rule without relying on experts.

(2) The inference time for cause estimation can be shortened by updating (learning) the confidence level of diagnostic rules from the diagnosis result information and giving priority to executing rules with a high confidence level at the next diagnosis.

(3) By arbitrarily setting the window of the moving average value of the learning process, it is possible to change the system to either rapid learning or slow learning.

Therefore, it is possible to build a more flexible diagnostic system.

(4) Expert's personal experience through automatic learning.

To prevent variations in the degree of learning of rules without being influenced by intuition. Therefore, the failure diagnosis system can be standardized.

[Brief explanation of the drawing]

Figure 1 is a software configuration diagram of an embodiment of the present invention, Figure 2 is a software configuration diagram of an embodiment of the present invention.
The figure is a flowchart showing the operation sequence of FIG. 1. FIG. 3 is a diagram showing a graph of rule certainty update, and FIG. 4 is a diagram showing a graph representing the total number of failures and cause hit rate. 1... Diagnosis target, 2... Man-machine interface, 3... Diagnosis section, 4... Automatic data collection section, 5.
...Knowledge base, 6. User, 7. Abnormal performance database, 8. Learning department.

Claims (1)

[Claims] 1. A data collection unit that recognizes the occurrence of a failure in a computer system and collects the data necessary for failure diagnosis, a diagnosis unit that estimates the cause of the failure based on the relevant knowledge base, and a man-machine interface that notifies the operator of the diagnosis results. What is claimed is: 1. A computer system failure diagnosis device having a function of updating certainty factors used in rules in a knowledge base each time a failure occurs.