|Publication number||US7373552 B2|
|Application number||US 10/955,290|
|Publication date||May 13, 2008|
|Filing date||Sep 30, 2004|
|Priority date||Sep 30, 2004|
|Also published as||CN1763720A, DE102005046388A1, US20060085689|
|Publication number||10955290, 955290, US 7373552 B2, US 7373552B2, US-B2-7373552, US7373552 B2, US7373552B2|
|Original Assignee||Siemens Aktiengesellschaft|
|Export Citation||BiBTeX, EndNote, RefMan|
|Patent Citations (19), Non-Patent Citations (1), Referenced by (9), Classifications (10), Legal Events (4)|
|External Links: USPTO, USPTO Assignment, Espacenet|
Software systems comprising various components frequently utilize log databases to track system and component operation for diagnostic purposes. An “event log” may be used to chronologically stores events that are generated by different software components in the system. Software components may generate events as responses to certain combinations of their internal state and stimuli from, for example, other software modules, the hardware, or the user.
The logged events typically fall into one of three categories: “Error Events” are generated when errors are found or exceptional or unexpected things occur; “Success Events” are generated as information indicating that aspects of the system are running properly; and “Information Events” are generated as information indicating that certain informational things occur.
Event can further more be assigned a severity level. Different Error Events may, for example, have different severity levels. The Success Events and the Information Events are usually indicated as having a lower severity level than the Error Events.
The event log can be broken down as having different access levels as well. For example, only system administrators may have access to certain secure logs (“Internal Event Log”) or sections of the log or events (e.g., security violations, etc.), whereas software component users may have access to various logs (“User Event Log”) or log sections pertaining to operation of the respective software component.
For the user, the User Event Log shows a filtered version of the Internal Event Log. The purpose of filtering the Internal Event Log is to avoid showing irrelevant and redundant information to the user. The User Event Log only shows events with a particular criticality level (this level being a configurable level). Events are displayed in the User Event Log until the user acknowledges them. The user interface may show a special icon as long as the User Event Log contains at least one unacknowledged event. The User Event Log shows the filtered events in reverse chronological order, so that the most recent one is displayed at the top in a list. Using a separate user interface, the user can view the complete User Event Log, that is, the user log that also includes the acknowledged events. Events in the User Event Log can be automatically acknowledged when Success Events are received.
Both the Internal Event Log (for systems personnel) and the User Event Log (for users) are provided to help diagnose problems in the system.
The problem with such log files, however, is that the User Event Log shows too many events or not the most relevant ones. Each significant problem that interests the user may generate more than one event. Because the events are shown chronologically, the most important ones are not necessarily at the top.
Furthermore, on such systems, the explanatory text shown for each event may describe the cause for the problem, but the event cause text is static and is not influenced by other events. Some events may have different causes. Because the explanation is static, it then must either describe all possibilities, or else omit some or all causes. This can be confusing, especially when multiple events are present in the User Event Log because of conflicting, redundant, or insufficient information.
The explaining text shown for each event may describe an appropriate repair action to solve the problem. The problem is that the event action text is static and not influenced by other events. For some events, it may not be possible to specify a single repair action because the appropriate repair actions depends on additional information. Since the explanation is static, it then must describe all possibilities, or omit some or all repair actions. This too can be confusing, especially when multiple events are present in the User Event Log because of conflicting, redundant, or insufficient instructions.
Software that automatically performs repair actions is lacking. Some problems can be repaired with software programs. Such repair actions could be performed automatically if a diagnosis can be automatically found, or perhaps allowed to run when acknowledged by the user.
Software is needed that tries to diagnose by analysing multiple events. Some problems can only be conclusively diagnosed by considering more than one event or additional information.
The Internal Event Log does not always contain enough information for a conclusive diagnosis. It would be useful if also other information sources could be used for diagnostic purposes. Such information sources could be log files, data or program module state information.
In some cases additional information necessary for a conclusive diagnosis could be collected automatically by calling test functions. This possibility does not presently exist. The technical problem is to find out when such test functions should be called. For performance reasons, it is not reasonable to execute them e.g., for each received event.
Necessary information for a conclusive diagnosis is not always possible to collect automatically without intervention from the user. Some things can only, or easiest, be checked by the user. The diagnostic capability of the system could be improved if the diagnosis software would prompt for or accept manual test results.
Some of the Wizards in modern Microsoft products are an example of efficient diagnostic tools. The user is guided through a series of dialogs that serves to collect information and home in on the problem cause.
It is known to have event logs where events are classified by severity and the most severe ones are shown at the top of a list. Usually they can be acknowledged and are then moved to a history list for later analysis, when required.
The aim of the invention is the isolation of a hardware or user error in a software controlled apparatus e.g., an NMR-apparatus. The invention achieves this aim and solves the previously described problems by adding a diagnostic function to the User Event Log. The invention can either replace the filtering between the Internal Event Log and the User Event Log, or it can be used in addition to the User Event Log.
An analysis of information sources is performed: the event log history is searched for patterns; additionally, questions/tests give further information for extended patterns; additionally, repair actions are suggested.
An optional embodiment of the invention adds the capability of questioning the user for manual test results, or accepting manual test results, depending on a realization method. Another embodiment of the invention allows the diagnostic function to automatically call test functions to collect more information necessary for a conclusive diagnosis. A further embodiment of the invention is to allow the diagnostic function to automatically call repair actions to solve the problem.
This approach is advantageously applicable to a broad spectrum of technical equipment. The only prerequisite is that the system software generates events and stores them in an event log. The invention is especially suited for medical systems software. It can be integrated into existing software with little effort; the required software is small and can be implemented in a separate software module. The change to the user interface is small and isolated to the Event Log. It is controlled by a model that is easy to update. Because no change to program code is needed, it is viable to distribute updated models to customer systems, including when these systems involve medical equipment. It is viable to update the models from remote locations making it possible to quickly and cheaply distribute improvements over the whole world.
This system may also be useful also with incomplete models, and could even work with an empty model; the diagnostic capability would then degrade to the stand of a pure event log as if the invention was not used. The quality of diagnosis can be incrementally improved by extending the model. As experience grows with the use of the system, the model can be extended to improve the diagnostic capabilities.
The invention is explained in more detail referencing various embodiment depicted in the drawings and described in more detail below.
The following terms are defined as follows, with reference to the Figures for reference characters.
Root cause (diagnosis d1)
A defect hardware component or wrong
Root cause related pattern
The root cause will cause a series
(event sequence, en1)
of events (error, info, etc.); this
series is more or less directly
related to the root cause; it can
include logical operations on events.
error1 OR error2; at least three
times, then error3; “answer
question1: component1 does not
respond”; then error4; info1, etc.
Further information might narrow the
root cause search, therefore: a)
“questions” can be asked that the
user can answer (correct plugged plug,
etc.); and b) “tests (t1)” can
be done that concern the functionality
of the hardware (see e.g., U.S.
Patent Application Ser. No.
2004/0153819, herein incorporated by
reference); this information adds to the
root cause related pattern.
Repair action (r1)
An isolated error can be fixed by a
repair action like “plug in again”,
“input correct parameter again”,
“call service”, etc.
These are relations, e.g., between a
root cause and pattern or pattern and
repair action; positive probability −>
directly connected, negative
probability −> exclusively connected;
realized by Bayesian Network
implementation (see e.g., U.S. Patent
Application No. Ser. 2004/0153819).
A “causality model” (
Example queries for the user, which preferably comprise yes/no questions, could include, “did you plug Connector A into Port B?” or “did you position the device correctly during the tune up?”.
Hardware tests may be performed (e.g., out of a test model as described in U.S. Patent Application No. 2004/0153819) that include software test routines that: 1) result in yes/no answers, or 2) extract further information out of other log-files that relate to and describe the running system.
Simple events in the event history may form a pattern when coupled together with responses to a few questions. For example, a local coil error pattern can be mixed with all kinds of different events in the event log history, e.g., 1) “Do not know coil”—an error event in software layer A; 2) “Can not measure”—an error event in software layer B; 3) “Measurement stopped by NMR-Scanner”—an error event in (a top) software layer C. In this example, a filtered error event ispresented to user: “local coil error—local coil not detectable”. The possible reasons are: the local coil is: a) broken; b) badly connected; c) not yet known to the system (a new coil of the supplier).
A possible test to determine whether the coil is connected, broken, etc. might be a “voltage test”. Questions could include: 1) “Did you plug the coil in”? (to which a yes/no response would be requested); 2) “Is this a standard (Brand X) coil?” (to which a “yes” response might invoke the repair action “call service” and a “no” response might invoke the repair action, “install a new coil”.
A more detailed description follows. Various embodiments of the invention described below have two parts: a data model and an algorithm. The data model stores information that is specific for a certain system. The algorithm is on the other hand generic and remains the same on all systems.
The data model is a network model with four major node types: event sequences, tests, diagnosis, and repair actions. The edges of the network model describe dependencies between the nodes. The relevant dependencies are: event-diagnosis dependencies, test-diagnosis dependencies, and diagnosis-repair dependencies.
An event sequence node represents an expression that is evaluated to true (1) or false (0). An especially suited expression type usable for the invention is “regular expressions”. Regular expressions evaluate to true when and only when the sequence of events in the Internal Event Log can be matched to the pattern of the expression. Regular expressions can be evaluated very efficiently. The event sequence node expressions evaluate to true as soon as the first event is received that completes the pattern of the regular expression. Normally the regular expression is formulated so that it evaluates to false again as soon as another event is received, for example, a success event. In an embodiment of the invention the regular expression could be extended to handle also time constraints between events.
In an embodiment of the invention other information sources can also be evaluated in event sequence nodes. Such sources of information are, for example other forms of log files that the system maintains, configuration files, and databases.
The test node represents tests that can be performed to collect information improving the possibility for a decisive diagnosis. Test nodes can be said to have an expression that, similar to the event sequence nodes, evaluates to true (1) or false (0). “True” means that the test was positive and “false” means that the test was negative. There are two main types of tests: manual and automatic. Manual tests consist of a question to the user that can be answered by “yes” or “no”. Depending on the context, one must specify which answer corresponds to a positive test result. The automatic tests can be performed by the system itself without interaction with the user.
In an embodiment of the invention, the event sequence node expression and the test node expression could be evaluated to a value between zero and one expressing the degree of belief that the expression is “true”. A value close to one is then “almost true” and a value close to zero “almost false”. The value could be interpreted as the probability that the event sequence node is true.
The diagnosis node contains a textual description specifying what is wrong when the diagnosis is correct. Whether a diagnosis is correct or not is evaluated using the event-diagnosis and the test-diagnosis dependencies. The result is a value between zero and one, which can be interpreted as the probability than the diagnosis is correct. Event-diagnosis and test-diagnosis dependencies each have two properties that go into the evaluation. The first property is the “polarity” of the dependency, that is, if the result from evaluating an event node or test node should be inverted or not. The second property is the weight of the dependency. In some implementations of the invention (using a Bayesian Network), the weight can be interpreted as the probability that the event node or test node evaluates to true (first taking the polarity into account) when the diagnosis is correct. In this case, the weight must be between zero and one. There is usually more than one event-diagnosis and test-diagnosis dependency for each diagnosis.
The repair node represents an action that is believed to cure the problem described by a diagnosis node. There are two main types of repair nodes, manual and automatic. The manual repair node is a textual description specifying what to do to correct the problem. The automatic repair node represents a function that can be executed by the system to automatically correct the problem. The diagnosis-repair dependency has a weight property. In some implementations of the invention, the weight can be interpreted as the probability that the repair node represents the correct way to cure the problem described by the diagnosis. One repair node may be the cure for more than one diagnosis.
The algorithm for the invention can be described by a flow diagram, as illustrated by
In step S3, the algorithm computes the probability that each of the diagnosis is correct. An especially suited method for this is the Bayesian Network model. In a step S4, if a single conclusive diagnosis cannot be found, the algorithm looks for unanswered tests for the diagnosis candidates, otherwise, the algorithm goes to step S7.
In a step S5, the algorithm performs any selected automatic tests, and in a step S6, it presents to the user the manual tests that are most likely to differentiate between the diagnosis candidates.
In a step S7, the algorithm presents to the user the diagnosis candidates, possibly with their respective probability. In a step S8, the algorithm computes the probability that each of the repair actions is suitable. In a step S9, the algorithm performs all automatic repair actions with a probability over a particular threshold. In a step S10, the algorithm presents to the user the most likely repair action, possibly with their respective probability. The entire process is then repeated.
Various embodiments of the above-described invention are best illustrated by way of example.
The event filter 32 filters the events before they are provided to the User Event Log 20.2. As illustrated in
Likewise the repair action r1 is appropriate with a probability of 0.8 when the diagnosis d1 is correct. Some repair actions may be common for more than one diagnosis. Such a shared repair action is especially relevant in cases when a decisive diagnosis cannot be found, but when the candidate diagnoses have the same repair actions.
For the purposes of promoting an understanding of the principles of the invention, reference has been made to the preferred embodiments illustrated in the drawings, and specific language has been used to describe these embodiments. However, no limitation of the scope of the invention is intended by this specific language, and the invention should be construed to encompass all embodiments that would normally occur to one of ordinary skill in the art.
The present invention may be described in terms of functional block components and various processing steps. Such functional blocks may be realized by any number of hardware and/or software components configured to perform the specified functions. For example, the present invention may employ various integrated circuit components, e.g., memory elements, processing elements, logic elements, look-up tables, and the like, which may carry out a variety of functions under the control of one or more microprocessors or other control devices. Similarly, where the elements of the present invention are implemented using software programming or software elements the invention may be implemented with any programming or scripting language such as C, C++, Java, assembler, or the like, with the various algorithms being implemented with any combination of data structures, objects, processes, routines or other programming elements. Furthermore, the present invention could employ any number of conventional techniques for electronics configuration, signal processing and/or control, data processing and the like.
The particular implementations shown and described herein are illustrative examples of the invention and are not intended to otherwise limit the scope of the invention in any way. For the sake of brevity, conventional electronics, control systems, software development and other functional aspects of the systems (and components of the individual operating components of the systems) may not be described in detail. Furthermore, the connecting lines, or connectors shown in the various figures presented are intended to represent exemplary functional relationships and/or physical or logical couplings between the various elements. It should be noted that many alternative or additional functional relationships, physical connections or logical connections may be present in a practical device. Moreover, no item or component is essential to the practice of the invention unless the element is specifically described as “essential” or “critical”. Numerous modifications and adaptions will be readily apparent to those skilled in this art without departing from the spirit and scope of the present invention.
|Cited Patent||Filing date||Publication date||Applicant||Title|
|US4881230||Oct 5, 1987||Nov 14, 1989||Ibm Corporation||Expert system for processing errors in a multiplex communications system|
|US4972453||Feb 28, 1989||Nov 20, 1990||At&T Bell Laboratories||Autonomous expert system for directly maintaining remote telephone switching systems|
|US5127012||Feb 19, 1991||Jun 30, 1992||Eastman Kodak Company||Diagnostic and administrative device for document production apparatus|
|US5293556||Jul 29, 1991||Mar 8, 1994||Storage Technology Corporation||Knowledge based field replaceable unit management|
|US5544308 *||Aug 2, 1994||Aug 6, 1996||Giordano Automation Corp.||Method for automating the development and execution of diagnostic reasoning software in products and processes|
|US5675724||Mar 25, 1996||Oct 7, 1997||Storage Technology Corporation||Knowledge based resource management|
|US5712896||Aug 5, 1996||Jan 27, 1998||Electronics And Telecommunications Research Institute||Method for diagnosing a fault of digital exchanger|
|US5847972||Sep 24, 1993||Dec 8, 1998||Eick; Stephen Gregory||Method and apparatus for graphically analzying a log-file|
|US5922079 *||Oct 16, 1997||Jul 13, 1999||Hewlett-Packard Company||Automated analysis of a model based diagnostic system|
|US6473659||Apr 10, 1998||Oct 29, 2002||General Electric Company||System and method for integrating a plurality of diagnostic related information|
|US6609217||May 26, 2000||Aug 19, 2003||General Electric Company||System and method for diagnosing and validating a machine over a network using waveform data|
|US6691249 *||Mar 22, 2000||Feb 10, 2004||Agilent Technologies, Inc.||Probabilistic diagnosis, in particular for embedded and remote applications|
|US20030018619||Jun 22, 2001||Jan 23, 2003||International Business Machines Corporation||System and method for granular control of message logging|
|US20030126501 *||Jan 3, 2002||Jul 3, 2003||Integrated Management Systems, Inc.||System and method for using agent-based distributed case-based reasoning to manage a computer network|
|US20040059966 *||Sep 20, 2002||Mar 25, 2004||International Business Machines Corporation||Adaptive problem determination and recovery in a computer system|
|US20040153819||Sep 16, 2003||Aug 5, 2004||Siemens Aktiengesellschaft||Method to assist identification of a defective functional unit in a technical system|
|US20050172162||Jan 28, 2005||Aug 4, 2005||Fujitsu Limited||Operation management method and operation management server|
|DE10244131A1||Sep 23, 2002||Apr 8, 2004||Siemens Ag||Technical plant assessment method in which test measurements on functional units of the plant are automatically processed to detect faulty functional unit groups and assign corresponding defectiveness probabilities|
|EP1577783A1||Dec 26, 2002||Sep 21, 2005||Fujitsu Limited||Operation managing method and operation managing server|
|1||*||David Heckerman □□ A tutorial on learning with Bayesian Networks □□ Mar. 1995 (Revised 1996) □□ Microsoft□□ Technical Report, pp. 1-2 □□ MSR-TR-95-06.|
|Citing Patent||Filing date||Publication date||Applicant||Title|
|US7519568 *||Apr 11, 2005||Apr 14, 2009||Microsoft Corporation||Playbook automation|
|US7908524 *||Mar 15, 2011||Fujitsu Limited||Storage medium readable by a machine tangible embodying event notification management program and event notification management apparatus|
|US8086650 *||Nov 2, 2007||Dec 27, 2011||Ipswitch, Inc.||Method for transforming and consolidating fields in log records from logs generated on different operating systems|
|US8504874||Sep 21, 2010||Aug 6, 2013||Microsoft Corporation||Repair-policy refinement in distributed systems|
|US20060212743 *||Sep 28, 2005||Sep 21, 2006||Fujitsu Limited||Storage medium readable by a machine tangible embodying event notification management program and event notification management apparatus|
|US20060229846 *||Apr 11, 2005||Oct 12, 2006||Microsoft Corporation||Playbook automation|
|WO2007059090A2 *||Nov 13, 2006||May 24, 2007||Gemex Systems, Inc.||Engraved gemstone viewer|
|WO2007059090A3 *||Nov 13, 2006||Sep 4, 2008||Gemex Systems Inc||Engraved gemstone viewer|
|WO2015179370A1 *||May 19, 2015||Nov 26, 2015||Siemens Healthcare Diagnostics Inc.||Intelligent service assistant inference engine|
|U.S. Classification||714/37, 714/E11.026|
|Cooperative Classification||G06F11/079, G06F11/25, G06F11/0793, G06F11/0748|
|European Classification||G06F11/07P1L, G06F11/07P6, G06F11/25|
|Nov 26, 2004||AS||Assignment|
Owner name: SIEMENS AKTIENGESELLSCHAFT, GERMANY
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:BJORSNE, TORD;REEL/FRAME:016018/0838
Effective date: 20041014
|Aug 19, 2005||AS||Assignment|
Owner name: PARKER-HANNIFIN CORPORATION, OHIO
Free format text: MERGER;ASSIGNOR:AEC HOLDINGS, INC.;REEL/FRAME:016418/0685
Effective date: 20041231
Owner name: AEC HOLDINGS, INC., VIRGINIA
Free format text: MERGER;ASSIGNOR:ACADIA ELASTOMERS CORPORATION;REEL/FRAME:016418/0681
Effective date: 20041231
|Oct 14, 2011||FPAY||Fee payment|
Year of fee payment: 4
|Oct 13, 2015||FPAY||Fee payment|
Year of fee payment: 8