JP6276668B2 - Failure analysis system - Google Patents

Description

  The present invention relates to a failure analysis system that analyzes a failure.

  2. Description of the Related Art Conventionally, there is a failure prediction system that predicts a failure by specifying a parameter that causes a failure even when other parameter data is abnormal due to a failure in the data of a certain parameter (for example, the following patents) See reference 1.)

  In the failure prediction system of Patent Literature 1, for each parameter group composed of a plurality of parameters, the cross-correlation coefficient calculation unit generates a correlation data sequence for each parameter pair, and the threshold comparison unit exceeds the threshold in the correlation data sequence. It is determined whether or not a correlation coefficient is included. When a parameter pair including a correlation coefficient exceeding the threshold is detected, the similarity calculation unit calculates the distance between the correlation data strings of each parameter pair of the parameter group, and the cause parameter specifying unit Is specified as a cause parameter, and the failure prediction unit predicts the occurrence of a failure due to data abnormality of the cause parameter.

JP 2013-41173 A

  A system maintenance or repair worker records the work date, work content, etc. in the work daily report. Also, when a failure occurs, a failure report is created that describes the target system name, phenomenon details, response details, and cause analysis results. However, in the above-described conventional technology, daily work reports and failure reports are not utilized, and there is a problem in failure prediction accuracy.

  An object of the present invention is to improve the accuracy of failure analysis by effectively utilizing existing data relating to failures.

  A failure analysis system according to one aspect of the invention disclosed in the present application includes a failure report database that stores a failure report for each failure including a phenomenon content indicating a failure phenomenon and a failure cause, a work content for the failure, and a work date. A failure analysis system comprising: a daily work database for storing daily work report data for each operation, and a failure analysis device accessible to the failure report database and the daily work database, wherein the failure analysis device is identified A reception process for receiving failure information including a failure occurrence date and time and a specific phenomenon content indicating a failure phenomenon, and a daily work report data for which the work date is before the specific occurrence date and time from the daily work report database From the failure selection database and the failure report database, the phenomenon content is the specific phenomenon content. Work content similar to the cause of failure of the similar failure report acquired by the first acquisition processing from the first acquisition processing for acquiring a similar failure report and the daily work report data selected by the first selection processing And a specific process for specifying daily work report data.

  According to the representative embodiment of the present invention, it is possible to improve the accuracy of failure analysis by effectively utilizing existing data relating to failures. Problems, configurations, and effects other than those described above will become apparent from the description of the following embodiments.

FIG. 1 is an explanatory diagram of a system configuration example of the failure analysis system according to the present embodiment. FIG. 2 is an explanatory diagram showing an example of the contents stored in the system log DB shown in FIG. FIG. 3 is an explanatory diagram showing an example of the contents stored in the failure report DB. FIG. 4 is an explanatory diagram showing an example of the contents stored in the daily work report DB. FIG. 5 is an explanatory diagram showing an example of the contents stored in the work instruction sheet DB. FIG. 6 is an explanatory diagram of an example of the contents stored in the association DB. FIG. 7 is an explanatory diagram illustrating an example of a failure report registration screen. FIG. 8 is an explanatory diagram showing an example of a daily work report registration screen. FIG. 9 is an explanatory diagram showing an example of a work instruction sheet registration screen. FIG. 10 is an explanatory diagram illustrating an example of the association information registration screen. FIG. 11 is an explanatory diagram illustrating an example of a failure information input screen. FIG. 12 is a flowchart illustrating an example of a failure analysis processing procedure performed by the failure analysis apparatus. FIG. 13 is a flowchart showing a detailed processing procedure example of the daily work report selection processing (step S1202) shown in FIG. FIG. 14 is an explanatory diagram illustrating an output screen example of the analysis result displayed in step S1206 of FIG. FIG. 15 is a flowchart illustrating an example of a latent failure prediction process performed by the failure analysis apparatus. FIG. 16 is an explanatory diagram showing an example of an output screen of the potential failure prediction result displayed in step S1504 of FIG. FIG. 17 is a flowchart illustrating an example of a failure prevention processing procedure. FIG. 18 is an explanatory diagram showing an example of failure occurrence risk information displayed in step S1704 of FIG.

  The failure analysis apparatus according to the present embodiment may be implemented by, for example, software running on a general-purpose computer, or may be implemented by dedicated hardware or a combination of software and hardware. In the following description, each information of the present invention will be described in a “table” format. However, the information does not necessarily have to be represented by a data structure of a table, and a data structure such as a list, DB (Database), or queue. Or may be expressed in other ways. Therefore, “table”, “list”, “DB”, “queue”, etc. may be simply referred to as “information” to indicate that they do not depend on the data structure. In addition, when explaining the contents of each information, the expressions “identification information”, “identifier”, “name”, “name”, “ID” can be used, and these can be replaced with each other. It is.

  Hereinafter, each process in the embodiment of the present invention may be described using “program” as a subject (operation subject). However, a program is executed by a processor and a process determined by a memory and a communication port (communication control). Therefore, the description may be based on the processor. Further, the processing disclosed with the program as the subject may be processing performed by a computer such as a management server or an information processing apparatus. Part or all of the program may be realized by dedicated hardware, or may be modularized. Various programs may be installed in each computer by a program distribution server or a storage medium.

<System configuration example>
FIG. 1 is an explanatory diagram of a system configuration example of the failure analysis system according to the present embodiment. The failure analysis system 100 includes an analysis target system 101, a computer 102, a failure analysis device 103, a failure report DB 104, a daily work report DB 105, and a work instruction DB 106, such as the Internet and a local area network (LAN). Communication is established via the network 107.

  The analysis target system 101 is a computer that is analyzed by the failure analysis apparatus 103. In FIG. 1, there is one analysis target system 101, but a plurality of analysis target systems 101 may be used. Further, the analysis target system 101 is configured by one or more computers, for example. The analysis target system 101 is operated by a user of the analysis target system 101 or an administrator of the failure analysis system 100 such as an SE (system engineer). Further, the analysis target system 101 has a system log DB 110. The system log DB 110 records a log related to the analysis target system 101. Details of the system log DB 110 will be described with reference to FIG.

  The computer 102 is a computer that inputs data to the analysis target system 101, the failure analysis apparatus 103, or the DBs 104 to 106, and displays data from the analysis target system 101, the failure analysis apparatus 103, or the DBs 104 to 106. In FIG. 1, there is one computer 102, but a plurality of computers may be used.

  The failure analysis device 103 is a computer that analyzes a failure of the analysis target system 101. The failure analysis apparatus 103 includes a processor 131, a storage device 132, an input device 133, an output device 134, and a communication interface (communication IF) 135. The processor 131, the storage device 132, the input device 133, the output device 134, and the communication IF 135 are connected by a bus. The processor 131 controls the failure analysis apparatus 103. The storage device 132 serves as a work area for the processor 131.

  The storage device 132 is a non-temporary or temporary recording medium that stores various programs and data. Examples of the storage device 132 include a ROM (Read Only Memory), a RAM (Random Access Memory), a HDD (Hard Disk Drive), and a flash memory. The storage device stores the association DB 130. Details of the association DB 130 will be described with reference to FIG.

  The input device 133 inputs data. Examples of the input device 133 include a keyboard, a mouse, a touch panel, a numeric keypad, and a scanner. The output device 134 outputs data. Examples of the output device 134 include a display and a printer. The communication IF 135 is connected to the network 107 and transmits / receives data. The failure analyzer 103 is operated by an administrator. In FIG. 1, the failure analysis apparatus 103 is configured by one computer, but may be configured such that a plurality of computers cooperate.

  The failure report DB 104 is a database that stores failure reports. The failure report is data that summarizes the cause and response for each failure phenomenon. The failure report is stored in the failure report DB 104 from the computer 102 or the failure analysis device 103. The failure report DB 104 constitutes an entry for each failure report. Details of the failure report DB 104 will be described with reference to FIG.

  The daily work report DB 105 is a database that stores daily work report data. The daily work report data is data describing the work performed by the administrator for the analysis target system 101 on that day. Specifically, for example, the daily work report data is data describing the work date and time, the worker, the work target system, and the work content. The daily work report data is stored in the daily work DB 105 from the computer 102 or the failure analysis device 103. The daily work report DB 105 constitutes an entry for each daily work report data. The details of the daily work DB 105 will be described with reference to FIG.

  The work instruction DB 106 is a database that stores work instruction data. The work instruction form data is data describing a work instruction for the analysis target system 101 from the user to the administrator. Specifically, for example, work instruction data is data in which user requests and work contents for realizing the requests are organized. The work instruction form data is stored in the work instruction form DB 106 from the computer 102 or the failure analysis device 103. The work instruction DB 106 constitutes an entry for each work instruction data. Details of the work instruction DB 106 will be described with reference to FIG. In addition, these DB104-106 are managed by the failure analysis apparatus 103 or DB server which is not shown in figure, for example. In addition, the DBs 104 to 106 may be managed by the same DB server or may be managed by different DB servers.

<Example of DB contents>
Next, examples of stored contents of the various DBs 104 to 106, 110, and 130 shown in FIG. 1 will be described with reference to FIGS. In the following description, “value of XX field” may be simply referred to as “XX” or “XX information”.

  FIG. 2 is an explanatory diagram showing an example of the contents stored in the system log DB 110 shown in FIG. (A) is the operation log table 210, and (B) is the login / logout table 220.

  The operation log table 210 is a table in which the analysis target system 101 stores operation logs. The operation log is operation history information for the analysis target system 101. The operation log table 210 includes an operation log ID field 211, an operation target software field 212, an operation terminal address field 213, an operation date / time field 214, and an operation content field 215. A combination of values of the fields 211 to 215 constitutes an operation log that is an entry of the operation log table 210.

  The operation log ID field 211 is an area for storing an operation log ID. The operation log ID is identification information that uniquely identifies the operation log.

  The operation target software field 212 is an area for storing operation target software information. The operation target software information is identification information that uniquely identifies software that has been operated by a user or an administrator.

  The operation terminal address field 213 is an area for storing an operation terminal address. The operation terminal address is identification information that uniquely identifies a terminal used for an operation on the analysis target system 101. For example, when the analysis target system 101 is operated from the computer 102, the address of the computer 102 becomes the operation terminal address.

  The operation date / time field 214 is an area for storing the operation date / time. The operation date / time is the date / time when the analysis target system 101 is operated.

  The operation content field 215 is an area for storing the operation content. The operation content is content (for example, an input command) of operating the operation target software.

  The login / logout table 220 is a table in which the analysis target system 101 stores information related to login and logout to the analysis target system 101. The login / logout table 220 includes a login / logout ID field 211, a user account field 222, a login date / time field 223, and a logout date / time field 224. The combination of values in each field constitutes an entry in the login / logout table 220.

  The login / logout ID field 211 is an area for storing a login / logout ID. The login / logout ID is identification information that uniquely specifies a login period from when the user or administrator specified by the user account logs in until the user logs out.

  The user account field 222 is an area for storing a user account. The user account is identification information that uniquely identifies a user or administrator who is permitted to operate the analysis target system 101.

  The login date / time field 223 is an area for storing the login date / time. The login date and time is the date and time when the user or administrator specified by the user account logged in.

  The logout date / time field 224 is an area for storing the logout date / time. The logout date and time is the date and time when the user or administrator specified by the user account logs out.

  FIG. 3 is an explanatory diagram showing an example of the contents stored in the failure report DB 104. The failure report DB 104 includes a failure report ID field 301, a reporter ID field 302, a failure target field 303, an occurrence date / time field 304, a subject field 305, a phenomenon content field 306, a failure cause field 307, and a countermeasure field. 308, a resolution date / time field 309, a keyword (phenomenon content) field 310, a keyword (failure cause) field 311, and a keyword (measure) field 312. A combination of values in the fields 301 to 312 constitutes a failure report that is an entry in the failure report DB 104.

  The failure report ID field 301 is an area for storing a failure report ID. The failure report ID is identification information that uniquely identifies the failure report.

  The reporter ID field 302 is an area for storing a reporter ID. The reporter ID is identification information that uniquely identifies a reporter (that is, an administrator) who registers a failure report.

  The failure target field 303 is an area for storing failure target information. The failure target information is identification information that uniquely identifies the analysis target system 101 that is the failure target.

  The occurrence date / time field 304 is an area for storing the occurrence date / time. The occurrence date and time is the date and time when the failure occurred in the failure target.

  The subject field 305 is an area for storing a subject. The subject is a name that becomes the title of the failure report, such as “xx work error”, for example.

  The phenomenon content field 306 is an area for storing phenomenon content information. The phenomenon content information is information in which an administrator describes a failure phenomenon such as “down after xx work”, for example.

  The failure cause field 307 is an area for storing failure cause information. The failure cause information is information in which the administrator describes the cause of the failure.

  The countermeasure field 308 is an area for storing countermeasure information. The countermeasure information is information describing a countermeasure taken by the administrator for the failure.

  The resolution date / time field 309 is an area for storing the resolution date / time. The resolution date and time is the date and time when the failure was resolved by the countermeasure.

  The keyword (phenomenon content) field 310 is an area for storing a keyword related to the phenomenon content. The keyword related to the phenomenon content is a word obtained from the phenomenon content information in the failure cause field 307 by morphological analysis.

  The keyword (failure cause) field 311 is an area for storing a keyword related to the cause of the failure. The keyword relating to the cause of the failure is a word obtained from the failure cause information in the failure cause field 307 by morphological analysis.

  The keyword (measure) field 312 is an area for storing a keyword related to the countermeasure. The keyword related to the countermeasure is a word obtained from the countermeasure information which is the value of the countermeasure field 308 by morphological analysis.

  Note that the computer 102 or the failure analysis device 103 operated by the administrator may execute the above morphological analysis, or a server (not shown) that manages the failure report DB 104 may execute the morphological analysis.

  FIG. 4 is an explanatory diagram showing an example of the contents stored in the daily work report DB 105. The daily work report DB 105 includes a daily work ID field 401, a work day field 402, a worker ID field 403, a work target field 404, a request item field 405, a work content (subject) field 406, and a work content (details). ) Field 407, result field 408, and keyword field 409. The combination of the values of the fields 401 to 409 constitutes daily work report data that is an entry in the daily work DB 105.

  The daily work report ID field 401 is an area for storing the daily work report ID. The daily work report ID is identification information for uniquely specifying daily work report data.

  The work day field 402 is an area for storing a work day. The work day is a day when a work such as a maintenance work is performed on the analysis target system 101 as a work target.

  The worker ID field 403 is an area for storing a worker ID. The worker ID is identification information that uniquely identifies an administrator who has performed work such as maintenance work on the analysis target system 101 that is the work target.

  The work target field 404 is an area for storing work target information. The work target information is identification information that uniquely identifies the analysis target system 101 on which the administrator has performed work such as maintenance work.

  The requested item field 405 is an area for storing requested item information. The request item information is a name indicating an item for a work request such as maintenance work.

  The work content (subject) field 406 is an area for storing the subject of the work content. The subject is a name that uniquely identifies the work content.

  The work content (detail) field 407 is an area for storing detailed information of work content such as maintenance work. The detailed information on the work content is information that describes the details of the work such as the maintenance work.

  The result field 408 is an area for storing result information. The result information is information describing work results such as maintenance work.

  The keyword field 409 is an area for storing a keyword related to detailed information about the work content, which is the value of the work content (detail) field 407. The keyword related to the detailed information of the work content is a word obtained from the detailed information of the work content in the work content (detail) field 407 by morphological analysis.

  Note that the computer 102 or the failure analysis device 103 operated by the administrator may execute the above morphological analysis, or a server (not shown) that manages the failure report DB 104 may execute the morphological analysis.

  FIG. 5 is an explanatory diagram showing an example of the contents stored in the work instruction sheet DB 106. The work instruction DB 106 includes a work instruction ID field 501, a subject field 502, a customer field 503, a target system field 504, a work period field 505, a request content field 506, a work item field 507, and a person in charge. ID field 508. A combination of the values of the fields 501 to 508 constitutes work instruction data that is an entry in the work instruction DB 106.

  The work instruction ID field 501 is an area for storing a work instruction ID. The work instruction sheet ID is identification information that uniquely identifies the work instruction sheet data.

  The subject field 502 is an area for storing a subject. The subject is a name indicating a work instruction.

  The customer field 503 is an area for storing customer information. The customer information is identification information that uniquely identifies the customer in which the analysis target system 101 is introduced.

  The target system field 504 is an area for storing target system information. The target system information is identification information that uniquely identifies the analysis target system 101 introduced to the customer.

  The work period field 505 is an area for storing a work period such as maintenance work.

  The request content field 506 is an area for storing request content information. The request content information is information describing the request content from the customer.

  The work item field 507 is an area for storing work items such as maintenance work. The work item is information described by subdividing work such as maintenance work.

  A person-in-charge ID field 508 is an area for storing a person-in-charge ID. The person-in-charge ID is identification information that uniquely identifies an administrator who has received a work instruction (that is, a person in charge).

  FIG. 6 is an explanatory diagram showing an example of the contents stored in the association DB 130. The association DB 130 has a failure report ID field 601, a daily work report ID field 602, and a work instruction form ID field 603. A combination of values in the fields 601 to 603 indicates a correspondence relationship between the failure report ID, the daily work report ID, and the daily work ID.

  The failure report ID field 601, the daily work report ID field 602, and the daily work report ID field 603 are the same as the above-described failure report ID field 301, daily work report ID field 401, and daily work report ID field 401. To do.

<Example of input screen>
Next, various input screen examples will be described with reference to FIGS. 7 to 11 are displayed on a display device of a server (not shown) that manages the computer 102, the failure analysis device 103, or the daily work report DB 105, for example.

  FIG. 7 is an explanatory diagram illustrating an example of a failure report registration screen. The failure report registration screen 700 is an input screen for registering a failure report in the failure report DB 104. The failure report registration screen 700 includes a reporter ID input field 701, a failure target input field 702, an occurrence date and time input field 703, a subject name input field 704, a phenomenon content input field 705, a failure cause input field 706, a countermeasure An input field 707 and a resolution date / time input field 708 are provided. The values input in the input fields are stored in the reporter ID field 302 to the resolution date / time field 309 of the newly assigned fault report ID entry in the fault report DB 104 when the registration button 709 is pressed.

  FIG. 8 is an explanatory diagram showing an example of the daily work report registration screen 800. The daily work report registration screen 800 is an input screen for registering daily work report data in the daily work DB 105. The daily work report registration screen 800 includes a work day input field 801, a worker ID input field 802, a work target input field 803, a request item input field 804, a work content (subject) input field 805, and a work content (details). ) An input field 806 and a result input field 807 are provided. The values entered in the input fields 801 to 807 are stored in the work date field 402 to the result field 408 of the entry of the newly assigned work daily report ID in the work daily report DB 105 when the registration button 808 is pressed.

  FIG. 9 is an explanatory diagram showing an example of a work instruction sheet registration screen. The work instruction registration screen 900 is an input screen for registering work instruction data in the work instruction DB 106. A work instruction registration screen 900 includes a subject input field 901, a customer input field 902, a target system input field 903, a work period input field 904, a request content input field 905, a work item input field 906, and a person in charge. ID input field 907. The values input in the input fields 901 to 907 are stored in the subject field 502 to the person-in-charge ID field 508 of the entry of the newly assigned work instruction sheet ID in the work instruction sheet DB 106 when the registration button 908 is pressed. .

  FIG. 10 is an explanatory diagram illustrating an example of the association information registration screen. The association information registration screen 1000 is an input screen for registering a correspondence relationship between a failure report ID, a daily work report ID, and a work instruction ID, that is, a combination of a failure report ID, a daily work report ID, and a work instruction ID. is there.

  The association information registration screen 1000 has a first pane 1010 to a third pane 1030. The first pane 1010 includes a failure report ID input field 1011, a reference button 1012, a radio button 1013, a keyword input field 1014, a target system input field 1015, a search result display field 1017, a search button 1018, including.

  A failure report ID is entered in the failure report ID input field 1011. The reference button 1012 is a button for displaying a failure report specified by the failure report ID input in the failure report ID input field 1011. A radio button 1013 is a button for narrowing a search target of DB search using the failure report DB 104. In the keyword input field 1014, keywords are input. In the target system input field 1015, the analysis target system 101 name is input.

  The search result display field 1017 displays a DB search, that is, a failure report ID corresponding to the keyword or analysis target system name narrowed down by the type indicated by the radio button. A search button 1018 is a button for performing a DB search using the failure report DB 104, and the search result is displayed in the search result display field 1017. If the failure report ID is not known, the administrator can specify the failure report ID by performing a DB search using the failure report DB 104.

  The second pane 1020 includes a daily work report ID input field 1021, a reference button 1022, a keyword input field 1024, a target system input field 1025, a worker ID input field 1026, a search result display field 1027, and a search button. 1028.

  A daily work report ID is input to the daily work ID input field 1021. The reference button 1022 is a button for displaying daily work report data specified by the daily work report ID input in the daily work report ID input field 1021. In the keyword input field 1024, keywords are input. In the target system input field 1025, an analysis target system name is input. In the worker ID input field 1026, the worker ID is input.

  The search result display column 1027 displays DB search, that is, a daily work report ID corresponding to a keyword, an analysis target system name, or a worker ID. The search button 1028 is a button for performing a DB search using the daily work report DB 105, and the search result is displayed in the search result display field 1027. When the daily work report ID is not known, the administrator can specify the daily work report ID by performing a DB search using the daily work report DB 105.

  The third pane 1030 has a work instruction ID input field 1031, a reference button 1032, a radio button 1033, a keyword input field 1034, a target system input field 1035, a worker ID input field 1036, and a search result display. A column 1037 and a search button 1038 are included.

  The work instruction form ID is entered in the work instruction form ID input field 1031. The reference button 1032 is a button for displaying the work instruction sheet data specified by the work instruction sheet ID input in the work instruction sheet ID input field 1031. The radio button 1033 is a button for narrowing down the search target of the DB search using the work instruction document DB 106. A keyword is input in the keyword input field 1034. In the target system input field 1035, an analysis target system name is input. In the worker ID input field 1036, the worker ID is input.

  The search result display field 1037 displays a DB search using the work instruction document DB 106, that is, a keyword narrowed down by the type indicated by the radio button 1033, an analysis target system name, or a daily work report ID corresponding to the worker ID. The The search button 1038 is a button for performing a DB search using the work instruction document DB 106, and the search result is displayed in the search result display field 1037. When the daily work report ID is not known, the administrator can specify the daily work report ID by performing a DB search using the work instruction sheet DB 106.

  FIG. 11 is an explanatory diagram illustrating an example of a failure information input screen. The failure information input screen 1100 is used when causing the failure analysis apparatus 103 to execute failure analysis of the analysis target system 101. The failure information input screen 1100 includes an analysis target system name input column 1101, a failure detection date / time input column 1102, a phenomenon content input column 1103, a supplementary keyword input column 1104, and an OK button 1105.

  An analysis target system name is input to the analysis target system name input field 1101. In the failure detection date / time input field 1102, the failure detection date / time is input. An analysis target system name is input to the analysis target system input field 1101. In the phenomenon content input field 703, the phenomenon content is input. In the supplementary keyword input field 1104, supplementary keywords are input. Supplementary keywords are keywords that are supplementarily added to the phenomenon content. For example, a keyword that does not appear in the phenomenon content is input. An OK button 1105 is a button for transmitting failure information, which is data input in the input fields 1101 to 1104, to the failure analysis apparatus 103.

<Example of failure analysis processing procedure>
FIG. 12 is a flowchart illustrating a failure analysis processing procedure example by the failure analysis apparatus 103. First, the failure analysis apparatus 103 receives failure information (step S1201). Specifically, for example, the failure analysis apparatus 103 receives the failure information input on the failure information input screen 1100 illustrated in FIG. The failure information is held in the storage device 132 of the failure analysis apparatus 103.

  Next, the failure analysis apparatus 103 executes daily work report selection processing (step S1202). The daily work report selection process (step S1202) is a process for selecting the corresponding daily work report data from the daily work report DB 105 using the failure detection date and time included in the failure information received in step S1201. The daily work report data selected in the daily work report selection process (step S1202) is referred to as “selected daily report data”. The selected daily work report data is held in the storage device 132 of the failure analysis apparatus 103. Details of the daily work report selection process (step S1202) will be described later.

  Next, the failure analysis apparatus 103 acquires, from the failure report DB 104, a failure report including a phenomenon content similar to the phenomenon content included in the failure information received in step S1201 and the keyword appearance tendency (step S1203).

  Specifically, for example, the failure analysis apparatus 103 performs a morphological analysis on the phenomenon content included in the failure information, and extracts words included in the phenomenon content. Then, the failure analysis apparatus 103 generates a vector indicating the presence / absence of the extracted word. Here, the extracted keyword may include a supplementary keyword included in the failure information. If the extracted words are, for example, five words W1 to W5, the vector V0 is V0 = (1, 1, 1, 1, 1). The vector element “1” indicates the presence, and “0” indicates the absence.

  Similarly, the failure analysis apparatus 103 generates, for each entry in the failure report DB 104, a vector V1 indicating the presence / absence of extracted words W1 to W5 in the phenomenon content of the failure report. Specifically, for example, the failure analysis apparatus 103 uses the word group stored in the keyword (phenomenon content) of the failure report DB 104 to generate a vector indicating the presence / absence of the extracted words W1 to W5 in the phenomenon content of the failure report. Generate. For example, suppose that the vector V1 in an entry is V1 = (1, 0, 0, 0, 1). The vector V1 means that the extracted words W1 and W5 exist and the extracted words W2 to W4 do not exist.

  The failure analysis apparatus 103 obtains an intervector distance (for example, Euclidean distance) using the vector V0 and the vector V1. The shorter the distance between vectors, the more similar the phenomenon content included in the failure information and the phenomenon content of the failure report. The failure analysis apparatus 103 obtains a distance between vectors for each entry in the failure report DB 104, and acquires a failure report that is an entry whose distance between vectors is equal to or less than a threshold value. The acquired failure report is referred to as a “similar failure report”. The similar failure report is held in the storage device 132 of the failure analysis apparatus 103. Here, the similar fault report is acquired using the threshold value, but the fault analysis apparatus 103 acquires the top n fault reports (n is an integer of 1 or more) in the ascending order of the distance between vectors as the similar fault report. May be.

  Next, the failure analysis apparatus 103 specifies, for each similar failure report, a daily work report including a work content having a similar keyword appearance tendency to the failure cause in the similar failure report from the selected daily work data group (step S1204). Also in this case, the inter-vector distance is used as in step S1203.

  Specifically, for example, the failure analysis apparatus 103 generates a vector indicating the presence or absence of the keyword for the keyword (failure cause) that is the value of the keyword (failure cause) field 311 in the similar failure report. If the keyword (cause of failure) is, for example, four words w1 to w4, the vector v0 is v0 = (1, 1, 1, 1). The vector element “1” indicates the presence, and “0” indicates the absence.

  Similarly, the failure analysis apparatus 103 generates a vector v1 indicating whether keywords (failure causes) w1 to w4 are present in the work content of the selected daily work report data. Specifically, for example, the failure analysis apparatus 103 generates a vector v1 indicating the presence or absence of keywords (failure causes) w1 to w4 using a word group stored in the value of the keyword field 409 of the daily work report DB 105. . For example, it is assumed that the vector v1 in certain selected daily work report data is v1 = (1, 0, 0, 0). The vector v1 means that the keyword (failure cause) w1 exists and the keywords (failure causes) w2 to w4 do not exist.

  The failure analysis apparatus 103 obtains a distance between vectors (for example, Euclidean distance) using the vector v0 and the vector v1. The shorter the distance between vectors, the more similar the cause of failure in the similar failure report and the work content of the selected daily report data. The failure analysis device 103 obtains the inter-vector distance for each combination of the similar failure report and the selected daily work data, and identifies the daily work data for the combination whose vector distance is equal to or less than the threshold from the selected daily work data group. Here, the daily work report data is specified using the threshold value, but the failure analysis apparatus 103 may specify the top n daily work report data (n is an integer of 1 or more) in ascending order of the distance between vectors. . The identified selected daily work report data is referred to as “specific daily work data”. The specific work daily report data is held in the storage device 132 of the failure analysis apparatus 103.

  Then, the failure analysis apparatus 103 acquires work instruction data corresponding to the specific daily work report data from the work instruction DB 106 (step S1205). Specifically, for example, the failure analysis apparatus 103 includes the value (target system) of the target system field that matches the value (work target) of the work target field 404 of the specific work daily report data from the work instruction sheet DB 106. Filter entries. Then, the failure analysis apparatus 103 identifies an entry that includes the value of the work date field 402 (work date) of the specific work daily report data in the work period that is the value of the work period field 505 among the narrowed entry group. The failure analysis apparatus 103 acquires the work instruction data of the identified entry from the work instruction DB 106. In this way, by obtaining the work instruction data for the work period including the work day of the specific work daily report data, the administrator who created the specific work daily report data specifies what work instructions are received from the user. It becomes easy. The failure analysis apparatus 103 may acquire work instruction data corresponding to the specific work daily report data with reference to the association DB 130.

  In addition, the failure analysis apparatus 103 performs morphological analysis from the word group that is the value of the work content (detail) field 407 of the specific work daily report data and the request content that is the value of the request content field 506 of each entry in the work instruction DB 106. A distance between vectors with the obtained word group may be obtained, and work instruction data in a combination where the distance between vectors is equal to or less than a threshold may be acquired from the work instruction DB 106.

  Here, the work instruction data is acquired using the threshold value, but the failure analysis apparatus 103 acquires the top n work instruction data (n is an integer of 1 or more) in ascending order of the distance between vectors. Also good. In addition, a word group obtained by morphological analysis from the request content that is the value of the request content field 506 of each entry in the work instruction sheet DB 106 is used, but the work that is the value of the request item field of each entry of the work instruction sheet DB 106. You may use the word group obtained by the morphological analysis from the item. The acquired work instruction sheet data is held in the storage device 132 of the failure analysis apparatus 103. Thus, by analyzing the work instruction form data similar to the specific work daily report data, it becomes easy for the administrator who created the specific work daily report data to specify what work instruction is received from the user.

  In addition, in the acquisition of work instruction data for the work period including the work day of the specific work daily report data, when the work instruction data cannot be acquired, the work instruction data similar to the specific work daily report data is analyzed. Also good. Since obtaining work instruction data for the work period including the work day of the specific work daily report data has a lower processing load, priority is given to obtaining work instruction data for the work period including the work day of the specific work daily report data. Thus, the efficiency of the acquisition process can be improved.

  Thereafter, the failure analysis apparatus 103 displays the analysis result (step S1206). A display example of the analysis result will be described later with reference to FIG. Thereby, the failure analysis process is terminated.

  FIG. 13 is a flowchart showing a detailed processing procedure example of the daily work report selection processing (step S1202) shown in FIG. The failure analyzer 103 sets the failure detection date and time included in the received failure information as the reference date and time (step S1301). Next, the failure analysis apparatus 103 indicates the date and time when the user (excluding the administrator) of the analysis target system 101 logged in before the reference date and time (hereinafter referred to as the latest login date and time) and the date and time when logged out (hereinafter referred to as the latest logout date and time). Using the user account of the user of the analysis target system 101, the information is acquired from the login / logout table 220 (step S1302).

  Next, the failure analysis apparatus 103 acquires daily work report data having a work record within the non-login period from the most recent logout date and back to the most recent login date and time from the work daily report DB 105 (step S1303). Specifically, for example, the failure analysis apparatus 103 acquires an entry whose work date is included in the non-login period from the daily work report DB 105. Since no user is logged in during the non-login period, daily work report data for the login period during which any user is logged in can be excluded from acquisition targets.

  Thereafter, the failure analysis apparatus 103 determines whether or not the total number of daily work report data acquired in step S1303 is greater than or equal to a certain number (step S1304). The constant is an integer of 1 or more set in advance. If it is not more than a certain number (step S1304: No), the failure analysis apparatus 103 sets the latest logout date and time acquired in step S1302 as the reference date and time (step S1305), and proceeds to step S1302. As a result, the failure analysis apparatus 103 can acquire the daily work report data by going back to the past non-login period until a predetermined number or more of daily work report data is accumulated.

  On the other hand, if the total number of daily work report data acquired is equal to or greater than a certain number (step S1304: Yes), the daily work report selection process (step S1202) is terminated, and the process proceeds to step S1203. Thereby, the daily work report data about the work in the time zone when only the administrator and not the user logged in can be selected. Therefore, a failure caused by a user operation can be excluded, and a failure caused by a manager's work mistake can be specified.

  FIG. 14 is an explanatory diagram illustrating an output screen example of the analysis result displayed in step S1206 of FIG. The output screen 1400 is generated using the information held in the storage device 132 in steps S1201 to S1205. The output screen 1400 is displayed on the display device of the computer 102 or the failure analysis device 103, for example. In FIG. 14, the output screen 1400 has display areas 1401 to 1405.

  In the display area 1401, the failure information received in step S1201 is displayed. The “reference keyword” is a word obtained by morphological analysis of the phenomenon content included in the failure information, and a word input in the supplemental keyword input field.

  The display area 1402 displays the analysis result regarding the failure report. Specifically, for example, values of the countermeasure field 308, the subject field 305, the phenomenon content field 306, and the failure cause field 307 are displayed for the similar failure report acquired in step S1203. When there are a plurality of similar failure reports, the analysis result of each similar failure report is switched and displayed by tabs.

  In the display area 1403, the analysis result regarding the daily work report data is displayed. Specifically, for example, each value of the work date field 402, the work content (subject) field 406, and the work content (detail) field 407 is displayed for the specific work daily report data specified in step S1204. When there are a plurality of specific work daily report data, the analysis result of each specific work daily report data is switched and displayed by a tab.

  In the display area 1404, an analysis result regarding the work instruction data is displayed. Specifically, for example, the values of the subject field 502, the request content field 506, and the work item field 507 are displayed for the work instruction data acquired in step S1205. When there are a plurality of acquired work instruction sheet data, the analysis result of each work instruction sheet data is switched and displayed by tabs.

  The display area 1405 includes buttons for evaluating the analysis result regarding the above-described failure report, the analysis result regarding the daily work report data, and the analysis result regarding the work instruction data. The appropriate button 1406 is a button that is pressed when the administrator evaluates that the above three types of evaluation results are appropriate. The inappropriate button 1407 is a button that is pressed when the administrator evaluates that the above three types of evaluation results are inappropriate.

  When the appropriate button 1406 is pressed, the failure analysis apparatus 103 displays the failure report and work displayed by selecting the tab in the analysis result related to the failure report, the analysis result related to the daily work report data, and the analysis result related to the work instruction data. Each ID of daily report data and work instruction data is associated. The failure analysis apparatus 103 stores a set of the associated failure report ID, work daily report ID, and work instruction document ID as a new entry in the association DB 130.

  On the other hand, when the inappropriate button 1407 is pressed, the association information registration screen 1000 shown in FIG. 10 is displayed. As a result, the administrator can manually associate the failure report ID, the daily work report ID, and the work instruction ID.

  As described above, according to the present embodiment, when failure information is given from the administrator, the failure analysis apparatus 103 can search for a similar failure report similar to the failure information, and presents a response method to the administrator. can do. Thereby, an early response to the failure becomes possible. Further, the failure analysis device 103 can also search for specific work daily report data related to the similar failure report and work instruction data related to the specific work daily report data, and can present a work candidate causing the failure. it can.

  Next, a processing example for predicting potential failure and preventing failure using the association DB 130 will be described. Specifically, for example, when daily work report data is input from an administrator such as SE, the failure analysis apparatus 103 estimates a potential failure before the user of the analysis target system 101 detects (latent failure prediction). . In addition, when work instruction data is input in accordance with a work instruction received from a user of the analysis target system 101, the failure analysis apparatus 103 identifies and presents work content that is likely to cause a failure (preventing failure before it occurs). ). Thereby, it can prevent that the analysis object system 101 falls into a function stop. First, an example of latent failure prediction processing will be described.

<Example of potential failure prediction process>
FIG. 15 is a flowchart illustrating an example of a potential failure prediction process performed by the failure analysis apparatus 103. The flowchart in FIG. 15 is executed, for example, when the daily work report data input on the daily work report registration screen 800 shown in FIG. 8 is registered in the daily work DB 105. The flowchart in FIG. 15 may be executed when the failure analysis apparatus 103 acquires daily work report data of an entry arbitrarily selected from the daily work report DB 105 by an operation of the administrator.

  The failure analysis device 103 acquires daily work report data from the daily work DB 105 (step S1501). The acquired daily work report data is referred to as “acquired daily work report data”.

  Next, the failure analysis apparatus 103 selects past work daily report data having a keyword appearance tendency similar to the work content in the acquired daily work report data from the work daily report DB 105 (step S1502). Also in step S1502, as in steps S1203 and S1204, the failure analysis apparatus 103 uses the keywords for the work details (details) of the acquired daily work report data and the work details (details) of past work daily report data in the work daily report DB 105. The inter-vector distance is calculated using the keyword and the similarity is determined using the inter-vector distance. The past daily work data determined to be similar to the acquired daily work data is referred to as “selected daily work data”. The past daily work data is daily work data that is a work day before the work day of the obtained daily work data.

  Then, the failure analysis apparatus 103 identifies a failure report ID corresponding to each work daily report ID of the acquired daily work report data and the selected daily work report data from the association DB 130, and a failure report that is an entry of the identified failure report ID is reported to the failure report. Obtained from the DB 104 (step S1503). The acquired failure report is referred to as “acquired failure report”.

  The failure analyzer 103 displays the potential failure prediction result based on the phenomenon contents and countermeasures in the acquired failure report (step S1504). The latent failure prediction result includes latent failure prediction information and countermeasures. Thereby, the latent failure prediction process is terminated.

  FIG. 16 is an explanatory diagram showing an example of an output screen of the potential failure prediction result displayed in step S1504 of FIG. The output screen 1600 displays a first estimation result 1610, a second estimation result 1620, and a time series graph. The first estimation result 1610 is an estimation result from the work content of today (the date of creation of the daily work report data). The “estimated failure cause” is the value of the failure cause field 307 of the acquired failure report corresponding to the daily work report data acquired in step S1503. “Today's work daily report” is the value of the work content (detail) field 407 of the daily work report data acquired in step S1501.

  The second estimation result 1620 is an estimation result from the work content up to yesterday (the creation date of the selected work daily report data). The “estimated failure cause” is a value of the failure cause field 307 of the acquired failure report corresponding to the selected daily work report data acquired in step S1503. “Participating work daily report” is the value of the work day field 402 and the value of the work content (detailed) field 407 of the daily work report data acquired in step S1501.

  The time series graph is a graph showing the potential period of failure cause of the first estimation result 1610 and the second estimation result 1620. An asterisk corresponds to the work day.

  The first estimation result 1610 and the second estimation result 1620 include an estimation evaluation button 1621. As a result of referring to the estimation result, the administrator presses the estimation evaluation button 1621 to correct the failure report. The failure analysis apparatus 103 displays the failure report registration screen 700 of FIG. 7 for the estimation results obtained by pressing the estimation evaluation button 1621 out of the first estimation result 1610 and the second estimation result 1620. In this case, the information of the estimated result that has been pressed is embedded in each of the input fields 701 to 708 of the failure report registration screen 700. The administrator can modify the failure report registration screen 700 in which the input fields 701 to 708 have been input, if necessary, and press the registration button 709. As a result, the reporter ID field 302 to the resolution date / time field 309 of the entry of the failure report ID to be corrected in the failure report DB 104 are updated.

  As described above, according to the potential failure prediction process, it is possible to estimate a failure potentially occurring in the work up to the work day of the daily work report data input from the past by inputting the daily work daily report data. . As a result, the administrator can detect the failure before the actual detection of the failure and notice the presence of the failure, thereby enabling early resolution of the failure and suppression of expansion of the effect.

<Problem prevention procedure>
FIG. 17 is a flowchart illustrating an example of a failure prevention processing procedure. The flowchart in FIG. 17 is executed, for example, when the work instruction data input on the work instruction registration screen 900 shown in FIG. 9 is registered in the work instruction DB 106. Further, the flowchart of FIG. 17 may be executed when the failure analysis apparatus 103 acquires work instruction data of an entry arbitrarily selected from the work instruction DB 106 by an operation of the administrator.

  The failure analysis apparatus 103 acquires work instruction data from the work instruction DB 106 (step S1701). The acquired work instruction data is referred to as “acquired work instruction data”.

  Next, the failure analysis apparatus 103 selects other work instruction data having a keyword appearance tendency similar to the description (for example, request contents or work item) in the acquired work instruction data from the work instruction DB 106 ( Step S1702). Also in step S1702, as in steps S1203, S1204, and S1502, the failure analysis apparatus 103 determines the keyword for the request contents of the acquired work instruction sheet data and the request contents of other work instruction sheet data in the work instruction sheet DB 106. The inter-vector distance is calculated using the above keywords, and the similarity is determined using the inter-vector distance. Other work instruction data determined to be similar to the acquired work instruction data is referred to as “selected work instruction data”.

  Then, the failure analysis apparatus 103 identifies a failure report ID corresponding to the work instruction sheet ID of the selected work instruction sheet data from the association DB 130, and acquires a failure report that is an entry of the identified failure report ID from the failure report DB 104. (Step S1703). The acquired failure report is referred to as “acquired failure report”.

  The failure analysis device 103 displays failure occurrence risk information based on the phenomenon content and the failure cause in the acquired failure report (step S1704). This completes the failure prevention process.

  FIG. 18 is an explanatory diagram showing an example of failure occurrence risk information displayed in step S1704 of FIG. The output screen 1800 displays failure occurrence risk information. The failure occurrence risk information includes information 1801 indicating the value of the request content field 506 of the acquired work instruction data. Further, the failure prediction result includes information 1802 indicating the value of the phenomenon content field 306 and the value of the failure cause field 307 of the acquired failure report.

  As a result, it is possible to know in advance what kind of work instruction is given and what kind of failure risk is present, and it is possible to prompt the administrator not to cause any trouble.

  According to the failure prevention process, when an administrator receives a work request, the work instruction data is input before the work is started, so that the contents of the past similar failure phenomenon and cause of failure are presented for each work content. Can do. Thereby, for example, the administrator can estimate the influence range from the phenomenon contents of the similar fault. In addition, it is possible to grasp the work content that caused the failure from the cause of the similar failure, and it is possible to grasp in advance the points on the work to be noted.

  As described above, the failure analysis apparatus 103 according to the present embodiment is able to search for a similar failure report similar to the failure information by receiving the failure information from the administrator. The method can be presented to the administrator. Thereby, an early response to the failure becomes possible. Further, the failure analysis device 103 can also search for specific work daily report data related to the similar failure report and work instruction data related to the specific work daily report data, and can present a work candidate causing the failure. it can.

  Further, the failure analysis apparatus 103 can search daily work report data related to the similar failure report. Therefore, the administrator can confirm what kind of work is described in the daily work report data when a trouble as shown in the similar trouble report occurs. Thereby, the administrator can estimate the potential failure from the confirmed work content.

  Further, the failure analysis apparatus 103 can search for work instruction data related to the specific work daily report data. Therefore, the administrator can confirm what kind of request contents existed in the work instruction data when a failure as shown in the similar failure report occurs. Thereby, the administrator can estimate the failure with the risk of occurrence from the confirmed request content.

  The present invention is not limited to the above-described embodiments, and includes various modifications and equivalent configurations within the scope of the appended claims. For example, the above-described embodiments have been described in detail for easy understanding of the present invention, and the present invention is not necessarily limited to those having all the configurations described. A part of the configuration of one embodiment may be replaced with the configuration of another embodiment. Moreover, you may add the structure of another Example to the structure of a certain Example. In addition, for a part of the configuration of each embodiment, another configuration may be added, deleted, or replaced.

  In addition, each of the above-described configurations, functions, processing units, processing means, etc. may be realized in hardware by designing a part or all of them, for example, with an integrated circuit, and the processor realizes each function. It may be realized by software by interpreting and executing the program to be executed.

  Information such as programs, tables, and files that realize each function can be stored in a storage device such as a memory, a hard disk, and an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, and a DVD.

  Further, the control lines and the information lines are those that are considered necessary for the explanation, and not all the control lines and the information lines that are necessary for the mounting are shown. In practice, it can be considered that almost all the components are connected to each other.

104 Failure report DB
105 Daily work DB
106 Work instruction DB
110 System log DB
100 Failure Analysis System 101 Analysis Target System 102 Computer 103 Failure Analysis Device 107 Network 700 Failure Report Registration Screen 800 Daily Report Registration Screen 900 Work Instruction Registration Screen 1000 Information Registration Screen 1600 Output Screen 1800 Output Screen

Claims (11)

A fault report database that stores fault reports for each fault including the fault contents and the cause of the fault;
A daily work report database for storing daily work report data for each work including the work content and work day for the failure;
A failure analysis apparatus accessible to the failure report database and the daily work report database;
A failure analysis system comprising:
The failure analyzer is
A reception process for receiving failure information including a specific failure occurrence date and time and a specific phenomenon content indicating the failure phenomenon;
A first selection process for selecting work daily report data whose work date is before the specific occurrence date and time from the work daily report database;
A first acquisition process for acquiring a failure report in which the phenomenon content is similar to the specific phenomenon content from the failure report database;
A specific process for identifying daily work report data having work contents similar to the cause of failure of the similar failure report acquired by the first acquisition process from the daily work report data selected by the first selection process;
Failure analysis system characterized by executing   2. The failure analysis system according to claim 1, wherein in the first selection process, the failure analysis apparatus selects daily work report data in which the work date is within a non-login period of a user of the analysis target system. . The failure analyzer is
The failure analysis system according to claim 1 or 2, wherein an association process for associating the similar failure report with daily work report data specified by the specifying process for the similar failure report is executed. The failure analyzer is
A designation process for designating any daily work report data from the daily work database;
A work date similar to the work content of any one of the daily work report data specified by the specifying process from the daily work report database, and a work date that is earlier than the work date of any one of the daily work report data A second selection process for selecting similar daily work report data,
A second acquisition process for acquiring a failure report corresponding to the similar daily work report data selected by the second selection process based on the correspondence relationship associated by the association process;
An output process for outputting a potential fault prediction result based on the fault report acquired by the second acquisition process;
The failure analysis system according to claim 3, wherein: The failure analysis system includes:
A work instruction document database for storing work instruction data for each work instruction including a work period instructed for a failure and a work item indicating the content of the work instruction;
The failure analysis apparatus is accessible to the work instruction database;
The failure analyzer is
The failure analysis system according to claim 1, wherein a third acquisition process of acquiring work instruction data corresponding to daily work report data specified by the specifying process is executed from the work instruction database.   6. The failure analysis apparatus according to claim 5, wherein the failure analysis apparatus acquires work instruction data including a work date of work daily report data specified by the specifying process in the third acquisition process. Failure analysis system.   6. The failure analysis apparatus according to claim 5, wherein in the third acquisition process, the failure analysis apparatus acquires work instruction data having a work item similar to the work content of daily work report data specified by the specifying process. The failure analysis system described. The failure analyzer is
An associating process for associating the similar failure report, the daily work report data specified by the specifying process with respect to the similar failure report, and the work instruction data acquired by the third acquisition process with respect to the daily work report data; The failure analysis system according to claim 5, wherein the failure analysis system is executed. The failure analyzer is
A designation process for designating any work instruction data from the work instruction database;
A second selection process for selecting, from the work instruction database, similar work instruction data similar to the description in any of the work instruction data designated by the designation process;
A second acquisition process for acquiring a failure report corresponding to the similar work instruction data selected by the second selection process based on the correspondence relationship associated by the association process;
An output process for outputting a failure occurrence risk based on the failure report acquired by the second acquisition process;
The failure analysis system according to claim 8, wherein: A fault report database that stores fault reports for each fault including the fault contents and the cause of the fault;
A daily work report database for storing daily work report data for each work including the work content and work day for the failure;
A failure analysis apparatus accessible to the failure report database and the daily work report database;
A correspondence database for storing a correspondence relationship between the failure report and the daily work report data;
A failure analysis system comprising:
The failure analyzer is
A designation process for designating any daily work report data from the daily work database;
A work date similar to the work content of any one of the daily work report data specified by the specifying process from the daily work report database, and a work date that is earlier than the work date of any one of the daily work report data A selection process for selecting similar work daily report data,
An acquisition process for acquiring a failure report corresponding to the similar work daily report data selected by the selection process from the failure report database with reference to the association database;
An output process for outputting a potential fault prediction result based on the fault report acquired by the acquisition process;
Failure analysis system characterized by executing A fault report database that stores fault reports for each fault including the fault contents and the cause of the fault;
A daily work report database for storing daily work report data for each work including the work content and work day for the failure;
A failure analysis apparatus accessible to the failure report database and the daily work report database;
A work instruction document database for storing work instruction data for each work instruction including a work period instructed for a failure and a work item indicating the content of the work instruction;
A correspondence database that stores the correspondence between the failure report and the work instruction data;
A failure analysis system comprising:
The failure analyzer is
A designation process for designating any work instruction data from the work instruction database;
A selection process for selecting similar work instruction data similar to the description in any one of the work instruction data specified by the specifying process from the work instruction database;
An acquisition process for acquiring a failure report corresponding to the similar work instruction data selected by the selection process from the failure report database with reference to the association database;
Output processing for outputting a failure occurrence risk based on the failure report acquired by the acquisition processing;
Failure analysis system characterized by executing

Images