WO2023282024A1

WO2023282024A1 - System design support device, system design support method, and system design support system

Info

Publication number: WO2023282024A1
Application number: PCT/JP2022/024268
Authority: WO
Inventors: 剛畠山
Original assignee: 三菱電機株式会社
Priority date: 2021-07-05
Filing date: 2022-06-17
Publication date: 2023-01-12
Also published as: JPWO2023282024A1; JP7483143B2

Abstract

The objective of the present invention is to provide a technology capable of quantitatively evaluating the reliability or robustness of a system. This system design support device is a device that supports system design, and comprises an acquiring unit and a computing unit. The acquiring unit acquires system configuration information, data flow information, and probability information. The computing unit computes, as a partial abnormality generation probability, a data abnormality generation probability in each of hardware and software included in at least a portion of the system, on the basis of the system configuration information, the data flow information, and the probability information.

Description

System design support device, system design support method, and system design support system

The present disclosure relates to a system design support device, a system design support method, and a system design support system.

In society, there are many systems that can cause material and economic losses and human lives if unintended behavior (hereinafter simply referred to as abnormalities) occurs due to some kind of malfunction. Examples of such systems include control and management systems for moving bodies such as railways, automobiles, and aircraft, and social infrastructure systems such as power management systems for power plants.

Normally, in system development, S/W (software) function tests and H/W (hardware) failure countermeasures are performed. In developing a system that requires reliability or robustness as described above, in addition to these considerations, the possibility of the system malfunctioning due to an event with a very low probability of occurrence is taken into consideration. One of the abnormalities caused by such events is soft errors (also known as accidental failures) that cause garbled bits and data loss in electronic circuits due to collisions of electrons and the effects of electromagnetic fields, even if the electronic circuits are normal in terms of hardware and hardware. is noted).

　In the development of a complex and large-scale system, there is a problem that a huge amount of analysis work is required to consider all the possibilities brought about by soft errors and countermeasures for each point where soft errors occur.

By the way, the methods of coping with abnormalities caused by the above events can be categorized into two types, and either or both of them are used in system development. One of the two coping methods is to extremely increase the reliability of the S/W execution environment, that is, the reliability of the H/W side. This allows the design of the S/W to exclude some anomalies that may occur on the H/W side from consideration. The other is a coping method for coping with H/W anomalies with S/W logic, assuming that anomalous behavior may occur on the H/W side with a certain probability.

For example, in

Patent Documents

1, 2, 3, 4, and 5, as an abnormality detection method for H / W (especially semiconductor devices), a method for efficiently detecting defects within a realistic verification cost and an undetected defect A technique for evaluating the reliability of H/W by calculating how much is left has been proposed. The techniques of Patent Literatures 1 to 5 correspond to a method of improving the reliability of H/W among the above two methods.

For example, in Patent Literature 6, based on a hierarchical structure in which S/W and H/W are components, by simulating an abnormality that occurs in one of the components in the system, detection of vulnerabilities related to anomalies is supported. techniques have been proposed. The technique of Patent Literature 6 corresponds to a coping method that uses S/W logic to deal with an abnormality in H/W, among the above two coping methods.

The above two coping methods have two common issues. One is the inability to compensate for any anomalies (eg, soft errors) with 100% accuracy. The other is that any coping method is specialized for anomalies that occur at specific locations, timings, and frequencies within the system.

Furthermore, for example, with the techniques of Patent Documents 1 to 5, it is not possible to evaluate the ability to cope with abnormalities such as soft errors that occur even when the H/W is normal. For example, in the technique of Patent Document 6, since the effect of a predetermined abnormality is evaluated, an unexpected abnormality such as a normal state unintentionally changing to another normal state is detected. Cannot be evaluated. Specifically, in a system, control instructions A and B are represented as data 0x01 (0000 0001 in bit string) and 0x03 (0000 0011 in bit string), respectively. In this case, if 0x01 accidentally becomes 0x03 due to garbled 1-bit 1 data, the control instruction is correct as data.

JP-A-2004-185550 JP 2009-192407 A JP-A-05-209943 Japanese Patent Application Laid-Open No. 2010-015420 JP 2016-218577 A JP 2005-275749 A

Based on the above, it is necessary to use a combination of various countermeasures to increase the robustness of the entire system. For this purpose, it is conceivable to quantitatively evaluate the reliability or robustness of the system with respect to the use or non-use of various countermeasures. However, the prior art has the problem that the reliability or robustness of the system is not quantitatively evaluated.

Therefore, the present disclosure has been made in view of the problems described above, and aims to provide a technology that can quantitatively evaluate the reliability or robustness of a system.

A system design support device according to the present disclosure includes system configuration information indicating the hierarchy of hardware included in a system and software executed by the hardware, and data flow indicating the flow of data in at least part of the system. an acquisition unit configured to acquire information and probability information indicating a probability of occurrence of an abnormality in data in the hardware; a calculation unit for calculating, as a partial abnormality occurrence probability, an abnormality occurrence probability of data in each of the hardware and the software.

According to the present disclosure, based on the system configuration information, the data flow information, and the probability information, the data failure probability in each of the hardware and software included in at least a part of the system is defined as the partial failure probability. calculate. With such a configuration, it is possible to quantitatively evaluate the reliability or robustness of the system.

1 is a block diagram showing the configuration of a system design support device according to Embodiment 1; FIG. It is a figure which shows the example of coping method information. FIG. 4 is a diagram showing an example of system configuration information; It is a figure which shows the example of data flow information. It is a figure which shows the example of H/W abnormality probability information. 4 is a flow chart showing the operation of the design input section; It is a flowchart which shows the operation|movement of a hierarchy and components identification part. It is a figure which shows the example of hierarchy and component information. It is a figure which shows the example of hierarchy dependence information. 4 is a flow chart showing the operation of the hierarchy and parts disassembly section; It is a figure which shows the example of disassembled data flow information. 5 is a flow chart showing the operation of a contamination probability calculation unit; It is a figure for demonstrating the operation example of a contamination probability calculation part. It is a figure for demonstrating the operation example of a contamination probability calculation part. 2 is a block diagram showing the configuration of a system design support device according to Embodiment 2; FIG. It is a flowchart which shows operation|movement of a coping method learning part. FIG. 4 is a diagram showing an example of system configuration information; It is a figure which shows the example of disassembled data flow information. It is a figure which shows the example of coping method information. It is a flowchart which shows operation|movement of a coping method proposal part. It is a figure for demonstrating the operation example of a contamination probability calculation part. FIG. 11 is a block diagram showing a hardware configuration of a system design support device according to another modified example; FIG. 11 is a block diagram showing a hardware configuration of a system design support device according to another modified example;

<Embodiment 1>
FIG. 1 is a block diagram showing the configuration of system design support apparatus 100 according to the first embodiment.

The system design support device 100 in FIG. 1 comprises the components within the dashed lines in FIG. Specifically, the system design support apparatus 100 includes a design input unit 101 as an acquisition unit, a calculation unit 121, and a contamination probability display unit 109 as an output unit. The calculation unit 121 includes a hierarchy and parts identification unit 102 , a hierarchy and parts disassembly unit 105 , and a contamination probability calculation unit 107 .

As described below, the design input unit 101 acquires system configuration information 111, data flow information 112, and H/W failure probability information 113, which is probability information. Based on the system configuration information 111, the data flow information 112, and the H/W abnormality probability information 113, the calculation unit 121 calculates the data abnormality occurrence probability in each of the hardware and software included in at least a part of the system to be evaluated. is calculated as the partial failure occurrence probability. In Embodiment 1, the design input unit 101 further acquires the coping method information 110 , and the calculating unit 121 corrects the partial failure occurrence probability of the specific portion based on the coping method information 110 .

Based on the partial failure occurrence probability of at least a part of the system to be evaluated, the calculation unit 121 calculates the data failure probability of the entire hardware and software included in the at least part of the system as the overall failure occurrence probability. do. The system design support apparatus 100 pollutes contamination probability information 108, which is information including at least one of partial failure probability and overall failure probability, as a quantitative evaluation of the reliability or robustness of the system to be evaluated. It is displayed on the probability display unit 109 . That is, the contamination probability display unit 109 displays and outputs information based on the partial abnormality occurrence probability. The system design support device 100 supports the system design of the user 114 by performing such display. In addition, in the system design support system, the contamination probability display unit 109 may be provided separately from the system design support device 100 .

Next, the system design support device 100 will be described in detail. First, the coping method information 110, the system configuration information 111, the data flow information 112, and the H/W failure probability information 113 acquired by the design input unit 101 will be described.

FIG. 2 is a diagram showing an example of the coping method information 110. FIG. The coping method information 110 includes the type of coping method for anomalies, and the success rate (hereinafter also referred to as compensation success probability) of compensating for the occurrence of data anomalies in a specific part of the system to be evaluated by the coping method. and For example, in solution method 1 of FIG. 2, a specific part of the system that includes a computer, at least one of a LAN (Local Area Network) cable and network switch, and the computer is set as an application pattern. When an abnormality occurs in the data flowing through this application pattern, if the coping method 1 is performed, the abnormality will be compensated with a probability of 0.9 (=90%).

The application pattern is used for pattern matching, which will be described later. Moreover, the upper limit of the compensation success probability is 1, which means that the closer the compensation success probability is to 1, the higher the possibility that the abnormality will be compensated. In addition, coping method 1, coping method 2, . . . may be set in the order applied to the data flow when the system actually operates.

FIG. 3 is a diagram showing an example of the system configuration information 111. FIG. The system configuration information 111 is information indicating the configuration of the system to be evaluated.

The system configuration information 111 indicates the hierarchy and linkage between the hardware included in the system to be evaluated and the software executed by the hardware. Hierarchy implies a dependency where the behavior of one depends on the context of another. Coordination means a relationship in which data can be delivered directly, and may include relationships other than dependency (for example, parallel relationships). Note that cooperation is also described as connection, and hardware and software included in the system are also described as components.

In the system of FIG. 3, one network switch E202 is physically connected to three devices (devices E211, E221, E231) via three LAN cables (LAN cables E241, E242, E243). The device E211 includes a first computer E212, an OS (Operating System) E213, a M/W (middleware) E214, a first application E216, and a second application E215 as a S/W hierarchical structure. Note that the application is abbreviated as “App” in FIG. 3 and the like.

The devices E221 and 231 are configured similarly to the device E211. That is, the device E221 includes a second computer E222, an OSE223, an M/WE224, a third application E226, and a fourth application E225 as a S/W hierarchical structure. The device E231 includes a third computer E232, an OSE233, an M/WE234, a fifth application E236, and a sixth application E235 as a S/W hierarchical structure.

In FIG. 3, the system configuration information 111 shows the hierarchy and cooperation of hardware and software by block diagrams, but is not limited to this. For example, the system configuration information 111 may indicate the hierarchy and linkage of hardware and software using a table, for example.

FIG. 4 is a diagram showing an example of the data flow information 112. FIG. Data flow information 112 indicates the flow of data through at least a portion of the system under evaluation. For example, data flow 1 in FIG. 4 indicates that data flows through the first application, second application, M/W, . . . , M/W, and fourth application in this order. For example, data flow 2 of FIG. 4 shows data flowing through substantially all of the system of FIG.

FIG. 5 is a diagram showing an example of the H/W abnormality probability information 113. FIG. The H/W anomaly probability information 113 indicates an anomaly occurrence probability of data in hardware. In Embodiment 1, the probability of occurrence of data failure in hardware includes the probability of data corruption in hardware and the probability of data loss in hardware, but is not limited to these. . Also, the probability of garbled bits depends on various definitions such as x cases/year, x cases/number of transactions, etc., but the type of definition is not particularly limited.

<Design input section>
Next, the operation of the design input unit 101 will be described. FIG. 6 is a flow chart showing the operation of the design input unit 101. As shown in FIG.

First, in step S1, the design input unit 101 inputs coping method information 110, system configuration information 111, data flow information 112, and H/W abnormality probability information 113 is accepted.

In step S2, the design input unit 101 classifies and distributes various design information. As a result, the coping method information 110 is supplied to the contamination probability calculation unit 107, the system configuration information 111 is supplied to the hierarchy and component identification unit 102, the data flow information 112 is supplied to the hierarchy and component disassembly unit 105, and the H/W error probability information 113 is supplied to the contamination probability calculation unit 107. It is output to probability calculation section 107 . The input method, the transfer method, and the data method of the signal itself received by the design input unit 101 are not particularly limited.

<Hierarchy and part identification part>
Next, the operation of the hierarchy and component identification unit 102 will be described. FIG. 7 is a flow chart showing the operation of the hierarchy and component identification unit 102. As shown in FIG.

First, in step S<b>11 , the hierarchy and part identification unit 102 receives the system configuration information 111 from the design input unit 101 .

In step S<b>12 , the hierarchy and component identification unit 102 extracts linkages between hierarchical structures and component configurations from the system configuration information 111 and generates system hierarchy and component information 103 .

FIG. 8 is a diagram showing an example of the hierarchy and part information 103 regarding the cooperation of the device E211 from the system configuration information 111 (see FIG. 3). For example, since the first computer E212 in FIG. 3 has a direct connection relationship only with the OSE 213 and the LAN cable E241, in FIG. is circled.

It should be noted that, in the entire system of FIG. 3, there are multiple parts and layers that logically point to the same thing, such as LAN cables, OS and M/W. In view of this, in the hierarchy and component information 103 of FIG. given to the part. In Embodiment 1, the identification information is assumed to be the numbering system "E2xx" used in the symbols in FIG. 3, but it is not limited to this.

Note that in the first embodiment, the hierarchy and component identification unit 102 identifies the hierarchy in FIG. and component information 103 are extracted. Depending on the actual system design method, for example, there is also a method in which the first application E216 and the second application E215 can be linked only via the M/WE213. For such a method, information indicating it is separately included in the system configuration information 111 of FIG. 3, a gap is provided between these parts in FIG. You may provide the mechanism which can do it separately.

In step S13 of FIG. 7, the hierarchy and component identification unit 102 extracts the dependencies of the hierarchical structure of the H/W and the S/W operating thereon, and the unit of component configuration from the system configuration information 111. , is generated as the hierarchical dependency information 104 .

FIG. 9 is a diagram showing an example of hierarchical dependency information 104 generated from system configuration information 111 (see FIG. 3). In FIG. 9, for example, the operations of the OSE 213, the M/WE 214, the first application E 216, and the second application E 215 depend on the status of the first computer E 212, but the operations of the first computer E 212 do not depend on the status of the OSE 213, etc. is shown. Also, for example, the first application E216 and the second application E215 are in a parallel relationship in a certain hierarchy of applications, but are not in a dependent relationship. Further, for example, FIG. 9 shows that the system in FIG. 3 is composed of four layers: computer, OS, M/W, and application. Note that the specific data format of the hierarchy and component information 103 does not matter as long as it includes such dependency relationships and component configurations.

<Hierarchy and parts disassembly section>
Next, the hierarchy and parts decomposition unit 105 will be described. FIG. 10 is a flow chart showing the operation of the layer and component decomposition unit 105. As shown in FIG.

First, in step S21, the hierarchy and parts disassembly section 105 receives the data flow information 112 from the design input section 101 and the hierarchy and parts information 103 from the hierarchy and parts identification section .

In step S22, the hierarchy and component decomposition unit 105 interprets how the data flow indicated by the data flow information 112 is realized by how the hierarchy and components indicated by the hierarchy and component information 103 are linked. Then, based on the interpretation, the hierarchy and part decomposition unit 105 assigns the identification information of the hierarchy and part information 103 to the parts indicated in the data flow of the data flow information 112, and appropriately divides the parts of the hierarchy and part information 103. Complement. The hierarchy and component decomposition unit 105 generates the information obtained by the above processing as the decomposed data flow information 106 .

FIG. 11 is a diagram showing an example of the disassembled data flow information 106 generated from the data flow 1 of the data flow information 112 (see FIG. 4) and the hierarchy and component information 103 (see FIG. 8).

For example, based on the identification information in FIG. 8, the hierarchy and component disassembly unit 105 converts the portion "first application -> second application" in data flow 1 in FIG. 4 to "E216: first application - > E215: Converting to "second application". Also, for example, the layer and component disassembly unit 105 performs the " The part "first computer -> network switch" is supplemented with "E212: first computer -> E241 LAN cable -> E202: network switch" in FIG.

The hierarchy and component decomposition unit 105 generates the decomposed data flow information 106 of FIG. 11 by performing the conversion described above on all of the data flow 1 and data flow 2 of the data flow information 112 of FIG. Complementation of the data flow is not essential, and for example, in the data flow information 112, it may be set in advance so that the layer and component decomposition unit 105 does not perform complementation.

<Contamination probability calculation unit>
Next, the contamination probability calculator 107 will be described. FIG. 12 is a flowchart showing the operation of the contamination probability calculation unit 107. As shown in FIG.

First, in step S31, the contamination probability calculation unit 107 obtains the hierarchy dependency information 104 from the hierarchy and parts identification unit 102, the disassembled data flow information 106 from the hierarchy and parts disassembly unit 105, and the H /W Anomaly probability information 113 is accepted.

At step S32, the contamination probability calculation unit 107 calculates the probability of occurrence of failure of the data of each layer and each component as the probability of partial failure occurrence based on the hierarchy dependency information 104 and the H/W failure probability information 113.

FIG. 13 is a diagram for explaining an operation example of the contamination probability calculation unit 107. FIG. For example, the contamination probability calculation unit 107 reads four layers, computer, OS, M/W, and application, with the computer as the base, from the layer dependency information 104 (see FIG. 9). Further, the contamination probability calculation unit 107 reads 1% as the 1-bit garbled probability of the first computer, which is the H/W, from the H/W abnormality probability information 113 (see FIG. 5). Here, when garbled bits occur, the data is garbled in one of the above four hierarchies.

In order to simplify the explanation in the first embodiment, it is assumed that the number of bits of data used in each of the four hierarchies is the same. FIG. 13 shows, as an example, that the data used in each layer is 4-bit data "1010".

In this case, the occurrence probability of garbled bits in the four layers is roughly the same. Therefore, when 1% of garbled bits occur in all four hierarchies, the contamination probability calculation unit 107 divides 1% into 4 equal parts and calculates the garbled bit probability of each hierarchy as 0.25%. In addition, assuming that the occurrence probabilities of garbled bits in the parallel-related first application E216 and the second application E215 are approximately equal, the contamination probability calculation unit 107 divides the above 0.25% into two equal parts, is calculated as 0.125%. In the same manner as described above, the contamination probability calculation unit 107 also calculates the probability of occurrence of partial failure for the data of each layer and each component for other failures such as bit loss included in the H/W failure probability information 113 . Calculate as a probability.

Note that the actual system does not have a simple data distribution as described above, so the probability of occurrence of partial failures in each layer is not uniform. Therefore, the contamination probability calculation unit 107 sets a weight for correcting the probability of occurrence of a partial failure based on at least one of length of stay, arithmetic processing, and size in each layer of data in the data flow. You may For example, assume that any one of M/W stay period, arithmetic processing, and size is larger than those of the computer, OS, and application. In this case, the contamination probability calculation unit 107 sets the weights of the computer, OS, M/W, and application to, for example, 1, 1, 2, and 1, respectively, and sets the occurrence probability of garbled bits of M/W to 0.0. It may be calculated as 4% (=1%×2/(1+1+2+1)). According to such a configuration, it is possible to calculate the partial failure occurrence probability with high accuracy.

In step S33 of FIG. 12, the contamination probability calculation unit 107 associates each layer and each part included in the disassembled data flow information 106 with the partial failure occurrence probability of each layer and each part calculated in step S32.

FIG. 14 is a diagram for explaining an operation example of the contamination probability calculation unit 107 in steps S33 to S36 of FIG. Column C801 in FIG. 14 shows data flow 1 of the disassembled data flow information 106 in FIG. 11, and column C802 in FIG. 14 shows the partial failure occurrence probability in FIG. Column C801 and column C802 are linked by linking in step S33.

At step S34 in FIG. 12, the contamination probability calculation unit 107 performs processing for accepting the coping method information 110 corresponding to the system. Then, the contamination probability calculation unit 107 determines whether or not the coping method information 110 from the design input unit 101 has been received. If it is determined that the request has been received, the process proceeds to step S35, and if it is determined that the request has not been received, the process proceeds to step S36.

In step S35, the contamination probability calculation unit 107 reads each coping method of the coping method information 110, and determines which part of the data flow of the decomposed data flow information 106 the application pattern of the coping method corresponds to. Search by matching. For example, when searching for the application pattern of coping method 1 in FIG. 2 in the data flow of column C801 in FIG. E222: The second computer is retrieved.

In this way, the contamination probability calculation unit 107 searches by pattern matching which part of the data flow in the decomposed data flow information 106 the application pattern of each coping method corresponds to, and stores the position. In columns C803 and C805 of FIG. 14, the portions corresponding to the adaptive patterns of coping

methods

1 and 2 of FIG. ing.

In step S36, the contamination probability calculation unit 107 calculates the data abnormality occurrence probability for the entire hardware and software included in the data flow based on the partial abnormality occurrence probability of the data flow of the system under evaluation. Calculated as probability of occurrence. In the first embodiment, as an example, the overall error occurrence probability is the probability that one or more data errors occur in the entire hardware and software from the start point to the end point of the data flow.

For example, the contamination probability calculation unit 107 calculates the overall abnormality occurrence probability when the coping method is not applied based on the partial abnormality occurrence probability in column C802. As a specific example, the contamination probability calculation unit 107 calculates {1-(1-0.125%)*(1-0.125%)*(1-0.250%)*...*(1-0.125% )}×100, the overall failure occurrence probability is calculated as 21.301%.

For example, the contamination probability calculation unit 107 corrects the partial failure occurrence probability of the application pattern of countermeasure method 1 among the partial failure occurrence probabilities of column C802 by the compensation success probability of column C803. As a specific example, the contamination probability calculation unit 107 calculates {1−(1−0.250%)×(1−10.000%)×(1−1.000%)×(1−10.000%)× (1−0.250%)}×(1−90.000%)×100, the partial failure occurrence probability of the applied pattern is corrected to 2.021% as shown in column C804.

It should be noted that the partial failure occurrence probability corrected in this way is the probability that the failure will remain even if countermeasure method 1 is applied. In other words, in the column C804, when the data passes through all five layers and parts corresponding to the adaptive pattern of the handling method 1, even if the handling method 1 is applied, one or more parts have an abnormality in the data. The probability of survival is shown to be 2.021%. Also, column C804 shows the same partial failure occurrence probabilities as column C802 for layers and parts that do not correspond to the adaptive pattern of countermeasure method 1 .

The contamination probability calculation unit 107 calculates the overall abnormality occurrence probability when coping method 1 is applied, based on the partial abnormality occurrence probability in column C804. Specifically, the contamination probability calculation unit 107 calculates the overall abnormality occurrence probability to be 3.360% by performing the same calculation for the column C804 as the calculation for the column C802.

The contamination probability calculation unit 107 calculates column C806 from column C802 and column C805 in the same manner as column C804 was calculated from column C802 and column C803. The contamination probability calculation unit 107 calculates the overall abnormality occurrence probability when countermeasure method 2 is applied based on the partial abnormality occurrence probability in column C806. Specifically, the contamination probability calculation unit 107 calculates the overall abnormality occurrence probability as 1.743% by performing the same calculation for column C806 as the calculation for column C802.

A column R801 shows the overall failure occurrence probability when no handling method is applied, the overall failure occurrence probability when handling method 1 is applied, and the overall failure occurrence probability when handling method 2 is applied. there is

The operations of steps S31 to S36 in FIG. 12 described above are performed for all of the failure occurrence probabilities of the H/W failure probability information 113 (see FIG. 5) and all of the decomposed data flow information 112 (see FIG. 11). data flow. The contamination probability calculation unit 107 generates contamination probability information 108 including at least one of a partial failure probability and a total failure probability for all failure occurrence probabilities and all data flows.

The contamination probability display unit 109 displays the contamination probability information 108 to the user 114 in any display method. For example, when the contamination probability information 108 as shown in the column R801 of FIG. 14 is displayed, the user 114 selects in the following order: when no coping method is applied, when coping method 1 is applied, and when coping method 2 is applied. , it can be confirmed that the garbled bit occurrence probability decreases.

In the first embodiment, the output unit is described as being the contamination probability display unit 109 that displays the contamination probability information 108, but the contamination probability information 108 may be output. For example, the output unit may be a transmission unit that transmits the contamination probability information 108 instead of the contamination probability display unit 109 that displays the contamination probability information 108, or an output device that outputs the contamination probability information 108 to the storage device. may be

<Summary of Embodiment 1>
According to the system design support apparatus 100 according to the first embodiment as described above, based on the system configuration information, the data flow information, and the probability information, the data in each of the hardware and software included in the data flow is calculated as the partial abnormality occurrence probability. Further, based on the partial failure occurrence probability of at least a part of the system, the data failure probability of the entire hardware and software included in the at least part of the system is calculated as the overall failure occurrence probability. According to such a configuration, it is possible to quantitatively evaluate the reliability or robustness of the system with respect to, for example, garbled data and data loss.

<Embodiment 2>
FIG. 15 is a block diagram showing the configuration of system design support apparatus 100 according to the second embodiment. Hereinafter, among the constituent elements according to the second embodiment, constituent elements that are the same as or similar to the above-described constituent elements are denoted by the same or similar reference numerals, and different constituent elements will be mainly described.

The system design support device 100 in FIG. 15 comprises the components within the dashed lines in FIG. Specifically, the system design support apparatus 100 of FIG. 15 includes a coping method learning unit 132 and a coping method proposing unit 134 in addition to the configuration described in the first embodiment.

The design input unit 101 acquires allowable contamination probability information 131 in addition to coping method information 110, system configuration information 111, data flow information 112, and H/W abnormality probability information 113.

The coping method learning unit 132 learns a combination of the decomposed data flow information 106 and the contamination probability information 108 using the coping method of the coping method information 110 as a label. That is, the coping method learning unit 132 learns a combination of the decomposed data flow information 106, the contamination probability information 108 including the probability of occurrence of an abnormality, and the coping method information 110 including the coping method to be implemented in the system. As a result of this learning, a trained model 133 is generated. The trained model 133 is based on the disassembled data flow information 106 and the probability of occurrence of anomalies (corresponding to the contamination probability information 108), and a new coping method (corresponding to the coping method information 110) to be additionally implemented in the system. is a model that can infer

The coping method proposal unit 134 generates estimated coping method information 135 (coping method corresponding to the information 110) is output. The estimated coping strategy information 135 includes new coping strategies that can satisfy the permissible contamination probability information 131 in the system and should be additionally implemented.

<Coping method learning part>
The coping method learning unit 132 will be described. FIG. 16 is a flow chart showing the operation of the coping method learning unit 132 .

First, in step S41, the coping method learning unit 132 acquires the decomposed data flow information 106, its contamination probability information 108, and its coping method information 110 for a certain system.

FIG. 17 is a diagram showing system configuration information 111 according to the second embodiment. As shown in FIG. 17, at least one of hardware and software indicated in the system configuration information 111 is set with a first coefficient. Specifically, as the first coefficient, a coefficient named "cost" is set for the first computer E212, OSE213, second computer E222, OSE223, third computer E232, and OSE233.

FIG. 18 is a diagram showing decomposed data flow information 106 according to the second embodiment. As shown in FIG. 18 , the first coefficient (cost) in FIG. 17 is reflected in the decomposed data flow information 106 .

FIG. 19 is a diagram showing coping method information 110 according to the second embodiment. As shown in FIG. 19, at least one of hardware and software in coping method information 110 is set with a second coefficient. Specifically, as the second coefficient, a coefficient named “R” is set for the first computer, the LAN cable, and the second computer of coping method 3 . How to use the first coefficient (cost) and the second coefficient (R) will be described later.

In step S42, the coping method learning unit 132 uses the decomposed data flow information 106, the contamination probability information 108, and the coping method information 110 to train the convolutional neural network model. In the second embodiment, the coping method learning unit 132 performs supervised learning on the decomposed data flow information 106 and the contamination probability information 108 using the coping methods of the coping method information 110 as labels. Various types of input data may take information in various formats such as graphic representations, texts, and numerical values, but there is no particular limitation as to how these are converted to improve learning efficiency.

In step S<b>43 , the coping method learning unit 132 outputs the trained model as the learned model 133 . While the user repeatedly uses the above system, the data set of the disassembled data flow information 106, the contamination probability information 108, and the coping method information 110 is repeatedly input to the system design support device 100, and each time a series of steps S41 to S43 is performed. The process is repeated.

<Corresponding method proposal department>
Next, the coping method proposal unit 134 will be described. FIG. 20 is a flowchart showing the operation of the coping method proposing unit 134. As shown in FIG.

In step S51, the coping method proposal unit 134 acquires the disassembled data flow information 106, the allowable contamination probability information 131, and the learned model 133. Here, the acceptable contamination probability information 131 includes the expected contamination occurrence probability for each data flow that is acceptable in the system and included in the data flow information 112 . It does not matter whether the allowable contamination probability information 131 is specified as common to all data flows or specified individually.

In step S52, the coping method proposal unit 134 expands the allowable contamination probability acquired in step S51 to an arbitrary range. For example, in the data flow information 112, the allowable contamination probability of data flow 1 is set to "0.01%", and the allowable contamination probability of data flow 2 is set to "0.1%". . In this case, the coping method proposal unit 134 selects the lowest allowable contamination probability among the allowable contamination probability of data flow 1 and the allowable contamination probability of data flow 2, that is, the allowable contamination probability of data flow 1. Then, the coping method proposal unit 134 expands the range of "0.01%", which is the allowable contamination probability of data flow 1, by adding one digit to "0.001%" and by decreasing one digit. Expand to "0.1%". Note that the expansion here is not limited to this, and may be expanded according to arbitrary rules.

The countermeasure method proposal unit 134 creates new allowable contamination probability information 131 having substantially the same data structure as the original allowable contamination probability information 131 based on the expansion result of the allowable contamination probability. In the above example, the original allowable contamination probability information 131 is a combination of "0.01%" and "0.1%" as the allowable contamination probabilities of data flow 1 and data flow 2. FIG. In this case, the coping method proposal unit 134 creates the original allowable contamination probability information 131 as new allowable contamination probability information 131 as it is. Then, the handling method proposal unit 134 selects a combination of “0.001%” and “0.1%” as the allowable contamination probabilities of data flow 1 and data flow 2, and “0.1%” and “0.1%”. %” are created as new allowable contamination probability information 131 . That is, the coping method proposal unit 134 creates three new allowable contamination probability information 131 as combination patterns created from one original allowable contamination probability information 131 . A combination pattern created from one original allowable contamination probability information 131 is hereinafter referred to as allowable contamination probability variation data. It should be noted that the type of variation data to be created is arbitrary and is not limited to this example.

In step S53, the coping method proposal unit 134 uses the learned model 133 to generate the estimated coping method information 135 from the combination of the decomposed data flow information 106 and the variation of the allowable contamination probability created in step S52. demand. The estimated coping method information 135 includes an estimated pattern of coping methods to be implemented. The structure of the estimated coping method information 135 is substantially the same as the data structure of the coping method information 110 shown in FIG. 19 and the like. In the above example where the variation of allowable contamination probability includes three pieces of allowable contamination probability information 131, three pieces of estimated coping method information 135 are obtained in step S53.

In step S54, the coping method proposal unit 134 inputs the decomposed data flow information 106 acquired in step S51 and any one of the three estimated coping method information 135 obtained in step S53 to the contamination probability calculation unit 107. do. Contamination probability calculation section 107 generates contamination probability information 108 based on input decomposed data flow information 106 and estimated coping method information 135, as described in the first embodiment. In the above example where three pieces of estimated coping method information 135 are obtained, three pieces of contamination probability information 108 are generated in step S54.

Here, utilization of the first coefficient (cost) described in FIG. 18 and the second coefficient (R) described in FIG. 19 will be described. In the second embodiment, in step S54, calculation similar to the calculation of the contamination probability information 108 described in the first embodiment is performed. In this calculation, if the first coefficient and the second coefficient are set, the contamination probability calculation unit 107 further performs the following calculation.

FIG. 21 is a diagram for explaining an operation example of the contamination probability calculation unit 107. FIG. In FIG. 21, a first coefficient C811, a second coefficient C812, and a countermeasure application result coefficient C813 are added to the items in FIG. 14 described in the first embodiment. In FIG. 21, for the sake of simplicity, the information already explained in Embodiment 1 is uniformly indicated by "-" here, and the explanation thereof is omitted. In addition, in FIG. 21 , “{ }” is uniformly used to indicate that no coefficient is set.

For example, in E213:OS, the first coefficient is {cost: 100,000} and the second coefficient is {}. E212: In the first calculator, the first coefficient is {cost: 1,000,000} and the second coefficient is {R: 2}. It is arbitrary how to interpret the meaning of each coefficient and use it for calculation. , to mean multiplexing its elements.

The second coefficient is not set for E213: OS countermeasure method 3 with {cost: 100,000} set. Therefore, even if the coping method 3 in which the second coefficient is not set is applied, the cost of E213: OS remains {cost: 100,000} as indicated by the coping application result coefficient C813.

On the other hand, {R: 2} is set as the second coefficient in E212: Coping method 3 of the first calculator, in which {cost: 1,000,000} is set. In this case, if coping method 3 is applied, E212: The cost of the first computer is {cost: 1,000,000} doubled, and {cost: 2,000} as shown in coping application result coefficient C813. , 000} and double the original. As described above, in the second embodiment, the contamination probability calculation unit 107 obtains the countermeasure application result coefficient C813, which is the feature amount of the countermeasure method, based on the first coefficient and the second coefficient.

The contamination probability display unit 109 displays the estimated coping method information 135 and the contamination probability information 108 in any format. For example, the contamination probability display unit 109 may display the estimated coping method information 135 and the contamination probability information 108 by the number of variations of the allowable contamination probability information 131. display may be ordered based on

<Summary of Embodiment 2>
According to the system design support apparatus 100 according to the second embodiment as described above, combinations of the decomposed data flow information 106, the contamination probability information 108, and the coping method information 110 are learned. According to such a configuration, it is possible to propose an appropriate new coping method to be additionally implemented.

<Other Modifications>
The design input unit 101 and the calculation unit 121 shown in FIG. 1 described above are hereinafter referred to as "the design input unit 101 and the like". The design input section 101 and the like are implemented by a processing circuit 81 shown in FIG. That is, the processing circuit 81 includes a design input unit 101 that acquires the system configuration information 111, the data flow information 112, and the H/W abnormality probability information 113, the system configuration information 111, the data flow information 112, and the H/W and a calculation unit 121 that calculates, based on the error probability information 113, the error occurrence probability of data in each of the hardware and software included in the data flow as a partial error occurrence probability. Dedicated hardware may be applied to the processing circuit 81, or a processor that executes a program stored in a memory may be applied. Processors include, for example, central processing units, processing units, arithmetic units, microprocessors, microcomputers, and DSPs (Digital Signal Processors).

If the processing circuit 81 is dedicated hardware, the processing circuit 81 may be, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination of these. Each function of each unit such as the design input unit 101 may be realized by a circuit in which processing circuits are distributed, or the functions of each unit may be collectively realized by one processing circuit.

When the processing circuit 81 is a processor, the functions of the design input unit 101 and the like are realized by combining with software and the like. Software and the like correspond to, for example, software, firmware, or software and firmware. Software or the like is written as a program and stored in memory. As shown in FIG. 23, a processor 82 applied to a processing circuit 81 reads out and executes a program stored in a memory 83 to realize the function of each section. That is, when the system design support apparatus 100 is executed by the processing circuit 81, it obtains the system configuration information 111, the data flow information 112, and the H/W abnormality probability information 113; A step of calculating the probability of occurrence of a data failure in each of the hardware and software included in the data flow as a probability of partial failure based on the data flow information 112 and the H/W failure probability information 113. A memory 83 is provided for storing the program to be executed automatically. In other words, this program can be said to cause a computer to execute the procedures and methods of the design input unit 101 and the like. Here, the memory 83 is, for example, a non-volatile or Volatile semiconductor memory, HDD (Hard Disk Drive), magnetic disk, flexible disk, optical disk, compact disk, mini disk, DVD (Digital Versatile Disc), their drive devices, etc., or any storage media that will be used in the future There may be.

The configuration in which each function of the design input unit 101 and the like is realized by either hardware or software has been described above. However, the configuration is not limited to this, and a configuration in which a part of the design input unit 101 and the like is realized by dedicated hardware and another part is realized by software or the like may be used. For example, for the design input unit 101, the function is realized by a processing circuit 81 as dedicated hardware, an interface, a receiver, and the like. It is possible to realize the function by executing

As described above, the processing circuit 81 can implement each of the functions described above by means of hardware, software, etc., or a combination thereof.

In addition, the system design support device described above can also be applied to a system design support system constructed as a system by appropriately combining several devices. In this case, each function or each component of the system design support device described above may be distributed to each device that constructs the system, or may be concentrated in any one of the devices. good.

Note that the embodiment can be modified or omitted as appropriate.

100 system design support device, 101 design input unit, 108 contamination probability information, 109 contamination probability display unit, 110 coping method information, 111 system configuration information, 112 data flow information, 113 H/W abnormality probability information, 121 calculation unit.

Claims

system configuration information indicating the hierarchy of hardware included in the system and software executed by the hardware; data flow information indicating the flow of data in at least part of the system; and data flow in the hardware. an acquisition unit that acquires probability information indicating an abnormality occurrence probability;
Based on the system configuration information, the data flow information, and the probability information, a probability of occurrence of data failure in each of the hardware and the software included in the at least part is calculated as a probability of occurrence of partial failure. A system design support device, comprising: a calculator.
The system design support device according to claim 1,
The calculation unit
Supporting system design by setting a weight for correcting the probability of occurrence of a partial failure based on at least one of length of stay, arithmetic processing, and size in each layer of the data flowing through the at least part Device.
The system design support device according to claim 1 or claim 2,
The acquisition unit
further acquiring coping method information indicating a success rate of compensating for data anomalies in a specific part of the system;
The calculation unit
A system design support device that corrects the partial failure occurrence probability of the specific portion based on the coping method information.
The system design support device according to any one of claims 1 to 3,
The calculation unit
A system design support apparatus for calculating, as a total failure probability, a data failure probability for the entirety of the hardware and software included in the at least part based on the partial failure probability of the at least part. .
The system design support device according to claim 4,
A system design support apparatus, further comprising an output unit that outputs information including at least one of the partial failure probability and the overall failure probability.
The system design support device according to any one of claims 1 to 5,
Coping method learning for learning a combination of decomposed data flow information obtained from the system configuration information and the data flow information, anomaly occurrence probability obtained from the partial anomaly occurrence probability, and a coping method to be implemented in the system. Department and
A new coping method to be additionally implemented in the system is proposed based on the new decomposed data flow information, the probability of anomaly occurrence that can be tolerated in the system, and the learning result of the coping method learning unit. and a coping method proposing unit.
The system design support device according to claim 6,
A first coefficient is set to at least one of the hardware and the software indicated in the system configuration information;
A second coefficient is set to at least one of the hardware and the software representing the coping method,
The calculation unit
A system design support device that obtains a feature amount of the coping method based on the first coefficient and the second coefficient.
system configuration information indicating the hierarchy of hardware included in the system and software executed by the hardware; data flow information indicating the flow of data in at least part of the system; and data flow in the hardware. Acquiring probability information indicating the probability of anomaly occurrence,
Based on the system configuration information, the data flow information, and the probability information, a probability of occurrence of data failure in each of the hardware and the software included in the at least part is calculated as a probability of occurrence of partial failure. , system design support method.
system configuration information indicating the hierarchy of hardware included in the system and software executed by the hardware; data flow information indicating the flow of data in at least part of the system; and data flow in the hardware. an acquisition unit that acquires probability information indicating an abnormality occurrence probability;
Based on the system configuration information, the data flow information, and the probability information, a probability of occurrence of data failure in each of the hardware and the software included in the at least part is calculated as a probability of occurrence of partial failure. a calculation unit;
and an output unit that outputs information based on the partial failure occurrence probability.