System and method for fault identification in an electronic system based on context-based alarm analysis

• US 7,680,753 B2
• Filed: 03/02/2006
• Issued: 03/16/2010
• Est. Priority Date: 07/10/2002
• Status: Expired due to Fees

• Current Assignee: Tech Mahindra Limited
• Original Assignee: Satyam Computer Services Limited (Tech Mahindra Limited)
• Inventors: Sridhar, Varadarajan, Sudhindra, Veena, Rao, K. Kalyana, Sridhar, Gangadharapali
• Primary Examiner(s): Vincent, David R
• Assistant Examiner(s): Fernandez Rivas, Omar F
• Application Number:
  US11/365,927
• Publication Number:
  US 20060149990A1
• Time in Patent Office: 1,475 Days
• Field of Search: 706 45- 50, 706/61, 706/14, 706/15, 706/911, 714/2, 714/4, 714/5, 714/25, 714/26, 714 30- 31, 714 37- 39, 714 48- 49
• US Class Current: 706/45
• CPC Class Codes: H04L 1/22 using redundant apparatus to increase reliability

Abstract

A fault identification system analyzes alarm information and the associated contextual information to identify the occurred faults. The contextual information is based on usecases, transactions, and functions associated with the electronic system under consideration. Multiple detectors that form part of knowledge repositories are used in the process of fault identification.

Claims

1. A fault identification system, for efficiently identifying a plurality of faults occurring in a core electronic system during an epoch cycle and localizing said plurality of faults to a plurality of faulty software components and a plurality of faulty hardware blocks, by analyzing a plurality of alarms occurred during said epoch cycle using a plurality of contexts associated with said plurality of alarms so as to reduce the ambiguity and complexity arising due to the enormity of said plurality of alarms, and said fault identification system comprises:

a plurality of associated functions, wherein each of said plurality of associated functions is a part of said core electronic system;

a plurality of usecase detectors for detecting a plurality of usecases;

a plurality of transaction detectors for detecting a plurality of transactions;

a plurality of plurality of symptom detectors detecting a plurality of symptoms;

a plurality of fault detectors for detecting said plurality of faults;

an online contextual information collection subsystem, CIC, for collecting said plurality of alarms and for generating said plurality of contexts associated with said plurality of alarms based on said plurality of usecase detectors, said plurality of transaction detectors, said plurality of plurality of symptom detectors, and said plurality of fault detectors, wherein a context of said plurality of contexts comprises a usecase of said plurality of usecases, a transaction of said plurality of transactions, and a function of said plurality of associated functions;

an online global reasoning engine subsystem, GRE, for identifying and localizing a plurality of identified faults of said plurality of faults based on said plurality of alarms and said plurality of contexts associated with said plurality of alarms resulting in said plurality of faulty software components and said plurality of faulty hardware blocks; and

an offline supervised training subsystem, SS, for training said plurality of usecase detectors, said plurality of transaction detectors, said plurality of plurality of symptom detectors, and said plurality of fault detectors.

2. The system of claim 1, wherein said core electronic system is a computer system or a computer network system and further comprises:

a plurality of software components, wherein each of said plurality of faulty software components is a part of said plurality of software components;

a plurality of hardware blocks, wherein each of said plurality of faulty hardware blocks is a part of said plurality of hardware blocks;

a plurality of soft variables that form part of a monitor space associated with said core electronic system;

a plurality of hard variables that form part of a signal space associated with said core electronic system;

said plurality of usecases;

said plurality of transactions;

said plurality of associated functions;

said plurality of symptoms, and;

said plurality of faults; and

said core electronic system is associated with a plurality of epochs, wherein said epoch cycle is a part of a plurality of epoch cycles of an epoch of said plurality of epochs.

3. The system of claim 2, wherein each of said plurality of usecase detectors is associated with a particular epoch of said plurality of epochs.

4. The system of claim 2, wherein each of said plurality of transaction detectors is associated with a particular epoch of said plurality of epochs.

5. The system of claim 2, wherein a symptom detector of a plurality of symptom detectors of said plurality of plurality of symptom detectors is associated with a symptom of said plurality of symptoms and said plurality of symptom detectors is associated with an epoch of said plurality of epochs.

6. The system of claim 2, wherein each of said plurality of fault detectors is associated with a particular epoch of said plurality of epochs.

7. The system of claim 2, wherein said CIC subsystem comprises a procedure to identify a context of said plurality of contexts associated with an alarm of said plurality of alarms raised in said epoch cycle, said procedure comprising:

means for obtaining said epoch of said plurality of epochs associated with said epoch cycle;

means for determining a plurality of plurality of usecase related soft variables centroid values;

means for finding a plurality of plurality of usecase related hard variables centroid values;

means for determining a plurality of plurality of transaction related soft variables centroid values;

means for finding a plurality of plurality of transaction related hard variables centroid values;

means for obtaining a usecase detector associated with said epoch based on said plurality of usecase detectors;

means for obtaining a transaction detector associated with said epoch based on said plurality of transaction detectors;

means for identifying said usecase associated with said context based on said usecase detector, said plurality of plurality of usecase related soft variables centroid values, and a plurality of plurality of usecase related hard variables centroid values;

means for identifying said transaction associated with said context based on said transaction detector, said plurality of plurality of transaction related soft variables centroid values, and said plurality of plurality of transaction related hard variables centorid values;

means for obtaining an execution snapshot associated with said alarm; and

means for identifying said function associated with said context based on said execution snapshot.

8. The system of claim 7, wherein said means for determining further comprising:

means for obtaining a plurality of epoch specific soft variables associated with said epoch based on said plurality of soft variables;

means for obtaining a plurality of plurality of soft variables values associated with said plurality of epoch specific soft variables during said plurality of epoch cycles of said epoch, wherein each plurality of soft variables values of said plurality of plurality of soft variables values is associated with a variable of said plurality of epoch specific soft variables;

means for clustering each plurality of soft variables values of said plurality of plurality of soft variables values into a pre-defined number of clusters resulting in a plurality of clustered soft variables values of a plurality of plurality of clustered soft variables values;

means for computing centroid of each cluster of a plurality of clustered soft variables values of said plurality of plurality of clustered soft variables values resulting in a plurality of plurality of soft variables centroid values;

means for determining said plurality of plurality of usecase related soft variables centroid values based on said usecase and said plurality of plurality of soft variables centroid values; and

means for determining said plurality of plurality of transaction related soft variables centroid values based on said transaction and said plurality of plurality of soft variables centroid values.

9. The system of claim 7, wherein said means for finding further comprises:

means for obtaining a plurality of epoch specific hard variables associated with said epoch based on said plurality of hard variables;

means for obtaining a plurality of plurality of hard variables values associated with said plurality of epoch specific hard variables during said epoch cycles of said epoch, wherein each plurality of hard variables values of said plurality of plurality of hard variables values is associated with a variable of said plurality of epoch specific hard variables;

means for clustering of each plurality of hard variables values of said plurality of plurality of hard variables values into a pre-defined number of clusters resulting in a plurality of clustered hard variables values of a plurality of plurality of clustered hard variables values;

means for computing of centroid of each cluster of a plurality of clustered hard variables values of said plurality of plurality of clustered hard variables values resulting in a plurality of plurality of hard variables centroid values;

means for determining said plurality of plurality of usecase related hard variables centroid values based on said usecase and said plurality of plurality of clustered hard variables centroid values; and

means for determining said plurality of plurality of transaction related hard variables centroid values based on said transaction and said plurality of plurality of clustered hard variables centroid values.

10. The system of claim 2, wherein said GRE subsystem further comprises a procedure to identify a fault of said plurality of faults occurred during said epoch cycle, and said procedure further comprises:

means for obtaining said epoch of said plurality of epochs associated with said epoch cycle;

means for obtaining said plurality of alarms;

means for obtaining said plurality of contexts associated with said plurality of alarms;

means for determining a plurality of detected symptoms;

means for obtaining a fault detector of said plurality of fault detectors based on said epoch;

means for determining a score associated with said fault based on said plurality of contexts, said plurality of detected symptoms, and said fault detector; and

means for making said fault a part of said plurality of identified faults if said score exceeds a pre-defined threshold.

11. The system of claim 10, wherein said subsystem further comprises:

means for obtaining a symptom of said plurality of symptoms;

means for obtaining a plurality of symptom detectors, of said plurality of plurality of symptom detectors, associated with said epoch;

means for obtaining a symptom detector of said plurality of symptom detectors based on said symptom;

means for determining a score based on said context, said alarm, said symptom, and said symptom detector; and

means for making said symptom a part of said plurality of detected symptoms if said score exceeds a pre-defined threshold.

12. The system of claim 2, wherein said GRE subsystem further comprises a procedure to localize said plurality of identified faults, said procedure further comprising:

means for obtaining an identified fault of said plurality of identified faults;

means for obtaining a context associated with said identified fault;

means for obtaining a usecase associated with said context;

means for obtaining a transaction associated with said context;

means for obtaining a function associated with said context;

means for determining a plurality of usecase related software components based on said usecase and said plurality of software components;

means for determining a plurality of transaction related software components based on said transaction and said plurality of software components;

means for determining a plurality of function related software components based on said function and said plurality of software components;

means for computing intersection among said plurality of usecase related software components, said plurality of transaction related software components, and said plurality of function related software components, resulting in a plurality of possibly faulty software components; and

means for making each of said plurality of possibly faulty software components a part of said plurality of faulty software components.

13. The system of claim 12, wherein said subsystem further comprises a procedure to localize said plurality of identified faults, said procedure further comprising:

means for obtaining an identified fault of said plurality of identified faults;

means for obtaining a context associated with said identified fault;

means for obtaining a usecase associated with said context;

means for obtaining a transaction associated with said context;

means for obtaining a function associated with said context;

means for determining a plurality of usecase related hardware blocks based on said usecase and said plurality of hardware blocks;

means for determining a plurality of transaction related hardware blocks based on said transaction and said plurality of hardware blocks;

means for determining a plurality of function related hardware blocks based on said function and said plurality of hardware blocks;

means for computing intersection among said plurality of usecase related hardware blocks, said plurality of transaction related hardware blocks, and said plurality of function related hardware blocks, resulting in a plurality of possibly faulty hardware blocks; and

means for making each of said plurality of possibly fault hardware blocks a part of said plurality of faulty hardware blocks.

14. The system of claim 2, wherein said SS subsystem comprises a procedure to train a usecase detector of said plurality of usecase detectors, wherein said usecase detector is associated with an epoch of said plurality of epochs to detect a usecase of said plurality of usecases, said procedure comprising:

means for obtaining said plurality of epoch cycles associated with said epoch;

means for obtaining a plurality of plurality of soft variables values associated with said plurality of soft variables during an epoch cycle of said plurality of epoch cycles of said epoch, wherein each plurality of soft variables values of said plurality of plurality of soft variables values is associated with a variable of said plurality of soft variables;

means for clustering each plurality of soft variables values of said plurality of plurality of soft variables values into a pre-defined number of clusters resulting in a plurality of clustered soft variables values of a plurality of plurality of clustered soft variables values;

means for computing centroid of each cluster of a plurality of clustered soil variables values of said plurality of plurality of clustered soft variables values resulting in a plurality of plurality of soft variables centroid values;

means for obtaining a plurality of plurality of hard variables values associated with said plurality of hard variables based on said epoch cycle of said plurality of epoch cycles of said epoch, wherein each plurality of hard variables values of said plurality of plurality of hard variables values is associated with a variable of said plurality of hard variables;

means for clustering each plurality of hard variables values of said plurality of plurality of hard variables values into a pre-defined number of clusters resulting in a plurality of clustered hard variables values of a plurality of plurality of clustered hard variables values;

means for computing centroid of each cluster of a plurality of clustered hard variables values of said plurality of plurality of clustered hard variables values resulting in a plurality of plurality of hard variables centroid values;

means for obtaining a plurality of usecase specific soft variables of the monitor space associated with said usecase based on said plurality of soft variables of the monitor space;

means for obtaining a plurality of usecase specific hard variables of the signal space associated with said usecase based on said plurality of hard variables of the signal space;

means for determining a plurality of plurality of usecase specific soft variables centroid values based on said plurality of plurality of soft variables centroid values and said plurality of usecase specific soft variables;

means for determining a plurality of plurality of usecase specific hard variables centroid values based on said plurality of plurality of hard variables centroid values and said plurality of usecase specific hard variables; and

means for updating said usecase detector based on based on said plurality of plurality of usecase specific soft variables centroid values, said plurality of plurality of usecase specific hard variables centroid values, and said usecase.

15. The system of claim 14, wherein said subsystem further comprises a procedure to train a transaction detector of said plurality of transaction detectors, wherein said transaction detector is associated with said epoch, to detect a transaction of said plurality of transactions, said procedure comprising:

means for obtaining a plurality of transaction specific soft variables of the monitor space associated with said transaction based on said plurality of soft variables of the monitor space;

means for obtaining a plurality of transaction specific hard variables of the signal space associated with said transaction based on said plurality of hard variables of the signal space;

means for determining a plurality of plurality of transaction specific soft variables centroid values based on said plurality of plurality of soft variables centroid values and said plurality of transaction specific soft variables;

means for determining a plurality of plurality of transaction specific hard variables centroid values based on said plurality of plurality of hard variable centroid values and said plurality of transaction specific hard variables; and

means for updating said transaction detector based on said plurality of plurality of transaction specific soft variables centroid values, said plurality of plurality of transaction specific hard variables centroid values, and said transaction.

16. The system of claim 14, wherein said subsystem further comprises a procedure to train a symptom detector of said plurality of symptom detectors, wherein said symptom detector is associated with said epoch and a symptom of said plurality of symptoms, to detect said symptom, said procedure comprising:

means for setting up hardware and software conditions to observe said symptom with respect to said epoch during execution of said core electronic system;

means for obtaining an alarm of said plurality of alarms generated by said core electronic system during said epoch cycle;

means for obtaining a context of said plurality of contexts based on said alarm; and

means for updating said symptom detector based on said context, said alarm, and said symptom.

17. The system of claim 14, wherein said subsystem further comprises a procedure to train a fault detector of said plurality of fault detectors, wherein said fault detector is associated with said epoch, to detect a fault of said plurality of faults, wherein said procedure comprising:

means for setting up hardware and software conditions to observe said fault with respect to said epoch during execution of said core electronic system;

means for obtaining said plurality of alarms generated by said core electronic system during said epoch cycle;

means for obtaining said plurality of contexts;

means for determining a plurality of fault related symptoms based on said plurality of symptom detectors, said plurality of contexts, and said plurality of alarms, wherein each of said plurality of fault related symptoms is a part of said plurality of symptoms; and

means for updating said fault detector based on said plurality of contexts, said plurality of fault related symptoms, and said fault.