Design support apparatus and design support method

Abstract

To provide a design support device and a design support method for highly accurately converting a design in a certain field into a design in another field.SOLUTION: A design support device 1 includes a classification unit 12 that classifies a division content obtained by dividing event information regarding a control system in a certain field into an arbitrary item, a conversion unit 13 that creates a conversion content 203 obtained by converting the arbitrary item in the certain field into another field with reference to conversion information 22 indicating a combination of keywords corresponding to a plurality of fields, a determination unit 14 that determines validity of the conversion content 203 as another field with reference to domain knowledge 23 serving as a reference for determining validity of a content of an event in another field, and an output unit 15 that outputs the conversion content 203 determined to have validity by the determination unit 14.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a design support device and a design support method. [Background technology]

[0002] As background art in this technical field, Patent Document 1 describes its objective as "providing a method for confirming the validity of a probabilistic risk assessment model." As a solution, it describes the following as a solution: "The validation method calculates a first group of clusters by performing clustering based on feature quantities of a first cutset output from a PRA model, calculates feature quantities of a second cutset output from the PRA model to be confirmed, adds the second cutset to the first cutset, and performs clustering based on the feature quantities of the first and second cutsets to calculate a second group of clusters. Based on the first and second cutsets included in each cluster of the second group of clusters and the first cutsets included in the clusters of the first group of clusters corresponding to each of the clusters, corresponding clusters of the first group of clusters and the second group of clusters are compared to identify clusters in the second group of clusters that require confirmation." [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2023-39583 Summary of the Invention [Problem to be solved by the invention]

[0004] Designing a control system requires specialized knowledge of the field (domain) in which the control system is applied. For example, designing with safety in mind (safety design) requires extensive knowledge of the domain in which the safety design is being performed (system behavior, the environment in which it is placed, and its relationship with surrounding systems). Furthermore, safety design also requires knowledge of the safety design itself (typical hazards, risks, and safety design patterns). As a result, a significant amount of work is required by experts in the domain or safety design.

[0005] To address this issue, it is believed that the above-mentioned man-hours can be reduced by applying the results of safety design in a certain domain (e.g., the aerospace field) to the current domain (e.g., the automotive field) that is the target of safety design. However, useful knowledge and design results cannot be obtained simply by replacing words or language. On the other hand, when conversion is performed using generative AI that utilizes LLM (Large Language Model), erroneous conversion results known as hallucination can occur, which can lead to inconsistencies in word correspondence or the output of incorrect results. In safety design, results with low reliability are difficult to tolerate, making such application difficult.

[0006] In Patent Document 1, a second cut set is added to a first cut set to confirm the validity of a risk assessment model, but the process of converting the first cut set (first domain) to the second cut set (second domain) is not realized. As a result, unnecessary items may be mixed in the second domain, which increases the burden of subsequent confirmation processing.

[0007] SUMMARY OF THE INVENTION It is therefore an object of the present invention to provide a design support system and a design support method that converts a design in one field into a design in another field with high accuracy. [Means for solving the problem]

[0008] In order to solve the above problems, the design support device of the present invention has the following means. The present invention includes an input unit for inputting event information related to a control system in a certain field; an identification unit that identifies another field different from the certain field; a classification unit that classifies the divided contents obtained by dividing the event information into arbitrary categories; a conversion unit that refers to conversion information indicating a combination of keywords corresponding to a plurality of fields and creates a conversion content in which the arbitrary item in the one field is converted into the other field; a determination unit that determines the validity of the converted content as the other field by referring to domain knowledge that serves as a standard for determining the validity of the content of the event in the other field; and an output unit that outputs the conversion content that the determination unit determines to be valid. Other means will be described later. [Effects of the Invention]

[0009] According to the present invention, it is possible to provide a design support device and a design support method for converting a design in one field into a design in another field with high accuracy. [Brief explanation of the drawings]

[0010] [Figure 1] 1 is a configuration diagram of a design support device according to an embodiment of the present invention; [Figure 2] FIG. 10 is an explanatory diagram showing an example of syntax data used in processing by a classification unit according to the present embodiment. [Figure 3] 3 is an explanatory diagram showing classification contents output by a classification unit in accordance with the syntax data of FIG. 2 according to the present embodiment. FIG. [Figure 4] 10 is a table showing an example of conversion information according to the present embodiment. [Figure 5] 10A and 10B are explanatory diagrams illustrating examples of conversion results by a conversion unit according to the present embodiment. [Figure 6] FIG. 10 is an explanatory diagram showing an example of domain knowledge used in determination A according to the present embodiment. [Figure 7] 10 is a table showing an example of domain knowledge used in determination B according to the present embodiment. [Figure 8] 10 is a risk value table showing an example of domain knowledge used in determination C according to the present embodiment. [Figure 9] 10 is an occurrence probability table showing an example of domain knowledge used in determination C according to the present embodiment. [Figure 10] FIG. 10 is an explanatory diagram showing an example of domain knowledge of a combination condition used in determination D according to the present embodiment. [Figure 11] 10 is a flowchart illustrating an example of a determination flow in a determination unit according to the present embodiment. [Figure 12] FIG. 10 is an explanatory diagram showing function conversion information according to the present embodiment. [Figure 13] FIG. 10 is an explanatory diagram showing an example of first design knowledge of FTA according to the present embodiment. [Figure 14] 14 is an explanatory diagram showing an example in which the first design knowledge in FIG. 13 according to the present embodiment is converted by a conversion unit. FIG. [Figure 15] FIG. 1 is a hardware configuration diagram of a design support apparatus according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0011] Preferred embodiments of the present invention (Examples 1 and 2) are described below. These embodiments mainly explain an example of converting a forklift case in a domain such as a logistics warehouse operation into an automobile domain, and are suitable for application to safety design cases related to mobility, but do not prevent application to systems other than mobility. Furthermore, this embodiment is not limited to safety design, and does not preclude application to designs for any purpose, such as designs for improving performance or designs for localization to comply with foreign legal systems. [Example]

[0012] FIG. 1 is a configuration diagram of a design support device 1. In the first embodiment, the first design knowledge 21 is in text format. The design support device 1 includes an input unit 10, an identification unit 11, a classification unit 12, a conversion unit 13, a determination unit 14, and an output unit 15. The design support device 1 is a main device of a design support system 100 that can access first design knowledge 21, conversion information 22, domain knowledge 23, and second design knowledge 24. The first design knowledge 21 is information on the design of a control system in a first field (the field before conversion). The second design knowledge 24 is information on the design of a control system in a second field (the field after conversion). Then, by converting the first design knowledge 21 into the second design knowledge 24, the design support device 1 can reuse the knowledge of the first design knowledge 21 as the second design knowledge 24.

[0013] The input unit 10 receives input of the first design knowledge 21. The identification unit 11 identifies the domains before and after conversion (domain conversion from a first field to a second field) in response to a user instruction or the like. Therefore, the identification unit 11 may have a user interface for the user or the like to specify the domain. The classification unit 12 organizes the contents of the first design knowledge 21 according to the format of the syntax data 201 (FIG. 2), and the result is classified contents 202 (FIG. 3). The conversion unit 13 converts the classification content 202 into conversion content 203 (FIG. 5) by using conversion information 22 (FIG. 4) of the domain specified by the identification unit 11. The conversion information 22 is information that associates a keyword indicating an event in a certain field (the field of the first design knowledge 21) with a keyword indicating an event in another field (the field of the second design knowledge 24).

[0014] The determination unit 14 determines the validity of the conversion content 203 using the domain knowledge 23 (such as table 301 in FIG. 6) of the second field specified by the identification unit 11, and removes invalid information from the conversion content 203. The domain knowledge 23 is information that serves as a standard for determining the validity of the content of an event in a predetermined field (the field of the second design knowledge 24) (see FIGS. 6 to 10 for details). The determination unit 14 may also have a user interface for inputting instructions to determine what kind of safety analysis to perform, which will be described later, and to change the determination threshold. The output unit 15 outputs the conversion content 203 output by the determination unit 14 as second design knowledge 24.

[0015] The design support device 1 of FIG. 1 described above is not limited to safety design, but can also be applied to the transfer of design between any fields as follows. The input unit 10 inputs event information (first design knowledge 21) related to a control system in a certain field (first field). The identification unit 11 identifies a field (a second field) different from the given field. The classification unit 12 classifies the divided contents obtained by dividing event information related to a control system in a certain field into arbitrary items (classification contents 202). The conversion unit 13 refers to conversion information 22 indicating combinations of keywords corresponding to a plurality of fields, and creates conversion content 203 in which an arbitrary item in a certain field is converted into another field. The determining unit 14 determines the validity of the converted content 203 in another field by referring to the domain knowledge 23 that serves as a standard for determining the validity of the content of the event in another field. The output unit 15 outputs the conversion content 203 (second design knowledge 24) that the determining unit 14 has determined to be valid.

[0016] Each component of the design support device 1 will be described in detail below. The input unit 10 externally imports the first design knowledge 21. Examples of the first design knowledge 21 include the following. - Listing accident cases (hazards, events) in a certain domain in natural language - Natural language of safety analysis results (e.g., risk assessment results including hazard sources / hazardous events / risk values / required safety levels / risk reduction measures or design examples of safety mechanisms) - Semi-formal notation (results of FTA: Fault Tree Analysis, FMEA: Failure Mode and Effects Analysis, etc.), formal notation, or safety design details (safety mechanisms and safety requirements)

[0017] Furthermore, when language processing is performed internally, the following is also included as part of the first design knowledge 21. -Original data of large-scale language models that are input to LLM (Large Language Model) Data for fine tuning the original data Data for RAG (Retrieval Augmented Generation)

[0018] The identification unit 11 receives the data received from the input unit 10 and the domain instruction from the user, and identifies the domains before and after conversion of the first design knowledge 21. Then, the identification unit 11 selects appropriate conversion information 22 and domain knowledge 23 based on the information of the identified domains before and after conversion. In the following, an example will be described in which the first field is accident cases and safety design cases in the logistics field (forklift) domain, and the second field is the automotive field (self-driving vehicles) domain.

[0019] Furthermore, the specifying unit 11 may automatically acquire knowledge of a plurality of related domains by predicting a domain without a user instruction, as follows. · The domain before conversion is automatically determined from the information and keywords contained in the input first design knowledge 21 information. - Guess the domain after conversion (since it is the same mobility, the automotive domain is selected assuming autonomous driving). Select from the Domain Knowledge 23 tables (before and after conversion) described below.

[0020] FIG. 2 is an explanatory diagram showing an example of syntax data 201 used in the processing of the classification unit 12. As shown in FIG. The syntax data 201 clearly classifies examples of safety-related injuries and organizes them as follows, for example: -Indicating the circumstances under which the accident occurred, in the format "Circumstances: While (actor) is (event)" -Indicating the cause of the accident, in the format "Cause: (Actor) did (Event)" -Indicating the result of an accident (accident), in the form "Result: (actor) was (dead or injured)" In particular, by clearly stating and organizing the content in the form of "actors" and "events," the format will be designed to facilitate the conversion described below. Note that the "hazard" of an accident is a state in which there is a risk that an accident may occur, and indicates the circumstances in which the accident occurred and the cause of the accident.

[0021] Furthermore, the classification unit 12 may use the syntax data 201B of an accident involving property instead of or in addition to the syntax data 201 of an accident involving property. In the syntax data 201B of an accident involving property, the result of the accident is replaced with the format "(asset) was (damaged)." Then, the classification unit 12 inputs the following command (prompt) into an interactive AI service such as ChatGPT (registered trademark) provided by OpenAI, Inc., and converts the output data from the AI ​​service into classification content 202 in Figure 3. "Please summarize each sentence in the first design knowledge 21 so that it conforms to the syntax data 201."

[0022] In this way, the classification unit 12 reads as syntax data 201 a combination of an actor, which is the entity that causes the cause of the event, and an event that indicates the actor's behavior, as well as a first element that indicates the situation or cause of the event, and a second element that indicates the state of the actor as a result of the event. Then, the classification unit 12 creates classification contents 202 by executing a process of summarizing the sentences of the first design knowledge 21 so as to conform to the syntax data 201 .

[0023] As a result, the classification unit 12 classifies the divided contents obtained by dividing event information related to a control system in a certain field into arbitrary items (classification contents 202). The division process here is a process of dividing event information including multiple cases into individual cases. Then, the classification unit 12 classifies the combination of an actor, which is the entity that causes the cause of the event, a first element that indicates the situation or cause of the event by combining it with an event that indicates the actor's behavior, and a second element that indicates the state of the actor as a result of the event, as an arbitrary item.

[0024] FIG. 3 is an explanatory diagram showing classification contents 202 output by the classification unit 12 in accordance with the syntax data 201 of FIG. As shown in FIG. 3, the classification contents 202 include five cases (first case to fifth case). The classification method here is not limited to the above information, but for example, in the case of accidents, classification can be done by accident classification etc. to make the relationships between each more clear (Tree of Thought). By doing so, each description is organized and it becomes easier to satisfy the judgment by the judgment unit described later.

[0025] FIG. 4 is a table showing an example of the conversion information 22. The conversion unit 13 converts the classification content 202 into a second field using the conversion information 22 for the domain output by the identification unit 11 for the output of the classification unit 12. Conversion information 22 shows combinations of keywords corresponding to domain A (logistics: forklift) before conversion and domain B (automobile: autonomous driving) after conversion, separated into actors and events to which the combinations are applied. For example, conversion information 22 shows that a worker in domain A is replaced with a pedestrian in domain B.

[0026] FIG. 5 is an explanatory diagram showing an example of the conversion result by the conversion unit 13. The conversion unit 13 uses conversion information 22 (FIG. 4) to convert the classified content 202 (FIG. 3) of the classification unit 12 into converted content 203. The converted content 203 includes five cases (first case to fifth case). By using the conversion information 22, which is a table of specific keywords, for conversion, it is possible to prevent a word from not being converted into a keyword because it is unclear which word should be converted into a keyword, or to prevent an inaccurate keyword conversion from being performed. On the other hand, there is a possibility that the converted content 203 may contain inappropriate content if keyword conversion is simply performed based on the conversion information 22. Therefore, the determination unit 14, which will be described later, uses domain knowledge 23 to remove examples of inappropriate content from the converted content 203 after the fact.

[0027] 4, one-to-one conversion information 22 is used, but one-to-N (integer N≧2) conversion information 22 such as "an operator can be converted to both a pedestrian and a driver" may also be used. In that case, N converted cases are created for one case, and unnecessary cases are deleted in the judgment by the judgment unit 14, thereby realizing conversion that takes both cases into consideration.

[0028] The determination unit 14 determines the validity of the converted content 203 output from the conversion unit 13. The validity determination is classified according to the domain knowledge 23 of the converted domain (here, automobiles) used, for example, as follows. [Judgment A] Judgment processing based on domain knowledge 23 (physical structure, logical structure). [Judgment B] Judgment process based on domain knowledge 23 (performance: specifications, operating limits). [Judgment C] Judgment processing based on domain knowledge 23 (risk value, occurrence probability). [Judgment D] Judgment processing based on domain knowledge 23 (combination of mutually contradictory content).

[0029] That is, the determining unit 14 determines the appropriateness of the converted content 203 as the second field based on at least one of the following criteria as the domain knowledge 23: Physical limits of operation ·Logical structure standards Specification standards ·Operating limit criteria - Criteria for the probability of occurrence of risk events · Criteria for the risk level of risk phenomena The decision unit 14 removes the conversion content 203 that does not satisfy at least one of these criteria.

[0030] FIG. 6 is an explanatory diagram showing an example of domain knowledge 23 (physical structure, logical structure) used in determination A. Table 301 shows the domain knowledge 23 of the physical structure. Table 302 shows the domain knowledge 23 of the logical structure. The determination unit 14 refers to the table 301, determines the physical structure of the domain after conversion from the structural parts and hierarchy, and removes the first design knowledge 21 that does not satisfy the conditions from the conversion content 203. Similarly, for the logical structure, if the conversion content 203 describes a function that does not exist in the table 302 for the corresponding domain, the determination unit 14 removes the corresponding content from the conversion content 203.

[0031] As a structure determination process, the determination unit 14 removes from the conversion content 203 any cases that include components (such as lift and mast) that do not exist in the table 301 of the automobile domain. For example, the determination unit 14 determines that the validity of the physical structure domain knowledge 23 is not satisfied because the expression "mast" that exists in the first and fourth cases out of the five cases described in the conversion content 203 of Fig. 5 does not exist in the components of the table 301. Alternatively, the determination unit 14 removes from the conversion content 203 a case where a component (such as a gear) exists in the table 301 of the automobile domain, but the correspondence between the component and the subsystem does not exist in the table 301. For example, the determination unit 14 removes from the conversion content 203 the case where "the control unit controls the gear" does not correspond to the "correspondence between the operation unit and the gear" that exists in the table 301.

[0032] FIG. 7 is a table 303 showing an example of the domain knowledge 23 (performance: specifications, operating limits) used in judgment B. Similarly, if there is a sentence in the first design knowledge 21 that violates the performance requirements listed in the table 303 , the determining unit 14 removes it from the conversion content 203 . Specifically, if an operation requiring a minimum turning radius that cannot be realized by an automobile (such as a pivot turn) is described, the determination unit 14 removes that description from the conversion content 203. The determination unit 14 can also make a similar determination regarding content that can be inferred or estimated from the expression (such as the above-mentioned phrases "pivot turn" and "speed exceeding...") even when the description of the conversion content 203 does not specifically state numerical values.

[0033] FIG. 8 is a risk value table 304 showing an example of the domain knowledge 23 used in judgment C. The determination unit 14 determines whether the description of the converted content 203 is a hazard that is judged to have a sufficiently low risk (not subject to this safety analysis) by checking it against the risk value table 304. If the determination corresponds to not being subject to the risk, the determination unit 14 removes the description of the converted content 203 from the converted content 203 because it is unnecessary even if it is valid. This removal process is performed in cases where the risk value is lower than expected from a safety perspective.

[0034] FIG. 9 is an occurrence probability table 305 showing an example of the domain knowledge 23 used in the determination C. The determination unit 14 determines whether the description of the conversion content 203 has a sufficiently low occurrence probability by referring to the occurrence probability table 305. If the determination corresponds to a low occurrence probability, the determination unit 14 similarly removes the description of the conversion content 203 from the conversion content 203 because the description is unnecessary even if it is valid. The determination unit 14 may refer to the occurrence probability table 305 to determine not only the occurrence probability of a single event but also the occurrence probability of a combination of events. For example, when a low-probability combination of complex traffic conditions, rare bad weather, road conditions, etc. is expressed, the determination unit 14 may exclude the event as the combined occurrence probability is extremely low. This allows the determination unit 14 to make a determination even when multiple conditions overlap.

[0035] FIG. 10 is an explanatory diagram showing 23 examples of domain knowledge of combined conditions used in decision D. The combination table 306 is prepared as follows, showing patterns of combinations that are assumed to be inconsistent in the items of occurrence probability and risk value. - Inconsistencies within the same conditions (summer and winter, etc.) - Conflicts in related conditions (single track and overtaking vehicles) · Inconsistency in causality (dry road despite being outdoors in the rain) Statistical contradiction (highway and many pedestrians) If a combination in the combination table 306 is listed in the conversion content 203, the determination unit 14 also removes it from the conversion content 203.

[0036] In addition, if a risk occurs even with a low probability combination, this may be important information for safety analysis. Taking such cases into consideration, the determination unit 14 may leave, without removing from the conversion content 203, a situation where the risk value in the risk value table 304 is high and the occurrence probability in the occurrence probability table 305 is low. On the other hand, if the risk value in the risk value table 304 is high and there is a contradictory situation described in the combination table 306, the determination unit 14 may remove it from the conversion content 203. To do this, for example, by setting one of the following as a user instruction, it is possible to leave appropriate conversion content 203 depending on the purpose of creating the second design knowledge 24. -If the application requires keeping the risk value up to a low threshold (for example, to support idea generation), set the threshold low, and keep it if the risk value is above that. - For applications where a low threshold value is not to be left (for example, implementing safety analysis and design of a system), set the threshold high, and leave it if it is above that value.

[0037] In this way, the judgment unit 14 judges that the conversion content 203 that meets the criteria for the probability of occurrence of the risk phenomenon but does not meet the criteria for the degree of danger of the risk phenomenon is valid if it corresponds to domain knowledge 23 that indicates a combination of mutually contradictory contents. Furthermore, the determination unit 14 may use the inputted threshold as the threshold for determining whether the standard of the risk level of the risk phenomenon is satisfied.

[0038] FIG. 11 is a flowchart showing an example of a determination flow in the determination unit 14. If the risk is not equal to or greater than the threshold value in the risk value table 304 (No in S101), the determining unit 14 removes the first design knowledge 21 with an extremely low safety risk and which is not important from the conversion content 203 (S102). If the risk is equal to or greater than the threshold value of the risk value table 304 (Yes in S101), the process proceeds to S103. The determination unit 14 refers to the combination table 306, and if the combination is assumed to be contradictory (Yes in S103), removes the first design knowledge 21 assumed to be contradictory from the conversion content 203 (S104).

[0039] On the other hand, if the combination is not contradictory (No in S103), the determination unit 14 leaves the first design knowledge 21, which has a risk value higher than the threshold and is not contradictory, without removing it from the conversion content 203 (S105). This makes it possible to leave only the conversion content 203 necessary for safety analysis and design as the first design knowledge 21. Alternatively, instead of S105, the determining unit 14 may remove the first design knowledge 21 having a low occurrence probability in the occurrence probability table 305 from the conversion content 203.

[0040] Furthermore, examples of the converted domain knowledge 23 referred to by the determination unit 14 may include a table of risk assessment results, in addition to the above. The risk assessment results indicate examples of hazards, situations, risk values, and associated safety measures. Therefore, the determination unit 14 can easily determine the risk values ​​of the output situations and hazards.

[0041] The output unit 15 outputs the content output by the determination unit 14 (content obtained by removing unnecessary descriptions from the converted content 203) as the second design knowledge 24. As the output content, the first design knowledge 21 before and after conversion may be output in a text format using character display, or in a format notation, table format, or the like. That is, the output unit 15 outputs, as the second design knowledge 24, a combination of the first element and the second element of the conversion content 203 that the determining unit 14 has determined to be valid.

[0042] In addition, the output unit 15 may output at least one of the conversion information 22 (Figure 4) used by the conversion unit 13 to create the converted content 203 before validity judgment and the domain knowledge 23 used by the judgment unit 14 to create the content after unnecessary descriptions have been removed from the converted content 203, together with the second design knowledge 24 (the converted content 203 output by the output unit 15). In particular, since information related to the judgment is important, the output unit 15 also outputs the removed information and the reason for the removal (determination content of the judgment unit 14) as necessary. This allows the user to confirm how the first design knowledge 21 was converted and the reason for it.

[0043] According to the first embodiment described above, the classification unit 12 formalizes the description in natural language of the first design knowledge 21 in the first field into a description in accordance with the syntax data 201, thereby performing preprocessing so that the conversion unit 13 can perform conversion with high accuracy. The conversion unit 13 refers to conversion information 22 that associates the first field with the second field, and generates conversion content 203 by converting the first design knowledge 21 in the first field into the second field. The determination unit 14 refers to the domain knowledge 23 of "structure, risk value, occurrence probability, etc." in the second field to determine the validity of the converted content 203. As a result, information determined to be invalid is removed from the converted content 203, and valid second design knowledge 24 can be output from the output unit 15.

[0044] Furthermore, the determination unit 14 may take into consideration a combination of multiple domain knowledge 23 (a combination of one or more of the risk value table 304, the occurrence probability table 305, and the combination table 306). This allows the determination unit 14 to remove, for example, content with a very low occurrence probability or contradictory content from the converted content 203. Conversely, the determination unit 14 can leave only useful content that poses a risk even if the occurrence probability is very low, by reflecting user instructions as necessary. [Example]

[0045] In the second embodiment, a case will be described in which the first design knowledge 21 is in a format other than text (semi-formal notation: FTA / FMEA, etc.). In this case, classification, conversion, and judgment are performed in the same way as in the case of the text format in the first embodiment, but some of the content is different. Therefore, the input unit 10 receives the first design knowledge 21 (event information related to a control system in a certain field) as an FTA or FMEA having a tree structure in which nodes indicating at least one of actors and events are connected by links.

[0046] FIG. 12 is an explanatory diagram showing the function conversion information 450. Function correspondence data 400, which is an example of the conversion information 22, indicates the correspondence between a forklift automatic driving function 410 before conversion and an automobile automatic driving function 420 after conversion. As an example of the functions of the first design knowledge 21 before conversion, an automatic forklift driving function 410 has a recognition function 411, a judgment function 412, a vehicle body operation function 413, and a lift operation function 414. As an example of the functions of the second design knowledge 24 after conversion, an automatic automobile driving function 420 has a cognitive function 421, a judgment function 422, and a motor function 423.

[0047] The function conversion information 450, which is an example of the conversion information 22, is a table showing the correspondence relationship for each function described in the function correspondence data 400. The conversion unit 13 targets functions (such as the cognitive function 411 and the cognitive function 421) that correspond to each other in the function conversion information 450 between the domain A (automatic forklift driving function 410) and the domain B (automatic automobile driving function 420). On the other hand, functions that do not correspond to each other in the function conversion information 450 (such as the lift operation function 414) are not targets for conversion by the conversion unit 13, and are removed from the output of the conversion unit 13.

[0048] FIG. 13 is an explanatory diagram showing an example of the first design knowledge 21 of the FTA. The input unit 10 receives input of the first design knowledge 21 of the FTA shown in Fig. 13. Each node of this first design knowledge 21 indicates a Failure, a Fault, etc., and the contents are written in a natural language. Furthermore, each node of the FTA is connected to other nodes via logical symbols. For example, a transition symbol 505 is written below the node 503 "object entering forklift trajectory cannot be avoided." This indicates that an FTA (not shown) other than that in Figure 13 exists and is connected to the FTA in Figure 13 via the transition symbol 505.

[0049] 13, the "distance between forklift and worker is less than a certain value" node 501 is the top node indicating the top event (hazard). Nodes 502, 503, 504, 505, 506, 507, 508, 509, 510, 511, 512, 513, 514, 515, 516, 517, 518, 519, 520, 521, 522, 523, 524, 525, 526, 527, 528, 529, 530, 531, 532, 533, 534, 535, 536, 537, 538, 539, 540, 541, 542, 543, 544, 545, 546, 547, 548, 549, 550, 551, 552, 553, 554, 555, 556, 557, 558, 559, 560, 561, 562, 563, 564, 565, 566, 567, 568, 569, 570, 571, 572, 573, 574, 575, 576, 577, 578, 579, 580, 581, 582, 583, 584, 585, 586, 587, 588, 589, 590, 600, 609, 691, 692, 693, This defines that when an event at node 502 or an event at node 503 occurs, it is considered that an event at node 501 has occurred.

[0050] As in the first embodiment, the classification unit 12 converts the inputted first design knowledge 21 into the short sentence format shown in each node in Fig. 13 by summarizing the inputted first design knowledge 21 so that it conforms to the syntax data 201. Alternatively, in the second embodiment, when the first design knowledge 21 is inputted, it is already in a semi-formal notation that facilitates data processing, so the processing by the classification unit 12 may be omitted. When the first design knowledge 21 received by the input unit 10 is information including actors and events, the conversion unit 13 performs conversion using the conversion information 22 (function conversion information 450 in Figure 12) specified by the identification unit 11, as in the case of Example 1.

[0051] FIG. 14 is an explanatory diagram showing an example in which the conversion unit 13 converts the first design knowledge 21 of FIG. The description of each node in the FTA in FIG. 14 is the result of conversion performed by the conversion unit 13 on actors and events, as in the first embodiment. On the other hand, on the right side of Fig. 14, there are also nodes and logical symbols indicated by dashed lines. These dashed nodes and logical symbols have been removed by the determination unit 14 after determining that they are invalid based on the validity of the domain knowledge 23. For example, the "Lift operation function malfunctions for the worker" node 511 in Fig. 14 is set as the upper node, and the determination unit 14 removes multiple pieces of related information because if the upper node is invalid, the lower nodes (nodes 512, 513, etc.) are also invalid.

[0052] That is, in addition to the upper node in the tree structure for which the validity of the conversion content 203 has been determined to be invalid, the determining unit 14 also determines the validity of the nodes below that upper node to be invalid. In this way, the conversion unit 13 can appropriately remove information that is not used in the converted domain from the information described semi-formally. Even when the first design knowledge 21 is in semi-formal notation, the first design knowledge 21 in the first field can be converted into the second design knowledge 24 in the second field by performing almost the same process on the other contents.

[0053] The output unit 15 displays, as second design knowledge 24, a display screen (FIG. 14) of a tree structure of nodes and links indicating the conversion content 203 that the determining unit 14 has determined to be valid.

[0054] Furthermore, while Figures 13 and 14 show the structure of an FTA (Deductive Analysis) as a semi-formal notation, it is also possible to apply the structure of an FMEA (Inductive Analysis), which is a reverse representation of the FTA structure. In this case, the tree structure made up of nodes and links is common to both FTA and FMEA, and the nodes contained in this tree structure are also common to both FTA and FMEA. In that case, by making the same judgment as for FTA at the common nodes in the structure traced from the Failure Mode, the common parts can be similarly deleted.

[0055] Here, we will explain the FMEA structure assuming that the Failure mode that is the starting point of the analysis is the "pedestrian recognition error" node (node ​​513 in Fig. 14). In this case, the Failure via the higher-level gate to the "pedestrian recognition error" node is the "mistake in instruction of lift operation value" node (node ​​512 in Fig. 14). Furthermore, we will assume that the FMEA is organized in a structure where the Failure via the higher-level gate is the "lift operation function malfunctions for the worker" node (node ​​511 in Fig. 14). At this time, as explained in FIG. 14, since the “Lift operation function malfunctions for the worker” node 511 has been removed as the upper node, the judgment unit 14 can delete all the information on Failure mode related to each lower node (nodes 512, 513, etc.) relative to that upper node.

[0056] FIG. 15 is a hardware configuration diagram of the design support device 1. As shown in FIG. The design support device 1 is configured as a computer 900 having a CPU 901 , a RAM 902 , a ROM 903 , a HDD 904 , a communication I / F 905 , an input / output I / F 906 , and a media I / F 907 . The communication I / F 905 is connected to an external communication device 915. The input / output I / F 906 is connected to an input / output device 916. The media I / F 907 reads and writes data from a recording medium 917. Furthermore, the CPU 901 controls each processing unit by executing a program (also called an application or an app for short) loaded into the RAM 902. This program can also be distributed via a communication line or recorded on a recording medium 917 such as a CD-ROM and distributed.

[0057] According to the second embodiment described above, even if the first design knowledge 21 has a semi-formal structure (FTA or FMEA), the design support device 1 can convert it into the second design knowledge 24. During this conversion, the determination unit 14 performs a detailed examination according to the semi-formal structure, and further makes effective use of the fact that it is in the form of a tree structure, thereby efficiently determining the validity in a manner similar to pruning.

[0058] Furthermore, the present invention is not limited to the above-described embodiments, and various other applications and modifications are possible without departing from the spirit of the present invention as defined in the claims. For example, the above-described embodiments provide a detailed and specific description of the configuration of the design support device 1 in order to clearly explain the present invention, and the present invention is not necessarily limited to a system including all of the components described above. Furthermore, it is possible to replace part of the configuration of one embodiment with a component of another embodiment. It is also possible to add a component of another embodiment to the configuration of one embodiment. It is also possible to add, replace, or delete other components from part of the configuration of each embodiment.

[0059] Furthermore, the above-described configurations, functions, processing units, etc. may be partially or entirely implemented in hardware, for example, by designing them as integrated circuits. As the hardware, a broad processor device such as an FPGA (Field Programmable Gate Array) or an ASIC (Application Specific Integrated Circuit) may be used. Furthermore, each component of the design support device 1 according to the above-described embodiment may be implemented in any hardware as long as the respective hardware can transmit and receive information to and from each other via a network. Furthermore, the processing executed by a certain processing unit may be realized by a single piece of hardware, or may be realized by distributed processing using multiple pieces of hardware. [Explanation of symbols]

[0060] 1 Design support equipment 10 Input section 11 Specific section 12 Classification section 13 Conversion unit 14 Judgment section 15 Output section 21 First Design Knowledge 22 Conversion Information 23 Domain Knowledge 24 Second Design Knowledge 100 Design Support System 201 Syntax Data 202 Classification content 203 Conversion Contents

Claims

1. an input unit for inputting event information related to a control system in a certain field; an identification unit that identifies another field different from the certain field; a classification unit that classifies the divided contents obtained by dividing the event information into arbitrary categories; a conversion unit that refers to conversion information indicating a combination of keywords corresponding to a plurality of fields and creates a conversion content in which the arbitrary item in the one field is converted into the other field; a determination unit that determines the validity of the converted content as the other field by referring to domain knowledge that serves as a standard for determining the validity of the content of the event in the other field; an output unit that outputs the conversion content that the determination unit determines to be valid. Design support equipment.

2. The classification unit classifies, as the arbitrary item, a combination of a first element indicating the situation or cause of the event by combining an actor that is the subject causing the cause of the event with an event that indicates the operation content of the actor, and a second element indicating the state of the actor as a result of the event. The design support device according to claim 1 .

3. The output unit outputs a combination of the first element and the second element of the conversion content that the determination unit determines to be valid. The design support device according to claim 2.

4. The input unit receives the event information as FTA (Fault Tree Analysis) or FMEA (Failure Mode and Effects Analysis), which is a tree structure in which nodes indicating at least one of the actors and the events are connected by links. The design support device according to claim 2.

5. The determination unit determines the validity of the conversion content of the upper node in the tree structure as invalid, and also determines the validity of the lower nodes from the upper node as invalid. The design support device according to claim 4.

6. The determining unit determines the validity of the converted content as the other field based on at least one of the following criteria as the domain knowledge: a standard for physical limits of operation, a standard for logical structure, a standard for specifications, a standard for operational limits, a standard for the probability of occurrence of a risk phenomenon, and a standard for the degree of danger of a risk phenomenon. The design support device according to claim 1 .

7. The determination unit is characterized in that, when the conversion content that satisfies the criterion of the occurrence probability of the risk phenomenon and does not satisfy the criterion of the risk level of the risk phenomenon corresponds to the domain knowledge that indicates a combination of mutually contradictory contents, the determination unit determines that the conversion content is valid. The design support device according to claim 6.

8. The determination unit determines whether the risk phenomenon satisfies a standard of the degree of risk by setting the threshold value that is received as an input. The design support device according to claim 7.

9. The output unit displays a display screen of the tree structure of nodes and links indicating the conversion content that the determination unit has determined to be valid. The design support device according to claim 5.

10. The output unit outputs at least one of the conversion information used by the conversion unit to create the converted content and the domain knowledge used by the determination unit to create the converted content together with the converted content. The design support device according to claim 1 .

11. The design support device includes an input unit, an identification unit, a classification unit, a conversion unit, a determination unit, and an output unit, the input unit inputs event information related to a control system in a certain field; The identification unit identifies another field different from the certain field, the classification unit classifies the divided contents obtained by dividing the event information into arbitrary items, the conversion unit refers to conversion information indicating a combination of keywords corresponding to a plurality of fields, and creates a conversion content in which the arbitrary item in the one field is converted into the other field; the determination unit determines the validity of the converted content as the other field by referring to domain knowledge that serves as a standard for determining the validity of the content of the event in the other field; The output unit outputs the conversion content that the determination unit determines to be valid. Design support method.

Images