Design aid device and design aid method

Abstract

A design aid device (1) is provided with: a classification unit (12) that classifies divided content into arbitrary items, the divided content being obtained by dividing event information concerning a control system in a certain field; a conversion unit (13) that creates converted content (203) by converting the arbitrary items in the certain field into those in another field with reference to conversion information (22) indicating combinations of keywords corresponding across a plurality of fields; a determination unit (14) that determines the validity of the converted content (203) as the other field with reference to domain knowledge (23) serving as criteria for determining the validity of the content of events in the other field; and an output unit (15) that outputs the converted content (203) determined to have validity by the determination unit (14).

Description

Design support device and design support method

[0001] The present invention relates to a design support device and a design support method.

[0002] As background art in this technical field, Patent Literature 1 describes an object of "providing a method for confirming the validity of a probabilistic risk assessment model." As a solution, it describes the following: "The validation method performs clustering based on feature quantities of a first cutset output from a PRA model to calculate a first cluster group, calculates feature quantities of a second cutset output from a PRA model to be confirmed, adds the second cutset to the first cutset, performs clustering based on the feature quantities of the first and second cutsets, and calculates a second cluster group. Based on the first and second cutsets included in each cluster of the second cluster group and the first cutsets included in the clusters of the first cluster group corresponding to each of the clusters, corresponding clusters of the first cluster group and the second cluster group are compared to identify clusters in the second cluster group that require confirmation."

[0003] JP 2023-39583 A

[0004] Designing a control system requires specialized knowledge of the field (domain) in which the control system is applied. For example, designing with safety in mind (safety design) requires extensive knowledge of the domain in which the safety design is being performed (system behavior, the environment in which it is placed, and its relationship with surrounding systems). Furthermore, safety design also requires knowledge of the safety design itself (typical hazards, risks, and safety design patterns). As a result, a large amount of work is required from experts in the domain or safety design.

[0005] To address this issue, it is believed that the above-mentioned man-hours can be reduced by applying the results of safety design in a certain domain (e.g., the aerospace field) to the current domain (e.g., the automotive field) that is the target of safety design. However, useful knowledge and design results cannot be obtained by simply replacing words or languages. On the other hand, when conversion is performed using generative AI that utilizes LLM (Large Language Model), erroneous conversion results known as hallucination may occur, causing inconsistencies in word correspondence or outputting incorrect results. In safety design, results with low reliability are difficult to tolerate, making such application difficult.

[0006] In Patent Document 1, a second cut set is added to a first cut set to confirm the validity of a risk assessment model, but the process of converting the first cut set (first domain) to the second cut set (second domain) is not realized. As a result, unnecessary items may be mixed in the second domain, which increases the burden of subsequent confirmation processing.

[0007] SUMMARY OF THE INVENTION It is therefore an object of the present invention to provide a design support system and a design support method that converts a design in one field into a design in another field with high accuracy.

[0008] In order to solve the above problems, the design support device of the present invention has the following means. The present invention is characterized by comprising an input unit that inputs event information related to a control system in a certain field, an identification unit that identifies a field different from the certain field, a classification unit that classifies the divided contents obtained by dividing the event information into arbitrary items, a conversion unit that creates converted contents by converting the arbitrary item in the certain field into the other field by referring to conversion information indicating a combination of keywords corresponding in multiple fields, a determination unit that determines the validity of the converted contents as the other field by referring to domain knowledge that serves as a standard for determining the validity of the event contents in the other field, and an output unit that outputs the converted contents that the determination unit determines to be valid. Other means will be described later.

[0009] According to the present invention, it is possible to provide a design support device and a design support method for converting a design in one field into a design in another field with high accuracy.

[0010] 13 is a block diagram of a design support device according to the present embodiment. FIG. 14 is an explanatory diagram showing an example of syntax data used in processing by a classification unit according to the present embodiment. FIG. 15 is an explanatory diagram showing classification contents output by the classification unit according to the syntax data of FIG. 2 according to the present embodiment. FIG. 16 is a table showing an example of conversion information according to the present embodiment. FIG. 17 is an explanatory diagram showing an example of a conversion result by the conversion unit according to the present embodiment. FIG. 18 is an explanatory diagram showing an example of domain knowledge used in judgment A according to the present embodiment. FIG. 19 is a table showing an example of domain knowledge used in judgment B according to the present embodiment. FIG. 19 is a risk value table showing an example of domain knowledge used in judgment C according to the present embodiment. FIG. 19 is an occurrence probability table showing an example of domain knowledge used in judgment C according to the present embodiment. FIG. 19 is an explanatory diagram showing an example of domain knowledge of a combination condition used in judgment D according to the present embodiment. FIG. 19 is a flowchart showing an example of a judgment flow in a judgment unit according to the present embodiment. FIG. 19 is an explanatory diagram showing function conversion information according to the present embodiment. FIG. 19 is an explanatory diagram showing an example of first design knowledge of FTA according to the present embodiment. FIG. 19 is an explanatory diagram showing an example of conversion of the first design knowledge of FIG. 13 by the conversion unit according to the present embodiment. FIG. 19 is a hardware block diagram of a design support device according to the present embodiment.

[0011] Preferred embodiments of the present invention (Examples 1 and 2) will be described below. This embodiment mainly describes an example of converting a forklift in a domain such as logistics warehouse work into the automobile domain, and is suitable for application to safety design examples related to mobility, but does not preclude application to systems other than mobility. Furthermore, this embodiment is not limited to safety design, and does not preclude application to any design purpose, such as design for performance improvement or design for localization to conform to foreign legal systems.

[0012] FIG. 1 is a configuration diagram of a design support device 1. In Example 1, the first design knowledge 21 is in text format. The design support device 1 includes an input unit 10, an identification unit 11, a classification unit 12, a conversion unit 13, a determination unit 14, and an output unit 15. The design support device 1 is a main device of a design support system 100 that can access the first design knowledge 21, conversion information 22, domain knowledge 23, and second design knowledge 24. The first design knowledge 21 is information about the design of a control system in a first field (the field before conversion). The second design knowledge 24 is information about the design of a control system in a second field (the field after conversion). The design support device 1 converts the first design knowledge 21 into the second design knowledge 24, thereby enabling the knowledge of the first design knowledge 21 to be reused as the second design knowledge 24.

[0013] The input unit 10 accepts input of the first design knowledge 21. The identification unit 11 identifies the domains before and after conversion (domain conversion from the first field to the second field) in response to a user instruction or the like. For this reason, the identification unit 11 may have a user interface that allows the user or the like to specify the domain. The classification unit 12 organizes the contents of the first design knowledge 21 in accordance with the format of the syntax data 201 ( FIG. 2 ) and generates the result as classified content 202 ( FIG. 3 ). The conversion unit 13 converts the classified content 202 into converted content 203 ( FIG. 5 ) using conversion information 22 ( FIG. 4 ) of the domain specified by the identification unit 11. The conversion information 22 is information that associates keywords indicating events in a certain field (the field of the first design knowledge 21) with keywords indicating events in another field (the field of the second design knowledge 24).

[0014] The determination unit 14 determines the validity of the conversion content 203 using the domain knowledge 23 (such as table 301 in FIG. 6 ) of the second field specified by the identification unit 11, and removes invalid information from the conversion content 203. The domain knowledge 23 is information that serves as a reference for determining the validity of the content of an event in a predetermined field (the field of the second design knowledge 24) (see FIGS. 6 to 10 for details). The determination unit 14 may also have a user interface for inputting instructions to determine what kind of safety analysis to perform (described later) or to change the determination threshold. The output unit 15 outputs the conversion content 203 output by the determination unit 14 as the second design knowledge 24.

[0015] The design support device 1 of FIG. 1 described above can be applied not only to safety design but also to the transfer of design between any fields, as follows. The input unit 10 inputs event information (first design knowledge 21) related to a control system in a certain field (first field). The identification unit 11 identifies another field (second field) different from the certain field. The classification unit 12 classifies the divided contents obtained by dividing the event information related to the control system in the certain field into any items (classified contents 202). The conversion unit 13 references conversion information 22 indicating a combination of keywords corresponding to multiple fields, and creates converted contents 203 by converting any item in one field into another field. The determination unit 14 references domain knowledge 23, which serves as a standard for determining the validity of the event contents in the other field, and determines the validity of the converted contents 203 as the other field. The output unit 15 outputs the converted contents 203 (second design knowledge 24) determined to be valid by the determination unit 14.

[0016] Each component of the design support device 1 will be described in detail below. The input unit 10 imports the first design knowledge 21 from the outside. Examples of the first design knowledge 21 include: - Contents in which accident cases (hazards, events) in a certain domain are listed in natural language - Natural language representation of safety analysis results (for example, risk assessment results including hazard sources / hazardous events / risk values / required safety levels / risk reduction measures or design examples of safety mechanisms) - Semi-formal representations (results of FTA: Fault Tree Analysis, FMEA: Failure Mode and Effects Analysis, etc.), formal representations, or safety design contents (safety mechanisms and safety requirements), which will be described later.

[0017] Furthermore, when language processing is performed internally, the following are also included as part of the first design knowledge 21: Original data of a large-scale language model that is input to an LLM (Large Language Model) Data for fine-tuning the original data Data for Retrieval Augmented Generation (RAG)

[0018] The identification unit 11 receives the data received from the input unit 10 and a domain instruction from the user, and identifies the domains before and after conversion of the first design knowledge 21. Then, the identification unit 11 selects appropriate conversion information 22 and domain knowledge 23 based on information on the identified domains before and after conversion. In the following, an example will be described in which the first field is accident cases and safety design cases in the logistics field (forklift) domain, and the second field is the automotive field (autonomous driving vehicles) domain.

[0019] Furthermore, the identification unit 11 may automatically acquire knowledge of multiple related domains by predicting the domain without user instructions, as follows: - Automatically determine the domain before conversion from the information of the input first design knowledge 21 based on the information and keywords contained therein; - Predict the domain after conversion (select the automobile domain assuming autonomous driving because it is the same mobility); - Select from a table (before conversion and after conversion) of the domain knowledge 23 described below.

[0020] 2 is an explanatory diagram showing an example of syntax data 201 used in processing by the classification unit 12. The syntax data 201 clearly specifies the classification of, for example, safety-related personal injury accident cases, and organizes them as follows: - The situation in which the accident occurred is indicated in the format of "Situation: When (actor) was doing (event)" - The cause of the accident is indicated in the format of "Cause: Due to (actor) doing (event)" - The result of the accident (accident) is indicated in the format of "Result: (actor) was (injured or killed)" By clearly specifying and organizing the content in the format of "actor" and "event," in particular, the format is used to facilitate the conversion described below. Note that the "hazard" of an accident refers to a state in which there is a risk of an accident occurring, and indicates the situation in which the accident occurred and the cause of the accident.

[0021] Furthermore, the classification unit 12 may use the syntax data 201B for property damage accidents instead of or in addition to the syntax data 201 for personal injury accidents. In the syntax data 201B for property damage accidents, the result of the accident is replaced with the format "(asset) was (damaged)." The classification unit 12 then inputs the following command (prompt) to an interactive AI service such as ChatGPT (registered trademark) provided by OpenAI, Inc., and generates the output data from the AI ​​service as the classification content 202 in FIG. 3: "Please summarize each sentence in the first design knowledge 21 so that it conforms to the syntax data 201."

[0022] In this way, the classification unit 12 reads a combination of a first element indicating the situation or cause of the event by combining an actor, which is the entity that causes the cause of the event, with an event indicating the action of the actor, and a second element indicating the state of the actor as a result of the event, as syntax data 201. Then, the classification unit 12 creates classification content 202 by executing a process to summarize the sentences of the first design knowledge 21 so that they conform to the syntax data 201.

[0023] As a result, the classification unit 12 classifies the divided contents obtained by dividing event information related to control systems in a certain field into arbitrary items (classification contents 202). The division process here refers to a process of dividing event information including multiple cases into individual cases. The classification unit 12 then classifies, as arbitrary items, a combination of a first element indicating the status or cause of the event by combining an actor that is the entity causing the cause of the event with an event that indicates the action of the actor, and a second element indicating the state of the actor as a result of the event.

[0024] 3 is an explanatory diagram showing the classification content 202 output by the classification unit 12 in accordance with the syntax data 201 of FIG. 2. As shown in FIG. 3, the classification content 202 includes five cases (case 1 to case 5). The classification method here is not limited to the above information. For example, in the case of an accident, classification may be performed based on the classification of the accident, so that the relationships between each case are more clearly defined (Tree of Thought). By doing so, each description is organized, making it easier to satisfy the judgment by the judgment unit, which will be described later.

[0025] 4 is a table showing an example of the conversion information 22. The conversion unit 13 converts the classification content 202 into a second field using the domain conversion information 22 output by the identification unit 11 for the output of the classification unit 12. The conversion information 22 shows combinations of keywords corresponding to domain A (logistics: forklift) before conversion and domain B (automobile: autonomous driving) after conversion, separated into actors and events to which the combinations are applied. For example, the conversion information 22 indicates that a worker in domain A is replaced with a pedestrian in domain B.

[0026] FIG. 5 is an explanatory diagram showing an example of the conversion result by the conversion unit 13. The conversion unit 13 uses the conversion information 22 ( FIG. 4 ) to convert the classified content 202 ( FIG. 3 ) of the classification unit 12 into the converted content 203. The converted content 203 includes five cases (cases 1 to 5). By performing conversion using the conversion information 22, which is a specific keyword correspondence table, it is possible to prevent a word from being left unconverted into a keyword because it is unclear which word should be converted into a keyword, or to prevent inaccurate keyword conversion. On the other hand, simply performing keyword conversion based on the conversion information 22 may result in the converted content 203 containing inappropriate content. Therefore, the determination unit 14, described below, uses domain knowledge 23 to retroactively remove inappropriate content from the converted content 203.

[0027] 4, one-to-one conversion information 22 is used, but one-to-N (integer N≧2) conversion information 22 such as "an operator can be converted to both a pedestrian and a driver" may also be used. In this case, N converted cases are created for one case, and unnecessary cases are deleted in the determination by the determination unit 14, thereby realizing conversion that takes both cases into consideration.

[0028] The judgment unit 14 judges the validity of the conversion content 203 output from the conversion unit 13. The validity judgment is classified, for example, according to the domain knowledge 23 of the converted domain (here, automobiles) used, as follows: [Judgment A] Judgment processing based on the domain knowledge 23 (physical structure, logical structure). [Judgment B] Judgment processing based on the domain knowledge 23 (performance: specifications, operating limits). [Judgment C] Judgment processing based on the domain knowledge 23 (risk value, occurrence probability). [Judgment D] Judgment processing based on the domain knowledge 23 (combination of mutually contradictory contents).

[0029] That is, the determination unit 14 determines the validity of the conversion content 203 as the second field based on at least one of the following criteria as domain knowledge 23: Criteria for physical limits of operation Criteria for logical structure Criteria for specifications Criteria for operational limits Criteria for the probability of occurrence of risk phenomena Criteria for the degree of danger of risk phenomena The determination unit 14 removes the conversion content 203 that does not satisfy at least one of these criteria.

[0030] 6 is an explanatory diagram showing an example of domain knowledge 23 (physical structure, logical structure) used in judgment A. Table 301 shows the domain knowledge 23 of the physical structure. Table 302 shows the domain knowledge 23 of the logical structure. The judgment unit 14 refers to table 301 to determine the physical structure of the domain after conversion from the structural parts and hierarchy, and removes from the conversion content 203 any first design knowledge 21 that does not satisfy the conditions. Similarly, for the logical structure, if the conversion content 203 describes a function that does not exist in table 302 for the corresponding domain, the judgment unit 14 removes the corresponding content from the conversion content 203.

[0031] As part of the structure determination process, the determination unit 14 removes from the conversion content 203 any cases that include components (such as a lift or a mast) that do not exist in the table 301 of the automobile domain. For example, the determination unit 14 determines that the validity of the physical structure domain knowledge 23 is not satisfied because the expression "mast" that exists in the first and fourth cases of the five cases described in the conversion content 203 of FIG. 5 does not exist as a component in the table 301. Alternatively, the determination unit 14 removes from the conversion content 203 any cases that include a component (such as a gear) that exists in the table 301 of the automobile domain but for which a correspondence between the component and a subsystem does not exist in the table 301. For example, the determination unit 14 removes from the conversion content 203 the case "the control unit controls the gear" because this case does not correspond to the "correspondence between the operating unit and the gear" that exists in the table 301.

[0032] 7 is a table 303 showing an example of domain knowledge 23 (performance: specifications, operating limits) used in judgment B. Similarly, if there is a sentence in the first design knowledge 21 that violates the performance requirements described in table 303, the judgment unit 14 removes it from the converted content 203. Specifically, if an operation requiring a minimum turning radius that cannot be achieved by an automobile (such as a pivot turn) is described, the judgment unit 14 removes the description from the converted content 203. The judgment unit 14 can also make a similar judgment on content that can be inferred or estimated from the expression (such as the above-mentioned phrases "pivot turn" and "speed exceeding...") even when the description in the converted content 203 is not specifically stated with a numerical value.

[0033] 8 is a risk value table 304 showing an example of domain knowledge 23 used in judgment C. The judgment unit 14 checks the description of the converted content 203 against the risk value table 304 to determine whether the degree of harm is determined to be sufficiently low risk (not subject to this safety analysis). If the determination corresponds to not being subject to the risk, the judgment unit 14 removes the description of the converted content 203 from the converted content 203 because it is unnecessary even if it is valid. This removal process is performed in cases where the risk value is lower than expected from a safety perspective.

[0034] FIG. 9 illustrates an example of an occurrence probability table 305 of the domain knowledge 23 used in determination C. The determination unit 14 refers to the occurrence probability table 305 to determine whether the description in the conversion content 203 has a sufficiently low occurrence probability. If the determination results in a low occurrence probability, the determination unit 14 similarly determines that the description in the conversion content 203 is unnecessary even if it is valid, and therefore removes it from the conversion content 203. Note that the determination unit 14 may refer to the occurrence probability table 305 to determine not only the occurrence probability of a single event but also the occurrence probability of a combination. For example, if a combination of complex traffic conditions, rare bad weather, and road conditions, which are low in probability, is expressed, the determination unit 14 may exclude the combination as the combined occurrence probability is extremely low. This allows the determination unit 14 to make a determination even when multiple conditions overlap.

[0035] 10 is an explanatory diagram showing an example of domain knowledge 23 of combination conditions used in judgment D. The combination table 306 is prepared with the following combination patterns that are assumed to cause contradictions in the items of occurrence probability and risk value: ・Contradiction within the same condition (summer and winter, etc.) ・Contradiction between related conditions (single track and overtaking vehicles) ・Contradiction in causal relationships (raining outdoors but dry road surface) ・Statistical contradiction (highway and many pedestrians) Even if a combination in the combination table 306 is listed in the conversion content 203, the judgment unit 14 removes it from the conversion content 203.

[0036] Note that if a risk occurs even with a low-probability combination, this information may be important for safety analysis. Taking such cases into consideration, the determination unit 14 may leave situations in which the risk value in the risk value table 304 is high and the occurrence probability in the occurrence probability table 305 is low from the conversion content 203 without removing them. On the other hand, the determination unit 14 may remove situations in which the risk value in the risk value table 304 is high and the situation is a contradictory situation described in the combination table 306 from the conversion content 203. To do this, for example, by setting one of the following as a user instruction, appropriate conversion content 203 can be left depending on the purpose for creating the second design knowledge 24. - For purposes in which risk values ​​up to a low threshold are left (e.g., support for idea generation), the threshold is set low, and anything above that is left. - For purposes in which risk values ​​below the threshold are not left (e.g., implementation of safety analysis design for a system), the threshold is set high, and anything above that is left.

[0037] In this way, the determination unit 14 determines that the conversion content 203 that satisfies the criteria for the occurrence probability of the risk phenomenon but does not satisfy the criteria for the risk level of the risk phenomenon is valid if it corresponds to domain knowledge 23 that indicates a combination of mutually contradictory contents. Furthermore, the determination unit 14 may use the threshold value received as an input as a threshold value for determining whether the criteria for the risk level of the risk phenomenon are satisfied.

[0038] 11 is a flowchart showing an example of a determination flow in the determination unit 14. If the risk is not equal to or greater than the threshold of the risk value table 304 (No in S101), the determination unit 14 removes the first design knowledge 21, which has an extremely low safety risk and is not important, from the conversion content 203 (S102). If the risk is equal to or greater than the threshold of the risk value table 304 (Yes in S101), the process proceeds to S103. The determination unit 14 refers to the combination table 306, and if the combination is expected to cause a contradiction (Yes in S103), removes the first design knowledge 21 expected to cause a contradiction from the conversion content 203 (S104).

[0039] On the other hand, if the combination is not contradictory (No in S103), the determining unit 14 leaves the first design knowledge 21, whose risk value is higher than the threshold and which is not contradictory, without removing it from the conversion content 203 (S105). This allows only the conversion content 203 necessary for safety analysis and design to remain as the first design knowledge 21. Alternatively, instead of S105, the determining unit 14 may remove from the conversion content 203 the first design knowledge 21 whose occurrence probability in the occurrence probability table 305 is low.

[0040] Furthermore, examples of the converted domain knowledge 23 referenced by the determination unit 14 may include a table of risk assessment results, in addition to the above. The risk assessment results indicate examples of hazards, situations, risk values, and associated safety measures. This allows the determination unit 14 to easily determine the risk values ​​of the output situations and hazards.

[0041] The output unit 15 outputs the content output by the determination unit 14 (content obtained by removing unnecessary descriptions from the converted content 203) as the second design knowledge 24. As the output content, the first design knowledge 21 before and after conversion may be output in a text format using character display, or in a format notation, table format, or the like. In other words, the output unit 15 outputs, as the second design knowledge 24, a combination of the first element and the second element of the converted content 203 that the determination unit 14 has determined to be valid.

[0042] Furthermore, the output unit 15 may output at least one of the conversion information 22 ( FIG. 4 ) used by the conversion unit 13 to create the converted content 203 before the validity determination and the domain knowledge 23 used by the determination unit 14 to create the content after removing unnecessary descriptions from the converted content 203, together with the second design knowledge 24 (the converted content 203 output by the output unit 15). Since information related to the determination is particularly important, the output unit 15 also outputs the removed information and the reason for the removal (determination content of the determination unit 14) as necessary. This enables the user to confirm how the first design knowledge 21 was converted and the reason for the conversion.

[0043] According to the first embodiment described above, the classification unit 12 formalizes the natural language description of the first design knowledge 21 in the first field into a description that conforms to the syntax data 201, thereby performing preprocessing so that the conversion unit 13 can perform conversion with high accuracy. The conversion unit 13 generates converted content 203 by converting the first design knowledge 21 in the first field into the second field, with reference to conversion information 22 that associates the first field with the second field. The determination unit 14 determines the validity of the converted content 203 with reference to domain knowledge 23 of "structure, risk value, occurrence probability, etc." in the second field. As a result, information determined to be invalid is removed from the converted content 203, and valid second design knowledge 24 can be output from the output unit 15.

[0044] Furthermore, the determination unit 14 may consider a combination of multiple domain knowledge 23 (a combination of one or more of the risk value table 304, the occurrence probability table 305, and the combination table 306). This allows the determination unit 14 to remove, for example, content with a very low occurrence probability or contradictory content from the converted content 203. Conversely, the determination unit 14 can leave only useful content that poses a risk even if the occurrence probability is very low, by reflecting user instructions as necessary.

[0045] In the second embodiment, a case will be described in which the first design knowledge 21 is in a format other than text (semi-formal notation: FTA / FMEA, etc.). In this case, classification, conversion, and judgment are performed in the same way as in the text format of the first embodiment, but some of the content is different. Therefore, the input unit 10 accepts the first design knowledge 21 (event information related to a control system in a certain field) as FTA or FMEA, which has a tree structure in which nodes indicating at least one of actors and events are connected by links.

[0046] 12 is an explanatory diagram showing function conversion information 450. Function correspondence data 400, which is an example of the conversion information 22, shows the correspondence between a forklift automatic driving function 410 before conversion and an automobile automatic driving function 420 after conversion. As an example of the function of the first design knowledge 21 before conversion, the forklift automatic driving function 410 has a cognitive function 411, a judgment function 412, a vehicle body operation function 413, and a lift operation function 414. As an example of the function of the second design knowledge 24 after conversion, the automobile automatic driving function 420 has a cognitive function 421, a judgment function 422, and a motor function 423.

[0047] The function conversion information 450, which is an example of the conversion information 22, is a table showing the correspondence between each function described in the function correspondence data 400. The conversion unit 13 targets functions (such as the cognitive function 411 and the cognitive function 421) that correspond to the function conversion information 450 between domain A (automatic forklift driving function 410) and domain B (automatic automobile driving function 420). On the other hand, functions that do not correspond to the function conversion information 450 (such as the lift operation function 414) are not targets of conversion by the conversion unit 13 and are removed from the output of the conversion unit 13.

[0048] FIG. 13 is an explanatory diagram showing an example of the first design knowledge 21 of an FTA. The input unit 10 accepts input of the first design knowledge 21 of the FTA shown in FIG. 13. Each node of this first design knowledge 21 indicates a Failure, a Fault, or the like, and the contents are described in natural language. Each node of the FTA is connected to other nodes via logical symbols. For example, a transition symbol 505 is written below the node 503 that says "object entering the forklift track cannot be avoided." This indicates that an FTA (not shown) other than the one in FIG. 13 exists and is connected to the FTA in FIG. 13 via the transition symbol 505.

[0049] 13, the "distance between forklift and worker is less than a certain value" node 501 is the highest node indicating the top event (hazard). Nodes 502 and 503 are connected to the highest node via OR symbol 504. This defines that if the event at node 502 or 503 occurs, the event at node 501 is considered to have occurred.

[0050] As in the first embodiment, the classification unit 12 converts the input first design knowledge 21 into the short sentence format described in each node in Fig. 13 by summarizing the input first design knowledge 21 so that it conforms to the syntax data 201. Alternatively, in the second embodiment, the processing by the classification unit 12 may be omitted because the first design knowledge 21 is already in a semi-formal notation that facilitates data processing when it is input. When the first design knowledge 21 accepted by the input unit 10 is information including actors and events, the conversion unit 13 performs conversion using the conversion information 22 (function conversion information 450 in Fig. 12 ) specified by the identification unit 11, as in the first embodiment.

[0051] FIG. 14 is an explanatory diagram showing an example of the conversion of the first design knowledge 21 in FIG. 13 by the conversion unit 13. The description of each node in the FTA in FIG. 14 is the result of the conversion of actors and events by the conversion unit 13, as in the first embodiment. Meanwhile, on the right side of FIG. 14, there are also nodes and logical symbols indicated by wavy lines. These dashed nodes and logical symbols were removed by the determination unit 14 after determining that the domain knowledge 23 was invalid. For example, the "Lift operation function malfunctions for worker" node 511 in FIG. 14 is the upper node, and the determination unit 14 removes multiple pieces of related information because if the upper node is invalid, the lower nodes (nodes 512, 513, etc.) are also invalid.

[0052] That is, in addition to the upper node in the tree structure for which the validity of the conversion content 203 has been determined to be invalid, the determination unit 14 also determines the validity of the nodes from that upper node to the lower nodes as invalid. In this way, the conversion unit 13 can appropriately eliminate, from the information described semi-formally, information that is not used in the converted domain. Even when the first design knowledge 21 is in semi-formal notation, the first design knowledge 21 in the first field can be converted into the second design knowledge 24 in the second field by performing almost the same process on the other content.

[0053] The output unit 15 displays, as second design knowledge 24, a display screen (FIG. 14) of a tree structure of nodes and links indicating the conversion content 203 that the determining unit 14 has determined to be valid.

[0054] 13 and 14 show the structure of an FTA (Deductive Analysis) as a semi-formal notation, but the same can be applied to an FMEA structure (Inductive Analysis), which is an inverse representation of the structure of an FTA. In this case, the tree structure made up of nodes and links is common to both FTA and FMEA, and the nodes included in this tree structure are also common to both FTA and FMEA. In that case, by performing the same judgment as in FTA at the common nodes in the structure traced back from Failure Mode, the common parts can be similarly deleted.

[0055] Here, a description will be given of the FMEA structure in which the failure mode serving as the starting point of the analysis is the "pedestrian recognition error" node (node ​​513 in FIG. 14). In this case, the failure via the upper gate of the "pedestrian recognition error" node is the "mistake in instruction of lift operation value" node (node ​​512 in FIG. 14). Furthermore, it is assumed that the FMEA is organized in a structure in which the failure via the upper gate is the "lift operation function malfunctions for the worker" node (node ​​511 in FIG. 14). In this case, as explained in FIG. 14, the "lift operation function malfunctions for the worker" node 511 has been removed as the upper node, and therefore the determination unit 14 can delete all information on the failure mode related to each lower node (nodes 512, 513, etc.) for that upper node.

[0056] FIG. 15 is a hardware configuration diagram of the design support device 1. The design support device 1 is configured as a computer 900 having a CPU 901, a RAM 902, a ROM 903, a HDD 904, a communication I / F 905, an input / output I / F 906, and a media I / F 907. The communication I / F 905 is connected to an external communication device 915. The input / output I / F 906 is connected to an input / output device 916. The media I / F 907 reads and writes data from a recording medium 917. Furthermore, the CPU 901 controls each processing unit by executing a program (also called an application or an app for short) loaded into the RAM 902. This program can also be distributed via a communication line or recorded on a recording medium 917 such as a CD-ROM.

[0057] According to the second embodiment described above, even if the first design knowledge 21 has a semi-formal structure (FTA or FMEA), the design support device 1 can convert it into the second design knowledge 24. During this conversion, the determination unit 14 performs a detailed examination in accordance with the semi-formal structure, and further makes effective use of the fact that it is in a tree structure, thereby efficiently determining the validity in a manner similar to pruning.

[0058] Furthermore, the present invention is not limited to the above-described embodiments, and various other applications and modifications are possible without departing from the spirit of the present invention as defined in the claims. For example, the above-described embodiments have described the configuration of the design support system 1 in detail and specifically in order to clearly explain the present invention, and are not necessarily limited to those including all of the components described. Furthermore, it is possible to replace part of the configuration of one embodiment with a component of another embodiment. It is also possible to add a component of another embodiment to the configuration of one embodiment. It is also possible to add, replace, or delete other components from part of the configuration of each embodiment.

[0059] Furthermore, some or all of the above-described configurations, functions, processing units, etc. may be implemented in hardware, for example, by designing them as integrated circuits. Broadly defined processor devices such as FPGAs (Field Programmable Gate Arrays) and ASICs (Application Specific Integrated Circuits) may also be used as hardware. Furthermore, the components of the design support apparatus 1 according to the above-described embodiment may be implemented in any hardware as long as the respective hardware can transmit and receive information to and from each other via a network. Furthermore, the processing performed by a certain processing unit may be implemented by a single piece of hardware, or may be implemented by distributed processing using multiple pieces of hardware.

[0060] REFERENCE SIGNS LIST 1 design support device 10 input unit 11 identification unit 12 classification unit 13 conversion unit 14 determination unit 15 output unit 21 first design knowledge 22 conversion information 23 domain knowledge 24 second design knowledge 100 design support system 201 syntax data 202 classification content 203 conversion content

Claims

1. A design support device comprising: an input unit for inputting event information relating to a control system in a certain field; an identification unit for identifying a field different from the certain field; a classification unit for classifying the divided contents obtained by dividing the event information into arbitrary items; a conversion unit for creating converted contents by converting the arbitrary item in the certain field into the other field by referring to conversion information indicating a combination of keywords corresponding in a plurality of fields; a judgment unit for judging the validity of the converted contents as the other field by referring to domain knowledge that serves as a standard for judging the validity of the event contents in the other field; and an output unit for outputting the converted contents that the judgment unit judges to be valid.

2. The design support device described in claim 1, characterized in that the classification unit classifies as the arbitrary item a combination of an actor that is the entity that causes the cause of the event, a first element that indicates the situation or cause of the event by combining an event that indicates the action content of the actor, and a second element that indicates the state of the actor as a result of the event.

3. The design support device according to claim 2, characterized in that the output unit outputs a combination of the first element and the second element of the conversion content that the judgment unit judges to be valid.

4. The design support device according to claim 2, characterized in that the input unit accepts the event information as FTA (Fault Tree Analysis) or FMEA (Failure Mode and Effects Analysis), which is a tree structure in which nodes representing at least one of the actors and the events are connected by links.

5. The design support device according to claim 4, characterized in that the judgment unit judges the validity of the conversion content to be invalid for not only the upper node in the tree structure for which the validity of the conversion content has been judged to be invalid, but also the lower nodes from that upper node to the lower nodes as invalid.

6. The design support device of claim 1, wherein the judgment unit judges the validity of the conversion content as the other field based on at least one of the following criteria as the domain knowledge: criteria for physical limits of operation, criteria for logical structure, criteria for specifications, criteria for operational limits, criteria for the probability of occurrence of risk phenomena, and criteria for the degree of danger of risk phenomena.

7. The design support device described in claim 6, characterized in that the judgment unit judges that the conversion content that meets the criteria for the probability of occurrence of the risk phenomenon and does not meet the criteria for the degree of danger of the risk phenomenon is valid if it corresponds to the domain knowledge that indicates a combination of mutually contradictory contents.

8. The design support device according to claim 7, wherein the judgment unit uses the inputted threshold value as the threshold value for judging whether the risk phenomenon satisfies the standard of the degree of danger.

9. The design support device according to claim 5, wherein the output unit displays a display screen of the tree structure of nodes and links indicating the conversion content that the judgment unit judges to be valid.

10. The design support device according to claim 1, characterized in that the output unit outputs at least one of the conversion information used by the conversion unit to create the conversion content and the domain knowledge used by the judgment unit to create the conversion content together with the conversion content.

11. A design support method comprising: a design support device having an input unit, an identification unit, a classification unit, a conversion unit, a judgment unit, and an output unit; the input unit inputs event information relating to a control system in a certain field; the identification unit identifies another field different from the certain field; the classification unit classifies the divided contents obtained by dividing the event information into arbitrary items; the conversion unit creates converted contents by converting the arbitrary item in the certain field into the other field by referring to conversion information indicating a combination of keywords corresponding in multiple fields; the judgment unit judges the validity of the converted contents as the other field by referring to domain knowledge that serves as a standard for judging the validity of the event contents in the other field; and the output unit outputs the converted contents that the judgment unit judges to be valid.

Images