Information processing system and information processing method

Abstract

This information processing system holds input information pertaining to a target system, the accuracy of the input information, and risk definition information, wherein the risk definition information indicates context pertaining to the target system and a risk value in the context. The information processing system: identifies the risk value on the basis of the risk definition information and the current context of the target system identified on the basis of the input information; derives a risk determination result on the basis of the identified risk value and the accuracy of the input information corresponding to the identified context; and executes information processing pertaining to the target system on the basis of the accuracy, the risk determination result, and the input information.

Description

Information Processing System and Information Processing Method

[0001] The present invention relates to an information processing system and an information processing method.

[0002] As background art in this technical field, there is Japanese Unexamined Patent Application Publication No. 2022-32522 (Patent Document 1). This publication states that "a communication unit that acquires, from an external device, defective pattern information generated in equipment or a product, a predetermined observed value in the equipment, and sensor information indicating the state of the equipment; a storage unit that stores factor estimation information in which the defective pattern, the observed value, an observation item indicating the state of the equipment, a predetermined estimation factor and countermeasure are associated and registered; and a factor estimation unit that specifies the predetermined estimation factor and countermeasure from the factor estimation information based on the information acquired from the external device. The factor estimation unit specifies the reliability of the sensor information using a predetermined threshold value calculated based on the relationship between the sensor information and a predetermined element of a handling target handled by the equipment or a component of the equipment used in a sequence in which the sensing of the observation item for which the sensor information was acquired was performed." (See the abstract).

[0003] Japanese Unexamined Patent Application Publication No. 2022-32522

[0004] When information with low accuracy is input to an information processing system that performs information processing on a target system using input information, there is a risk that an accurate processing result cannot be obtained by the information processing. Therefore, it is conceivable to calculate the reliability of the input information by the method described in Patent Document 1, discard the input information with low reliability, and perform information processing using only the input information with high reliability.

[0005] On the other hand, for example, assume that the information processing system is a mission-critical system (such as a system where a failure in information processing may cause significant damage). At this time, if input information indicating a risk related to the target system with low reliability is discarded, a processing result in which the risk is not considered in the information processing is obtained, and ultimately, the safety related to the target system itself and the surrounding environment of the target system (including objects and people) may be impaired, such as significant damage occurring.

[0006] Therefore, one aspect of the present invention achieves both accuracy of processing results and security of the target system in information processing.

[0007] To solve the above problems, one aspect of the present invention adopts the following configuration. An information processing system that performs information processing on a target system comprises a processor and a memory, the memory holding input information relating to the target system input to the information processing system, information indicating the accuracy of the input information, a context indicating the state of the target system, and a risk definition information indicating the magnitude of the risk relating to the target system that may occur in the context, the processor identifies the current context of the target system based on the input information, identifies the risk value based on the identified context and the risk definition information, derives a risk determination result that includes a converted risk value based on the identified risk value and the accuracy of the input information used to identify the identified context, selects at least a portion of the input information based on the accuracy and the risk determination result, and performs the information processing using at least a portion of the input information.

[0008] According to one aspect of the present invention, it is possible to achieve both accuracy of processing results and security of the target system in information processing.

[0009] Other issues, configurations, and effects not mentioned above will be clarified by the following description of the embodiments.

[0010] This is a block diagram showing an example of the functional configuration of the information processing system in Example 1. This is a block diagram showing an example of the hardware configuration of the information processing system in Example 1. This is a diagram showing an example of the data configuration of the context definition table in Example 1. This is an explanatory diagram showing an example of a state machine in Example 1. This is an explanatory diagram showing an example of a tree structure showing states and events related to accidents that may occur in the target system in Example 1. This is a diagram showing an example of the data configuration of the risk definition table in Example 1. This is a diagram showing an example of the screen configuration of the threshold setting screen in Example 1. This is a diagram showing an example of the data configuration of the protection definition table in Example 1. This is a flowchart showing an example of overall processing by the information processing system in Example 1. This is a block diagram showing an example of the application of the information processing system to an IT support system in Example 2. This is an explanatory diagram showing an example of the screen configuration of the output information display screen output by the information processing system applied to the IT support system in Example 2. This is a block diagram showing an example of the functional configuration of the information processing system in Example 3. This is an explanatory diagram showing an example of the application of the information processing system to a manufacturing robot system in Example 4. This is a diagram showing an example of the data configuration of the context definition table in Example 4. This is a diagram showing an example of the data configuration of the protection definition table in Example 4.

[0011] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In this embodiment, the same components will be denoted by the same reference numerals in principle, and repeated descriptions will be omitted. It should be noted that this embodiment is merely one example for realizing the present invention and does not limit the technical scope of the present invention.

[0012] In this embodiment, examples of the application of the information processing system 101 are mainly described for IT (Information Technology) support systems that support people, such as call centers, and control systems for manufacturing robots. While these examples are optimal, this does not preclude its application to other systems.

[0013] <System Overview> Figure 1 is a block diagram showing an example of the functional configuration of the information processing system 101. The information processing system 101 includes, for example, an accuracy determination unit 110, a risk analysis unit 111, an information processing unit 112, an output protection unit 201, and a user setting unit 701, all of which are functional units. The information processing unit 112 holds context definition information 130, risk definition information 131, and protection information 132.

[0014] The information processing system 101 acquires input information. The input information includes, for example, information transmitted from a target system connected to the information processing system 101, information input to the information processing system 101 by a user, and information transmitted from sensors, etc., that monitor the status of the target system or the environment surrounding the target system. The accuracy determination unit 110 determines the accuracy of the input information and transmits the input information and the accuracy determination result to the risk analysis unit 111 and the information processing unit 112.

[0015] The risk analysis unit 111 performs a risk analysis based on the input information, the accuracy determination result from the accuracy determination unit 110, the context definition information 130, and the risk definition information 131 to analyze the risks related to the target system indicated by the input information (for example, the risk of the target system suffering specific damage such as failure and destruction (risks related to the safety of the target system), the risk of objects or people in the vicinity of the target system suffering specific damage (risks related to the safety of the environment surrounding the target system), etc.), and transmits the risk analysis results to the information processing unit 112 and the output protection unit 201.

[0016] The information processing unit 112 performs information processing on the input information based on the accuracy determination result from the accuracy determination unit 110 and the risk analysis result from the risk analysis unit 111, and transmits the processed information to the output protection unit 201.

[0017] The output protection unit 201 protects the output of the processed information received from the information processing unit 112 as necessary, based on the risk analysis results from the risk analysis unit 111 and the protection information 132.

[0018] The user setting unit 701 accepts user input to set thresholds related to accuracy and risk values ​​when the information processing unit 112 performs information processing, and thresholds related to risk values ​​for whether the output protection unit 201 performs protection.

[0019] The information processing system 101 does not necessarily have to include at least one of the output protection unit 201 and the user setting unit 701. If the information processing system 101 does not include the user setting unit 701, the thresholds described above are predetermined, for example. If the information processing system 101 does not include the output protection unit 201, the information processing system 101 does not need to hold the protection information 132, the transmission and reception of information between the output protection unit 201 and other functional units is omitted, and the information processing unit 112 outputs the processed information to the outside.

[0020] Figure 2 is a block diagram showing an example of the hardware configuration of the information processing system 101. The information processing system 101 is composed of a computer 200 having, for example, a CPU (Central Processing Unit) 210, memory 220, auxiliary storage device 230, input device 240, display device 250, and communication device 260.

[0021] The CPU 210 is an example of a processor and executes programs stored in the memory 220. The memory 220 includes non-volatile memory elements such as ROM (Read Only Memory) and volatile memory elements such as RAM (Random Access Memory). The ROM stores immutable programs (e.g., BIOS (Basic Input / Output System)). The RAM is a high-speed, volatile memory element such as DRAM (Dynamic Random Access Memory) and temporarily stores programs executed by the CPU 210 and data used during program execution.

[0022] The auxiliary storage device 230 is a high-capacity, non-volatile storage device such as a magnetic storage device (HDD (Hard Disk Drive)) or flash memory (SSD (Solid State Drive)), and stores the program executed by the CPU 210 and the data used when the program is executed. In other words, the program is read from the auxiliary storage device 230, loaded into the memory 220, and executed by the CPU 210.

[0023] The input device 240 is a device that receives input from the operator, such as a keyboard or mouse. The display device 250 is a device that outputs the results of program execution in a format that the operator can see, such as a display device or printer. Note that the computer 200 that constitutes the information processing system 101 does not necessarily have to have the input device 240 and the display device 250.

[0024] The communication device 260 is a network interface device that controls communication with other devices according to a predetermined protocol. The communication device 260 may also include a serial interface such as USB (Universal Serial Bus).

[0025] Some or all of the program executed by the CPU 210 may be provided to the computer 200 via a network from an external computer equipped with a non-temporary storage medium, such as removable media (CD-ROM, flash memory, etc.), or a non-temporary storage device, and stored in a non-volatile auxiliary storage device 230, which is also a non-temporary storage medium. For this reason, the computer 200 may have an interface for reading data from the removable media.

[0026] The information processing system 101 is a computer system that operates on a single physical computer 200, or on multiple logically or physically configured computers 200, and may operate on the same computer 200 in separate threads, or on a virtual computer built on multiple physical computer resources.

[0027] The CPU 210 includes, for example, the functional units described above. For example, the CPU 210 functions as an accuracy determination unit 110 by operating according to an accuracy determination program loaded into memory 220, and functions as a risk analysis unit 111 by operating according to a risk analysis program loaded into memory 220. The relationship with the programs is similar for other functional units included in the CPU 210.

[0028] Furthermore, some or all of the functions performed by the aforementioned functional unit may be implemented by dedicated hardware such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field-Programmable Gate Array).

[0029] The auxiliary storage device 230 holds, for example, the various types of information mentioned above (context definition information 130, risk definition information 131, and protection information 132). Some or all of this information may be stored in the memory 220, or in an external database connected to the information processing system 101.

[0030] In this embodiment, the information used by the information processing system 101 is independent of the data structure and may be represented in any data structure. For example, a data structure appropriately selected from a table, list, database, or queue can store the information.

[0031] <Accuracy Determination Process> A specific example of the accuracy determination process performed by the accuracy determination unit 110 will be described below. The accuracy determination unit 110 calculates a value (hereinafter also simply called accuracy) that indicates the accuracy of the input information (for example, the probability that the input information is accurate). For example, accuracy is defined as a value between 0% and 100%.

[0032] Specifically, for example, when the accuracy determination unit 110 receives input information and the confidence level of the input information (for example, calculated by the target system or determined by user input), it calculates the accuracy of the input information using a predetermined function such that, for example, a higher confidence level indicates higher accuracy.

[0033] Furthermore, for example, when the accuracy determination unit 110 receives sensor information used for object recognition as input information, it calculates the accuracy of the input information using a predetermined function such that the accuracy increases as the accuracy rate of the object recognition algorithm (which is given in advance, for example) increases.

[0034] Furthermore, for example, when the accuracy determination unit 110 receives sensor information as input information, it may calculate the accuracy of the input information using a predetermined function such that the higher the reliability of the sensor information (for example, the reliability information of the sensor itself, such as SIL (Safety Integrity Level) and PL (Performance Level), and the assumed error rate, and which is given in advance), the higher the accuracy.

[0035] Furthermore, for example, when the accuracy determination unit 110 receives input information and attribute information attached to the input information (for example, information indicating the authenticity of the input information, such as information indicating the creator of the input information, logs of the target system, and / or past data generated or acquired by the target system, which is transmitted by the target system or determined by user input), it may calculate the accuracy of the input information based on the attribute information.

[0036] If the input information is text data and the attribute information indicates the creator of the text data's knowledge level regarding the target system (for example, the number of years of experience or position when handling the target system), the higher the creator's knowledge level, the more reliable the input information is considered to be. Therefore, in this case, the accuracy determination unit 110 calculates the accuracy of the input information using a predetermined function such that the accuracy increases with the creator's knowledge level. Furthermore, if the attribute information is logs or historical data related to the target system, the higher the consistency between the input information and the logs or historical data, the more reliable the input information is considered to be. Therefore, in this case, the accuracy determination unit 110 calculates the accuracy of the input information based on the consistency between the input information and the logs or historical data, for example.

[0037] Furthermore, for example, if the input information is sensor information, the accuracy determination unit 110 may calculate the reliability of the sensor information using the method described in Patent Document 1 and use the calculated reliability as the accuracy of the sensor information. The accuracy determination unit 110 may be located outside the information processing system 101. In this case, the information processing system 101 receives the input information to which accuracy has been assigned.

[0038] <Risk Analysis Processing> A specific example of the risk analysis processing performed by the risk analysis unit 111 will be described below. Based on the information received from the accuracy determination unit 110 (input information and accuracy information), the risk analysis unit 111 identifies a context and calculates the accuracy of that context. Furthermore, based on the identified context and the accuracy of that context, the risk analysis unit 111 calculates a risk value that indicates the risk of damage to the target system and / or the surrounding environment of the target system (for example, peripheral devices of the target system or users of the target system).

[0039] Context is a concept that describes the state of a target system, specifically, at least one of the state of the target system and the state of the environment surrounding the target system. The accuracy of the context refers to the accuracy (e.g., probability) of the target system and / or the environment surrounding the target system being in the state described by the context.

[0040] For example, parameters set in the target system, parameters set in other systems connected to the target system, and the states of the target system and those other systems indicated by these parameters are examples of context. Also, if the target system is a robot with an arm, the presence or absence of a human within the arm's work area is another example of context.

[0041] First, we will explain specific examples of how to identify the context and how to calculate the accuracy of that context.

[0042] When the input information itself includes information indicating a context (for example, information indicating that "the state of the target system is xxx"), the risk analysis unit 111 identifies the information as a context and determines the accuracy of the input information calculated by the accuracy determination unit 110 based on the accuracy of the context.

[0043] In addition, the risk analysis unit 111 may be able to identify a context by combining multiple types of input information. Specifically, for example, the risk analysis unit 111 identifies a context by determining the state in which the target system is placed based on the type, position, and speed of the surrounding objects of the target system, or identifies a context by determining the state of the target system based on a combination of a plurality of logs and information output from the target system.

[0044] For example, assume that it is predetermined that context D is indicated when all of condition A, condition B, and condition C are satisfied (that is, an AND condition) (the predetermined information is described in, for example, the context definition information 130). Further, assume that input information A', input information B', and input information C' indicate that condition A, condition B, and condition C are satisfied, respectively, and the accuracies calculated by the accuracy determination unit 110 of input information A', input information B', and input information C' are 90%, 80%, and 50%, respectively.

[0045] In this case, the risk analysis unit 111 calculates, for example, 90% × 80% × 50% = 36% as the accuracy of context D. Also, for example, the risk analysis unit 111 may calculate 50%, which is the minimum value among 90%, 80%, and 50%, as the accuracy of context D. As described above, the risk analysis unit 111 calculates the accuracy of context D based on a predetermined type of statistic of the accuracies of multiple types of input information.

[0046] Another example of a context identification method will be described. FIG. 3 is a diagram showing an example of the data configuration of a context definition table 301. The context definition table 301 is stored in advance in, for example, the context definition information 130.

[0047] The context definition table 301 shows the correspondence between input information (e.g., system logs, messages, output contents such as LED (Light Emitting Diode) outputs, voices, and operation procedures, etc.) and contexts. The risk analysis unit 111 identifies the context by, for example, obtaining the context corresponding to the input information from the context definition table 301.

[0048] The input information indicated by the record 302 in the example of the context definition table 301 in FIG. 3 is "CCC→DDD", and the context is "S3". This record 302 indicates that when the input information "DDD" is input to the information processing system 101 after the input information "CCC" is input to the information processing system 101, the context S3 is identified. It is defined by the record 302 that when multiple types of input information are obtained in a specific order due to reasons such as a specific operation procedure being defined, a transition to a specific context occurs.

[0049] When the risk analysis unit 111 identifies the context using the context definition table 301, it calculates the accuracy of the context using the accuracy of the input information. In the example of FIG. 3, when the risk analysis unit 111 determines that the input information "AAA" is input, it determines that the context is "S1" and calculates the accuracy of "AAA" as the accuracy of the context. In the example of FIG. 3, when the risk analysis unit 111 determines that the input information "DDD" is input after the input information "CCC", it determines that the context is "S3" and calculates the product (or minimum value) of the accuracy of "AAA" and the accuracy of "DDD" as the accuracy of the context.

[0050] Another example of the context identification method will be described. FIG. 4 is an explanatory diagram showing an example of a state machine 401. The state machine 401 is, for example, stored in the context definition information 130 in advance.

[0051] The state machine 401 indicates state transitions of the target system or the environment surrounding the target system. The state machine 401 indicates that when Event 1 occurs while in state A, the system transitions to state B; when Event 2 occurs while in state B, the system transitions to state C; when Event 4 occurs while in state C, the system transitions to state D; when Event 3 occurs while in state D, the system transitions back to state C; and when Event 5 occurs while in state D, the system transitions back to state B. Each state indicated by the state machine 401 corresponds to a context, and each Event indicated by the state machine 401 corresponds to specific input information being input to the information processing system 101.

[0052] The risk analysis unit 111 identifies the context by monitoring the transition of states (contexts) according to the state machine 401 and the input information. The risk analysis unit 111 can also calculate the accuracy of the context after the transition by sequentially multiplying the accuracy of the input information corresponding to the Event that triggered the state transition.

[0053] As another example of a method for identifying context, the risk analysis unit 111 may use a language model (e.g., LLM (Large language Model)) that is present in or connected to the information processing system 101.

[0054] Specifically, for example, the risk analysis unit 111 identifies the current context by inputting input information and a prompt instructing the language model to infer the current context from the input information. Note that RAG (Retrievable-Augmented Generative) may be used as the language model. Specifically, for example, the language model may be connected to a database of past input information and past contexts, and may refer to this database when identifying the current context and the accuracy of that context.

[0055] The risk analysis unit 111 can flexibly identify the context from the input information by using a language model. Even when the risk analysis unit 111 identifies the context using a language model, it calculates the accuracy of the context using the accuracy of the input information, similar to the example described above. The risk analysis unit 111 may also calculate the accuracy of the context when having the language model identify the context.

[0056] As another example of how context can be identified, the states corresponding to a context may be predetermined based on safety analysis, and the risk analysis unit 111 may determine whether the current state corresponds to a context determined based on safety analysis.

[0057] Figure 5 is an explanatory diagram showing an example of a tree structure 501 that indicates states and events related to accidents that may occur in the target system. The information showing the tree structure 501 may, for example, be stored in the context definition information 130 in advance, or it may be generated by the risk analysis unit 111 using a method described later and stored in the context definition information 130.

[0058] The tree structure 501 includes, for example, nodes indicating accidents that may occur in the target system, nodes indicating hazardous situations that may lead to accidents, and nodes indicating hazardous events that may cause hazardous situations.

[0059] The node indicating an accident is the root node in the tree structure 501 and is determined, for example, by input from the administrator of the information processing system 101 based on past knowledge or business knowledge. The node indicating a hazardous situation is a child node of the node indicating an accident in the tree structure 501 and is determined, for example, by input from the administrator of the information processing system 101.

[0060] Nodes indicating a Hazardous event are descendant nodes of the Hazardous situation in the tree structure 501, and are derived by applying a predetermined safety analysis method (e.g., FTA (Fault Tree Analysis), FMEA (Failure Mode and Effects Analysis), or HAZOP (HAZARD and OPERABLEness studies), etc.) to the target system based on the Hazardous situation.

[0061] Each Hazardous Situation represented by the tree structure 501 corresponds to a context, and each Hazardous Event represented by the tree structure 501 represents an event that causes a hazard (accident) when it occurs in the system or surrounding environment within the Hazardous Situation. For example, this corresponds to specific input information being input to the information processing system 101. In addition, gates such as AND gates or OR gates are provided between the parent node of the tree structure 501 and the group of child nodes (consisting of one or more child nodes).

[0062] In the example of the tree structure 501 in Figure 5, if an OR gate is provided between a node indicating an accident and a group of nodes indicating a hazardous situation, an accident will occur if at least one of the hazardous situations 1 to 3 is met.

[0063] The risk analysis unit 111 identifies the context by identifying the currently relevant Hazardous situation according to the tree structure 501 and the input information. Furthermore, the risk analysis unit 111 can calculate the probability that the context corresponding to the currently relevant Hazardous situation is occurring, based on, for example, the accuracy of the input information corresponding to the Hazardous Event corresponding to the child node of the currently relevant Hazardous situation (the probability that the input information is accurate) and the provided gates, as the accuracy of the context.

[0064] Next, a specific example of the risk value calculation process included in the risk analysis process will be explained. Figure 6 shows an example of the data structure of the risk definition table 601. The risk definition table 601 may, for example, be stored in the risk definition information 131 in advance, or it may be generated by the risk analysis unit 111 using the method described later and stored in the risk definition information 131.

[0065] The risk definition table 601 shows, for example, the context, the type of risk value, and the risk value. The types of risk values ​​include, for example, "monetary value" and "safety." Risk values ​​of type "monetary value" are risk values ​​that evaluate the degree of damage in monetary terms, such as the repair costs if the target system is damaged, or the compensation costs if a person is harmed by the operation of the target system, etc.

[0066] Risk values ​​classified as "safe" are risk values ​​that evaluate the degree of damage in terms of safety probabilities, such as the probability of loss of life in the event that harm is inflicted on a person due to the operation of the target system.

[0067] In the risk value calculation process, the risk analysis unit 111 obtains the risk value corresponding to the identified context from the risk definition table 601, and calculates a converted risk value (a risk value that takes the accuracy of the context into account) by multiplying the accuracy of the identified context by the obtained risk value.

[0068] Depending on the input information entered into the information processing system 101, the risk analysis unit 111 may identify multiple contexts. In this case, the risk analysis unit 111 calculates a converted risk value for each of these multiple contexts.

[0069] A specific example of how to create the risk definition table 601 will be described. For example, the risk analysis unit 111 identifies accidents (e.g., damage to the target system and compensation for harm to people), the context (hazardous situation) that presupposes the accident, and the events (hazardous event) that lead to that context, using a safety analysis method similar to the method used to generate the tree structure 501 in Figure 5.

[0070] The risk analysis unit 111 can use the safety analysis method to estimate the amount of damage from an accident and estimate the risk value to be stored in the risk definition table 601 based on the context (Hazardous Situation), the probability of events that may occur in that context, and the estimated amount of damage.

[0071] For example, if an accident (e.g., damage to equipment X due to collision with an object) is estimated to result in 2 billion yen in damages, the risk analysis unit 111 identifies the context that underlies the accident (e.g., the proximity of equipment Y to equipment X) and several events that may occur afterward (e.g., failure of equipment Y, incorrect instructions, and failure of protective equipment) using safety analysis methods such as HAZOP, FMEA, or FTA, and then estimates the probability of each of the context and the events occurring.

[0072] The risk analysis unit 111, for example, describes a tree structure with the accident as the top event (root node) based on the FTA algorithm, and calculates the probability of the accident occurring based on the estimated probability and the AND and OR gates of the FTA. If the probability of the accident occurring is 5%, the risk analysis unit 111 calculates 2 billion yen × 0.05 = 100 million yen as the risk value corresponding to the context that underlies the accident and stores it in the risk definition table 601.

[0073] Furthermore, in another example of how risk values ​​stored in the risk definition table 601 are calculated, the risk analysis unit 111 can statistically calculate, for example, the probability and amount of damage that will occur in the future under a specific context, based on past damage data related to the target system.

[0074] The risk analysis unit 111 transmits, for example, the identified context, at least one of the input information that led to the identification of the context, and the risk value and converted risk value corresponding to the context to the information processing unit 112. The risk analysis unit 111 also transmits, for example, the identified context, the risk value and converted risk value corresponding to the context to the output protection unit 201.

[0075] <Information Processing> A specific example of information processing by the information processing unit 112 will be explained. For example, when the input information is the text of a question about the target system entered by the user, the process of generating an answer to the question (for example, using a language model such as LLM that the information processing system 101 has or is connected to the information processing system 101) and outputting it (for example, proposing countermeasures to be taken for the target system in its current state, or presenting the results of the cause analysis of a malfunction that occurred in the target system) is an example of such information processing.

[0076] Furthermore, for example, when the input information is sensor data relating to the target system and / or the surrounding environment of the target system, control output to the target system based on said sensor data (e.g., formulating a trajectory plan or action plan for a robot arm or vehicle) is also an example of such information processing.

[0077] The information processing unit 112 selects and discards input information based on the accuracy of the input information calculated by the accuracy determination unit 110 and the risk value calculated by the risk analysis unit 111, then performs information processing using the input information, and transmits the processing result of the information processing to the output protection unit 201.

[0078] Specifically, for example, the information processing unit 112 performs information processing using input information with high accuracy (an example of high-accuracy information) and input information with low accuracy but high risk (an example of low-accuracy, high-risk information). Input information whose accuracy, as calculated by the accuracy determination unit 110, is equal to or greater than the accuracy threshold is an example of high-accuracy information, and input information whose accuracy, as calculated by the accuracy determination unit 110, is less than the accuracy threshold is an example of low-accuracy information.

[0079] Furthermore, the input information that led to the identification of a context in which the converted risk value calculated by the risk analysis unit 111 is equal to or greater than the conversion threshold, and the input information used that led to a context in which the risk value obtained from the risk definition table 601 by the risk analysis unit 111 is equal to or greater than the pre-conversion threshold, are both examples of input information related to high risk (that is, input information that falls under at least one of these categories is used for information processing even if its accuracy is low).

[0080] In this way, by using input information that is determined to be high-risk based on converted risk values ​​that reflect the accuracy of the context, as well as input information that is determined to be high-risk based on risk values ​​that do not reflect the accuracy of the context, it is possible to reflect input information related to a high-risk state in the event of an occurrence, even if the probability of occurrence is low.

[0081] The information processing unit 112 can increase the likelihood of performing more appropriate information processing by using highly accurate input information for information processing. Furthermore, by using input information that is less accurate but high-risk for information processing, the information processing unit 112 can reduce the risk of dangerous situations occurring in the target system and further enhance safety.

[0082] Furthermore, when the information processing unit 112 receives data input including text indicating the state of the target system and performs information processing to output the countermeasures to be taken for the target system in that state, the context can be used in the information processing. In such cases, the information processing unit 112 may use the context identified from the input information by the risk analysis unit 111 in place of or in addition to the input information in the information processing.

[0083] In the example described above, the information processing unit 112 performs the determination of the accuracy level of the input information and the level of risk. However, the accuracy determination unit 110 may transmit only the input information with high accuracy to the information processing unit 112, and the risk analysis unit 111 may transmit only the input information (and context) with low accuracy but high risk, and the information processing unit 112 may perform information processing using all the information received from the accuracy determination unit 110 and the risk analysis unit 111.

[0084] The accuracy threshold, conversion threshold, and pre-conversion threshold are predetermined, for example, by the administrator of the information processing system 101. Alternatively, for example, the information processing unit 112 may determine the accuracy threshold by calculating an evaluation of the processing result of information processing using past input information with high accuracy according to each of the multiple candidates for the accuracy threshold, and searching for the optimal value of the accuracy threshold. Since the conversion risk value is a value that reflects the accuracy of the context in the risk value, it is desirable that the conversion threshold be less than or equal to the pre-conversion threshold.

[0085] Alternatively, for example, the user setting unit 701 may display a threshold setting screen 702 on the display device 250, and determine the accuracy threshold, conversion threshold, and pre-conversion threshold according to the input to the input device 240 via the threshold setting screen 702.

[0086] Figure 7 shows an example of the screen configuration of the threshold setting screen 702. The threshold setting screen 702 includes an input area for receiving input for the accuracy threshold, the conversion threshold and pre-conversion threshold for risk values ​​of type "amount", and the conversion threshold and pre-conversion threshold for risk values ​​of type "safe".

[0087] The conversion threshold and pre-conversion threshold are used not only for determining the level of risk in information processing, but also for determining the level of risk in output protection by the output protection unit 201, which will be described later. However, the conversion threshold and pre-conversion threshold used for determining the level of risk in information processing may be the same as or different from the conversion threshold and pre-conversion threshold used for determining the level of risk in output protection, respectively.

[0088] If the conversion threshold and pre-conversion threshold used to determine the level of risk in information processing may be different from the conversion threshold and pre-conversion threshold used to determine the level of risk in output protection, the threshold setting screen 702 may include an input area for receiving input for the conversion threshold and pre-conversion threshold used to determine the level of risk in information processing, and the conversion threshold and pre-conversion threshold used to determine the level of risk in output protection.

[0089] Furthermore, it is desirable that the accuracy threshold be shared with the risk analysis unit 111. This allows the risk analysis unit 111 to identify input information with low accuracy, perform risk analysis processing using only the input information with low accuracy, and transmit the results of the risk analysis processing to the information processing unit 112, thereby improving the efficiency of processing by the information processing system 101.

[0090] In at least one of the determination of the level of risk in information processing and the determination of the level of risk in output protection by the output protection unit 201 described later, the pre-conversion threshold may not be used, and only the converted threshold may be used. If only the converted threshold is used in at least one of the determination of the level of risk in information processing and the determination of the level of risk in output protection by the output protection unit 201 described later, the threshold setting screen 702 may not include an input area for receiving input of the pre-conversion threshold for that at least one.

[0091] <Output Protection Processing> A specific example of output protection processing by the output protection unit 201 will be described below. Based on the context identified by the risk analysis unit 111, the risk value and / or converted risk value corresponding to the context, and the processing result of the information processing by the information processing unit 112, the output protection unit 201 protects the output from being sent outside the information processing system 101.

[0092] Figure 8 shows an example of the data structure of the protection definition table 801. The protection definition table 801 may, for example, be pre-stored in the protection information 132, or it may be generated by the risk analysis unit 111 using a method described later and stored in the protection information 132.

[0093] The protection definition table 801 shows, for example, a context, a guard condition which is determined to be satisfied in the current context, and countermeasures which should be taken if the guard condition is satisfied in the current context.

[0094] The output protection unit 201, when the context identified by the risk analysis unit 111 is included in the protection definition table 801, and the context is a high-risk context, and the corresponding guard conditions in the protection definition table 801 for that context are met, implements the countermeasures in the protection definition table 801 for that context (for example, deleting the information received from the information processing unit 112 (stopping output to the outside), outputting a warning message, or transitioning to a safe state by replacing the information received from the information processing unit 112 with alternative information and outputting it). This enables the output protection unit 201 to protect against risky outputs in the current context.

[0095] Furthermore, the countermeasures defined in the protection definition table 801 are not limited to those described in the example in Figure 8. For example, if the target system is a control system, a control program for executing an alternative algorithm (including output cessation) or a pointer to said control program may be indicated. In this case, when output protection by the output protection unit 201 is activated, the alternative algorithm (including output cessation) will be executed.

[0096] Furthermore, the context in which the converted risk value calculated by the risk analysis unit 111 is equal to or greater than the conversion threshold, and the context in which the risk value obtained from the risk definition table 601 by the risk analysis unit 111 is equal to or greater than the pre-conversion threshold, are both examples of high-risk contexts (i.e., countermeasures are implemented if the guard conditions corresponding to at least one of these contexts are met).

[0097] Thus, output protection can be implemented not only in contexts determined to be high-risk based on converted risk values ​​that reflect the accuracy of the context, but also in contexts determined to be high-risk based on risk values ​​that do not reflect the accuracy of the context. This makes it possible to suppress the occurrence of situations that are high-risk if they occur, even if the probability of occurrence is low.

[0098] A specific example of how to create the protection definition table 801 will be explained. For example, the risk analysis unit 111 determines the guard conditions using the safety analysis method described above. For example, if the risk analysis unit 111 determines from the results of the safety analysis that an accident will occur when an event occurs when a certain context (Hazardous situation) is present, it determines that the event will be the guard condition corresponding to that context.

[0099] Furthermore, for example, if the instruction manual for the target system describes prohibited operations under specific conditions, the risk analysis unit 111 may determine those prohibited operations as guard conditions in the context indicated by those specific conditions. Alternatively, for example, the risk analysis unit 111 may conduct a risk assessment of the target system and determine the risk trigger conditions in the preconditions for the target system derived from the risk assessment as guard conditions in the context indicated by those preconditions.

[0100] Furthermore, the countermeasures in the protection definition table 801 may be determined, for example, by input by the administrator of the information processing system 101, or, if the guard condition indicates that specific information has been output from the information processing unit 112, the risk analysis unit 111 may include stopping the output of that specific information as a countermeasure.

[0101] Furthermore, as shown in the protection definition table 801 in Figure 8, it is desirable that countermeasures corresponding to the context and guard conditions be uniquely determined. By doing so, even if the processing content by the information processing unit 112 is difficult to verify in terms of input / output patterns, it becomes possible to perform output protection in a way that allows for external verification of safety.

[0102] The conversion threshold and pre-conversion threshold used in the output protection process may be arbitrarily set by the user using the threshold setting screen 702 described above, based on past usage conditions, or they may be predetermined using the default values ​​of the target system.

[0103] <Overall Processing> Figure 9 is a flowchart showing an example of overall processing by the information processing system 101. The information processing system 101 receives input information (S901). The accuracy determination unit 110 performs the accuracy determination process described above on the input information (S902). If the input information itself is already accurate, the accuracy determination may be omitted.

[0104] The risk analysis unit 111 identifies the context based on the input information using the method described above (S903). The risk analysis unit 111 calculates the risk value and the converted risk value of the context using the method described above (S904).

[0105] The information processing unit 112 determines whether there is any input information with low accuracy (S905). If the information processing unit 112 determines that there is no input information with low accuracy (S905: NO), it performs information processing using the input information with high accuracy (S906) and proceeds to step S909. If the information processing unit 112 determines that there is input information with low accuracy (S905: YES), it determines whether there is input information related to high risk (S907).

[0106] If the information processing unit 112 determines that there is no input information related to high risk (S907: NO), it proceeds to step S906. If the information processing unit 112 determines that there is input information related to high risk (S907: YES), it performs information processing using the input information with high accuracy and the input information related to high risk, even if it is not very accurate (S908), and then proceeds to step S909.

[0107] The output protection unit 201 determines whether it is necessary to perform output protection processing based on the context identified by the risk analysis unit 111, the scr value and / or converted risk value corresponding to that context, and the guard conditions shown in the protection definition table 801 (S909).

[0108] If the output protection unit 201 determines that it is necessary to perform output protection processing (S909: YES), it performs processing according to the countermeasures in the protection definition table 801 based on the current context and the guard conditions that are met (S910), and then terminates the overall processing. If the countermeasure does not include stopping the output of information output from the information processing unit 112, the output protection unit 201 outputs the information output from the information processing unit 112 to the outside.

[0109] If the output protection unit 201 determines that it is not necessary to perform output protection processing (S909: NO), it outputs the information output from the information processing unit 112 to the outside (S911) and terminates the overall processing.

[0110] As described above, the information processing system 101 of this embodiment can improve the accuracy of processing results while obtaining processing results that prepare for risks related to the target system by performing appropriate information processing based on highly accurate input information and information processing using input information that is less accurate but carries high risk.

[0111] Furthermore, the information processing system 101 in this embodiment can enhance the safety of the target system and / or the surrounding environment of the target system by performing output protection, which involves taking specific measures to suppress the occurrence of high-risk situations when a high-risk situation may occur if guard conditions are met in a particular context.

[0112] <Example of Application to an IT Support System> Example 2 describes an example in which the information processing system 101 is applied to an IT support system. Example 2 mainly describes the differences from Example 1, and explanations of points that are the same as in Example 1 may be omitted as appropriate.

[0113] Figure 10 is a block diagram illustrating an example of applying the information processing system 101 to an IT support system. The information processing system 101 is included in a terminal 1001 used by a user of the IT support system and operates within the terminal 1001. The terminal 1001, which includes the information processing system 101, is composed of, for example, a computer 200 as shown in Figure 2, and has a user interface such as an input device 240 and a display device 250.

[0114] The user, for example, uses an input device 240 to input a question (a text-based question) about the target system used by the user to the information processing system 101. The information processing system 101 then performs information processing, referring to data it owns or stored in an external database, and outputs an answer to the question (for example, the operating procedures or countermeasures that should be performed on the target system) to a display device 250 or the like. In this way, the information processing system 101 functions as an IT support system.

[0115] Furthermore, the information processing system 101 does not necessarily have to be located inside the user's terminal 1001; for example, it may be located inside another terminal (PC (Personal Computer), cloud service, and other information processing equipment) that terminal 1001 can connect to via a network or the like.

[0116] In the information processing system 101 of Example 2, the accuracy determination unit 110 calculates the accuracy of the input information using the same procedure as in Example 1, based on attribute information attached to the text information of the inquiry as input information (such as the knowledge level of the text creator regarding the target system, whether or not there are operation logs for the target system, etc.) and the history of repeated exchanges.

[0117] The risk analysis unit 111 uses the text information of the inquiry as input information and the accuracy calculated by the accuracy determination unit 110 to derive the context of the target system used by the user and the accuracy of that context in the same procedure as in Example 1.

[0118] The risk analysis unit 111 identifies the risk value in the context using the risk definition table 601 in the same procedure as in Example 1, and calculates a converted risk value that reflects the accuracy of the context based on the identified risk value. The risk definition table 601 is generated from, for example, past data or the manual of the target system used by the user, or is predetermined.

[0119] The information processing unit 112, for example, similar to Embodiment 1, performs information processing using highly accurate input information and low-accuracy, high-risk input information, that is, generates operating procedures and countermeasures that should be performed on the target system, and outputs them to the output protection unit 201.

[0120] Furthermore, the output protection unit 201, following the same procedure as in Example 1, implements output protection measures as necessary, based on the context and guard conditions shown in the protection definition table 801 and the determination result of whether the risk of the context is high or low.

[0121] Furthermore, in a specific context, when a guard condition indicating that specific output information has been output from the information processing unit 112 is met and output measures are implemented, examples of such measures include outputting the specific output information with a warning message attached, and deleting the specific output information and then outputting a message indicating that the specific output information has been deleted.

[0122] The combination of context and guard conditions shown in the protection definition table 801 may be determined, for example, by the risk analysis unit 111 extracting operations that should not be performed in a particular context (guard conditions) from past data or the manual of the target system, or it may be predetermined.

[0123] In this embodiment, for example, if the accuracy of input information is determined based on attributes such as the user's knowledge level regarding the target system, input information from users with a high level of knowledge is used for information processing as highly accurate input information, while input information from users with a low level of knowledge, even if it is high-risk input information, is also used for information processing and output protection.

[0124] This means that even if a user with extensive knowledge of the target system overlooks high-risk information, if a user with less knowledge of the target system inputs high-risk information, even if they are unsure, the system can perform information processing and output protection processing using that input information, thereby increasing security.

[0125] Figure 11 is an explanatory diagram showing an example of the screen configuration of the output information display screen 1101 output by the information processing system 101 applied to the IT support system. The output information display screen 1101 is a screen that displays information on which output protection has been applied by the output protection unit 201 as needed to the output information from the information processing unit 112, and is displayed on the display device 250 of the terminal 1001.

[0126] In the example of the output information display screen 1101 in Figure 11, the information processing unit 112 output countermeasure 1 and countermeasure 2 as a response to an inquiry from the user. However, the output of the information indicated by countermeasure 1 ("AAA") corresponds to one of the guard conditions indicated in the protection definition table 801, and output protection is performed by the output protection unit 201, which adds a warning message ("The current state is BBB, and the above countermeasure may result in CCC.") to the output of countermeasure 1.

[0127] Furthermore, if the output of the information indicated by countermeasure 2 falls under any of the guard conditions indicated in the protection definition table 801, the output protection unit 201 performs output protection on the output of countermeasure 2, stopping (deleting) the output of countermeasure 2 and adding a warning message ("The above countermeasure has been deleted because it poses a risk in the XXX state."). This makes it possible to prevent unsafe outputs, as demonstrated by the output protection performed on the output of the information indicated by countermeasure 2.

[0128] In particular, by including information with low accuracy in the risk analysis by the risk analysis unit 111, it becomes possible to process information and protect output without overlooking high-risk events, even if they have low accuracy.

[0129] Furthermore, if, for example, there is information deleted by the output protection unit 201 (countermeasure 2 in the example of Figure 11), a button 1102 may be displayed in the area that displays information about the deleted information. When button 1102 is selected, the information deleted by the output protection unit 201 is displayed. This allows the user to check the deleted information at their own responsibility if they deem it necessary.

[0130] Furthermore, the output information display screen 1101 may also display, for example, the input information used to derive each of the countermeasure proposals output by the information processing unit 112, and the accuracy of the input information calculated by the accuracy determination unit 110.

[0131] Furthermore, when the area where the input information and its accuracy are displayed is selected using the input device 240, a button 1103 may pop up. Button 1103 is an area for accepting corrections to the accuracy of the input information. Button 1103 allows the user to judge and correct the accuracy of the input information.

[0132] The corrected accuracy (for example, 100% accuracy if "correct" is selected, or 0% accuracy if "incorrect" is selected) is transmitted via button 1103 to the information processing unit 112 and the risk analysis unit 111, and the processing from step S903 onward may be re-executed using the corrected accuracy. This allows the information processing system 101 to output information while receiving corrections and instructions on accuracy from the user.

[0133] Furthermore, when "Error" is selected at button 1103, the corrected accuracy value (0% in the example above) should preferably be below the accuracy threshold. This ensures that information for which "Error" is selected is treated as information with low accuracy.

[0134] In the example shown in Figure 11, button 1103 accepts correction of the accuracy of the input information as a choice between "correct" or "incorrect," but it may also be possible to correct the accuracy by accepting the input of a specific numerical value.

[0135] <Information Processing by Multi-Agents> Example 3 shows an example in which the information processing unit 112 performs consensus by multiple agents. Example 2 mainly explains the differences from Example 1, and explanations of points that are the same as in Example 1 may be omitted as appropriate.

[0136] Figure 12 is a block diagram showing an example of the functional configuration of the information processing system 101. The information processing system 101 of Embodiment 3 differs from Embodiment 1 in that the information processing unit 112 includes a plurality of sub-information processing units 1201 and a decision-making unit 1202, that is, information processing is performed by a multi-agent system.

[0137] Each of the multiple sub-information processing units 1201 performs the information processing that the information processing unit 112 in Embodiment 1 executes, and transmits the processing results from the information processing to the decision unit 1202. For example, if the input information input to each of the multiple sub-information processing units 1201 is different, or if the parameters used for information processing by each of the multiple sub-information processing units 1201 are different, the processing results that each of the multiple sub-information processing units 1201 transmits to the decision unit 1202 may be different. The decision unit 1202 integrates the processing results received from each of the multiple sub-information processing units 1201 according to a predetermined decision algorithm and transmits them to the output protection unit 201.

[0138] For example, some of the multiple sub-information processing units 1201 (for example, one sub-information processing unit 1201) perform information processing on input information related to high risk but with low accuracy, which is input from the risk analysis unit 111, while the other sub-information processing units 1201 perform judgments on input information with high accuracy, which is input from the accuracy determination unit 110.

[0139] As a result, processing results based on risk are output from some of the sub-information processing units 1201, and processing results based on highly accurate input information are output from the other sub-information processing units 1201, making it possible to improve safety while increasing the accuracy of the consensus results.

[0140] Furthermore, in the deliberations by the deliberation unit 1202, the processing results based on input information that is inaccurate and high-risk may be impaired, and there is a possibility that high-risk processing results will be output. Therefore, as in Example 1, the output protection unit 201 can further enhance safety by providing protection against high-risk outputs.

[0141] <Example of application to a manufacturing robot system> Example 4 describes an example in which the information processing system 101 is applied to a manufacturing robot system. In Example 4, the differences from Example 1 will be mainly explained, and explanations of points that are the same as in Example 1 may be omitted as appropriate.

[0142] Figure 13 is an explanatory diagram illustrating an example of the application of the information processing system 101 to a manufacturing robot system. For example, the information processing system 101 is included inside the manufacturing robot 1301. In the example in Figure 13, the manufacturing robot 1301 is viewed from above. The manufacturing robot 1301 also has a robotic arm, and the range of motion of this robotic arm is the work area of ​​the manufacturing robot 1301.

[0143] In Embodiment 4, sensor information from the manufacturing robot 1301 or sensors placed around the manufacturing robot 1301 (sensors that measure numerical values ​​related to the state and operation of the manufacturing robot 1301, and sensors that measure numerical values ​​related to the state of the environment surrounding the manufacturing robot 1301), and control information for the manufacturing robot 1301 from a control system connected to the manufacturing robot 1301 are input to the information processing system 101 as input information.

[0144] The accuracy determination unit 110 calculates the accuracy of the input information using the same method as in Example 1 (for example, based on the accuracy information of the sensor attached to the sensor information). The risk analysis unit 111 identifies the context based on the sensor information using the same method as in Example 1.

[0145] Figure 14 shows an example of the data structure of the context definition table 1401 in Embodiment 4. In this embodiment, the context definition information 130 contains the context definition table 1401 shown in Figure 14, either in place of or in addition to the context definition table 301 shown in Figure 3.

[0146] The context definition table 1401 shows the correspondence between a context and a combination of elements, such as the distinction between inside and outside the work area, the number of people inside or outside the work area, the robot speed (arm speed), the weight of the object grasped by the robot arm, and the distance between the robot arm and the person, all of which are identified by sensor information and control information.

[0147] The information in the context definition table 1401 may be pre-set by the administrator of the information processing system 101, or it may be generated according to the results of the safety analysis by the risk analysis unit 111.

[0148] The risk analysis unit 111, similar to Embodiment 1, calculates the accuracy of the context using, for example, the reliability of the sensors themselves and control information that acquire the distinction between inside and outside the work area, the number of people inside or outside the work area, the robot speed, the weight of the object, and the distance between the robot arm and the person.

[0149] In Example 4, the same risk definition table 601 as in Example 1 is stored in the risk definition information 131. The risk analysis unit 111 calculates the context risk value and the converted risk value, for example, using the same method as in Example 1.

[0150] In other words, the risk analysis unit 111 obtains a risk value from the risk definition table 601 that corresponds to the context identified using the context definition table 1401. Furthermore, the risk analysis unit 111 calculates a converted risk value by multiplying the obtained risk value by the accuracy of the context.

[0151] The risk analysis unit 111 may calculate the risk value using the following formula instead of specifying the risk value using the risk definition table 601.

[0152] Risk=(Existence×Speed×Weight×Distance) / (Awareness×Expertise)

[0153] In the above calculation formula, "Risk" represents the risk value, "Existence" represents the number of people in the work area, "Speed" represents the robot speed, "Weight" represents the weight of the object grasped by the robot arm, "Distance" represents the distance between the robot arm and the people, "Awareness" represents the probability that people in the work area are aware of the robot arm's movements, and "Expertise" is an indicator of the amount of expertise that people in the work area possess regarding the manufacturing robot 1301.

[0154] The above formula includes the product of "Awareness," which indicates the person's situation, and "Expertise," which indicates the person's characteristics, in its denominator. Therefore, the risk is lower if the person is aware of the robot arm's movements, and the risk is lower if the person is an expert on the manufacturing robot 1301. When the risk value can be expressed in a formula in this way, the calculation of the risk value becomes easier.

[0155] Furthermore, "Awareness" can be calculated from sensor information, for example, and "Expertise" can be identified from the results of human identification based on sensor information and information about the amount of pre-defined expertise. In addition, "Awareness" and "Expertise" may be used to identify the context (they may be included in the items of the context definition table 1401).

[0156] Furthermore, when the risk analysis unit 111 calculates a risk value using the calculation formula described above, it can calculate the accuracy of the risk value by multiplying it by the accuracy of each parameter of the calculation formula (calculated by the accuracy determination unit 110) as a percentage, and then calculate the converted risk value by multiplying the risk value by that accuracy.

[0157] Furthermore, for example, a table may be pre-configured in which the values ​​of each parameter in the above calculation formula are defined in stages (for example, "Distance" is defined in stages as "near," "medium," and "far" for each range of distance values), and the risk analysis unit 111 may calculate the risk value using the staged values ​​converted by the pre-configured table. This makes it easier to reduce the amount of calculation and to match the results with those of safety analysis and risk analysis.

[0158] The information processing unit 112 performs information processing using highly accurate input information and input information that is less accurate but high-risk, similar to the first embodiment. In the fourth embodiment, the information processing unit 112 performs information processing such as generating a robot arm trajectory plan and control output using sensor information, which is an example of input information. Even with less accurate input information, the information processing unit 112 can perform trajectory planning and control output that takes into account the context and input information for input information corresponding to a high-risk context.

[0159] Figure 15 shows an example of the data structure of the protection definition table 1501 in Embodiment 4. In this embodiment, the protection information 132 stores the protection definition table 1501 shown in Figure 15, either in place of or in addition to the protection definition table 801 shown in Figure 8.

[0160] In the example of the protection definition table 1501 in Figure 15, in a context where there is a possibility of a person (worker, etc.) being present within the robot arm's work area, the information processing unit 112 outputs a trajectory plan that would cause the robot arm to collide with that person, and a countermeasure (emergency stop) is defined to prevent a collision between the robot arm and the person, based on that condition. The output protection unit 201 performs output protection based on the protection definition table 1501 in Figure 15, thereby achieving protection against high-risk outputs and ensuring safety.

[0161] In the example where the manufacturing robot 1301 is controlled, as in Example 4, it is desirable to assign accuracy not only to the accuracy of the context itself, but also to the recognition results of individual objects (people, the manufacturing robot 1301, and other objects, etc.) that are the subject of risk analysis.

[0162] For example, even if the accuracy of the input information regarding the recognition results (object recognition) for objects surrounding the robot arm is high, if the accuracy of the input information regarding the recognition results (object recognition) for people within the robot arm's work area is low, it is desirable to make a decision based on the accuracy of the recognition results for people rather than the accuracy of the context which is the average of the recognition results for objects and people.

[0163] Specifically, for example, accuracy is assigned only to the processing of input information related to the recognition result of people, while the accuracy of the recognition result of other objects is judged to be 100% and not used in numerical calculations of the context (such as averaging). In particular, when the accuracy of the input information related to the recognition result of people is low, information processing and output protection are carried out using high-risk input information that has low accuracy, so as not to increase the risk of people being harmed by discarding that input information during information processing. This makes it possible to enhance safety, especially for people.

[0164] As described above, the information processing systems 101 in Examples 1 to 4 are capable of performing information processing while considering both accuracy and risk analysis results, thereby enhancing safety against uncertain inputs.

[0165] Furthermore, the information processing system 101 can further enhance the safety of its output by taking into account the risk analysis results when protecting the output of the information processing results.

[0166] In particular, by utilizing information that is less accurate but high-risk, the information processing system 101 can take into account situations where even low-accuracy information that might be discarded in normal processing poses a risk, thereby achieving appropriate information processing and output protection, and further enhancing safety.

[0167] Furthermore, in risk analysis, the information processing system 101 derives the context of the target system and the accuracy of that context, enabling risk assessment appropriate to the situation of the target system and thereby improving safety.

[0168] In particular, the information processing system 101 uses safety analysis methods to perform risk analysis using the probabilities and structures of events that may occur in a hazardous situation, thereby facilitating probability calculations and event identification. Furthermore, by allowing the thresholds used for accuracy determination and risk level determination in the information processing system 101 to be set by user input, information processing that matches the user's intentions becomes possible.

[0169] It should be noted that the present invention is not limited to the embodiments described above, and various modifications are included. For example, the embodiments described above are described in detail to make the present invention easier to understand, and are not necessarily limited to those having all the configurations described. It is also possible to replace parts of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add configurations from other embodiments to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace parts of the configuration of each embodiment with other configurations.

[0170] Furthermore, each of the above configurations, functions, processing units, processing means, etc., may be implemented in hardware, either partially or entirely, by designing them as integrated circuits, for example. Alternatively, each of the above configurations, functions, etc., may be implemented in software by having the processor interpret and execute programs that realize each function. Information such as programs, tables, and files that realize each function can be stored in memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card, SD card, or DVD.

[0171] Furthermore, the control lines and information lines shown are those deemed necessary for explanatory purposes, and not all control lines and information lines are necessarily shown in the actual product. In reality, it is safe to assume that almost all components are interconnected.

Claims

1. An information processing system that performs information processing related to a target system, comprising a processor and a memory, wherein the memory holds input information relating to the target system input to the information processing system, information indicating the accuracy of the input information, a context indicating the state of the target system, and a risk definition information indicating the magnitude of risks relating to the target system that may occur in the context, and the processor identifies the current context of the target system based on the input information, identifies the risk value based on the identified context and the risk definition information, derives a risk determination result including a converted risk value based on the identified risk value and the accuracy of the input information used to identify the identified context, selects at least a portion of the input information based on the accuracy and the risk determination result, and performs the information processing using the at least portion.

2. An information processing system according to claim 1, wherein the processor performs the information processing using high-accuracy information which is input information whose accuracy is equal to or greater than an accuracy threshold, and low-accuracy, high-risk information which is input information whose accuracy is less than the accuracy threshold and which is used to identify a context in which the converted risk value is equal to or greater than a conversion threshold.

3. An information processing system according to claim 2, wherein the low-accuracy, high-risk information includes the input information used to identify a context in which the accuracy is less than the accuracy threshold and the identified risk value is equal to or greater than the pre-conversion threshold, and the conversion threshold is less than or equal to the pre-conversion threshold.

4. An information processing system according to claim 2, wherein the processor is connected to an input device and accepts the setting of the accuracy threshold and the conversion threshold according to the input to the input device.

5. An information processing system according to claim 2, wherein the processor performs sub-information processing including information processing using the high accuracy information and information processing using the low accuracy high risk information, and integrates the processing results of the sub-information processing.

6. An information processing system according to claim 1, wherein an accident that may occur in the target system and a state that may lead to the accident are predetermined, the processor identifies an event that may cause the state that may lead to the accident based on the state that may lead to the accident and a predetermined safety analysis method, determines the state that may lead to the accident in the context, calculates the amount of damage from the accident based on the predetermined safety analysis method, and calculates the risk value to be stored in the risk definition information based on the determined context, the probability of the event that may occur in the determined context, and the amount of damage.

7. An information processing system according to claim 1, wherein the input information is generated according to input from a user of the target system, the accuracy information indicates the user's knowledge level, and the higher the knowledge level, the higher the accuracy.

8. An information processing system according to claim 1, wherein the memory holds protective information indicating the context, guard conditions, and countermeasures relating to the output of the information processing, and the processor implements countermeasures corresponding to the protective information for the specified context and the satisfied guard conditions, provided that the converted risk value is greater than or equal to a conversion threshold, the specified context is included in the protective information, and the guard conditions corresponding to the specified context in the protective information are satisfied by the processing result of the executed information processing.

9. An information processing system according to claim 8, wherein the processor implements the measures in the protective information corresponding to the specified context and the satisfied guard condition, when the specified risk value is greater than or equal to the pre-conversion threshold, the specified context is included in the protective information, and the guard condition in the protective information corresponding to the specified context is satisfied by the processing result of the executed information processing, and the conversion threshold is less than or equal to the pre-conversion threshold.

10. An information processing system according to claim 8, wherein an accident that may occur in the target system and a state that may lead to the accident are predetermined, the processor identifies an event that may cause the state that may lead to the accident based on the state that may lead to the accident and a predetermined safety analysis method, determines the state that may lead to the accident in the context, and, based on the predetermined safety analysis method, determines that the accident will occur if the event occurs in the determined context, stores the event in the protective information as the guard condition corresponding to the determined context.

11. An information processing system according to claim 8, comprising: an input device and a display device for displaying the processing results of the information processing, wherein the countermeasure includes stopping the display of the processing results of the information processing on the display device, and the processor, when stopping the display of the processing results of the executed information processing on the display device is implemented as the countermeasure, displays a message indicating that the display on the display device has been stopped, and displays the processing results for which the display on the display device has been stopped on the display device in accordance with the input to the input device.

12. An information processing system according to claim 1, wherein the processor is connected to an input device and a display device for displaying the processing results of the information processing, the processor displays on the display device the processing results of the information processing performed, as well as input information used in the information processing performed and information indicating the accuracy of the input information, corrects the accuracy of the input information used in the information processing performed according to the input to the input device, re-derives a risk determination result including a converted risk value based on the identified risk value and the corrected accuracy of the input information used to identify the identified context, re-selects at least a portion of the input information based on the corrected accuracy and the re-derived risk determination result, and executes the information processing using at least a portion of the re-selected portion.

13. An information processing system according to claim 1, wherein the input information includes a question about the target system entered by a user of the target system, and the information processing includes a process of generating and outputting an answer to the question.

14. An information processing system according to claim 1, wherein the input information includes sensor information from sensors that measure the state and operation of a robot and sensors that measure the surrounding environment of the robot, and the information processing includes motion control of the robot based on the sensor information.

15. An information processing method by an information processing system that performs information processing related to a target system, wherein the information processing system has a processor and a memory, the memory holds input information relating to the target system input to the information processing system, information indicating the accuracy of the input information, a context indicating the state of the target system, and a risk definition information indicating the magnitude of risks relating to the target system that may occur in the context, the information processing method comprising: the processor identifying the current context of the target system based on the input information; the processor identifying the risk value based on the identified context and the risk definition information; the processor deriving a risk determination result including a converted risk value based on the identified risk value and the accuracy of the input information used to identify the identified context; the processor selecting at least a portion of the input information based on the accuracy and the risk determination result; and the processor performing the information processing using the at least a portion.

Images