Patent Application
20130031086
Disclosed embodiments relate to the field of process automation systems, and more particularly to the management of problems exhibited by process automation systems.
A process automation system refers to a control system, usually of a manufacturing system or process in which the controller elements may or may not be central in location. In a distributed implementation, called a distributed control system (DCS), the controller elements are distributed throughout the control system with each component sub-system controlled by one or more controllers. The distributed system of controllers may be connected by a network for communication and monitoring.
A process automation system will typically have a problem report system wherein log messages related to problems or failures of various software and hardware components of the process automation system are generated. There is a large variety of different error messages, process identifiers and other data that may be written in a log message. Such logs may include, for instance, information about excessive usage of memory or central processing unit (CPU), as well as information about events, such as lost connection between a station and a server. Logs are typically stored in text files, which are viewed by individuals, such as support engineers, or analysts attempting to discern the problem being reported. Lengthy text files, however, can be difficult and tedious to review manually. Consequently, it can be time-consuming for an individual to pore over extensive lists of text in order to identify and isolate problems. Further, this manual process is prone to human error.
One existing approach to handling log messages includes an interface that highlights certain logs or log properties and provides basic log message visualization. This approach, however, leaves it up to the support engineer or analyst to discern the frequency of certain messages, the relationship between the messages and the time each message was transmitted. Consequently, this approach requires a human operator to wade through large amounts of textual data when attempting to identify the cause of a problem in various software and hardware components of the process automation system, which is time consuming and prone to human error. Therefore, there is a need for a more efficient method and system for facilitating an individual such as a support engineer or analyst in determining the causes of problems exhibited by process automation systems.
Disclosed embodiments include an automated data processing method. The method includes providing a plurality of incident data (e.g., in the form of log messages) from a physical installation of a process automation system in a processing facility that collectively spans a period of time, and building a relational database including database data from the incident data. The method further includes data processing that automatically generates at least one processed data result from the database data, such as the frequency by type of message, and the relationship between the messages. The processed data result is in a displayable form (e.g., graph form) that upon display facilitates identification of a problem in the process automation system by an individual, such as an analyst or a support engineer.
A system for performing automated data processing includes a receiver for receiving a plurality of incident data from a physical installation of a process automation system in a processing facility that collectively spans a period of time, and a non-transitory machine readable storage device for storing database data from the incident data. The system further includes a processor configured for automatically generating at least one processed data result from the database data, wherein the processed data result is in a displayable form that facilitates identification of a problem in the process automation system by an individual, such as an analyst.
Disclosed embodiments are described with reference to the attached figures, wherein like reference numerals are used throughout the figures to designate similar or equivalent elements. The figures are not drawn to scale and they are provided merely to illustrate certain disclosed aspects. Several disclosed aspects are described below with reference to example applications for illustration. It should be understood that numerous specific details, relationships, and methods are set forth to provide a full understanding of the disclosed embodiments. One having ordinary skill in the relevant art, however, will readily recognize that the subject matter disclosed herein can be practiced without one or more of the specific details or with other methods. In other instances, well-known structures or operations are not shown in detail to avoid obscuring certain aspects. This Disclosure is not limited by the illustrated ordering of acts or events, as some acts may occur in different orders and/or concurrently with other acts or events. Furthermore, not all illustrated acts or events are required to implement a methodology in accordance with the embodiments disclosed herein.
Disclosed embodiments include methods and systems for performing automated data processing of log messages, or incident data, in order to determine the cause of problems or failures of various software or hardware components of the process automation system.
The analytical system 101 deployed in the remote support center system 108 receives information about process automation system 100 deployed in the industrial facility 150, which may be a power plant, in one particular example. Namely, the process automation system 100 sends to the analytical system 101 log messages, or incident data, from its various software and hardware components distributed throughout the industrial facility 150 pertaining to problems or failures of those software and hardware components, i.e., incidents. A software process ran by a hardware component may comprise multiple threads. The term “log” or “log message” is herein used to refer to a message that may include a date/time stamp, a process identifier, a thread identifier, an error message or other data surrounding the problem being reported. A log may be in the form of a text message.
Below is a textual example of a log message, wherein “28-Oct-10” represents the date of the message, “14:34:34.5998” represents the time of the message, “9416” represents an identifier for the software process that spawned the message, “8216” represents an identifier for the thread within the software process that spawned the message, “gdamngr.exe:cdadll.cpp” usually represents the name of the software process in the message, and “GUninitialize( ) called” represents an error message, which may indicate a line of source code that caused the error or failure that spawned the message.
28-Oct-10 14:34:34.5998 (9416 8216) gdamngr.exe:cdadll.cpp:1: GUninitialize( ) called
In summary, the log message above indicates that on the identified date and time, the software process named “gdamngr.exe:cdadll.cpp” generated a “GUninitialize( )” error message, which indicates an error in setting a variable. The log messages received from the process automation system 100 installed in the industrial facility 150, as well as any other data calculated or generated by analytical system 101, may be stored in non-transitory machine readable storage 106 as a relational database 111 comprising database data.
The relational database 111 is sourced from the incident data. A “relational database” as used herein is a database that matches data by using common characteristics found within the data set, and the resulting groups of data are organized for ease of understanding. Such a grouping uses the relational model. Accordingly such a database is called a “relational database.” The software used to do this grouping is generally called a relational database management system (RDBMS).
In one particular embodiment, the relational database 111 comprises a Structured Query Language (SQL) database that can be stored in memory associated with a database server. SQL can be employed to access data, and also to define the form of the database, i.e., describe the tables, and describe indexes and views of the tables and other objects of the database. SQL is a high level programming language specifically designed for the database product, and permits a user to access or define elements without resorting to a lower-level language or assembly.
As explained in greater detail below with reference to
Step 202 comprises building a relational database 111 including database data comprising the incident data, such as in the form of log messages, where the analytical system 101 stores the relational database 111 on non-transitory machine readable storage 106. In step 203, processor 120 of the analytical system 101, running a disclosed algorithm, processes the incident data stored in the relational database 111 and automatically generates at least one processed data result that is in a displayable form which facilitates identification of a problem at the process automation system 100 deployed in the industrial facility 150 by an individual, for display on user interface 103.
The displayable form can comprise one or more graphical representations of the data stored in the relational database 111, as shown in the example user interfaces of
In step 204, processor 120 of the analytical system 101, running a disclosed algorithm, can generate a trend graph, such as shown in
In step 206, processor 120 of the analytical system 101, running a disclosed algorithm, processes the log messages stored in relational database 111 and can generate a histogram illustrating a frequency of log messages corresponding to each process identifier over a specified time interval, as shown in
In step 208, processor 120 of the analytical system 101, running a disclosed algorithm, processes the incident data, such as log messages, stored in the relational database 111, and can generate a sequential graph, as shown in
In step 210, processor 120 of the analytical system 101, running a disclosed algorithm, processes the incident data stored in machine readable storage 106 as relational database 111, such as in the form of log messages, and can generate a tree graph, as shown in
Another function of the tree graph 602 of
In step 212, processor 120 of the analytical system 101, running a disclosed algorithm, displays one or more of the graphical representations of
In another embodiment, step 214 may further include the use of artificial intelligence algorithms configured for obtaining knowledge from the incident data, such as in the form of log messages, stored in relational database 111 and discerning a cause of the problems reported by the log messages. The aforementioned algorithms may analyze the correlation among particular incidents in order to discern and store, for future use, patterns that lead to indications of an incident. For example, a particular stored pattern may include a list of process/thread identifiers, a time profile that indicates when the aforementioned process/thread identifiers are featured in log messages, and a log message count profile that indicates the number of log messages that are associated with each process/thread. Also associated with the stored pattern may be a cause of the incident and a known fix for the problem. In this example, the processor 120 of analytical system executes the aforementioned artificial intelligence algorithms to compare current log message activity against the stored pattern. If there is a match between the current log message activity and the stored pattern, the analytical system 101 may then conclude that the cause of the incident associated with the stored pattern, and the corresponding fix, are related to the current log message activity.
In step 216, the analytical system 101 automatically identifies information associated with a cause of the problem instigating the log messages, and/or a fix for the problem, according to the algorithm(s) executed in step 214 and in step 218 displays the information in the user interface 103 for the analyst 110 or other individual.
While various disclosed embodiments have been described above, it should be understood that they have been presented by way of example only, and not limitation. Numerous changes to the subject matter disclosed herein can be made in accordance with this Disclosure without departing from the spirit or scope of this Disclosure. In addition, while a particular feature may have been disclosed with respect to only one of several implementations, such feature may be combined with one or more other features of the other implementations as may be desired and advantageous for any given or particular application.
The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting. As used herein, the singular forms “a,” “an,” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. Furthermore, to the extent that the terms “including,” “includes,” “having,” “has,” “with,” or variants thereof are used in either the detailed description and/or the claims, such terms are intended to be inclusive in a manner similar to the term “comprising.”
As will be appreciated by one skilled in the art, the subject matter disclosed herein may be embodied as a system, method or computer program product. Accordingly, this Disclosure can take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a “circuit,” “module” or “system.”Furthermore, this Disclosure may take the form of a computer program product embodied in any tangible medium of expression having computer usable program code embodied in the medium.
Any combination of one or more computer usable or computer readable medium(s) may be utilized. The computer-usable or computer-readable medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device. More specific examples (a non-exhaustive list) of the computer-readable medium would include non-transitory media including the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a portable compact disc read-only memory (CDROM), an optical storage device, or a magnetic storage device.
Computer program code for carrying out operations of the disclosure may be written in any combination of one or more programming languages, including an object-oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the “C” programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider).
The Disclosure is described below with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
These computer program instructions may also be stored in a physical computer-readable storage medium that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable medium produce an article of manufacture including instruction means which implement the function/act specified in the flowchart and/or block diagram block or blocks.
The computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
