Efficient Data-Driven Theory Revision System

1. Field of the Invention

The present invention relates to a part of a "theory revision" system that identifies a revision which produces a theory with highest accuracy and more particularly, to a system that efficiently uses a given set of annotated session transcripts and a given set of possible theory-to-theory revision operators to modify a given theory, encoded as a fault hierarchy, to form a new theory that is optimally accurate.

2. Description of the Prior Art

Many expert systems use a fault hierarchy to propose a repair for a device based on a set of reported symptoms test values. Unfortunately, such systems may return the wrong repair if their underlying hierarchies are incorrect. A theory revision system uses a set, C, of "labeled session transcripts" (each transcript includes answers to the tests posed by the expert system and the correct repair as supplied by a human expert) to modify the incorrect fault hierarchy, to produce a new hierarchy that will be more accurate. Typical revision systems compare the initial hierarchy, KB, with each of its neighbors in N(KB)={KB.sub.k }, where each KB.sub.k is formed from KB by performing a single simple revision, such as deleting a connection between a pair of fault nodes, or altering the order in which some fault nodes are considered. These revision systems will climb from KB to a neighboring KB* .epsilon. N(KB) if KB*'s empirical accuracy over C is significantly higher than KB's.

There are many theory revision systems described in the machine learning literature. Most resemble the present invention by using a set of transformations to convert one theory to another. Many of the other systems, however, focus on Horn clause knowledge bases or decision trees; representations that are not particularly suited to deployed application systems. It is an object of the present invention to use the widely deployed fault hierarchy representation. Further, the modifications suggested by existing theory revision systems could result in theories which would be rejected by domain experts. It is a further object of the present invention to suggest modifications which preserve the structure of the fault hierarchy, and so are more likely to be acceptable to domain experts. Finally, these prior art systems assume that the training data (i.e., the annotated session transcripts), used to decide which knowledge base is most accurate, will include answers to all relevant tests. This is not realistic in many standard situations, where each training instance includes only the minimal amount of information required to reach an answer, relative to a particular theory. In contrast, the DELTADELTA system of the present invention is designed to evaluate any theory's accuracy, even with incomplete data.

Moreover few of these systems are concerned with computational efficiency. In particular, the obvious way to implement each hill climbing step involves first empirically evaluating the initial KB and each KB.sub.i .epsilon. N(KB), over the entire set of case reports. However, it can be very expensive to evaluate a single hierarchy on a single report, and worse, there can be a great many reports and huge number of neighbors. It is an object of the present invention to provide an efficient way to determine which KB.sub.i .epsilon. N(KB) has the highest empirical accuracy, if that accuracy is greater than KB's.

The present invention is a computer system, known as DELTADELTA, which takes as input an initial fault hierarchy KB.sub.0 and a set of annotated session transcripts C={<.pi..sub.j,r.sub.j >}, where .pi..sub.j includes the answers to all tests presented to the expert system, and the correct repair r.sub.j is supplied by a human expert. The present invention is given a specified set of revision operators T={.theta..sub.i } where each .theta..sub.i .epsilon. T maps a fault hierarchy KB to a slightly different hierarchy .theta..sub.i (KB). This revised fault hierarchy .theta..sub.i (KB) is called a neighbor of KB, and the set of all neighbors of KB, N(KB)={.theta..sub.i (KB)}, is KB's neighborhood.

The present invention uses T to hill climb from the initial fault hierarchy KB.sub.0, through successive hierarchies, KB.sub.1 . . . KB.sub.m, with successively higher empirical accuracies over C; the final hierarchy, KB.sub.m, is a local optimum in the space defined by the revision operators. At each stage, to go from a fault hierarchy KB.sub.k to its neighbor KB.sub.k+1, the present invention must evaluate KB.sub.k 's accuracy over C, as well as the accuracy of each KB' .epsilon. N(KB.sub.k). Let KB* be the hierarchy with the largest empirical accuracy. If this KB* is more accurate than KB.sub.k, this KB* hierarchy becomes the new standard, labeled KB.sub.k+1, and the theory revision process iterates, seeking a neighbor of this KB.sub.k+1, that is more accurate than KB.sub.k+1 over the set of examples C, and so forth. Otherwise, if no KB' is more accurate than KB.sub.k, the hill climbing process will return this KB.sub.k, and terminate. The present invention differs from the Delta system, described in application Ser. No. 08/583,249, filed Jan. 5, 1996, by providing an efficient means for evaluating the accuracy of a set of knowledge bases, KB' .epsilon. N(KB.sub.k).

If the labeled session transcripts C={<.pi..sub.j,r.sub.j >} are complete (that is, each c.sub.j .epsilon. C contains answers to every possible test in KB) then it is straightforward to evaluate KB's empirical accuracy over C. In practice, however, C is typically incomplete, as each .pi..sub.j contains only a small subset of the test values in KB. The theory revision system of the present invention provides a way of evaluating the empirical accuracy of KB, and each KB' .epsilon. N(KB), even when C is incomplete.

Moreover, the evaluator (within the theory revision system) of the present invention provides an efficient way of evaluating the accuracy of KB.sub.k, and each .theta..sub.i (KB.sub.k), towards determining which, if any, .theta..sub.i (KB.sub.k) is more accurate than KB.sub.k. It exploits a few key observations. First, as each transformation used in the present invention to map one hierarchy to a related one performs only local changes to the hierarchy, it will have only minor, and easily computed, effects on any instance. Second, most transformations will have no effect on many instances. Finally, one can bound how much the accuracy score for a knowledge base can change based on any instance, which means branch-and-bound techniques can be used to avoid computing the accuracy scores for various hierarchies that cannot be optimal. For these reasons, a straightforward analysis allows for the system to avoid a great deal of brute-force empirical computation.

FIG. 1 illustrates an overall theory revision task that utilizes the present invention.

FIG. 2 illustrates the structure of a fault hierarchy (KB.sub.0) used by one embodiment of the present invention.

FIG. 3 illustrates the EVALKB and EVALNODE Subroutines of one embodiment of the present invention.

FIG. 4 illustrates the ACCKB Subroutine of one embodiment of the present invention.

FIG. 5 illustrates that nodes can be dependent, even if distinct tests are independent. ACCNODE* will correct this problem.

FIG. 6 illustrates the ACCNODE* Subroutine of one embodiment of the present invention.

FIG. 7 illustrates the dependencies between parent and child nodes, which will cause ACCNODE* Subroutine to produce incorrect response.

FIG. 8 illustrates the DELTADELTA Subroutine of one embodiment of the present invention.

FIG. 9 illustrates the RTP and RTM Subroutines of one embodiment of the present invention.

FIG. 10 illustrates the initial KB.sub.before and the subsequent KB.sub.after hierarchies used by one embodiment of the present invention.

FIG. 11 illustrates the RTI.sub.-- ELIGIBLE and associated Subroutines of one embodiment of the present invention.

FIG. 12 illustrates the information required by any single step in the theory revision process.

FIG. 1 illustrates the overall theory revision task. The overall task is also described in U.S. patent application, Ser. No. 08/583,249, entitled "The Delta Learning System For Using Expert Advice To Revise Diagnostic Expert System Fault Hierarchies", Filed Jan. 5, 1996, assigned to the same assignee as the present invention and hereby incorporated by reference. Given a knowledge base 11 KB and user feedback (a set of training examples, each a session transcript 12 annotated by a correct answer) a theory revision system 13 produces a new knowledge base KB' which exhibits better performance over the training examples. In more detail, session transcripts 12 are collected after deploying the expert system 14 to field users 15. Each transcript 12 will include answers to the tests requested by the expert system 14 as well as the repair suggested by the expert system 14. When appropriate (such as when the suggested repair is incorrect), a domain expert 16 will annotate these transcripts to indicate missing tests and appropriate repairs. The theory revision system 13 (such as the present invention) uses these annotated transcripts as training data to suggest revisions to the knowledge base 11. Finally, the domain expert 16 evaluates these revisions to decide whether to incorporate them into the knowledge base 11 which can then be redeployed.

Many currently deployed expert systems use a fault hierarchy to propose a repair for a device, based on a set of reported symptoms. Unfortunately, due to modifications of the basic devices, new distribution of faults as the device ages and the installation of new devices, as well as errors in the original knowledge base, these proposed repairs may not always be the correct repair. A "theory revision" system uses a set of "labeled session transcripts" to modify the incorrect fault hierarchy to produce a new hierarchy that is more accurate. As no efficient algorithm is guaranteed to find the globally-optimal hierarchy, many projects implement their theory revision systems as a hill-climbing process that climbs, in a series of steps, to a hierarchy whose accuracy is locally optimal. On each step, each such system computes the empirical accuracy, relative to the given set C of labeled session transcripts, of the current hierarchy KB and each of KB's "neighbors", N(KB)={KB.sub.k }, where each neighbor KB.sub.k .epsilon. N(KB) is a slight modification of KB. The theory revision system then selects the neighbor KB* .epsilon. N(KB) with the highest empirical accuracy and if KB*'s accuracy is greater than KB's, the theory revision process iterates. It then compares this KB* with each of its neighbors and climbs to any neighbor that is better. If the labeled session transcripts C={<.pi..sub.j,r.sub.j >}, are complete (that is, each C.sub.j .epsilon. C contains answers to every possible test in KB) then it is straightforward to evaluate KB's empirical accuracy over C. In practice, however, C is typically incomplete, as each .pi..sub.j contains only a small subset of the test values in KB. The theory revision system of the present invention provides a way of evaluating empirical accuracy of a fault hierarchy and each of its neighbors, relative to a given set of labeled session transcripts, even when the transcripts are incomplete.

The present invention provides an efficient way of evaluating the empirical accuracy of a fault hierarchy and each of its neighbors, relative to a given set of labeled case reports. This application will provide the framework for the present invention, by describing the operation of the underlying expert system and summarizing the theory revision task. It will next describe ways of implementing a theory revision system for this task: first summarizing the obvious exhaustive algorithm, then providing the insights that lead to a more efficient "data-driven" theory revision system and finally describing the DELTADELTA algorithm of the present invention.

The following defines the structures of both fault hierarchies and of problem instances and then describes how a fault-hierarchy-based expert system works: by evaluating a hierarchy in the context of an instance to produce a repair. Each fault hierarchy KB=<N, E, TS, R, t(.multidot.), r(.multidot.), child(.multidot.,.multidot.)>is a directed-acyclic forest <N,E>, whose nodes, N, represent faults, and whose edges, E, connect faults to subordinate faults. Each node n .epsilon. N is labeled with a test t(n)=t or t(n)=t, where t .epsilon. TS. In addition, each leaf node is also labeled with a "repair", r(n)=r .epsilon. R. The arcs under each internal node are ordered; child(n,i) refers to the "i.sup.th child of n". To simplify the notation, let the k:N.fwdarw.Z.sup.+ function map each node to its number of children, and let the 1:N.fwdarw.Z.sup.+ function map each node to its number of parents.

For example, consider the hierarchy shown in FIG. 2, where the test associated with the node .chi. is T.sub..chi.. Hence, the test associated with the A node is T.sub.A, etc. The r.sub..chi. expression is the repair labeling the associated leaf node .chi.. Hence, the repair associated with the node D, whose test is T.sub.D, is r.sub.D. A's children are, in order, C, D and E. Hence child(A, 1)=C, child(A, 2)=D and child(A, 3)=E. Here, k(A)=3. Similarly, 1(A)=1.

When run, the expert system that uses the KB hierarchy, called S.sub.KB, will ask the user a series of questions. These questions correspond to a depth-first, left-to-right, no-backtrack traversal of (part of) the KB structure. Here, S.sub.KB0 begins at the root, and asks the question associated with that node; here "Is T.sub.Z true?". If the user answers "yes", S.sub.KB0 descends to consider Z's children, in left-to-right order, here next asking "Is T.sub.A true?". If the user responds "Yes", S.sub.KB0 will descend to A's children. If the user answers T.sub.C with "No", S.sub.KB0 will continue to C's sibling D, and ask about T.sub.D. Assuming the user responds "Yes" here, S.sub.KB0 will return the repair associated with that leaf node, D, here r.sub.D. On the other hand, if the user had responded "No" to T.sub.D, S.sub.KB0 would have continued to ask about T.sub.E. If this answer was "Yes", S.sub.KB0 would return r.sub.E. Otherwise, if this answer was also "No", S.sub.KB0 would return the "No-Repair-Found" answer, r.sub..perp.. N.b., S.sub.KB0 will not then continue to B; answering T.sub.A with "Yes" means the user will only consider tests and repairs under this node.

Ignoring the details of the actual user-interaction, each "total problem instance" is an assignment .pi.: TS.fwdarw.{+,-} that maps each test to one of {+,-}, where "+" means the test was confirmed (passed), and "-" means the test was disconfirmed (failed). Given an instance .pi., S.sub.KB will return a repair r .epsilon. R, written as EVALKB(KB, .pi.)=r. This r is the value returned by EVALNode(ROOT(KB), .pi.), using the EVALNode subroutine shown in FIG. 3, where n.sub.root =ROOT(KB) is KB's root. On calling EVALNode, it is assumed that the test associated with n.sub.root has already been confirmed, i.e., that .pi.(t(n.sub.root))=+. This test t(n.sub.root) is viewed as the symptom or triggering information. S.sub.KB only considered using this subtree after it observed this test value. It is also assumed that the root's test has been confirmed when dealing with the ACCKB subroutine defined below.

The accuracy of the hierarchy KB for the instance .pi. is ##EQU1## where the correct answer to the instance is r.sub.cor .epsilon. R. (This r.sub.cor repair is often supplied by a human expert.) In general, such a pair <.pi.,r.sub.cor) will be referred to as a "labeled (total) problem instance". Over a set of labeled instances (a.k.a. session transcripts) C={<.pi..sub.i,r.sub.i >}.sub.i, KB's (empirical) accuracy is ##EQU2##

The average accuracy is this value divided by the number of examples, .vertline.C.vertline..

These computations assume that S.sub.KB is always able to obtain answers to all relevant tests. This is not always true in the theory revision context. Here, the theory revision system may only know some of the required answers. To allow us to consider the results an expert system might produce in such contexts, we use a "partial problem instance" .pi.: TS.fwdarw.{+,-, ?} where ".pi.(t)=?" means that the value of the test t is not known.

Each such partial instance .pi. really corresponds to some total instance a .pi.', where certain test values are not observed. To state this more precisely, say that the total problem instance .pi.': TS.fwdarw.{+,-} is a completion of .pi. if .pi.' agrees with .pi. whenever .pi.(t) is categorical (i.e., is not "?"):

Hence the total instance

is a completion of the partial instance

Let

refer to the set of total instances that complete a given partial instance.

In general, the probability Pr›.pi.'.vertline..pi.! that the observed partial instance .pi. corresponds to the total instance .pi.'.epsilon. Complete(.pi.) depends on the probability that each unobserved test t (i.e. where .pi.(t)="?") has the specified value .pi.'(t). Here, the probability that the observed .pi..sub.P1 corresponds to the actual total .pi..sub.T1, depends on the probabilities that T.sub.B =-, T.sub.E =+ and T.sub.F =-. It will be assumed that these tests are independent (of each other and other context) which means this conditional probability can be expressed in terms of the probability function p:TS.fwdarw.›0,1!, where p(t)is the probability that the unobserved test t would succeed, if only it had been run and reported.

Notice that each .pi.' .epsilon. Complete(.pi.) has an associated repair, r.sub..pi.' =EVALKB(KB,.pi.'); we can therefore use the p(.multidot.) values to compute the probability that S.sub.KB0 will return each r.sub..pi.', given the observed values .pi.. In general, we will need to compute the probability that S.sub.KB0 will return the correct repair r.sub.cor, Pr›S.sub.KB0 returns r.sub.cor .vertline..pi. observed!. As this quantity corresponds to acc(KB, <.pi.,r.sub.cor)) when .pi. is a total instance, acc(.multidot.,.multidot.) can be extended to be this probability value in general, even when .pi. is a partial instance. (The p(.multidot.) function is implicit in this acc(KB, <.pi.,r.sub.cor >) description.)

The ACCKB subroutine illustrated in FIG. 4 computes this accuracy score, for a partial problem instance .pi.. It returns the correct value whenever the tests associated with the nodes are independent; i.e., if the event that one node's test t(n) is confirmed is independent of whether any of the other node's test t(n') was confirmed. Unfortunately, this is not always the case. If all nodes are labelled with different tests (i.e., n.noteq.n' implies t(n).noteq.t(n')), then this condition holds whenever the tests are independent--which can be assumed. However, this independent node condition can fail if different nodes are labelled with the same test, even if the tests are independent. For example, consider the structure shown in FIG. 5, where n.sub.1 =child(n,1) is labeled with the test t.sub.1, n.sub.2 =child(n,2) is labled with test t.sub.1 and n.sub.3 's repair is the correct r.sub.cor ; and assume S.sub.KB has reached and traversed this top n with probability 1 (i.e., the t.sub.0 test is known to succeed). Here ACCKB will compute that the probability of reaching n.sub.3 =child(n, 3) is (1-p(t.sub.1)).times.p(t.sub.1), which suggests the probability of success is p(t.sub.3).times.›(1-p(t.sub.1)).times.p(t.sub.1)!. Of course, the real probability of this event is 0.

Unfortunately, for general dag-structures, the task of computing the probability of reaching any particular repair and hence of computing acc(KB, c) is NP-hard. It cannot be expected to have an efficient algorithm that will compute the correct answer in every situation. Instead, algorithms can be utilized that work correctly in many typical situations.

The present invention therefore uses a slight extension to the ACCKB subroutine, called ACCKB* and shown in FIG. 6, that maintains the dependencies across sibling nodes, and so will correctly handle the case mentioned above. However, it does not maintain other dependencies, meaning it may not return the correct answer if, say, both n and n.sub.1 =child(n, 1) are each labeled with t.sub.1, where .pi.(t.sub.1)="?" as shown in FIG. 7. Here ACCKB*, like ACCKB, would claim that the probability of reaching the r.sub.cor repair, assuming it reached n, is p(t.sub.1).times.p(t.sub.1); the correct value of course is simply p(t.sub.1).

The following will describe the theory revision task. The main DELTADELTA routine (FIG. 8) takes as input an initial hierarchy KB.sub.0 and a set of labeled session transcripts, C={C.sub.j }. DELTADELTA uses a set of transformations, T={.theta..sub.k }, where each .theta..sub.k maps one hierarchy to another. DELTADELTA considers four classes of revision operators:

each Delete.sub.par,n revision operator deletes the existing link between the node par and its child node n. Hence, Delete.sub.B,E (KB.sub.0) is a hierarchy KB.sub.1 that includes all of the nodes of KB.sub.0 and all of its arcs except the arc from B to E. Hence, in KB.sub.1, child(B, 1)=F. Notice that this deletion implicitly redefines the child(.multidot.,.multidot.) function.

each Add.sub.par,n,i revision operator adds a new link between par and n as the i.sup.th arc under par. Hence, the hierarchy KB.sub.2 =Add.sub.A,F,2 (KB.sub.0)includes all of the nodes and arcs in KB.sub.0 and an additional arc from A to F, coming after <A,C> and before <A,D>. Hence, in KB.sub.2, child(A, 1)=C, child(A,2)=F, child (A, 3)=D and child(A, 4)=E.

each Move.sub.par1,par2,n,i revision operator both deletes the existing link between par1 and n, and then adds a link from par2 to n, as the i.sup.th arc under par2. Hence, Move.sub.par1,par2,n,i (KB)=Add.sub.par2,n,i (Delete.sub.par1,n (KB)).

each Switch.sub.par,n1,n2 revision operator switches the order of the links from par to n1, and from par to n2. Notice each Switch.sub.n1,n2,par revision operator corresponds to at most two move revision operators.

FIG. 10 illustrates the effects of applying the revision operator Add.sub.A,B,1 to the fault hierarchy, KB.sub.before. Notice that each operator has an associated operator that can undo the effects of the operator. For instance applying the operator Delete.sub.A,B to KB.sub.after in FIG. 10, will restore the fault hierarchy to KB.sub.before. Let N(KB)={.theta..sub.i (KB).vertline..theta..sub.i .epsilon. T} be the set of KB's neighbors.

DELTADELTA begins each hill climbing step with a particular knowledge base, KB.sub.-- i. It then needs to determine whether any KB' .epsilon. N(KB.sub.-- i) is better than KB.sub.-- i; that is, whether any KB' has a higher empirical accuracy, over a set of labeled instances C={<.pi..sub.j,r.sub.j >}. (If so, DELTADELTA will climb from KB.sub.-- i to the KB* .epsilon. N(KB) with the highest empirical accuracy.)

Computing this optimal KB* implicitly requires obtaining the .vertline.C.vertline. values of {acc(KB, c.sub.j)}.sub.cj.epsilon.C to compute acc(KB, C), and also computing the .vertline.C.vertline..times..vertline.T.vertline. values of {acc(.theta..sub.i (KB), c.sub.j)} for each .theta..sub.i .epsilon. T and each c.sub.j in C, to compute the .vertline.T.vertline. values of {acc(.theta..sub.i (KB), C)}.sub.i, and then determining which (if any) of these values exceeds acc(KB, C). One algorithm for this task, would first load in the KB hierarchy, then use the resulting S.sub.KB to evaluate EvalKB(KB,.pi..sub.j) for each (.pi..sub.j,r.sub.j).epsilon. C to compute first the values of acc(KB, .pi..sub.j) and then their sum acc(KB,C)=.SIGMA..sub.j acc(KB,<.pi..sub.j,r.sub.j >). It would then build KB.sub.1 =.theta..sub.1 (KB) by applying the first revision operator .theta..sub.1 to KB, then load in this hierarchy to obtain S.sub.KB1, and once again consider the .vertline.C.vertline. instances {<.pi..sub.j,r.sub.j >} to compute acc(KB.sub.1, C). Next, it would produce KB.sub.2 =.theta..sub.2 (KB), and go through all .vertline.C.vertline. instances to produce acc(KB.sub.2, C); and so forth, for all .vertline.T.vertline. transformations. In essence, this involves sequentially computing each row of the matrix shown in FIG. 12. The revision algorithm would then determine the largest of these KB*=argmax.sub.i {acc(KB.sub.i, C)}, and climb to this KB* hierarchy if acc(KB*, C)>acc(.theta..sub.i (KB),C).

This can be very expensive as (1) computing each acc(KB.sub.i, <.pi..sub.j,r.sub.j >), requires evaluating a hierarchy on an instance, which can be expensive; and worse, (2) both .vertline.T.vertline. and .vertline.C.vertline. can be huge, e.g., in one study, values of .vertline.T.vertline..apprxeq.10,000 were often found.

There are two basic ideas for improving the efficiency: The first is to evaluate fewer of the (acc(.theta..sub.i (KB),c.sub.j)}.sub.ij entries; below are three techniques for this. The second is to provide a more efficient way to compute this quantity. For reasons explained below, we will actually use the equally-useful values

which is the difference in accuracy between .theta.(KB) and KB, on instance c (resp., the relative score for the transformed .theta.(KB) knowledge base, after k instances). The resulting DELTADELTA system is sketched in FIG. 8.

The first idea, called RT.sub.I, is to restrict the transformations, based on instance <.pi..sub.j,r.sub.j > being considered. This idea exploits the particular set of transformations that are being considered. This is done by using observations that, for almost every .pi..sub.j, the value of acc(.theta..sub.i (KB), <.pi..sub.j,r.sub.j >) is equal to acc(KB, <.pi..sub.j,r.sub.j >) for a great many .theta..sub.i 's. This means that most transformations .theta..sub.i do not influence whether a hierarchy will be correct on an instance. As an illustration, consider the KB.sub.0 hierarchy (FIG. 2) and the partial instance .pi..sub.1 ={t(Z)/+, t(A)/+, t(C)/-, t(D)/+} that confirms t(Z), t(A), and t(D) and disconfirms t(C); here, S.sub.KBo,returns r.sub.D =EVALKB(KB.sub.0,.pi..sub.1). (Notice S.sub.KBo would only ask about these 4 tests, and only record their values. The other tests would not be asked, as their values do not matter here; hence, .pi..sub.1 maps each other test to "?".) Now consider the Delete.sub.B,E transformation that deletes the <B,E> arc, and observe that, as the original KB.sub.0 arrives at its answer (r.sub.D) before ever reaching B, this new KB.sub.1 =Delete.sub.B,E (KB.sub.0) will also reach the same decision; here r.sub.D. As EVALKB(KB.sub.0,.pi..sub.1)=EVALKB(KB.sub.1,.pi..sub.1), clearly acc(KB.sub.0,<.pi..sub.1,r>)=acc(Delete.sub.B,E (KB.sub.0),<.pi..sub.1,r>). (Notice this does not depend on whether r.sub.D was the correct answer: if KB.sub.0 was correct on .pi..sub.1, then so is KB.sub.1 ; likewise, if KB.sub.0 was incorrect on .pi..sub.1, then so is KB.sub.1.)

Now consider other deletions, such as deleting either the <B,F> or the <A,E> arc; by the above argument, we see immediately that acc(KB.sub.0, <.pi..sub.1,r>)=acc(Delete.sub.B,F (KB.sub.0), <.pi..sub.1,r>)=acc(Delete.sub.A,E (KB.sub.0), <.pi..sub.1,r>). Notice that deleting <A,C> has no effect, as the C node was disconfirmed anyway. (Here, as we are only considering the accuracy of the hierarchy, and not its efficiency, evaluating the extra T.sub.c test is not an issue.) It should be clear that the only deletions that might make a difference here (i.e., produce a hierarchy KB'=Delete(KB.sub.0) whose accuracy on .pi..sub.1 might be different than KB.sub.0 's) are deleting <Z,A> and <A,D>. (Of course, it is still possible that acc(Delete.sub.z,A (KB.sub.0), <.pi..sub.1,r)=acc(KB.sub.0, <.pi..sub.1,r>). For example, if the correct repair r.sub.c, then both systems will have the score of 0. This can also happen if there are several paths in the initial hierarchy that lead to the same correct node, or if the hierarchy includes different nodes with the same repair, etc.)

Similar claims for adding new links can also be considered. As S.sub.KB0 never reached B, a new hierarchy that includes a new link from B to anything will return the same r.sub.D in instance .pi..sub.1, meaning acc(Add.sub.B,.chi.1,.chi.2 (KB.sub.0), <.pi..sub.1,r.sub.2 >)=acc(KB.sub.0,<.pi..sub.1,r.sub.2 >) for any node .chi..sub.1 and index .chi..sub.2. Similarly, as S.sub.KB0 descends to A's second child, Add.sub.A,.chi.,3 also has no effect, for any new child .chi.. There is also no effect if we add a link from A to some other node, say W, if W's test fails (i.e., if .pi..sub.1 (t(W))=-), independent of where Add.sub.A,W,i adds this new link. Here, the only addition transformations Add that might make a difference are the ones that produce new hierarchies KB.sub.2 =Add(KB.sub.0) that cause the S.sub.KB2 to take a different path, by descending from a node that could be reached (such as Z or A) to a node that could be confirmed.

Similarly, most Move and Switch transformations have no effect as well, in particular, Move.sub.par1,par2,n,i is guaranteed to have no effect whenever both Delete.sub.par1,n and Add.sub.par2,n,i have no effect.

Stated more precisely, DELTADELTA will only consider the subset of the transformations, returned by the RTI.sub.-- ELIGIBLE routine, call them RT.sub.I (T,N,c.sub.k), which excludes many transformations .theta. for which diff'(.theta.,c.sub.j)=0.

In one embodiment of the present invention, the RTI.sub.-- ELIGIBLE subroutine (see FIG. 11) returns a set of transformations, based on the initial fault hierarchy KB and annotated case <.pi., r>, which includes:

Delete(par, n) whenever

n is currently a child of par,

the status of the test associated with par (resp., n) is either + or ? (ie, .pi.(t(par)) .epsilon.{+, ?}), and

par will be reached (ie, .tau.(par) >0, using the .tau.(.multidot.) function defined below).

Add(par, n, i) whenever

the status of the test associated with par (resp., n) is either + or ?

i is between 0 and k(par),

par will be reached (ie, .tau.(par)>0)

n is not already a child of par, and

adding n under par will not cause a cycle.

Switch(par, n1, n2) whenever

both n1 and n2 are children of par

the status of the test associated with par (resp., n1, n2) is either + or ?

par will be reached (ie, .tau.(par)>0).

Move(par1, par2, n, i) whenever

Add(par2, n, i) is legal, based on above specifications

Delete(par1, n) is legal, based on above specifications

In addition, Move(par1, par2, n, i) is allowed even if a cycle is introduced by the Add(par2, n, i), provided it is broken by the Delete(par1, n) operation.

The second insight, called RT.sub.P for "restricting the transforms based on a positive score", comes from two observations: First, DELTADELTA will only climb from KB to the transformed theory KB*=.theta.(KB) if KB*'s empirical score, after all M instances, is strictly greater than KB's; ie if Diff(.theta.,M) >0. Second, as acc(.theta.(KB), c.sub.k) .ltoreq.1, the difference between Diff(.theta..sub.i, k) and Diff(.theta..sub.i, k-1) can be at most ##EQU3## This trivially means that Diff(.theta.,M).ltoreq.Diff(.theta.,k)+Err.sub.-- k, where Err.sub.k 32 .SIGMA..sup.M.sub.j=K+1 (1-acc(KB, <.pi..sub.j,r.sub.j >)) is the total error of KB on the remaining M-k instances. If Diff(.theta.,k).ltoreq.-Err.sub.k, then clearly Diff(.theta., M).ltoreq.0, which means DELTADELTA will not climb to .theta.(KB). Hence,

This is implemented by the RTP subroutine, shown in FIG. 9.

The third insight, called RT.sub.M for "restricting the transforms based on maximal score", is related to the RT.sub.P filter presented above, and is also based on dynamic programming. It uses two observations: First, DELTADELTA will only climb from KB to the transformed version KB*=.theta.'(KB) if KB*'s empirical score is the largest over all members of N(KB); ie., if .A-inverted..theta..sub.i .epsilon. N, Diff(.theta.*,M).gtoreq.Diff(.theta..sub.i,M). Second, for any .theta..sub.g, .theta..sub.h .epsilon. N, the difference between Diff(.theta..sub.g,k)-Diff(.theta..sub.h,k) and Diff(.theta..sub.g, k-1)-Diff(.theta..sub.h, k-1) can be at most 1. This trivially means that

and so

which means DELTADELTA will not climb to .theta..sub.g (KB). Letting Best.sub.k =max.sub..theta..epsilon.N {Diff(.theta.,k)} be the largest empirical (relative) score, over the transformations, after k samples, we define RT.sub.M (KB,N,k,M,Diff(.multidot.,k))={.theta..sub.i .epsilon.N.vertline.Diff(.theta..sub.i,k) >Best.sub.k -(M-k)}. This is implemented by the RTM subroutine, shown in FIG. 9.

The following will describe the final idea, QE (for "quick evaluation"). Given the above analysis, we need only compute the values of acc(.theta..sub.i,c.sub.k) for only a subset of the transformations; i.e., only for .theta..sub.i in the set

We could compute these acc(.theta..sub.i (KB), c.sub.k) values by first synthesizing each KB.sub.i =.theta..sub.i (KB), and then "running" each KB.sub.i on each c.sub.j =<.pi..sub.j,r.sub.j > instance to get their respective repairs and associated accuracy scores. The DELTADELTA algorithm, however, uses a more effective way of computing these accuracy scores.

Notice first that it is sufficient to compute diff' (.theta..sub.m,c), rather than acc(.theta..sub.m (KB),c); this quantity turns out to be relatively easy to compute (especially as diff' (.theta..sub.m,c)=0 holds for many <.theta..sub.m,c) pairs; see above discussion of RT.sub.I).

Given a (partial) instance .pi. and the correct repair r.sub.cor, the QE.sub.-- COMPUTERHOTAU subroutine identifies, with each node n in the initial KB, the probability .rho.(n) that S.sub.KB would reach r.sub.cor, given that it has reached n. Notice that acc(KB, <.pi.,r.sub.cor)=.rho.(n.sub.root), where n.sub.root is the root of KB; and also that .rho.(n)=.rho.'(n).times.ACCKB*(n, .pi., r.sub.cor), using ##EQU4##

QE.sub.-- COMPUTERHOTAU also identifies each arc a in KB with the probability that S.sub.KB will reach and traverse this arc, .tau.(a); and also each node n with the probably of reaching n. Clearly .tau.(n.sub.root)=1. Given an internal node n with children n.sub.i =child(n,i), let e.sub.i =<n,n.sub.i > be the arc connecting n to n.sub.i. Then recursively define

Finally, to compute each r(n.sub.j), just add up the .tau.-values of the arcs reaching n.sub.j ; i.e., in general .tau.(m)=.SIGMA..sub.<n,m>.epsilon.E .tau.(<n,m>). Notice that this can be computed in time linear in the size of the hierarchy.

Then, for each transformation .theta. .epsilon. T, QE.sub.-- DIFF uses these .rho.(.multidot.)and .tau.(.multidot.) values to compute diff' (.theta., <.theta.,r.sub.cor >), in essentially constant time. (The time is really bounded by the largest number of arcs descending from any node which is assumed to be a small constant.)

N.b., the DELTADELTA revision algorithm does not produce an explicit S.sub..theta.j(KB) performance system, nor does it explicitly compute the value acc(.theta..sub.j (KB), .pi.) on the instance .pi.. Instead, it uses the .rho.(.multidot.)and .tau.(.multidot.) values to produce the information it needs, directly.

The following will describe the way that QE.sub.-- DIFF computes the values of diff' (.tau..sub.k,c)=acc(.theta..sub.k (KB), c)-acc(KB, c). For each "Delete-Link" transformation Delete.sub.a,b, let KB'=Delete.sub.a,b (KB) be the hierarchy produced by deleting from KB the link connecting node a to node b. Clearly acc(KB', <.pi.,r>)=acc(KB, <.pi.,r>) whenever either .pi.(t(a))=-or .pi.(t(b))=-. It is therefore necessary to deal only with situations when .pi.(t(a)).epsilon.{+,?} and .pi.(t(b)) .epsilon.{+,?}. Without loss of generality, we can write ##EQU5## where P›success before <a,b>! is the probability of reaching r.sub.cor following the arcs that occur strictly before reaching the <a,b> arc (in the obvious traversal of KB); P›success after <a,b>.vertline.reached <a,b>! is the probability of reaching r.sub.cor following the arcs that occur strictly after the <a,b> arc, given that S.sub.KB has reached the <a,b> arc; and P›success after a! is the probability of reaching r.sub.cor following the arcs that occur strictly after the a node.

For example, using KB.sub.0 from FIG. 2, identify the a with the fault node "A" and b with "E". Then P›success before<a,b>! is the probability either (1) T.sub.Z, T.sub.A and T.sub.C all succeed and the correct repair is r.sub.c, or (2) T.sub.Z, T.sub.A and T.sub.D all succeed, T.sub.C fails, and the correct repair is r.sub.D. Here, P›success after <a,b>.vertline.reached <a,b>! is 0, as this is the probability of reaching a success node under A, strictly after reaching and traversing <a,b>.ident.<A,E>. (Notice that E has no "left-siblings" under A.) Finally, P›success after a! is the probability that T.sub.A fails, T.sub.B succeeds and either T.sub.E succeeds and the correct repair is r.sub.E, or T.sub.E fails, T.sub.F succeeds and the correct repair is r.sub.F.

Similarly,

Subtracting these quantities, it is found that

where P'=P›success after <a,b>.vertline.reached <a,b>!. The only remaining challenge is computing this P': Assume that b is the m.sup.th child of a, and a has k.gtoreq.m children, {a.sub.1, . . . ,a.sub.m =b, a.sub.m+1, . . . ,a.sub.k }. Here, P'=.SIGMA..sup.k.sub.1=m+1 .tau.›<a,a.sub.1 >.times..rho.(a.sub.1)/.tau.›<a,b>!. Notice the time required to compute this quantity is bounded by k, the number of children under node a.

To compute diff' (.theta., c) where .theta. is an "Add-Link" transformations, let KB'=Add.sub.a,b,i (KB) be the hierarchy produced by adding to KB a link that makes b the i.sup.th child of a. As before, acc(KB',<.pi.,r>)=acc(KB, <.pi.,r>) whenever either .pi.(t(a))=-or (t(b))=-, and so we will consider only .pi.(t(a)) .epsilon. {+,?} and .pi.(t(b)) .epsilon. {+,?}.

Assume a's i.sup.th child in the original KB is n.sub.i ; notice it will be the i+1.sup.st child in KB'. (If a only had i-1 children in KB, then assume this n.sub.i is a degenerate node that leads immediately to the r.sub..perp. repair.) Then ##EQU6## meaning

where again P›success after <a,n.sub.i >.vertline.reached <a,n.sub.i >!=.SIGMA..sup.k.sub.1=i+1 .theta.›<a,a.sub.1 >!.times..rho.(a.sub.1) .theta.›<a,n.sub.i >!.

Of course, this approach is implicitly based on the earlier "partial evaluation" ideas, as embodied in the ACCKB* subroutine; and in particular, as mentioned earlier, complete correctness for efficiency has been sacrificed, based on the observation that computing the correct accuracy score is intractable when considering general DAG-structured hierarchies. To see a potential problem, observe that adding a new link can easily produce a new DAG-instance within the hierarchy, which in turn may cause the computation to produce an incorrect answer. For example, consider the KB.sub.before hierarchy (shown in FIG. 10), and let KB.sub.after =Add.sub.A,B,1 (KB.sub.before) include a link from A to B that makes B, A's first child.

Now consider a labeled instance c=<.pi..sub.2,r.sub.B > in which .pi..sub.2 ={T.sub.A /+, T.sub.C /+, T.sub.B /?, T.sub.D /+}, and the correct repair is r.sub.B. Let p.sub.B =p(T.sub.B) be the probability that T.sub.B, the test at the B node, succeeds. Clearly acc(KB.sub.before,c)=p.sub.B, and the correct answer to acc(KB.sub.after,c)=p.sub.B. However, ACCKB*(A,.pi..sub.2,r.sub.B) would produce the incorrect answer p.sub.B +(1-p.sub.B).times.p.sub.B. (Recall that computing the correct answer, for DAGs in general, is NP-hard). Hence, if we used ACCKB* to produce the accuracy scores,

as this is greater than 0, this transformation would seem like a good idea.

However, this transformation should not be considered a good idea, for this instance. There is a simple way to correct for this particular error. Here, it is necessary to observe that the only way S.sub.KBafter can reach C is if the T.sub.B test fails. Hence, it is necessary to only propagate the information that reaching C means T.sub.B fails when computing the accuracy score on the post-B part of the hierarchy.

While it is NP-hard to compute even this score correctly in general, we can easily address this particular common occurrence. Associate with each node n in KB the set of all tests occurring under it; hence, AllTests(A)={T.sub.A,T.sub.B,T.sub.C,T.sub.D }, AllTests(C)=(T.sub.C, T.sub.B,TD.sub. }, etc. Now when adding a new link, here adding B with test T.sub.B, under A, before DELTADELTA computes the value of diff'(Add.sub.A,B,1, c), it would first walk through the other children of the new parent (associated with the transformation) A, and potentially recompute the .rho.-value of these children, given the new constraint that S.sub.KBafter will only reach such children if the T.sub.B test fails. To do this, DELTADELTA first matches the test T.sub.B against the tests in C's AllTests(.multidot.)-list. If T.sub.B .epsilon. AllTests(C), then DELTADELTA can simply use .rho.(C); no further work would be required. Notice, however, that T.sub.B .epsilon. AllTests(C) here. DELTADELTA will therefore recompute .rho.(C), in the context of a slightly modified C=<.pi..sub.2,r> labeled instance, where .pi..sub.2 includes the assignment T.sub.B /-: hence, .pi..sub.2 ={T.sub.A /+, T.sub.C /+, T.sub.B /-, T.sub.D /+}. Under this new assignment, .rho.(B)=0, meaning .rho.(C)=0, and so .rho.(A)=acc(Add.sub.A,B,1, c)=.rho..sub.B, as desired.

The following will describe how to handle "Move-Link" Transformations. To deal with KB'=Move.sub.par,par2,n,i (KB), notice that KB'=Add.sub.par2,n,i (KB.sub.1) where KB.sub.1 =Delete.sub.par1,n (KB). Hence, diff'(Move.sub.par,par2,n,i,c)=acc(Move.sub.par,par2,n,i (KB),c)-acc(KB,c)=(acc(Add.sub.par2,n,i (KB.sub.1),c)-acc(KB.sub.1,c))+(acc(KB.sub.1,c)-acc(KB,c})=diff'.sup.KB.sb sp.1 (Add.sub.par2,n,i,c)+diff'.sup.KB (Delete.sub.par1,n,c), each of which were described above. In the above, the superscript identifies the hierarchy involved.

The following will describe "Switch-Link Transformations" Switch.sub.par,n1,n2 : Using n1=child(par,i.sub.1) and n2=child(par,i.sub.2), observe that Switch.sub.par,n1,n2 (KB)=Move.sub.par,par,n1,i2 (KB.sub.1)where KB.sub.1 =Move.sub.par,par,n2,i1 (KB). (Where the first transformation, Move.sub.par,par,n1,i2 (KB.sub.1) is ignored if .vertline.i.sub.1 -i.sub.2 .vertline.=1. Hence, diff'(Switch.sub.par,n1,n2,c)=acc(Switch.sub.par,n1,n2 (KB),c)-acc(KB,c)=(acc(Move.sub.par,par,n1,i2 (KB.sub.1),c)-acc(KB.sub.1,c))+(acc(KB.sub.1,c)-acc(KB,c))=diff'.sup.KB1 (Move.sub.par,par,n1,i2 },c)+diff'.sup.KB (Move.sub.par,par,n2,i1 },c).

The above descriptions all implicitly assume that the underlying expert system will traverse fault hierarchy in the manner shown above; and in particular, will stop when reaching a repair. Some expert systems will allow the user to "verify" that the proposed repair worked effectively, and will then continue suggesting alternative repairs, if the first repair failed. This is called "verify after repair" (VAR). The present invention is also able to propose appropriate theory revisions for theories that use VAR.

It is not intended that this invention be limited to the software arrangement, or operational procedures shown disclosed. This invention includes all of the alterations and variations thereto as encompassed within the scope of the claims as follows.