Field of the invention The present invention relates to a system and a method for remote maintenance of user units used for processing digital data of broadcast multimedia services and able to transmit state data to a server via a return channel. More particularly, when a user unit detects an operational failure, it transmits to the server a state data set to be analyzed in order to determine a probable cause of the failure.

Technical background

Many evolved user u nits such as Pay-TV decoders, personal computers, mobile communication devices (mobile phones, tablets, etc.), routers, energy counters, etc. connected to a communication network such as the Internet are able to transmit to a server log files or functioning history records to be analyzed. Generally speaking, the log files are transm itted when the user unit has a failure preventing its expected operation accord ing to a given mode. For example, d uring a malfunction of a computer program, the user can be solicited to transmit or not a log file to the supplier of the program or of the computer operating system . This log file allows establishing a statistic of the failures of the program generally used as a basis for deciding corrective actions or creation of program update patches.

The document WO2010/01 0586A1 describes a real time monitoring system of the state and proper functioning of different un its in a commun ication network. The system uses a real time connection to directly or indirectly interact with an operating system of a network un it in order to obta i n a real time messages stream for processing. The m essages of th e stream are analyzed and introduced into a database as soon as they are produced by real time acquisition of the data of the stream in a format adapted to the database. The data processing and analysis based on predefined algorithms are thus carried out in real time on the contents stored in the database and result in a production of state data. The latter are used to detect defects, to generate reports, alerts, and notifications. The processing of state data by means of a database of solutions allows the system to supply a user with useful recommendations for correcting defects or warnings indicating a defective state of a unit of the network.

Such a real time monitoring system producing permanent messages streams can overload the communication network, especially when content data streams of audio/video services, for example, transit via the same network. Such an overload can cause a decrease of the network performances, in particular a diminution of the bandwidth or the content data throughput. Brief description of the invention

The aim of the present invention is to avoid the drawbacks of the real time monitoring systems for user units producing permanent data streams in a network while allowing at the same time an efficient diagnosis of failures in a reduced time.

This aim is achieved by a system for remote maintenance of user units comprising a management server and a plurality of user units connected to the management server via a communication network, each user unit being configured for transmitting to the management server, via the communication network, state data related to hardware and software parameters associated to an operating mode of the user unit, the system being characterized in that each user unit comprises:

- a memory configured to store the state data of the user unit comprising variable values related to the user unit states, values indicating a transition from an initial value of a given state towards a final value of the same state and temporary data associated to the states,

- a state data monitoring module configured to detect at least one value of a specific state or a transition of a value of a state indicating an operational failure of the user unit,

- a state data collecting and transmitting module configured to be activated when a failure is detected by the monitoring module, and to extract from the memory state data corresponding to current states of the user unit at the moment of the failure, - the management server comprising a module for reception and analysis of the state data transmitted by each user unit, said state data forming a log file, said module being at least configured to determine a statistic correlation coefficient resulting from a comparison of the values of each state of all the user units with the values of other states of all the user units.

Th is invention also refers to a method for remote maintenance of user units connected to a management server via a communication network, each user unit transmitting to the management server, via the communication network, state data related to hardware and software parameters associated to an operating mode of the user unit, the method is characterized in that it comprises following steps:

- storing, in a memory of the user unit, state data comprising variable values related to states of the user unit, values indicating a transition from an initial value of a given state towards a final value of the same state and temporary data associated to the states,

- monitoring the state data stored in the memory and detecting at least one value of a specific state or a transition of a value of a state indicating an operational failure of the user unit,

- when a failure is detected, extracting, from the memory, state data corresponding to current states of the user unit at the moment of the failure,

- transmitting the state data to the management server and determining, by the management server, a statistic correlation coefficient resulting from a comparison of the values of each state of all the user units with the values of other states of all the user units.

A user un it transm its state data as soon as a failure appears, or a series of successive or sporadic failures or an operational defect indicated by a value of a particular state or by a transition from an initial value of a state towards a final value corresponding to a failure. The management server creates a log file containing the state data of each user unit and also a trace including stored state data related to a predetermined time period preceding the failure.

The states appear in several forms:

- variable digital values according to the operating mode of the user unit such as the number of the selected channel, the temperature or the filling rate of the hard disk, the quality of the signal etc., which have various values according to the functioning of the user unit.

- alphanumeric character strings such as smart card or security module identifiers, channel or application identifiers, etc.

- enumerations related to states being able to take a predefined number N of values. For example, for N = 2, a state "crash" is represented by a binary value indicating a state of normal operating: "crash = 0" and a state indicating a failure: "crash = 1 ".

The states are preferably associated to temporary data like the date and the time indicating the moment at which a particular event occurred such as for example a failure or a sudden decrease of the signal quality or an increase of the channel change time. An abnormal variation of a d ig ital value like for example when the switching time from a current channel to another channel significantly increases, the value of a "zap time" state exceeds a predefined threshold which leads to a transition represented by a "slow zap" state which passes from a value 0 to a value 1 .

The log file thus contains for each state a value associated to a time datum (date and time) and a transition associated to a time datum indicating the date and the time at which the transition took place. A transition reflects a passage of a state from an initial value towards a final value wh ich may indicate a failure and activate the transmission of the state data to the management server.

In order to al low a processing and a statistical analysis in form of tables and/or graphs, a large number of user units, for example several thousands, transmit to the management server a high number of state data, for example data related to 100 or even 200 states referred to a predefined time period.

The state data refer to a selection of hardware and software parameters associated to the functioning of the user unit independently of the failure or the defect detected by the monitoring module. Thus for different types of failures, the management server can receive state data relating to a same selection of states having different values. The states selection depends on a setup of the mon itoring module pre- established by the manufacturer of the user unit, and/or an operator skilled in the maintenance of the user units who selects states to be monitored made available by a supplier of the software installed in the user units.

The log file tracing back the behavior of the users units is intended to be analyzed by the management server which establishes correlations by comparing the state data of each user un it. For example, in order to show that the switching time from a current channel towards another channel depends on the filling rate of the hard disk, the comparison will relate to user units having a hard disk with different filling rate values. The analysis of the correlation results in form of coefficients gives useful ind ications for interpreting a failure i n order to fi nd its cause a nd a ppropriate solutions for solving it.

The user units can also transmit state data to the management server when no failure is detected by the monitoring module, for example after a request of the server or automatically at predefined time intervals. These state data of "healthy" user units serve as references during the analysis of a log file to determine the origin(s) of the failure.

Brief description of the figure

The invention will be better understood thanks to the following detailed description referring to the annexed figure given as a non-limited example, i.e.:

Figure 1 shows a block diagram of the system according to the invention comprising user units each transmitting state data to a management server when a failure is detected. Detailed description of the invention

The system illustrated by figure 1 includes a user unit STBN in form of a Pay-TV decoder also called set top box. It is connected to a management server S via a communication network R. The user unit STBN is configured for receiving a digital data stream FS of multimedia services from the network R or any other wired or radio broadcast network and for transmitting state data DE to the management server S via the network R thanks to a return channel. Other user units STB1 , STB2, STB3 configured for transmitting state data DE1 , DE2, DE3 when failures occur are also connected to the management server S.

The user unit STBN stores, in a memory M, state data DE related to hardware and software parameters associated to an operation mode of the user unit. These state data DE are preferably stored when one or more predefined states change their value. A monitoring module SU is in charge of detecting one or more state data DE indicating one or more failures or functioning anomalies which lead to transitions of states causing the transmission of the state data DE to the management server S. The log file J containing the states of user units with their values and the transitions associated to a date and a time is converted by the server by transforming the transitions into states with two values 0 or 1 in order to allow their analysis by correlations. For example, an abrupt passage from a value of a state representing the normal functioning of the user unit towards a critical value recorded in form of a transition is converted into a state "crash" whose value 0 indicates the normal functioning and the value 1 a failure. A state indicating the remaining capacity of a hard disk which reaches a value near zero is converted into "disk full = 1 " indicating a full hard disk. A "slow zap = 1 " state indicating a low speed of channel change results from a "zap speed" state whose value is lower than a predefined threshold.

A failure or functional defect is generally defined by a value related to a state situated over or under a foreseen limit value or a reference value measured during a normal function i ng of the user u n it. The mon itoring mod ule SU incl udes filters and comparators associated to a selection of states to be monitored. A failure is recognized by one or more states values out of limits and/or by an abnormally high number of states values out of limits recorded in the memory at many time intervals, or by high warnings frequency related to abnormal states. A particular state, for example "crash", can indicate a failure related to a set of states.

When a critical state compromising the normal functioning of a user unit such as, for example, "crash", "disk remaining capacity", "signal strength", etc. transits from a neutral val ue towards an active val ue, the monitoring module SU activates a collecting and transmission module CT which collects state data sets stored in the memory M related to states monitored by the monitoring module SU and state data sets recorded during a predefined period before the failure. These state data sets are then transmitted via the communication network R to the management server S that includes an analysis module A in charge of analyzing them. For example in the log file J, a "crash = 1 " state may indicate a failure when a current states configuration does not correspond to a states configuration related to a normal functioning of the user unit STBN defined by the state "crash = 0".

The temporary data associated to the states do not only indicate the date and time at which a state value has been recorded in the memory but also the date and time at which a transition from an initial state value towards a final value took place such as, for example, the transition from the state "crash" 0 to 1 . Some states are determined by temporal data of other states. For example a "zap speed" state indicating a low speed of reception channel change is determined by the time interval between leaving a current channel (current channel state = 12) and activating a new channel (new channel state 18). When this time interval is higher than a reference time interval, the "zap speed" state takes an insufficient value in comparison with a normal value which leads to the "slow zap = 1 " state in the log file J . Th is time interval depends on factors like: the reaction time of the user unit to the remote control, the time for adjusting the new channel, the reception and connection time of the program tables PAT, PMT, the verification time of the conditional access or the parental control, the display time of the first image, etc. All these factors can also be represented by states monitored by the monitoring module SU and transmitted to the management server S if necessary. According to an embodiment, the conversion of the transitions into states with two values can be performed by the monitoring module SU of each user unit. The state data are thus transmitted to the management server S by the collecting and transmission module CT when one or several of these states with two values take a value 0 or 1 indicating a failure.

According to an embodiment, on reception of state data by the management server S, the analysis module A of the latter can transmit to the user unit STBN a response message M E wh ich will be processed by the monitoring module SU in order to indicate that the failure is managed by the management server S. The message ME can also indicate the states of the user unit STBN involved in a failure, a probable cause of the failure, a solution or a particular adjustment to carry out on the user unit STBN for resolving the failure.

According to an option, the management server S can send to one or more user units a request comprising a command for transmitting the states data recorded within a given period concerning predefined states. These states data related to healthy user units can serve as a reference for a future failure analysis. According to a configuration, the request sent by the management server S could activate the monitoring module SU in the same way as at the apparition of one or several failures so that the collecting and transmission module CT transmits the state data. The management server S can also solicit the transmission of the state data when a user calls the maintenance operator for a fast failure resolution.

The management server S is also in charge of sending a setup file to the user units comprising a list of states to be monitored and collected, a list of the transitions of the state values being able to activate the transmission of state data by the collecting and transmission module CT. This setup file may also contain some transmission instructions ind icating for example a transmission frequency of the state data (number of times per hour, per day, etc.), and/or instructions related to states, state values or value transitions being able to activate the transmission of the state data without indicating a failure. For example, state data can be transmitted when the measured temperature of the hard disk exceeds 60°C. The instructions of the setup file also allow preventing a saturation of the management server S due to a large state data log file issued from a million user units for example. In this case, a probability (percentage) of transmission is associated to each type of transition activating the state data transmission. For example, when the temperature of the disk exceeds 50°C, the state data are transmitted 5 times out of 100 or with a probability of 5%.

According to a preferred configuration, the state data comprise, besides the state data of the user unit, at least one identification information of the user unit in form of a unique serial number, an identifier of an associated security module, a MAC address, an IP address, or an identifier of a network node comprising the user unit STBN. The personalization of the state data allows the management server S transmitting response messages ME targeted to the concerned user units STBN of the network R.

According to another embodiment, the state data can be anonymous. In this case, it preferably contains a digest (hash) calculated by the user unit STBN by means of a mathematical collision free unidirectional hash function on all or part of the state data. This digest allows the server to val idate the state data by comparing the received digest with a digest calculated by the management server S on the state data received from the user u n it STBN. If the comparison is successful, the management server S recognizes the state data as being conform and coming from a user unit STBN connected to the communication network R. According to another embodiment, the state data containing identification information of the user unit can also include a digest (hash) calculated on all or part of the data. According to the communication protocol established between the user units and the management server, the state data are already accompanied by a digest like for example in the case of a transmission in TCP / http mode where the transmitted data include a Cyclic Redundancy Check (CRC).

Moreover, in order to avoid abuse by transmissions of sensitive data to unauthorized systems, the management server S is authenticated by known means and the data transmitted via the return channel secured. In particular, the state data are encrypted by the user unit STBN by means of a transmission key known by the management server S.

In order to l im it the number of user un its STBN call ing the server by the return channel on the basis of already received state data, the management method of the return channel described in the document US200501 38667 can be used. This method allows controlling a return channel leading towards a source system in an interactive television environment. An indication based on information associated to the interactive television environ ment is generated by the source system and broadcast to a plurality of receiver systems where each receiver system controls the return channel on the basis of the indication in order to avoid a saturation of the server. For example when a radio reception application breaks down 3 times a day on one million subscriber terminals, the server would receive 3 million state data sets without the control indication thanks to which th is large number of units can be reduced to the minimum necessary for drawing up statistics. In other words, when state data sets are transmitted at a high frequency, the server can reduce this frequency thanks to this control indication.

Such an ind ication is expressed by a digital value linked to a transition and to a transmission probabil ity of the state data monitored in real time by one or more receiver systems of which each compares the indication with a random value to determine the use of the return channel . Thus, the user benefits from a foreseen service quality, as he can obtain an access to the return channel when the service is less likely to be refused because of an insufficient capacity of the return channel in form of lack of server resources, modems or other system resources. The indication may be monitored by a contents supplier who can change the interactive contents broadcast to the receiver systems in order to increase or reduce the probability that a user attempts to use the return channel . The example developed hereinafter based on establishing statistical correlations among the state data shows a preferred realization of the invention.

The user unit monitors 1 1 states: DC1234, ST3456, SD, HD, MPG, AC3, subtitle, bookings (contents reservations), slow zap, crash (failure) and stand-by, which state data form the lines of the table 1 . These lines correspond to 16 user units that each has transmitted 1 1 states to the management server S, these states having been previously extracted from their memory M. When one or several failures are detected by the monitoring modu le SU , the collecting and transmission module CT recovers state data on the one hand from broken-down user units "crash = 1 " and on the other hand from user units without failure "crash = 0", but with a "slow zap = 1 " state for example. In table 1 , 8 user units designated by numbers 2, 4, 5, 7, 8, 1 2, 15, and 16 have failures which are indicated (crash = 1 ) while 8 others do not present any failure (crash = 0). The 16 state data sets thus constitute a log file J which will be analyzed by the server S by calculating the statistic correlation coefficients (table 2) resulting from comparisons between the different states values of the columns of table 1 taken two by two. The entries in table 2 give the correlation of the states of the columns two by two.

According to a preferred configuration of the monitoring module SU , when a state data set is transmitted to the server S at the apparition of one or several failures, the latter is generally shifted towards a location of the memory consecutive to the one used to store the current state data. A history record of the states is thus kept during a predetermined time period at the end of which new state data replace the old state data tra nsm itted to the server. Th is replacement can also be done when a predetermined number of shifts are reached, a number that can be fixed for example by the setup file that the server transmits to the user units.

slow stand¬

Log # DC1234 ST3456 SD HD MPG AC 3 subtitle bookings zap crash by

1 1 0 0 1 1 0 0 6 1 0 0

2 0 1 1 0 0 1 1 4 1 1 0

3 1 0 1 0 1 0 0 5 1 0 0

4 0 1 1 0 0 1 1 1 0 1 0

5 0 1 0 1 0 1 1 6 1 1 0

6 1 0 1 0 0 1 0 7 1 0 0

7 1 0 1 0 1 0 1 2 0 1 0

8 0 1 0 1 0 1 1 1 0 1 0

9 1 0 0 1 1 0 0 6 1 0 0

10 0 1 0 1 0 1 1 4 1 0 0

11 0 1 ¹ 0 0 1 0 3 1 0 0

12 0 1 ¹ 0 0 1 1 0 0 1 0

13 1 0 ¹ 0 0 1 0 6 1 0 0

14 0 1 ¹ 0 1 0 0 4 1 0 0

15 0 1 ¹ 0 1 0 1 2 0 1 0

16 0 1 0 1 0 1 1 4 0 1 1

Table 1 : state data examples related to some functioning parameters or states of 16 digital television decoders.

Table 2: correlation coefficients between the states data of columns of the table 1 The correlation coefficients r _p of the table 2 are calculated by the server S using the formula below: where σ _xy refers to the covariance between the variables x and y, and σ _x , σ _y the standard deviation of the variable x, respectively of the variable y.

In the example, the correlation coefficient r _p is calculated between two series x and y of same length each containing 16 state values of each of the 1 6 user units of x (xi , ....,xi ₆ ) and of y (yi, . .. ,yi6) of the columns corresponding to each of the 1 1 states (DC1234, ST3456, SD, H D, M PG, AC3, subtitle, bookings, slow zap, crash and standby) of table 1 . The covariance between the variable x and y σ _xy is calculated in the following way:

where the index i evolves from 1 to N = 16 which is the number of state sets of each of the 16 user units taken into account and where:

1

Δ ι i is the average of the values of x (3)

y ^~ y i is the average of the values of y (4) The standard deviations σ _x and σ _y are calculated in the following way:

The starting formula (1 ) becomes the following by replacing σ _xy , σ _x and σ _y according to the above definitions (2) to (6):

N

The correlation coefficient r _p thus calculated takes values between -1 and +1 , including the extreme values -1 and +1 .

The correlation coefficient r _p is equal to + 1 if one of the variables x or y is an increasing function of the other variable y or x. It is equal to -1 if the function is decreasing. The intermediate values inform on the degree of linear dependence between the two variables x and y. The nearer the coefficient r _p is to the extreme values -1 and +1 ; the stronger is the correlation between the variables. A correlation coefficient r _p equal to 0 means that the variables x and y are not correlated, thus independent one from the other. A negative correlation coefficient near -1 can ind icate a strong correlation in the same way as a positive coefficient near +1 according to the value of the concerned states. In fact, a state indicating for example a hard disk filling rate of 40% is complementary to a state indicating the remaining space of 60% of the same disk. Correlations carried out between these complementary states with other states will have same coefficients but with opposed signs.

In table 2, the correlation coefficient r _p between the "subtitle" and "crash" states is 0.88, near +1 . This means that the failures indicated by "crash = 1 " are certainly linked to the use of subtitles during the visualization of programs. For example, the subtitles are illegible, incomplete, or displaced because of missing data packets in the transmitted subtitles stream associated to the program currently being viewed.

The correlation coefficient 0.8 between the "booking" and "slow zap" states also near + 1 shows that when the number of bookings increases, the zapping speed is reduced. A probable cause of this low zapping speed would be a large number of bookings carried out and/or an insufficient broadcast rhythm of program tables PMT and / or event information tables EIT. The failures "crash" are independent from the operation mode of the user unit in high definition (HD) or in standard definition (SD), the correlation coefficient being equal to 0.

In this example, the failures "crash" are not expressly linked to the number of reservations "bookings" and to the low zapping speed "slow zap" as their respective correlation coefficient is negative -0,63 and -0,77 respectively. In other words, the "bookings" and "slow zap" states are not directly concerned by the failure «crash = 1 ». A high correlation coefficient (near -1 or +1 ) does not imply necessarily a causality relation between the two measured states. In fact, the two states can be correlated to a same initial state in form of a third not measured state on which the two others depend. In this case, the correlation coefficient, while indicating the states involved in the failure, also gives an indication in which direction a cause of the failure is to be searched.

The addition of measurements of other states which may have no relation with the states measured before, like for example the measurement of states during another operation mode of the user unit such as standby, the DVB (Digital Video Broadcast) reception mode or IP (Internet Protocol), the interactive mode, etc., can sometimes appear useful for establishing more appropriate correlations.

The determination of correlation coefficients as in the above example allows rapidly establishing and simplifying the interpretation of the links between the states of the user unit in order to target the search of a cause of detected failure(s).

This advantage becomes important when the server processes a very large number of user units for which it also establishes failure statistics and state history records. Moreover, parameters external to the user units such as the global state of the communication network, the level and the quality of the transmitted signals, the bandwidth or the data throughput, the load, etc. can also be correlated with states representing the behavior of a user unit or a group of user units. For example a big network load can degrade the quality of the reception of high definition programs which leads to failures "crashes" linked for example to the "HD", "slow zap" states, or to a too slow decoding leading to an incomplete and / or jerky image display.