A method of identifying faults in a target system (1, 2, 3), the method including steps of: providing a failure knowledge database for the target system, wherein the failure knowledge database specifies a plurality of failure mode and symptom data records, each data record identifying (i) a component of the target system, (ii) a failure mode for that component and (iii) a corresponding failure symptom; providing an incident report correction database which specifies, for each of at least a subset of the components of the failure knowledge database, one or more alternative components which are possible sources of reported failure symptoms and/or one or more possible alternative failure symptoms to reported failure symptoms, the alternative components and the alternative failure symptoms having corresponding failure mode and symptom data records in the failure knowledge database; receiving an incident report specifying a particular component and a reported failure symptom; identifying candidate failure mode and symptom data records which may explain the incident report by reference to the failure knowledge database, and further by using the incident report correction database to expand the number of candidate data records to include data records of alternative components and/or alternative failure symptoms which may explain the incident report; calculating respective confidence values for the candidate data records; comparing the calculated confidence values; for each of the identified candidate failure mode and symptom data records, determining a sensitivity of the calculated confidence values to an error in relation to that data record; and generating a maintenance instruction for the target system, the instruction pertaining to at least the candidate data record having the highest calculated confidence value, and when a high sensitivity is determined, a warning being included in the generated maintenance instruction identifying the respective data record. providing a failure knowledge database for the target system, wherein the failure knowledge database specifies a plurality of failure mode and symptom data records, each data record identifying (i) a component of the target system, (ii) a failure mode for that component and (iii) a corresponding failure symptom; providing an incident report correction database which specifies, for each of at least a subset of the components of the failure knowledge database, one or more alternative components which are possible sources of reported failure symptoms and/or one or more possible alternative failure symptoms to reported failure symptoms, the alternative components and the alternative failure symptoms having corresponding failure mode and symptom data records in the failure knowledge database; receiving an incident report specifying a particular component and a reported failure symptom; identifying candidate failure mode and symptom data records which may explain the incident report by reference to the failure knowledge database, and further by using the incident report correction database to expand the number of candidate data records to include data records of alternative components and/or alternative failure symptoms which may explain the incident report; calculating respective confidence values for the candidate data records; comparing the calculated confidence values; for each of the identified candidate failure mode and symptom data records, determining a sensitivity of the calculated confidence values to an error in relation to that data record; and generating a maintenance instruction for the target system, the instruction pertaining to at least the candidate data record having the highest calculated confidence value, and when a high sensitivity is determined, a warning being included in the generated maintenance instruction identifying the respective data record.