WO2023041458A2

WO2023041458A2 - Computer-implemented method, modules, and system for detecting anomalies in industrial manufacturing processes

Info

Publication number: WO2023041458A2
Application number: PCT/EP2022/075214
Authority: WO
Inventors: Georg Schneider; Nicolas Thewes
Original assignee: Zf Friedrichshafen Ag
Priority date: 2021-09-14
Filing date: 2022-09-12
Publication date: 2023-03-23
Also published as: DE102021210107A1; WO2023041458A3

Abstract

The invention relates to a computer-implemented method for controlling anomalies (NOK) in industrial manufacturing processes (IF), said method comprising the steps of: data-based definition of a state (Z) of a process step (PS, PS1, PS2, PS3) to be monitored of the industrial manufacturing process (IF) or of a system (A1); storing and processing data measured using a sensor and/or obtained from simulations according to the data-based state definition (A2); training an analysis model (Ref, Anno) to detect anomalies based on at least historical data (A3); integrating a verification instance (Expert) in order to control detected anomalies and generate annotations so as to extend the database (A4); detecting anomalies (A5); controlling the monitored process step (PS, PS1, PS2, PS3) or system if an anomaly is detected (A6).

Description

Computer-implemented methods, modules and systems for anomaly detection in industrial manufacturing processes

The invention relates to computer-implemented methods, modules and a system for anomaly detection in industrial manufacturing processes.

Industrial manufacturing processes are variable and complex processes that are correspondingly prone to errors and failures. At the same time, as part of the so-called 4th industrial revolution, the penetration of manufacturing processes with sensors is increasing, which ensures that the processes are comprehensively mapped by data. Ensuring that an industrial process step runs smoothly is associated with a great deal of effort and high costs, since error detection and error elimination are often manual processes and also take place reactively.

The object of the invention was how industrial manufacturing processes and/or individual steps of an industrial manufacturing process can be monitored in order to better detect deviations or anomalies.

The objects of claims 1, 7, 9, 12, 15, 20, 21 and 23 solve this problem.

In one aspect, the invention provides a computer-implemented method for obtaining an analysis model for anomaly detection in an industrial manufacturing process. The procedure includes the steps

• Obtaining data on states of a process, a component and/or a production machine in at least one process step of the industrial manufacturing process to be monitored at a specified point in time or in a specified time interval, from similar process steps and/or from downstream processes, including data measured by sensors and/or or data obtained from simulating the process;

• determining a state definition based on the data;

• Saving the data and the state definition; • Training at least one analysis model for anomaly detection, the data being fed into the analysis model and the analysis model based on the state definition determines a distribution of the states and based on the distribution the states that are rare based on the data and / or deviate from other states , classified as anomalies;

• evaluating the trained analysis model, wherein a verification entity annotates true positives and/or false positives among the classified anomalies;

• augmenting the data with the annotations and storing the augmented data;

• Saving the trained analysis model and its evaluation.

According to one aspect, the invention also provides a computer program for obtaining an analysis model for anomaly detection in an industrial manufacturing process. The computer program includes instructions that cause a computer to carry out the steps of the inventive method for obtaining an analysis model for anomaly detection in an industrial manufacturing process when the computer program runs on the computer.

According to one aspect, during training, annotation requests are sent to the validation entity. The data is enriched with annotations received from the reviewer.

According to a further aspect, for anomaly detection, the distribution of normal states is determined as a reference and/or patterns are determined in the data based on historical data, which are classified at least into the classes normal and abnormal by corresponding annotations.

According to one aspect of the invention, the reference is determined as follows: The data from each of N states is ordered by h·k positions, each entry of one of the N states at one of the h·k positions with the entry of another of the N states at the same position is comparable. For example, the h·k positions correspond to a matrix of times and frequencies. It N training states are thus obtained in the form of an N xhxk arrangement. At least one reference image is applied to the training states, with a value of a position in a reference state being calculated from the values of the position in the training states according to a predetermined calculation rule. For example, for each position in the reference state, the mean is calculated as a first reference image and the standard deviation is calculated as a second reference image over all corresponding positions in the training states, respectively.

According to a further aspect, the accuracy of the trained analysis model is increased by removing anomalies that were not recognized in the past from historical data that were initially fed into the analysis model.

According to a further aspect, the training is monitored and/or further analysis models are released based on an achieved accuracy.

According to a further aspect, the steps of the method according to the invention are carried out iteratively and analysis models are retrained and/or retrained.

According to a further aspect, the invention provides a first module for obtaining an analysis model for anomaly detection in an industrial manufacturing process. The first module includes

• a data processing module designed to receive data from states of a process, a component and/or a production machine in at least one process step of the industrial manufacturing process to be monitored at a specific point in time or in a specific time interval, from similar process steps and/or from downstream processes, comprising sensorially measured data and/or data obtained from simulating the process;

• a first data memory, which stores the data and, based on the data, a state definition and data extensions in the form of annotations of a checking instance;

• a training module that trains at least one analysis model for anomaly detection, the analysis model being based on the state definition determines a distribution of the states and, based on the distribution, classifies as anomalies the states that are rare and/or deviate from other states based on the data;

• an interface to the verification entity to obtain the annotations of true positives and/or false positives among the classified anomalies;

• a second data store storing the trained analysis model and an evaluation of the analysis model based on a test data set or on an evaluation by the verification authority.

According to one aspect, the first module further comprises

• a monitoring module for increasing the accuracy of the trained analysis model, in which historical data that the training module initially fed into the analysis model is cleaned of anomalies that were not recognized in the past, and/or

• a control module for monitoring the training and/or for enabling further analysis models based on an achieved accuracy.

The computer-implemented method, the computer program and the first module can receive analysis models for anomaly detection in the case of a failing/damaging production machine (scenario 1) and/or when testing components (scenario 2).

According to a further aspect, the invention provides a computer-implemented method for determining at least one anomaly value in an industrial manufacturing process. The procedure includes the steps

• Obtaining sensor-measured data from states of a process, a component and/or a production machine in at least one process step to be monitored of the industrial manufacturing process;

• Obtaining at least one analysis model based on historical data of the data, on data from similar process steps and/or on data from downstream processes, comprising data measured by sensors and/or data obtained from simulating the process trained to detect anomalies and inputting the data into the at least one analysis model;

• obtaining the at least one anomaly score as an output of the at least one analysis model;

• Providing the at least one anomaly value to a verification authority for verification of the at least one anomaly value.

According to one aspect, the invention also provides a computer program for determining at least one anomaly value in an industrial manufacturing process. The computer program includes instructions that cause a computer to carry out the steps of the method according to the invention for determining at least one anomaly value in an industrial manufacturing process when the computer program runs on the computer.

According to one aspect, the analysis model has been obtained according to the method for obtaining an analysis model according to the invention or by means of a first module according to the invention. The anomaly value checked by the checking instance flows into a training of the analysis model.

According to a further aspect, in the event that a reference-based analysis model that determines the distribution of normal states as a reference, and an annotation-based analysis model that determines the pattern in the data based on historical data, by corresponding annotations at least classified into the classes normal and abnormal, are available,

• an anomaly value obtained from the annotation-based analysis model, which is greater than a predetermined limit value, is provided to the verification authority;

• in the event that the annotation-based analysis model does not receive an anomaly value greater than a predetermined limit value or classifies a questionable state as a normal state, o an anomaly value obtained from the reference-based analysis model is provided to the checking instance or o the anomaly value obtained from the annotation-based analysis model and the anomaly value obtained from the reference-based analysis model are combined and the combined anomaly value is provided to the verification authority.

According to a further aspect, the invention provides a second module for determining at least one anomaly value in an industrial manufacturing process. The second module includes

• a data input Zcontrol module, executed, o sensor-measured data from states of a process, a component and/or a production machine in at least one process step to be monitored of the industrial manufacturing process and o at least one analysis model based on historical data of the data on data from similar process steps and/or on data from downstream processes, comprising data measured by sensors and/or data obtained from simulating the process, to obtain anomaly detection; o input the data into the at least one analysis model to obtain at least one anomaly score;

• an interface to a checking instance for providing the at least one anomaly value the checking instance for checking the at least one anomaly value.

According to one aspect, the second module further comprises a unifier module for combining an anomaly value obtained from an annotation-based analysis model and an anomaly value obtained from the reference-based analysis model.

According to a further aspect, the second module is designed to determine anomaly values according to the method according to the invention for determining at least one anomaly value. The computer-implemented method, the computer program and the second module can determine an anomaly value in scenario 1 and/or in scenario 2.

According to a further aspect, the invention provides a computer-implemented method for providing anomalies detected in an industrial manufacturing process to a verification authority. The procedure includes the steps

• obtaining at least one anomaly score;

• if the obtained anomaly score classifies an abnormal condition: o if the obtained anomaly score classifies an abnormal condition with high accuracy, reporting the condition as an anomaly without further verification; o or if the obtained anomaly value classifies an abnormal state, providing the anomaly value to a verification authority; o Calculation of the similarity between the abnormal state in question and states previously classified as abnormal and annotated by the verification authority using a given metric and, if there is sufficient equality, taking over the annotation of the already classified state without further verification;

• if the anomaly value obtained classifies a normal state: o no report in a part of the cases; o In another part of the cases, nevertheless, report to the verification body, for the purpose of statistical control of the anomaly detection algorithms and/or to ensure the attention of the verification body.

Whether a state classified as normal is sent to the checking instance can be made dependent on the degree of normality/abnormality, for example, which is represented by the level of the calculated anomaly value.

According to one aspect, the invention also provides a computer program for providing anomalies detected in an industrial manufacturing process to a verification authority. The computer program includes instructions that cause a computer, the steps of the method for providing to carry out anomalies detected in an industrial manufacturing process to a checking instance when the computer program is running on the computer.

According to one aspect, the state is annotated as a function

• an assessment of the accuracy of the annotation by a human reviewer and/or

• Metadata comprising identity of the human reviewer, quality of annotations already made by that reviewer, time of day, day of week and/or degree of anomaly.

According to a further aspect, annotation requests relating to states are sent to the verification authority and data from the states are supplemented with annotations received from the verification authority.

According to a further aspect, a state that has already been provided to a verification authority is provided again at a different time for the same verification authority and/or is provided to further verification authorities, and the annotations are compared and/or evaluated.

According to a further aspect, the anomaly value is obtained according to the method according to the invention for determining at least one anomaly value or by means of the second module according to the invention.

According to a further aspect, the invention provides a third module for providing anomalies detected in an industrial manufacturing process to a verification authority. The third module is designed to carry out the method according to the invention for providing anomalies detected in an industrial manufacturing process to a checking authority.

The computer-implemented method, the computer program and the third module can provide detected anomalies to the verification authority in scenario 1 and/or in scenario 2. According to a further aspect, the invention provides a computer-implemented method for controlling anomalies in industrial manufacturing processes, comprising the steps

• data-based definition of a status of a process step to be monitored in the industrial manufacturing process or a system;

• Storage and processing of data that are sensorially measured according to the data-based state definition and/or obtained from simulations;

• Training an analysis model for anomaly detection based on at least historical data;

• Integrate a verification instance to control detected anomalies and to generate annotations to expand the database;

• detecting anomalies;

• Checking the monitored process step or system if an anomaly is detected.

In one aspect, the invention also provides a computer program for controlling anomalies in industrial manufacturing processes. The computer program comprises instructions which cause a computer to carry out the steps of the method according to the invention for checking anomalies in industrial manufacturing processes when the computer program runs on the computer.

According to one aspect, the analysis model is trained according to the method according to the invention for obtaining an analysis model for anomaly detection, an anomaly is recognized according to the method according to the invention for determining at least one anomaly value and/or the checking instance according to the method according to the invention for providing anomalies recognized in an industrial manufacturing process to a Verification instance according to one of Claims 15 to 19 integrated.

According to a further aspect, the invention provides a system for controlling anomalies in industrial manufacturing processes. The system includes a first module according to the invention, a second module according to the invention and a third module according to the invention. The system is designed to carry out the inventive method for checking anomalies.

The computer-implemented method, computer program and system can control anomalies in scenario 1 and/or in scenario 2.

Advantageous configurations of the invention result from the following definitions, drawings and the description of preferred exemplary embodiments.

The claimed objects and the present disclosure can monitor all steps of an industrial manufacturing process, as well as component quality tests carried out during/after production, with the help of recorded data and detect deviations from the normal Ztarget state of a sub-process or a test, so-called anomalies, and send them to a checking authority, including a human reviewer.

The system according to the invention for checking anomalies in industrial manufacturing processes is an overall system for detecting anomalies. The analysis models, or anomaly detection models, form the brain of the overall system. The anomaly detection models assess a condition based on the data and calculate an anomaly score. The anomaly value reflects the degree of the anomaly. According to the invention, anomalies in industrial manufacturing processes are thus determined in a data-driven manner, in particular by ordered, numerical data.

For functions that are exclusively performed by a human reviewer, the term human reviewer is used. The term review instance is used for all other functions that a reviewer computer program could perform in addition to or as an alternative to a human reviewer.

The reviewer will assess the anomaly and report back his assessment, for example in the form of an annotation. This will create a continuous Improvement achieved during use of the items as well as an adaptation to changing processes and components.

According to one aspect, the annotations are binary annotations, for example "good" and "bad", which are identified in the form of labels. According to a further aspect, an annotation is divided into several (detail) levels, for example three levels. A first level includes a binary classification of the reviewer. If, for example, the second module detects an anomaly (positive) and the verifier comes to the conclusion that it is in fact not an anomaly, he enters a no/false on the first level, for example. This is a false positive event. In the second level, the inspector can, for example, specify the affected component in more detail. In the third level, the reviewer can, for example, provide more details about his review/result. According to a further aspect, the annotations are reported back online in the form of a table/file, for example.

In order to acquire data and process it further, the invention uses sensors and/or sensor models that are used in industrial processes. Sensor models simulate real sensors. The term sensor includes real sensors and sensor models. One way to categorize these sensors is based on their physical measurand, e.g. temperature sensors, vibration sensors, force and pressure sensors, optical sensors including camera, infrared, lidar and radar sensors, measuring the size of a component including its geometry, current and voltage sensors and others. Which sensors are used in a specific case depends on the respective process step. According to one aspect of the invention, functions of a machine and also the properties of a component are monitored by means of sensors, including the aforementioned sensors. According to one aspect, the invention includes the following sensor configurations:

• Component-related sensor measurement: geometry, appearance;

• Machine-related measurement: vibrations and temperatures of one or more components;

• Sensor in a component test: noise, vibration, current, pressure. According to one aspect, the sensors use Internet of Things technology to transmit data, for example to one another, to individual components/modules of the solution according to the invention and/or to a cloud infrastructure. Automated or autonomous anomaly detection can thus be implemented. The cloud infrastructure includes cloud-based data storage. The cloud infrastructure is, for example, a public, private or hybrid cloud infrastructure.

According to one aspect of the invention, the definition of what constitutes an anomaly can be based on the definition of what is to be understood by a state in the industrial manufacturing process.

Part of the solution according to the invention is based on the definition of the status of the production step or component to be monitored with regard to the data describing the status. The status definition can form the basis for further steps up to the detection of anomalies by defining the data basis for the training of models and the use of the solution according to the invention. The definition of both a state and the associated anomalies are not static concepts, but can be subject to change over time, for example because new sensors are available, quality requirements are changed, or materials involved in the process or product are changed.

Condition describes the condition/properties of a process, a component and/or a (production) machine at a specific point in time or in a specific time interval. This state is detected by measurements using suitable sensors as described above. Which sensors are suitable depends on the definition of the state as well as the system to be described (component, machine, ...). Conversely, the availability of appropriate sensors also influences the definition of the state. A state that is not accessible by appropriate sensors is not a meaningful definition of a state. A state can have different characteristics in the industrial manufacturing process, the invention includes the following state definitions: • The state of a machine can be defined by all of the sensor data within a time interval, for example the last 10 seconds, and also by component-specific parameters.

• The condition of a component can be defined by the results of a test, as well as by other component parameters, including different component variants.

A distribution of the states is determined depending on the respective state definition.

An anomaly is a condition, specified by corresponding (sensor) data, that is both rare and, based on the recorded data, deviates from almost all other conditions. An anomaly is rare and different. Nevertheless, it can often be difficult to draw a precise distinction between normal and abnormal, and in many cases even not possible with the available data, so that ultimately a condition is only abnormal with a certain probability. In order to accommodate this fact, the human reviewer is proposed as part of the solution according to the invention.

The modules according to the solution according to the invention include hardware and/or software modules, including hardware and/or software modules for regulating and/or controlling industrial manufacturing processes and/or for anomaly detection. The hardware modules include electronic units, integrated circuits, embedded systems, microcontrollers, multiprocessor systems-on-chip, central processors and/or hardware accelerators, e.g. graphics processors, data storage units and connectivity elements, e.g. WLAN modules, RFID modules, Bluetooth modules, NFC modules . According to one aspect of the invention, the anomaly detection is implemented as functional software in the cloud infrastructure.

The commands of the computer programs according to the invention include machine instructions, source text or object code written in assembly language, an object-oriented programming language, such as C ++, or in a procedural programming language, such as C. The computer programs are after a Aspect of the invention Hardware-independent application program that is provided, for example, via a data carrier or a data carrier signal using software over the air technology.

The invention is illustrated in the following exemplary embodiments. Show it:

1 shows a schematic representation of an exemplary embodiment of an industrial manufacturing process,

2 shows a first exemplary embodiment of a system according to the invention for industrial anomaly detection,

3 shows a second exemplary embodiment of a system according to the invention for industrial anomaly detection

4 shows an exemplary embodiment of a first module according to the invention of the system according to the invention,

5 shows an exemplary embodiment of anomaly scores,

6 shows an exemplary embodiment of a false positive rate after the selection of a limit value based on the anomalis scores from FIG. 5,

7 shows an exemplary embodiment of an optimal limit value for the costs of incorrect classification as an anomaly based on FIG. 6,

8 shows an exemplary embodiment of a second module according to the invention of the system according to the invention,

9 shows an exemplary embodiment of a method according to the invention for obtaining an analysis model for anomaly detection, 10 shows an exemplary embodiment of a method according to the invention for determining at least one anomaly value,

11 shows an exemplary embodiment of a method according to the invention for providing anomalies detected in an industrial manufacturing process to a checking authority and

12 shows an exemplary embodiment of a method according to the invention for checking anomalies.

In the figures, the same reference symbols denote the same or functionally similar reference parts. For the sake of clarity, only the relevant reference parts are highlighted in the individual figures.

Industrial production is usually divided into so-called production lines, which in turn are divided into individual production steps that build on one another. A production line has a certain production capacity, for example 100 products per day. Production is also scaled up by using several production lines of the same type, in which the same product is then manufactured. In addition to a main line, there are secondary lines in which individual components of the main product are manufactured. A single production step can have different characteristics, for example a component can be screwed together, a component can be milled or a quality inspection can be carried out on a component. 1 shows an industrial manufacturing process IF comprising a main line and two secondary lines. The main line includes the production steps PS1, PS2, PS3. One of the secondary lines, for example, also includes three production steps PS1, PS2, PS3 and relates, for example, to the production step PS2 of the main line. The other side lines also include, for example, three production steps PS1, PS2, PS3 and relate, for example, to the production step PS3 of the main line. At the end of the main line, an end-of-line test EOL is carried out. The system IF-Anom according to the invention monitors, for example, the production steps PS, PS1, PS2, PS3 and/or the respectively associated production machines PM with regard to any anomalies that occur, see FIG. 2 (scenario 1). In addition, the system IF-Anom according to the invention carries out quality checks with regard to any anomalies that occur, see FIG. 3 (scenario 2).

The IF-Anom system integrates the following steps or modules: Data-based definition of the state Z of the system to be monitored, data storage and processing of all necessary data Data1 -Data5, training an anomaly detection based on historical data Datal, integration of a human reviewer Expert to control the detected Anomalies NOK and to generate further annotations for the targeted expansion of the training database Datal, detection of anomalies, processing of the evaluation of the human reviewer Expert and based on this continuous adjustment and improvement of the anomaly detection.

The basic functionalities, such as saving and expanding the database Data, Data1 -Data5, Training Ref, Anno of models, setting up configurations of trained models Config-Model, requesting annotations to expand the data basis Data, Data1 -Data5, are handled by a first module IF-Anom Core adopted, see Fig. 4.

The task of detecting potential anomalies NOK is carried out by a second module IF-Anom anomaly detector, see FIG . The response from IF-Anom then contains a classification of the state Z as "normal/abnormal", optionally with confidence estimation, and is sent to a human expert for verification via a third module IF-Anom annotation manager.

The extent to which IF-Anom's suggestions are actually verified by a human depends on both the use case and how far the training of IF-Anom has progressed, i.e. how high the expected accuracies of the assessments of IF-Anom are.

As an additional, optional fourth module, IF-Anom data, the IF-Anom system includes the option of integrating further data sources into a production step PS. This can, for example, be an additional vibration sensor coupled to a special excitation. The data generated in this way can be transmitted to the IF-Anom system during operation and, as soon as a sufficient amount of data has been generated, serve as an additional data source for model training.

Scenario 1 shown in FIG. 2 could, for example, relate to the case of a broken production machine. So far, in such a case, a repair has only been carried out after the production machine has failed and costs for a production downtime have thus arisen. If the production machine does not fail immediately, faulty components can still be produced unnoticed, which can be further processed and then lead to problems in downstream production steps PS, PS1, PS2, PS3 or products.

Scenario 2 shown in FIG. 3 could relate to the testing of components, for example. Component also refers to finished products. Scenario 2 shown in FIG. 3 thus also includes, in particular, the end-of-production inspection EOL of a product. This plays a central role in the industrial manufacturing process IF and ensures consistent, high quality of the components produced. The challenge here is to quantify the requirements for a good component, which leads to initial difficulties in testing, especially for new components. If the corresponding requirements are not defined precisely enough, there is a risk of too many rejects on the one hand, and on the other hand there is a risk that defective components will be further processed and/or delivered.

In scenario 1 and/or scenario 2, the system IF-Anom according to the invention can carry out the method according to the invention for checking anomalies NOK. In the cases of FIGS. 2, 3, the penetration of the industrial manufacturing process IF and/or the tests with sensors and the corresponding availability of data Data2 offers the possibility of the intelligent system IF-Anom and/or its respective modules IF-Anom Core, IF-Anom anomaly detector, IF-Anom annotation manager, using artificial intelligence, among other things, to record the status Z of a production step PS, PS1, PS2, PS3 or a test based on data and subsequently to detect and report abnormal behavior. On the one hand, this enables an early reaction to changes that occur, ideally before a process comes to a standstill or a defective component continues in the process chain, and on the other hand, better identification of the underlying error.

Artificial intelligence includes machine learning. Machine learning is a technology that teaches computers and other data processing devices to perform tasks by learning from data rather than being programmed to do the tasks. The solution according to the invention corresponds to a data-based application, for which machine learning can advantageously be used. According to one aspect of the invention, the individual computer-implemented methods and modules according to the invention and the system according to the invention execute machine learning algorithms. For example, the analysis models for anomaly detection are based on machine learning algorithms. Examples of machine learning algorithms covered by the invention are artificial neural networks, for example convolutional networks, support vector machines and random forest models.

If not explicitly stated, the following descriptions apply to both scenarios and the term process step should be used as a general term for a production step as well as for a test.

In FIG. 2 the system IF-Anom monitors a production step PS or a production machine PM, for example. This could be, for example, a lathe machining a component or a component being screwed together by a human being. The procedure for using the IF-Anom system is, for example, as follows. After the process step to be monitored has been determined, the relevant database Data 2 is assessed. Based on this, a data-based definition of the state Z to be monitored is established. Then the initial training data Datal for the system IF-Anom is selected.

The main data source of the training data Datal regularly consists of the historical data of the process in question and the upstream processes insofar as these are relevant for the assessment of the state Z. This can be, for example, geometry information from the components involved. In addition, for example because insufficient data is available for the process to be monitored, data from comparable processes can be used as a second data source for the training data Datal. In some cases synthetic data can be used as third data sources of the training data DataB. In this case, data, for example via a physical model of the process in question, is artificially generated/simulated.

Regarding the second and third data source of the training data Data1, a transfer learning can be used, for example. The processing of the data Data1 -Data4 and the model training are taken over by the first module IF-Anom Core, see Fig. 4.

During operation of the IF-Anom system, data Data2 is continuously sent from the monitored process to the second IF-Anom anomaly detector module. The second module IF-Anom anomaly detector receives the current models from the first module IF-Anom Core, as well as an application-specific configuration Config-Model, in which, for example, the necessary pre-processing of the incoming data Data2 is specified. Using these models, the current state Z is then assessed by the second module IF-Anom anomaly detector.

This assessment is passed on to the third module IF-Anom annotation manager. The third module IF-Anom annotation manager takes over the task decide whether and when a state Z is given to one, or to which, human expert for assessment. For example, roughly speaking, detected anomalies are almost always propagated, and additionally detected-normal samples under certain circumstances. The evaluations by the human expert go back to the third module IF-Anom Annotation Manager, which decides in what form annotations go back to the first module IF-Anom Core in order to expand the database there accordingly. In the ideal case, the third module IF-Anom annotation manager has access to meta information regarding the assessment, for example an anonymous identification of the assessing expert, especially if necessary for data protection reasons, as well as a time stamp when the assessment was written. Details of the third module IF-Anom Annotation Manager are described below.

In order to set up an expanded database, the data sent to the second module IF-Anom Anomaly Detector are passed on to the first module IF-Anom Core Module for processing and data storage. The first module, IF-AnomCore, regularly retrains or retrains anomaly detection models. For this purpose, the first module IF-Anom Core also has the possibility to send annotation requests to the third module IF-Anom Annotationsmanager.

If an NOK anomaly is confirmed by the expert reviewer as an NOK anomaly or if the detected NOK anomaly is released without checking, two reactions are set in motion, for example. On the one hand, the monitored production step PS is examined more closely based on the state Z recognized as abnormal, in order to decide whether/when maintenance/repair must be carried out. On the other hand, the components that were processed during and after the occurrence of the NOK anomaly can be sorted out as a precaution and/or examined separately.

An exemplary application of the fourth module IF-Anom Data for additional data generation in this scenario is a specially designed test program that

Machine states generated that are not under standard production conditions occur, but contain a high level of information about the health of the components of the production machine PM to be monitored.

Fig. 3 shows the application of the IF-Anom system to industrial test methods, for example the end-of-production test EOL of gears. While there are hardly any differences between the scenarios shown in FIGS. 2, 3 at the level of algorithmic anomaly detection, there are significant differences with regard to the data.

Test methods carry out an annotation according to OK and non-OK NOK. In this respect, the main area of application of the IF-Anom system in this scenario is to search for anomalies NOK within the OK components that are not recognized as NOK by the current test procedure. These are also often referred to as unknown anomalies, in contrast to the known anomalies, the NOC. In principle, the use of the IF-Anom system can lead to the replacement of the existing test procedure, which would then mean that all components would be assessed by the IF-Anom system.

In this scenario, too, significant applications of transfer learning result from the use of data from comparable processes, i.e. comparable test stations P or comparable products, as well as synthetic data from the simulation of test processes. The fourth data source is data Data4 from the later use of products, so-called field data. If problems or failures occur during the use of products, this is a possible indication of NOK anomalies that are not detected by the current test procedure and thus an opportunity to test and train anomaly detection algorithms.

An important step in data generation here is the generation of special suggestions within test procedures by the fourth module IF-Anom data, for example driving through a transmission in different gears over a certain period of time in different load states. The under this suggestion The generated data often has a much higher information content of the process step to be analyzed than without this targeted suggestion.

In FIG. 3, a recognized, confirmed anomaly NOK leads to the sorting out and repair or dismantling of the component in question.

4 shows the first module IF-Anom Core. The first module IF-Anom Core includes two essential functions of the IF-Anom system, on the one hand the processing and data storage of incoming data Data1 -Data4 using a data processing module, on the other hand the training and evaluation of models for anomaly detection using a training module module 2. Both functions are subject to a temporal aspect, ie at the beginning of the use of the IF-Anom system, existing data Data2 from the process to be monitored is first accessed and/or data from comparable processes or synthetically generated data. Based on this, a status definition is developed. Data and state definition are brought into a form suitable for the subsequent steps and stored.

A first data memory Mem1 stores the data and/or configurations of the data processing module. The training module Modul2 reads in the data from the first data memory Mem1.

The processing of the existing data with regard to the later model training as well as the equivalent processing of incoming data during the operation of the IF-Anom system depends on the respective application.

For example, in the following not a complete list, high-frequency time signals are often transformed into the frequency domain by means of fast Fourier transformation or wavelet transformation. With time signals in general, it may be necessary to synchronize them before processing to ensure comparability. Image data represents a fundamentally different data source, again with specific processing steps. These steps are highly dependent of the respective application, but the basic principles of the IF-Anom system described here remain unaffected.

The existing data is used for the initial training of anomaly detection models. A suitable separation of the existing data into training, validation and test data is assumed here as a standard procedure and is therefore not mentioned explicitly. The IF-Anom system has two different approaches to anomaly detection.

When training reference-based models Ref, the normal state of a process step PS is recorded. This is based on the assumption that abnormal states in a process step PS are rare. Based on this assumption, a quantitative characterization of the distribution of the training states, i.e. almost exclusively normal states, is calculated. This characterization of normal states is called the reference state, or reference for short. The degree of deviation between a questionable state and the reference is then calculated for anomaly detection.

The requirements for the existing training data Datal are low. Apart from normal data quality requirements, no further annotations are necessary. This represents a great advantage in the industrial environment, since annotation is often not only difficult and potentially error-prone, but also generally labor-intensive and therefore expensive.

When training annotation-based models Anno, conspicuous, i.e. potentially abnormal, behavior from the past must be known and corresponding data must be available, i.e. historical data must at least be divided into the classes normal/abnormal. Then the IF-Anom system learns to recognize patterns that are associated with conspicuous or inconspicuous behavior in the data. During the use of the IF-Anom system, patterns are then sought that indicate abnormal behavior and their occurrence is quantified. With this methodology, the more detailed the annotations available, the more accurate the output. If only annotations of the form normal/abnormal are present, the IF-Anom system will only classify states into these classes, as in the reference-based methodology. However, if more detailed error/good classes were annotated, a correspondingly detailed statement from the IF-Anom system is possible. The requirements for the initial training data Datal are higher than for the reference-based methodology, since high-quality annotated historical data must be available.

The advantage of the reference-based methodology is a potentially more generic anomaly detection, which can be particularly beneficial when detecting unknown anomalies. Benefits of the annotation-based methodology is a higher level of detail in anomaly detection and potentially a better compromise between false-positive and false-negative predictions on known anomalies.

As a second level, the system IF-Anom can combine the results of a reference-based and an annotation-based approach Ref, Anno to train meta models Meta. The type of combination depends on the application, the quality of the available models and the current data. Various types of combination are possible, from a simple weighted sum to specially developed models, which are also trained on historical data/anomaly predictions and are used by the second module IF-Anom Anomaly Detector.

The trained reference models, annotation-based models, the combined meta-models and/or the results of the model evaluation are stored or temporarily stored in a second data memory Mem2 of the training module Module2. The released models are reloaded for use in the second module IF-Anom anomaly detector.

After an initial training, the IF-Anom system can be put into operation. This opens up further sources of information for the IF-Anom system. For the On the one hand, the current process step or test data, which is sent to the second module IF-Anom Anomaly Detector, is made available to the system. On the other hand, the IF-Anom system receives the manual evaluations of the potential anomalies, which are carried out at least statistically.

In addition, the IF-Anom system can send annotation requests to the third module IF-Anom Annotation Manager during the training of models, in order to expand the database with annotations, for example in the context of active learning. The IF-Anom system thus builds up an annotated database during operation. This contains at least the classes normal/abnormal, but can also have a higher level of detail if the human reviewer Expert provides appropriate annotations. As a result, the IF-Anom system will always have an annotated dataset available over time.

The database, which is expanded during operation, is used to regularly train new models. Even if only reference-based models Ref were used at the beginning, due to the absence of an annotated data set, annotation-based models Anno can now also be used. These can then replace or supplement the models currently used in the company. In addition, successfully trained and tested models can be used in an iterative process to clean the historical data, which was used for the initial training of a frequently reference-based model Ref, from anomalies that were not recognized in the past. By improving the quality of the initial training set, an additional improvement in model accuracy can be achieved.

The monitoring of the model training and the release of new models for productive anomaly detection can be automated using the monitoring module Moduli and/or the control module Modulß or manually based on the accuracy achieved and can be controlled by the control module Modulß as a function of a user interface. The control module Modulß is also used to display the data in the past, for example the last x days, achieved accuracy of anomaly detection, including the proportion of actual anomalies to the proposed anomalies, and thus fulfills a monitoring function.

The monitoring module module reads the data from the first data memory Mem1 and can exchange data with the control module module B.

There are two challenges in evaluating anomaly detection models.

Employed models can make errors in two directions, a condition recognized as abnormal is in fact normal, which corresponds to a false positive result. Or a condition that is actually abnormal has been classified as normal, which corresponds to a false negative result. In most cases there is competition between the two errors, i.e. a lower number of false negative predictions is accompanied by a higher number of false positive predictions and vice versa. The challenge at this point is that for a meaningful assessment of the usability of a model, the cost/cost function that an undetected anomaly or a normal state that is recognized as an anomaly entails must be taken into account. The IF-Anom system offers quantitative support for this.

In principle, better anomaly detection, as is achieved according to the invention with the IF-Anom system, leads to less competition between false-positive and false-negative results, making it fundamentally easier to find an acceptable compromise between the two.

In addition, the IF-Anom system offers the possibility of a detailed examination, in which the respective costs of the possible errors can be taken into account and thus an optimal decision can be made under the given circumstances, see Fig. 5. According to one aspect of the invention, the first module IF-Anom Core performs the method of obtaining analysis models according to the invention.

5 shows an example of the optimized selection of a model based on the costs of false positive and false negative classifications. A model, here logistic regression, assigns an anomaly score AS1, AS2, AS3 to test examples. The number of states is plotted on the abscissa. The anomalies score is plotted on the ordinate. The points marked as normal/abnormal represent ground truth. During use, the normal/abnormal classification would now be based on a limit value or threshold related to the anomalies score AS1, AS2, AS3. For example, if the cutoff is determined to be 0.8, any anomalis scores determined by the model that are greater than 0.8 correspond to an anomaly. That is, the points marked as normal above 0.8 correspond to false positive events. All anomaly scores determined by the model that are less than 0.8 do not represent an anomaly. This means that the points marked as abnormal below 0.8 correspond to false-negative events. In the case of false-negative events, actual anomalies that are present are not detected, whereas in the case of false-positive events, conditions are determined to be abnormal when in fact they are normal. False negative events thus have a correspondingly more expensive effect on the process and are weighted accordingly more heavily in the costs. For example, the cost of false negative events is 500, that of false positive is 100, for example in the euro currency.

The selection of this limit value, see dashed line, leads to a change in the number or the rate of false positive and false negative classifications, see FIG. 6. Instead of selecting a limit value, different models could also be compared here. Figure 6 is a threshold optimization curve, also known as a receiver operating characteristic. The AUC value, ie the size of the area under the curve, is a quality measure for the model. If the costs, including material costs, for an unrecognized anomaly, i.e. false negative, and a wrong classification as an anomaly, i.e. false positive, are known, an optimal limit value, i.e. an optimal model, can be calculated for productive use see dashed line in FIG. 7. If the limit value is set too small, for example all components whose received anomaly value is above the limit value are sorted out, including many components with incorrect classification. This leads to high costs. If the threshold value is too large, many components will be retained, including many components with undetected anomalies. The optimal limit obtained by optimizing the cost function balances these two trends.

Logistic regression is just one example of an analysis model here. The solution according to the invention is not limited to a specific analysis model. Further analysis models for carrying out the invention include, for example, isolation trees, also known as isolation forests, autoencoders, generative adversarial networks, also known as generative adversarial networks, convolution networks or support vector machines.

Isolation Forest denotes an anomaly detection algorithm that identifies anomalies through isolation. Anomalies are isolated using binary trees. Isolation forest works well in situations where the training set contains no or few anomalies. This means that the isolation forest is an advantageous analysis model for the solution according to the invention.

In the algorithmic detection of anomalies, the second challenge, as a direct consequence of the definition of an anomaly, is usually that there are few or, in the extreme case of unknown anomalies, no test anomalies that can be used for the evaluation. This leads at least to the fact that the evaluation of different models gets a statistical significance problem and in extreme cases it is even not possible to evaluate models at first. The IF-Anom system solves this problem by linking it to a human expert evaluator. If there are not enough test anomalies at the beginning, various models are used by manually evaluating the ones found anomalies evaluated. As a result, an initial evaluation of models takes place, by means of which a model can be selected for the first productive use. Furthermore, an initial set of annotated examples is generated, which can be used to evaluate models in the further course of using the IF-Anom system. The exchange between examples for annotation and the corresponding assessments by a human expert reviewer is carried out by the third module IF-Anom annotation manager.

8 shows the second module IF-Anom anomaly detector of the system IF-Anom.

The second module IF-Anom anomaly detector takes on the task of processing incoming data comprehensively Data2 according to the existing status definition and data pre-processing routines. The incoming data is processed in the same way as the historical data Datal used for model training. An assessment is then carried out using the available anomaly detection models. The output of each model includes an anomaly score, the anomalies score AS1, AS2, AS3. The anomaliscore AS1, AS2, AS3 indicates how abnormal the evaluated state Z is, usually but not necessarily, the higher the more abnormal. Which methodology and which models are used depends on the application and the availability of models of sufficient quality.

If only one model of a methodology is available, the anomaly value calculated by this model is sent to the third module IF-Anom annotation manager. In this case, this value is passed through by the combiner module Modul5. This case usually occurs at the beginning of the use of the IF-Anom system, when not enough annotated data is available and only a reference-based model is used.

A data entry/control module module 4 determines fifth data Data5 from the data of the first module IF-Anom Core and/or from the configuration of trained models Config-Model. The fifth data Data5 includes the status data and models. With the fifth data Data5, the second module IF-Anom anomaly identifier carries out a reference-based anomaly identifier Ref-anomaly and/or an annotation based anomaly detection Anno anomaly by. A first anomaly score AS1 is determined in the reference-based anomaly detection Ref-anomaly. In the annotation-based anomaly detection anno-anomaly, a second anomaly score AS2 is determined.

If the second module IF-Anom anomaly detector has both a reference-based and an annotation-based model available, the unifier module Module5 takes on the task of calculating a final, third anomaly score AS3 from the first and second anomaly scores AS1, AS2 . For example, the following procedure can be used:

If the annotation-based model detects an anomaly, ie the anomaliscore AS2 belonging to an anomaly class is greater than a set limit value, then this assessment is given to the third module IF-Anom annotation manager. Here, too, the unifier module Modul5 simply passes on the result.

If the annotation-based model does not recognize an anomaly class with sufficient confidence or classifies a questionable state Z as normal, this result is given to the unification module Module5. The unifier module also receives the assessment of the reference-based model. Then there are two possible approaches:

The unifier module takes over the assessment of the reference-based model and gives the calculated first anomaly score AS1 together with a classification based on a limit value as normal/abnormal to the third module IF-Anom annotation manager.

Or the unifier module takes the assessments of the annotation-based and the reference-based approach to generate a meta-prediction from them. A separate model Meta can be trained for this purpose. In addition to the model predictions, meta-information about the state Z in question as well as historical test accuracies of the models used can also be included in this model. In this case, too, an anomalies score, here the third anomalies score AS3, as well as a threshold-based assessment normal/abnormal passed to the third module IF-Anom annotation manager.

The communication between the IF-Anom system and the manual check of the predicted anomaly values/anomaly classes is taken over by the third module IF-Anom annotation manager.

The data pre-processed by the second IF-Anom anomaly detector module are sent to the first IF-Anom Core module for data storage and further processing.

According to one aspect, the second module IF-Anom anomaly identifier carries out the method according to the invention for determining at least one anomaly value AS1, AS2, AS3.

The third module IF-Anom Annotation Manager takes over the tasks related to the generation of annotations, including:

• processing incoming states Z evaluated by the second module IF-Anom anomaly detector and based thereon deciding whether a state Z is sent to a human verifier Expert; o Inclusion of similarity to already annotated anomalies;

• Request of annotation to expert verifier beyond the online anomaly detection, for the purpose of targeted expansion of the training set, model evaluation and for systematic testing of the expert verifier;

• Handling of the annotations.

According to one aspect, the third module IF-Anom annotation manager carries out the method according to the invention for providing recognized anomalies to the checking instance Expert.

For processing evaluated states Z: The models of the second module IF-Anom anomaly detector assign an anomaly value AS1, AS2, AS3 to a state Z to be examined, as well as a classification based on a limit value, at least into the classes normal/abnormal; in the case of training data with a higher level of detail, into the correspondingly more detailed classes. Based on this assessment, the third module IF-Anom annotation manager decides how to proceed.

If the condition Z has been assessed as abnormal, a decision is made as to whether a check by a human expert takes place or, usually if the expected accuracy is high, whether the condition Z is reported as an anomaly NOK without further checking.

If the state Z is assessed as normal, it can still be sent to an Expert for verification, flagged as a potential anomaly, in order to subject the modeling carried out by the IF-Anom system to a statistical control and at the same time to ensure the attention of the Expert verifiers. The probability of whether a normal state is sent to a checker Expert can be made dependent on the calculated anomaly value AS1, AS2, AS3, for example the more abnormal, the more likely a check will take place.

To include similarity to already annotated anomalies:

The continuous improvement of the IF-Anom system is achieved by using the annotations of the reviewers Expert for further training of models, and thus the knowledge of the human experts Expert flows into the anomaly detection. However, a characteristic of many of the models used here, especially those from the field of artificial intelligence, is that a certain number of examples of a class must be present for the class to be successfully learned and consequently recognized. In the operation of the IF-Anom system, this can lead to a human reviewer Expert very often having to classify very similar states Z as a true-positive or false-positive prediction before a model is able to recognize a comparable state Z as surely sufficiently abnormal or as not abnormal. In order to reduce this effort for a verifier expert, the third module IF-Anom annotation manager can calculate the similarity of a state Z to already recognized ones before there is a potential anomaly to a verifier expert. If there is a high level of agreement, the state Z in question can then be given the annotation of the already known similar state Z without further checking. The degree of the necessary similarity is defined via a limit value to be set.

To request annotations:

In addition to the annotation of states Z sorted out during operation, the optimal operation of the system IF-Anom requires further annotation effort.

The first module, IF-Anom Core, can send annotation requests to receive annotations to improve the models during training, for example in the context of active learning. A model calculates that the annotation of certain training states can particularly increase the model quality and these states Z are then given to a verifier expert by the third module IF-Anom annotation manager in order to specifically expand the annotated database.

The first module IF-Anom Core can also send annotation requests to the third module IF-Anom Annotation Manager for the purpose of model evaluation. The final evaluation of a trained model requires a test data set. If this is incomplete or too small, the first module IF-Anom Core can make specific annotation requests to evaluate a model. These are then sent by the third module IF-Anom annotation manager to a verifier Expert. This case plays a major role in particular at the beginning of the use of the IF-Anom system or after process changes, if not enough suitable test states Z are available. Another functionality of the IF-Anom system, more precisely of the third module IF-Anom annotation manager, is that different human reviewers Expert are systematically tested. For example, a status Z that has already been checked is given again to an expert for annotation. This can be the same Verifier Expert, for example at a different time of day, or it can be a different Verifier Expert. This essentially serves to weight the annotations given by the Expert reviewers accordingly and, if necessary, to continuously improve the annotation quality and thus the accuracy of the IF-Anom system by asking other Expert reviewers and/or at other times.

To handle the annotations:

A basic goal when performing the annotations described above is to improve the existing database and thus the accuracy of the anomaly detection models.

To ensure that the annotations performed are of high quality, the IF-Anom system performs an evaluation of the incoming annotations. This evaluation is based firstly on an assessment of the accuracy of an annotation by the expert reviewer himself, i.e. an expert reviewer states how certain he is of an annotation, for example in the three levels very certain, certain, unsure.

Second, the IF-Anom system performs its own assessment of the quality of an annotation based on metadata such as the ID of the Verifier Expert and the quality of the annotations made by this Verifier Expert in the past, including time of day, day of the week, degree of anomaly, self-assessment and other relevant variables as well as the assessment by the reviewer Expert associated with an annotation.

Based on the calculated assessment, the IF-Anom system decides whether an annotation is trustworthy enough to immediately send it to the first IF-Anom module Core to expand the training data set there, or whether the state Z is sent to a human reviewer Expert for further annotation. This usually involves selecting a different person, but it can also select the same person at a different time of day.

If contradictory annotations result from a multiple check, the IF-Anom system offers several comprehensive procedures:

A third annotation is requested. If there is a majority, the annotation can be sent to the first module IF-Anom Core or one of the next steps can also be carried out.

Conflicting annotations are collected and displayed in the monitoring application. A final decision regarding the annotation can be given there, for example after questionable states Z have been discussed in a team round. The final annotation is then given to the first module IF-Anom Core to extend the training data set.

An approach inspired by the label smoothing technique can be used. A state Z is not 100% assigned an annotation, but a state Z can have several, even contradictory, annotations, with each annotation being weighted, i.e. a state is, for example, 80% not okay and 20% okay . This weight can be assigned by the IF-Anom system based on its assessment of the annotation quality. The weighted annotations are then sent to the first module IF-Anom Core to extend the training data set.

A possible use of the IF-Anom system will now be described as an exemplary embodiment, limited to the essential aspects, for the sake of illustration.

The flawless condition Z of a finished transmission is determined as part of an end-of-line test EOL. This test includes a functional and acoustic test. As part of the acoustic test, a Speed ramp driven and meanwhile the resulting structure-borne noise is measured on the gearbox housing.

The established assessment of the transmission condition then occurs in the following manner.

First, the time signal is converted into a sonogram using a Fast Fourier Transform. Within this sonagram, areas can be assigned to specific transmission components and provided with limit values that must not be exceeded. Based on these areas, so-called characteristics, and the associated limit values, the condition Z of a transmission is determined as OK if no limit value is exceeded and as Not OK (NOK) if at least a limit is exceeded.

Defining the characteristics and the associated limits is a complex process that results from the structure of the transmission on the one hand and from experience during use on the other. As a result, there are always conspicuous gears that are not recognized. For this reason, the established transmission acoustic test is expanded to include anomaly detection using the IF-Anom system according to the invention.

The data basis of the IF-Anom system consists of the time signals that are recorded during the acoustic test and other meta information including the variant of the transmission, the ID of the testing test station, the ID of the production line, and the result of the established test NOK or OK . All of this data then also defines the state Z of a transmission, i.e. the state Z of a transmission in the sense of the IF-Anom system is defined by the acoustic signal from the EOL test, the result of the EOL test N IO/IO, the Transmission variant, the checking test station and the production line.

In this case, the historical acoustic test data of various transmission variants, test stations and production lines are available as training data Datal, as well as the annotation in OK and NOK according to the established one described above test procedure. The training data set Datal for reference-based models can thus be optimized to the extent that the known NOK are already removed.

The existing annotations can also be used to train annotation-based models. However, these are then only applied to IO cases in order to find unrecognized NOK.

Complaints from the operation of the gearbox are used as Data4 as a further data source for checking the anomaly detection. It is checked to what extent the anomalies recognized in the historical data are related to complaints in the field.

A separation of the existing data into training, validation and test data is assumed here as a standard procedure and is therefore not mentioned in detail.

In this case, the data pre-processing includes a transformation of the acoustic time signal into the frequency space by means of Fourier transformation or wavelet transformation. Furthermore, normalization steps, for example to the speed, can be added.

The anomaly detection models described below are trained with the initially available data.

A model that is based on the statistical recording of the distribution of the training data and calculates the deviation from the statistically observed normal state for anomaly detection. This model thus falls into the category of reference-based models.

A model that uses an autoencoder to map the Z states commonly observed in the training data. An autoencoder is a model with a two-part neural network architecture. One part of the model learns to create a low-dimensional representation of a state, for example a sonagram, and the second part of the model learns to restore the original state from this. The mistake that is made in doing this is for infrequently occurring ones States larger than for the majority of the occurring states Z. This model can thus be used for anomaly detection. The anomalies score AS1 then results from the difference between the original sonagram and the restored sonagram calculated by the model. This model is also a reference-based model.

Use of the existing OK and NOK annotations. For example, a convolution network can be trained to differentiate between OK and NOK states. In order to subsequently recognize unknown anomalies, the trained model can only be used for states Z that have been classified as IO by the established method. The model then looks for patterns in the IO states that actually belong to NIO cases. The probability calculated by the model that the condition in question belongs to the NOK class then serves as the anomaly score AS2. This model can be classified in the class of annotation-based models.

The models described are trained at the level of transmission variants and production lines. There is one version of each model for each transmission variant and production line. This restriction is always recorded in the associated configuration Config-Model, so that the model associated with the transmission in question is always loaded later on.

Since there are no real test anomalies in the use case described here, the accuracy of the developed models is tested in two ways. As a quick test, the accuracy with which a model would have found the known NOK of a test data set is calculated. If the result is promising, annotation requests are sent to an Expert human reviewer for analysis of the accuracy with which unknown anomalies are detected.

The model for the unifier module Modul5 is kept simple here. If an annotation-based model does not detect an anomaly, the assessment of the reference-based model is used, ie in this case no additional model training for the unifier module Module5 is required. The threshold values used to decide whether an anomalies score leads to classification as abnormal are set very narrowly in this case, for the following reasons:

In this application, the IF-Anom system is only used as an additional safety net.

Since no anomaly detection was carried out in the past, every anomaly found is a success, an anomaly that is not detected only corresponds to the process lived up to now.

Verifying the potential anomalies is laborious, so it is beneficial to focus on the very anomalous states Z.

During the use of the IF-Anom system, the data belonging to its state Z are sent to the second IF-Anom anomaly detector module for each EOL-tested transmission. Of the models described, for example, the statistical model is used as a reference-based model and, in addition, the annotation-based model described. The final anomaly prediction is then sent to the third module IF-Anom annotation manager and, if an anomaly is detected, always, since the thresholds are set correspondingly high, on to the human reviewer Expert. A gearbox classified as not abnormal will be sent for expert checking with a certain probability. The probability depends on the distance to the set anomaly score limit. To support the checks, an explainability output can be generated using the models used. This makes it transparent for the expert reviewer which areas of the sonagram were relevant for the normal/abnormal decision.

A transmission that is actually abnormal is then sorted out and repaired in a rework process. During operation of the IF-Anom system, two accuracies are manually monitored, which can be calculated from the manually annotated states Z requested by IF-Anom. On the one hand, this is the rate of false positives in relation to the states Z classified as abnormal, and on the other hand the rate of anomalies, i.e. false negatives, among the states Z classified as normal. There is an increase in the false positive rate and /or the false negative rate can be counteracted either by changing the set limit values or by retraining the models, preferably on more recent data.

9 schematically shows the computer-implemented method according to the invention for obtaining an analysis model for anomaly detection in an industrial manufacturing process IF. In a method step C1, data Data1, Data2, Dataß, Data4 are obtained from states Z, for example of a production machine PM, P in, for example, a process step PS to be monitored. A state definition is determined from the data in a method step C2. In a method step C3, the data and the state definition are stored in a first data memory Mem1. In a method step C4, an analysis model for anomaly detection in the form of an artificial intelligence K1, for example an artificial neural network, is trained on the data Data1, Data2, Data3, Data4. Driven by data, the analysis model learns to classify states Z that are rare and/or deviate from other states Z as anomalies. In a method step C5, the trained analysis model is evaluated by the checking instance Expert using an annotation of the anomalies found. The data Data1, Data2, Data3, Data4 are expanded with the annotations in a method step C6 and stored. The trained analysis model and its evaluation are stored in a method step C7.

For example, the first module IF-Anom Core is a software module, a hardware module or a combination of software and hardware module. The first module IF-Anom Core executes the method steps C1 -C7, for example. 10 schematically shows the computer-implemented method according to the invention for determining at least one anomaly value AS1, AS2, AS3 in an industrial manufacturing process IF. In a method step E1, sensor-measured data from states Z, for example of the production machine PM, is obtained in the process step PS to be monitored. In a method step E2, a reference-based analysis model Ref-Anomaly is obtained, for example, which was trained, for example, on historical data of the data for anomaly detection. The data is fed into the Ref-Anomaly analysis model. In a method step E3, the analysis model Ref-Anomaly receives the anomaly value AS1, AS2, AS3. In a method step E4, the anomaly value AS1, AS2, AA3 is made available to the checking instance Expert for further checking.

For example, the second module IF-Anom anomaly identifier is a software module, a hardware module or a combination of software and hardware module. The second module IF-Anom anomaly detector carries out the method steps E1-E4, for example.

FIG. 11 schematically shows the computer-implemented method according to the invention for providing recognized anomalies to the checking instance Expert. In a method step M1, an anomaly value AS1, AS2, AS3 is obtained. If the received anomaly value AS1, AS2, AS3 classifies an abnormal state with high accuracy, the state is reported as an anomaly in a method step M2 without further checking. If the received anomaly value AS1, AS2, AS3 classifies an abnormal state that is to be checked further, a similarity to a state already recognized as an anomaly is determined in a method step M3. In the case of high similarity, the annotation of the previously recognized and annotated state is adopted in a method step M4. If the condition recognized earlier was a false positive, this annotation is of course also adopted. Otherwise, in a method step M5, the status is made available to the checking instance Expert. Furthermore, the state is annotated accordingly by the checking instance Expert. Conditions classified as normal can also occasionally be reported to the verification authority for the purpose of statistical control of the anomaly detection algorithms and/or to ensure the attention of the verification authority.

For example, the third module IF-Anom annotation manager is a software module or a combination of software and hardware module. The third module IF-Anom annotation manager executes the method steps M1-M5, for example.

12 schematically shows the computer-implemented method according to the invention for checking anomalies NOK. In a method step A1, a data-based status Z, for example of the process step PS to be monitored, is defined. In a method step A2, the data are stored and processed. In a method step A3, an analysis model for anomaly detection is trained based on at least historical data, for example using the first module IF-Anom Core. In a method step A4, the checking instance is integrated to check detected anomalies and to generate annotations for expanding the database, for example using the third module IF-Anom anomaly detector. In a method step A5, the anomalies are detected, for example by means of the second module IF-Anom anomaly detector. In a method step A6, the monitored process step PS is checked if an anomaly is detected. For example, the monitored process step PS is examined more closely based on the detected anomaly in order to decide whether and/or when maintenance or repairs need to be carried out. A component that was processed during or after the occurrence of an anomaly can, for example, be sorted out and/or examined separately.

The method is carried out, for example, by the system IF-Anom according to the invention for checking anomalies NOK in industrial manufacturing processes IF. Reference sign

IF industrial manufacturing process

PS1-PS3 production steps

PS production step

PM production machine

P test station

EOL end of line check

IF-Anom system for industrial anomaly detection

IF-Anom Core first module

IF-Anom anomaly detector second module

IF-Anom annotation manager third module

IF-Anom data fourth module

NOK anomaly

Expert Supervisor

Datal first data

Data2 second data

Data3 third data

Data4 fourth data

Data5 fifth data

Data data processing module

Moduli monitoring module

Module2 training module

Module3 control module

Module4 Data Entry ZControl Module

Module 5 combiner module

Ref Training Reference-based models

Ref-Anomaly Reference-based anomaly detection

Anno Training annotation-based models Anno-Anomaly Annotation-based anomaly detection

AS1 first anomalies score

AS2 second anomaly score

AS3 third anomalies score

Meta training meta model

Mem1 first data store

Mem2 second data storage

Z state

Config-Model Configuration of trained models

C1 -C7 process steps

E1 -E4 process steps

M1-M5 procedural steps

A1 -A6 process steps

Kl Artificial Intelligence

Claims

patent claims

1 . Computer-implemented method for obtaining an analysis model for anomaly detection in an industrial manufacturing process (IF), comprising the steps

• Obtaining data (Data1, Data2, Data3, Data4) from states (Z) of a process, a component and/or a production machine (PM, P) in at least one process step to be monitored (PS, PS1, PS2, PS3) of the industrial Manufacturing process (IF) at a predetermined point in time or in a predetermined time interval, from process steps of the same type and/or from downstream processes comprising data measured by sensors and/or data (C1) obtained from simulating the process;

• determining a state definition based on the data (Data1, Data2, Data3, Data4) (C2);

• storing the data and the state definition (C3);

• Training at least one analysis model for anomaly detection, the data (Data1, Data2, Data3, Data4) being fed into the analysis model and the analysis model based on the state definition determines a distribution of the states (Z) and based on the distribution the states (Z) that are rare and/or deviate from other states (Z) based on the data (Data1 , Data2, Data3, Data4) are classified (C4) as anomalies;

• Assessing the trained analysis model, wherein a verification entity (Expert) annotates true-positive results and/or false-positive results among the classified anomalies (NOK) (C5);

• Extending the data (Datal , Data2, Data3, Data4) with the annotations and storing the extended data (C6);

• Saving the trained analysis model and its evaluation (C7).

2. The method as claimed in claim 1, wherein annotation requests are sent to the checking instance (expert) during the training and the data (Data1, Data2, Data3, Data4) are expanded with annotations obtained from the checking instance (expert).

45

3. The method according to any one of the preceding claims, wherein for anomaly detection

• the distribution of normal states is determined as a reference (Ref) and/or

• Patterns in the data (Data1, Data2, Data3, Data4) are determined (Anno) based on historical data, which are classified at least into the classes normal and abnormal by appropriate annotations.

4. The method as claimed in one of the preceding claims, in which the accuracy of the trained analysis model is increased by removing anomalies that were not recognized in the past from historical data which were initially fed into the analysis model.

5. The method according to any one of the preceding claims, wherein the training is monitored and/or further analysis models are released based on an achieved accuracy.

6. Method according to one of the preceding claims, wherein the steps of the method according to one of the preceding claims are carried out iteratively and analysis models are retrained and/or retrained.

7. First module (IF-Anom Core) for obtaining an analysis model for anomaly detection in an industrial manufacturing process (IF) comprising

• a data processing module (Data), running data (Data1, Data2, Data3, Data4) from states (Z) of a process, a component and/or a production machine (PM, P) in at least one process step (PS, PS1) to be monitored PS2, PS3) of the industrial manufacturing process (IF) at a specific point in time or in a specific time interval, from similar process steps and/or from downstream processes, comprising data measured by sensors and/or data obtained from simulating the process;

• a first data memory (Mem1) containing the data (Datal, Data2, Data3, Data4) and based on the data (Datal, Data2, Data3, Data4).

46 saves state definition and data extensions in the form of annotations of a checking instance (expert);

• a training module (Modul2) that trains at least one analysis model (Ref, Anno) for anomaly detection, with the analysis model (Ref, Anno) determining a distribution of the states (Z) based on the state definition and the states (Z) based on the distribution that are rare and/or deviate from other states (Z) based on the data (Data1, Data2, Dataß, Data4) are classified as anomalies;

• an interface to the verification entity (Expert) to obtain the annotations of true-positives and/or false-positives among the classified anomalies;

• a second data memory (Mem2) storing the trained analysis model (Ref, Anno) and an evaluation of the analysis model (Ref, Anno) based on a test data set or on an evaluation by the verification authority (Expert).

8. First module (IF-Anom Core) according to claim 7, comprising

• a monitoring module (Moduli ) to increase the accuracy of the trained analysis model (Ref, Anno) in which historical data (Datal ) that the training module (Modul2) initially fed into the analysis model (Ref, Anno) from in the past did not detected anomalies are cleaned up, and/or

• a control module (module β) for monitoring the training and/or for releasing further analysis models (meta) based on an achieved accuracy.

9. Computer-implemented method for determining at least one anomaly value (AS1, AS2, AS3) in an industrial manufacturing process (IF) comprising the steps

• Obtaining sensor-measured data from states (Z) of a process, a component and/or a production machine (P, PM) in at least one process step to be monitored (PS, PS1, PS2, PS3) of the industrial manufacturing process (IF) (E1) ;

47 • obtaining at least one analysis model (ref anomaly, anno anomaly) based on historical data of the data, on data from similar process steps and/or on data from downstream processes, comprising data measured by sensors and/or data obtained from simulating the process, was trained to recognize anomalies and enter the data into the at least one analysis model (ref anomaly, anno anomaly) (E2);

• Obtaining the at least one anomaly value (AS1, AS2, AS3) as the output of the at least one analysis model (ref anomaly, anno anomaly) (E3);

• Providing the at least one anomaly value (AS1, AS2, AA3) to a checking instance (Expert) for checking the at least one anomaly value (AS1, AS2, AS3) (E4).

10. The method according to claim 9, wherein the analysis model (ref anomaly, anno anomaly) was obtained according to the method according to one of claims 1 to 6 or by means of a first module (IF-Anom Core) according to one of claims 7 or 8 and the anomaly value (AS1, AS2, AS3) checked by the checking instance (Expert) flows into a training of the analysis model (Re, Anno)).

11 . The method of claim 9 or 10, wherein in the event that a reference-based analysis model (Ref anomaly) that determines the distribution of normal states as a reference, and an annotation-based analysis model (anno-anomaly), the pattern in the data are available based on historical data, which are classified at least into the classes normal and abnormal by appropriate annotations,

• an anomaly value (AS2) obtained from the annotation-based analysis model (anno-anomaly), which is greater than a predetermined limit value, is made available to the verification instance (expert);

• in the event that the annotation-based analysis model (anno-anomaly) does not receive an anomaly value (AS2) greater than a predetermined limit value or classifies a questionable state (Z) as a normal state (Z), o one from the reference-based analysis model (Ref-Anomaly) received anomaly value (AS1) of the verification instance (Expert) is provided or o the anomaly value (AS2) obtained from the annotation-based analysis model (Anno-Anomaly) and the anomaly value (AS1) obtained from the reference-based analysis model (Ref-Anomaly) are combined and the combined anomaly value (AS3) of the verification instance (Expert) provided.

12. Second module (IF-Anom anomaly identifier) for determining at least one anomaly value (AS1, AS2, AS3) in an industrial manufacturing process (IF).

• a data input Z control module (Modul4), executed, o sensorially measured data of states (Z) of a process, a component and / or a production machine (P, PM) in at least one process step to be monitored (PS, PS1, PS2, PS3) of the industrial manufacturing process (IF) and o at least one analysis model (ref anomaly, anno anomaly) based on historical data of the data, on data from similar process steps and/or on data from downstream processes, comprising data measured by sensors and/or from simulating the process obtained data that was trained to obtain anomaly detection; o to enter the data into the at least one analysis model (ref anomaly, annoanomaly) and to obtain at least one anomaly value (AS1, AS2, AS3);

• an interface to a checking authority (expert) for providing the at least one anomaly value (AS1, AS2, AS3) to the checking authority (expert) for checking the at least one anomaly value (AS1, AS2, AS3).

13. The second module (IF-Anom anomaly detector) according to claim 12, comprising a unifier module (Modul5) for combining an anomaly value (AS2) obtained from an annotation-based analysis model (anno-anomaly) and one from the reference-based analysis model (ref-anomaly ) obtained anomaly value (AS1 ).

14. Second module (IF-Anom anomaly detector) according to claim 12 or 13, designed to determine anomaly values (AS1, AS2, AS3) according to the method according to one of claims 9 to 11.

15. Computer-implemented method for providing anomalies detected in an industrial manufacturing process (IF) to a verification instance (expert) comprising the steps

• Obtaining at least one anomaly value (AS1, AS2, AS3) (M1);

• if the obtained anomaly value (AS1 , AS2, AS3) classifies an abnormal condition: o if the obtained anomaly value (AS1 , AS2, AS3) classifies an abnormal condition (Z) with high accuracy, reporting the condition (Z) as an anomaly (NOK ) without further checking (M2);or if the received anomaly value (AS1, AS2, AS3) classifies an abnormal state (Z), providing the anomaly value (AS1, AS2, AS3) to a checking instance (Expert); o Calculation of the similarity between the abnormal state in question and states previously classified as abnormal and annotated by the checking instance (expert) using a given metric and, if there is sufficient equality, adopting the annotation of the already classified state without further checking;

16. The method according to claim 15, wherein the annotating of the state (Z) as a function

• an assessment of the accuracy of the annotation by a human reviewer (expert) and/or of metadata comprising identity of the human reviewer, quality of the annotations already made by this reviewer, time of day, day of the week and/or degree of anomaly.

17. The method according to claim 15 or 16, wherein annotation requests for states (Z) are sent to the verification authority (expert) and data from the states (Z) are expanded with annotations obtained from the verification authority (expert).

18. The method according to any one of claims 15 or 17, wherein a state (Z), which has already been provided to a verification authority (expert), is provided again at another time of the same verification authority (expert) and/or is provided to further verification authorities (expert). and the annotations are compared and/or evaluated.

19. The method according to any of claims 15 to 18, wherein the anomaly value (AS1, As2, AS3) is obtained using the method according to any of claims 9 to 11 or by means of the second module (IF-Anom anomaly detector) according to any of claims 12 to 14 becomes.

20. Third module (IF-Anom annotation manager) for providing anomalies detected in an industrial manufacturing process (IF) to a checking instance (expert), designed to carry out the method according to one of claims 15 to 19.

21. Computer-implemented method for controlling anomalies (NOK) in industrial manufacturing processes (IF) comprising the steps

• data-based definition of a state (Z) of a process step to be monitored (PS, PS1, PS2, PS3) of the industrial manufacturing process (IF) or a system (A1);

51 • Storage and processing of data that are sensorially measured according to the data-based state definition and/or obtained from simulations (A2);

• Training an analysis model (Ref, Anno) for anomaly detection based on at least historical data (A3);

• Integration of a verification instance (Expert) to control detected anomalies and to generate annotations to expand the database (A4);

• Anomaly detection (A5);

• Checking of the monitored process step (PS, PS1, PS2, PS3) or system when an anomaly is detected (A6).

22. The method according to claim 21, wherein the analysis model (Ref, Anno) is trained according to the method according to one of claims 1 to 6, an anomaly is detected according to the method according to one of claims 9 to 11 and/or the verification authority (expert) integrated according to the method of any one of claims 15 to 19.

23. System (IF-Anom) for controlling anomalies (NOK) in industrial manufacturing processes (IF) comprising a first module (IF-Anom Core) according to claim 7 or 8, a second module (IF-Anom anomaly detector) according to one of the claims 12 to 14 and a third module (IF-Anom annotation manager) according to claim 20, wherein the system is designed to perform the method according to claim 21 or 22.

52