Method for detecting anomalies in a complex installation by means of an autoencoder, computer program product and device

Abstract

The invention relates to anomaly detection in an installation, for example an industrial installation or an energy generation installation such as a wind turbine. Essentially, an autoencoder model is trained. This means that the user does not require expert knowledge in order to configure the anomaly detection, but rather it is enough to provide a volume of data which contains sufficient information about the normal behaviour of the machine to be monitored. In this way, the model can be trained and the future measurement data can be monitored in an automated manner. Series production repeatedly follows the same paths in the 2D plane of the PCA-reduced vectors. These paths and an identifiably continuously increasing deviation of the path from the pattern, for example caused by wear, can be detected quickly and reliably. The crucial difference from already known methods lies in the mechanism which the autoencoder uses to decide which time series sequences are anomalies. In this case, it is not the reconstruction of the autoencoder that is considered, but rather the hidden states, that is to say the vector generated by the encoder.

Description

[0001] 202414792

[0002] 1

[0003] Description

[0004] Method for anomaly detection in a complex system using an autoencoder, computer program product and device

[0005] Industrial controllers (programmable logic controllers, PLCs) are used to monitor and control complex systems consisting of many interacting units. Such a system could be, for example, an industrial production plant for manufacturing goods or materials. However, other applications are also known; for instance, the complex system could be a power generation plant, specifically a wind turbine, or the motion control system for an amusement ride. Many amusement rides (carousels, swings, Ferris wheels, roller coasters, or drop towers) are controlled by a controller and also perform cyclical movements, in which a similar sequence of movements is repeated, with the end of one movement transitioning directly into the beginning of a new cycle.Monitoring the smooth operation is essential here, as a malfunction could potentially endanger the lives of passengers.

[0006] The units and the plant's work process, and potentially the production output, are monitored by sensors, generating countless data points throughout operation. Furthermore, PLC programs are used to collect live sensor data for sample production, maximizing process performance. This provides the plant operator with deeper insights into the manufacturing process, leading to increased production efficiency and reduced downtime.

[0007] The following assumes that the control system in the plant (among other things) controls a movement sequence which (ideally) is executed identically and repeatedly.

[0008] During operation, changes occur over time, for example due to wear and tear or external influences, which may not initially be apparent to the plant operator. These changes can be caused by mechanical issues, but also by faulty electronic components or microelectronics. External influences, such as the environmental conditions to which the plant is exposed during operation, cannot be ruled out either. 202414792

[0009] 2

[0010] If changes in the system / machine are not detected early, this can lead to more extensive damage, resulting in increased downtime and additional, higher maintenance costs. From the operator's perspective, this must be avoided at all costs, as consequential damage necessitates unnecessarily large repairs, leads to prolonged operational downtime, and ultimately results in unnecessary financial losses. Therefore, it is in the operator's interest to identify and assess all changes as quickly as possible in order to derive appropriate measures. The cause of the anomaly must be identified, as well as the affected parts of the system and the resulting consequences. Repairs, maintenance, or replacement of affected parts must be planned: Is a critical part of the system affected, or can a response be scheduled for a later time, such as during a planned shutdown period?

[0011] Therefore, anomaly detection methods are used that automatically evaluate a large number of different measurement data and thus recognize correlations and changes that are not visible even to experts.

[0012] The automatic detection of anomalies based on time series data is a complex problem that is usually only solved for very specific applications. The goal of these detection methods is a high anomaly detection rate with a low false prediction rate. Current state-of-the-art approaches present promising results, but their reliability remains questionable. The developed methods are often tested and evaluated with trivial, unrealistic datasets [R. Wu and EJ Keogh. “Current time series anomaly detection benchmarks are flawed and are creating the illusion of progress”, 2020.]. Predicted anomalies from such models should therefore always be interpreted with caution. Furthermore, there are different types of anomalies (point, contextual, and collective anomalies) that require approaches of varying complexity.When detecting contextual anomalies, all data must always be considered within its context. In the case of time series data, this context can extend over an arbitrarily long time period, thus making the application of neural networks difficult, as processing large time periods with common recurrent neural networks (RNNs) requires a high computational effort.

[0013] The condition of plants and machinery is monitored nowadays through regular manual inspection and continuous maintenance of plant components. Changes or problems are usually only detected when machines and systems have failed. 202414792

[0014] 3

[0015] Furthermore, there are numerous algorithms in the field of artificial intelligence, most of which are developed for specific domains and therefore cannot simply be transferred to other applications. These include: statistical methods, machine learning, clustering, and deep learning (autoencoders, variational autoencoders, generative adversarial networks).

[0016] An autoencoder is an artificial neural network used to learn efficient encodings. The goal of an autoencoder is to learn a compressed representation (encoding) for a set of data and thereby extract essential features. This allows it to be used for dimensionality reduction.

[0017] The autoencoder uses at least three layers:

[0018] • An input layer. In facial recognition, for example, the neurons could map the pixels of a photograph.

[0019] • Several significantly smaller layers that form the encoding.

[0020] • An output layer in which each neuron has the same meaning as the corresponding one in the input layer.

[0021] An autoencoder can be used to learn the normal state of a machine using training data.

[0022] The training data can be general sensor data from a wide variety of machine types. A neural network consisting of an encoder and a decoder is trained. The encoder compresses the incoming data into a multi-dimensional vector, and the decoder reconstructs the original data (with some loss) from this vector. If the input data repeatedly contains the same patterns as the original data, this reconstruction will work better than for new and unknown patterns. Only a dataset of regular / normal data is required to train an autoencoder. This makes the method accessible to more than just domain experts.

[0023] In P. Malhotra, A. Ramakrishnan, G. Anand, L. Vig, P. Agarwal, and G. Shroff, "LSTM-based Encoder-Decoder for Multi-sensor Anomaly Detection," 2016, the autoencoder is trained with the goal of inverting the reconstruction of the original time series to improve the training process. The autoencoder's results offer good precision (percentage of predicted anomalies that are actually anomalies) with very low recall (percentage of detected anomalies). The autoencoder used is based on LSTMs (Long Short-Term Memory), which are computationally intensive, especially when a large amount of context (i.e., a long time series) is to be included in the calculation. 202414792

[0024] 4

[0025] Patent application WO2019133316A1 also uses an autoencoder model for anomaly detection, which makes a decision based on the reconstruction of the input. Convolutional Neural Networks (CNNs) are mentioned as the basis for this model, and are more performant than LSTMs.

[0026] None of these methods focuses on cyclic applications, which are characterized by delivering measurement data in repeating, similar structures. For cyclic applications, it is easier to define a normal state or the normal behavior of the machine. The described methods attempt to solve the problem in a general way and therefore do not utilize the advantage that arises from cyclic data.

[0027] To offer added value for industrial plants, the invention aims to provide an easy-to-use and configurable method for anomaly detection that can be used in a wide variety of applications and also delivers reliable predictions. Furthermore, the method should utilize available computing resources efficiently to ensure it can run even on less powerful hardware.

[0028] The problem is solved by a method according to the features of claim 1. Furthermore, the problem is solved by a computer program product according to the features of claim 9 and a device according to the features of claim 10.

[0029] The method for anomaly detection in a complex system with a controller, wherein the controller receives data from the system, processes data and sends data back to the system, using an autoencoder. The autoencoder consists of an encoder, a decoder and a hidden layer. The autoencoder is trained on data to be monitored from the complex system. Vectors are generated from the data calculated by the encoder and hidden in the autoencoder's hidden layer, with the following steps: the generated vectors are projected into 2-dimensional space, and a first path is generated based on the vectors projected into 2-dimensional space. 202414792

[0030] 5 and new additional data calculated by the encoder and hidden in the Hidden Layer of the autoencoder are generated and projected into further vectors, and the result is compared with the first path, and a detected deviation is calculated in an anomaly score, and depending on the anomaly score, the control of the complex system triggers an alarm.

[0031] Further embodiments are specified by the dependent claims.

[0032] The generated vectors can be high-dimensional, depending on the configuration. If the patterns in the data are complex, the vectors can also have more than 100 rows.

[0033] The invention is also represented by the figures, showing

[0034] Figure 1 shows a basic sequence of the training phase and inference phase of the neural network,

[0035] Figure 2 shows a representation of the determined data using the example of a sugar centrifuge, and Figure 3 shows an analogous representation of the data in the example with significant deviations.

[0036] Anomaly detection in a system, such as an industrial plant or a power generation facility like a wind turbine, is a complex problem and rarely solvable in general. Therefore, specializing in cyclical problems, such as serial production or alternating CNC programs in the case of an industrial plant, offers significant advantages. Fundamentally, an autoencoder model is trained, but other types of neural networks are also conceivable, provided they are capable of performing non-linear dimensionality reduction of the input data. Thus, the user does not require expert knowledge to configure anomaly detection; only a dataset containing sufficient information about the normal behavior of the machine to be monitored needs to be provided. This data can then be used to train the model, and future measurement data can be monitored automatically.

[0037] In the 2D plane of PCA (Principal Component Analysis), reduced vectors in mass production repeatedly trace the same paths. These paths, and any detectable, steadily increasing deviation of the path from the pattern, which might be caused by wear, for example, can be identified quickly and reliably.

[0038] The crucial difference to previously known methods lies in the mechanism by which the autoencoder decides which time series sequences are anomalies. Here, 202414792

[0039] Section 6 does not consider the reconstruction of the autoencoder, but rather the hidden states, i.e., the vector generated by the encoder. These vectors are projected into two-dimensional space using PCA (Principal Component Analysis). In some applications, such as mass production or the alternating use of different CNC programs, the same motion sequences and activities are repeatedly performed cyclically, typically generating similar data. Thus, the aforementioned vectors also form cyclic paths in the 2D plane. These paths can change slightly due to wear and tear. The exact process is described below and divided into training and prediction.

[0040] The entire process is shown schematically in Figure 1.

[0041] First, an autoencoder is trained with suitable data from the procedure to be monitored, 10, using the following steps:

[0042] - Optionally, pre-existing noisy signals can be smoothed if required (configurable).

[0043] - The training data is normalized to the range 0 to 1, 101.

[0044] The training data is divided into fixed-length sequences, 102, which may overlap. 80% of these sequences are randomly selected for the actual training and 20% for validation. 80% is a typical value for training, but it can be varied as long as sufficient data remains to validate the training results. A neural network, configured as an autoencoder 12, is trained using the backpropagation algorithm. The optimization goal is the reconstruction of the input time series sequence.

[0045] Once the neural network is sufficiently trained, all time series sequences are processed by the autoencoder in the correct temporal order, and the hidden states 122 of the autoencoder are calculated. The result is a vector for each individual time series sequence 104. For further analysis, these vectors are reduced to two-dimensional vectors using PCA (Principal Component Analysis) 105. These 2D vectors form a path 13. For cyclic applications, where the same sequence of data always occurs cyclically, this path is also cyclic.

[0046] - This path 13 forms the basis for the predictions and is therefore, together with the trained autoencoder model, the overall result of the training.

[0047] Inference, 11 / Prediction:

[0048] To make anomaly decisions, the following steps are performed: 202414792

[0049] 7

[0050] New measurement data 111 are continuously divided into time series sequences of equal length and fed into the autoencoder, 112. Here, only the hidden states of the autoencoder need to be calculated, 113, so the decoder is not used. These vectors are also reduced to two dimensions using the PCA (Principal Component Analysis) established in the training step.

[0051] - The temporal sequence of the two-dimensional vectors also forms paths, 15. The length of the path to be considered is configurable.

[0052] - An anomaly score is calculated from the deviation of path 110 of the new data from the paths in the training data. This score is then compared to a threshold value 111. This threshold value can be automatically calculated from the training data and can be influenced by a configurable sensitivity parameter. To calculate the threshold value, the anomaly score is calculated for all paths in the training data. A suitable quantile of these values ​​(e.g., the 95th percentile) is then taken and multiplied by the sensitivity parameter.

[0053] The calculation of an anomaly score can proceed as follows, for example:

[0054] Each cycle has an associated path. We can assign points along this path to specific times within a cycle. For example, the first 5 seconds of the cycle form the first point in the path, seconds 50-55 belong to the 11th point in the path, and so on.

[0055] To calculate the anomaly score from a newly considered path, the first point in the new path is taken, and the first points of all training paths that are closest to it are found. The differences (2D distance) to these points are then calculated.

[0056] In both the path to be considered and the training paths, one works on each point one after the other and calculates the respective differences again (i.e., points 1 must be compared with each other, as well as points 2, etc.).

[0057] In one embodiment, the condition could be relaxed and, for example, point n of the new path could be compared with points n-1, n and n+1 of the training paths, and the minimum of these could be taken.

[0058] To calculate an anomaly score for the entire path, one could calculate the distances of the path points to the new path for each training path and then average them. The values ​​for all paths can then be averaged again to obtain an anomaly score.

[0059] For the inference step, the same scaling is applied as in training; an anomaly score is calculated using the trained model. Equal scaling means that the length of the sequences is essentially the same to ensure comparability of the 202414792

[0060] 8

[0061] To ensure accurate results, the score is smoothed and compared to various thresholds, each representing a different severity level of the anomaly. In the calculation example above, the anomaly score increases the further the path under consideration deviates from the training paths. The highest threshold thus triggers the most severe alarm. A lower threshold would accordingly only result in a warning. All thresholds can be adjusted using a sensitivity parameter, which is used to modify the number of detected anomalies.

[0062] Anomaly detection is described below using the example of a sugar centrifuge in Figures 2 and 3. This example should not be considered limiting; other examples of the aforementioned plant types are familiar to those skilled in the art.

[0063] In the chosen example, the two-dimensional hidden and projected states of the time series sequences from the training data are represented in a scatter plot 20. Certain value ranges in the plot have a high density of vectors. The line, divided into seven regions 21, ..., 27 and 31, ..., 37, describes the path for the 2D vectors for each production cycle. Figure 2 shows that this path is very close to the usual paths from the training data.

[0064] Figure 3, which shows the path of an irregular production cycle for comparison, reveals significant deviations, for example in areas 32, 34, and 37, even though the measurement data themselves differ only slightly from the usual (normal) behavior. It would therefore be possible to identify an anomaly with a high degree of certainty.

[0065] Applying the anomaly score calculation as described above will also result in a worse score if the path under consideration is not synchronized with the training paths. For example, the new path might only move one unit in space for every 5 path points, while the training paths move 10 units in space for every 5 path points. In this case, the new path is still within the area of ​​the training paths, but its trajectory is not synchronized. This could occur, for instance, if a specific operating point is normally maintained for 20 seconds in the sugar centrifugation process, but this operating point is held for 40 seconds in the new path.

[0066] The inventive method uses the autoencoder in a different way than usual, since the hidden states are not only traversed but actually utilized. The hidden states are first reduced using PCA, and paths are derived from them. Path formation allows a great deal of context to be integrated into an anomaly decision, since a path can be calculated from the data of a very large time range.

[0067] 9 is achieved without significantly increasing the input to the autoencoder. This allows for considerable computing power savings and also makes the anomaly detection more robust. More robust means that even minimal deviations that persist over a long period are detected. (For example, the motor runs at 1500.1 RPM instead of 1500 RPM for 15 minutes.) For a normal algorithm, this would most likely be within tolerance.

[0068] In another example, a situation can be detected where a motor remains at a constant speed for too long. Common autoencoder methods consider a fixed number of data points in a calculation. If these data points only cover a period of two minutes, then it is impossible for this model to detect if a motor, for example, runs at 1500 RPM for three minutes when it should only run at that speed for two minutes.

[0069] Predictions based on the deviation of a long 2D path are also easier to interpret, as can be seen in Figures 2 and 3. While certain path segments are very close to the typical paths from the training data, there are also segments that deviate significantly. This allows for a precise prediction of where the error in the process is likely to occur.

[0070] The described use case “sugar production with centrifuges” illustrates precisely these cyclical pathways and will be explained in more detail below.

[0071] Sugar production begins with the raw material: sugar cane or sugar beets. The raw material is cleaned to remove impurities, then sliced ​​and mixed with water. The sugar diffuses into the water, leaving us with a sugary solution (syrup). A thickened liquid remains after filtration and evaporation of some of the water. This liquid is boiled to encourage the growth of sugar crystals, and once these crystals are large enough, it is stored to cool. The tank used continuously agitates the liquid during this process to prevent the sugar crystals from settling.

[0072] Three different centrifuge types "A", "B" and "C" are used for further processing.

[0073] The cooled liquid is placed in the first centrifuge "A", and rapid rotation extracts the liquid while retaining sugar crystals on the centrifuge walls. The liquid is still not free of sugar crystals and becomes thicker. 202414792

[0074] 10 times more than before. The removal of these crystals is done with further centrifuges that have a different configuration (different shape and higher speed) to cope with the different viscosity of the liquid.

[0075] Since their behavior can change dynamically over time, Recurrent Neural Networks (RNNs) (of which the autoencoder is made) are very well suited for model time series data, which is the main motivation for using them for the data from the measurements on the sugar centrifuge.

[0076] This example uses data from a frequency converter and motor that drives a sugar centrifuge. The following steps must be performed to produce one batch of sugar:

[0077] (1) The liquid containing the dissolved sugar is first poured into the centrifuge at a low speed.

[0078] (2) The speed is increased so that the water is extracted from the sugar syrup. What remains is the crystalline sugar on the walls of the centrifuge.

[0079] (3) The centrifuge slows down to the usual idle speed.

[0080] (4) Knives are inserted into the centrifuge to scrape the produced sugar from the walls.

[0081] The duration of steps (1) and (2) is not fixed and can vary within certain limits, while the remaining steps of the production cycle are fixed. Once all steps have been completed, the next batch is started.

[0082] Torque is the force exerted by the motor. Once a motor reaches a constant speed, the force required to keep the centrifuge at that speed is lower than the force originally needed to reach that speed.

[0083] If, seemingly contradictorily, the diagram contains phases in which the rotational speed remains constant but a high torque is observed, this can only be explained by external factors, such as the addition of material to the centrifuge. The motor then has to increase the applied force to maintain the same rotational speed.

[0084] It is also possible to use other signals. Temperature, for example, is a slowly changing signal; it takes a very long time to reach its maximum or minimum. Because the machines are usually in use almost 24 hours a day, they rarely cool down completely. This will only happen during maintenance, and if the normal data does not include a complete cooling of the device, simple anomaly detection methods will detect anomalies as soon as the machine is restarted. 202414792

[0085] 11

[0086] Another challenge for accurate analysis is the temperature difference between summer and winter. The production hall may not be air-conditioned, leading to higher average and maximum motor temperatures in summer. Weather data from the machine's location can be used to validate that the ambient temperature actually correlates with the motor temperature. Motor failures are often visible at temperatures outside the threshold range, making it all the more important to always be able to detect an overheated motor rather than just a seasonal trend. Cooling problems, in particular, can be very easy and cost-effective to resolve, so it makes sense to integrate the ability to detect these scenarios into a detection model.

[0087] In the described example, most anomalies occur in phase (1), where the sugar liquid is added. A typical anomaly there is a lack of torque, indicating that the centrifuge is running dry. Otherwise, it regularly happens that the motor stops just before acceleration, which is usually a decision made by the machine operator.

[0088] In general, the motor current signal is one of the most interesting signals because it contains information about the motor's load. Anomalies in the signal can be caused not only by internal factors, such as motor or inverter deterioration, but also by external factors, such as a change in the motor's load.

[0089] An example of load switching can be illustrated using papermaking machines: The motors involved pull the sheet of paper through the system, and therefore a significant motor current is applied to achieve the required torque. When the paper sheet breaks, the load abruptly disappears, and less current is needed to keep the motor at a constant speed. This anomaly becomes visible in the electrical signals.

[0090] Various signals or measured values ​​are suitable for the described evaluation (the list is not exhaustive):

[0091] Motor temperature, speed setpoint, actual speed, active power, DC link voltage, output frequency, or current magnitude.

Claims

202414792 12 Patent claims 1. Computer-implemented method for anomaly detection in a complex system (A1, A2, A3) with a controller (S), wherein the controller receives data (S1, S2, S3) from the system, processes data and sends data back to the system, by means of an autoencoder (12), wherein: the autoencoder (12) consists of an encoder (121), a decoder (123) and a hidden layer (122), the autoencoder (12) is trained on data (101) of the complex system to be monitored, and state vectors (105) are generated from the data by the encoder (121) and hidden in the hidden layer (122) of the autoencoder, characterized in that the generated vectors are projected into 2-dimensional space, and a first path (13) is generated based on the vectors projected into 2-dimensional space.and new further data (111) calculated by the encoder (121) and hidden in the Hidden Layer (122) of the autoencoder are generated (15) and projected into further high-dimensional vectors, and the result is compared with the first path (110), and a detected deviation is calculated in an anomaly score, and depending on the anomaly score, the controller (S) of the complex system (A1, A2, A3) triggers an alarm.

2. Computer-implemented method for anomaly detection in a complex system (A1 , A2, A3) according to claim 1 , characterized in that the complex system (A1 , A2, A3) essentially performs cyclically recurring movements.

3. Computer-implemented method for anomaly detection in a complex system (A1, A2, A3) according to claim 1 or 2, characterized in that the complex system (A1, A2, A3) is in particular an industrial system (A1) for the manufacture of goods or an energy generation system (A3) or an amusement ride (A2).

4. Computer-implemented method for anomaly detection in a complex system (A1 , A2, A3) according to one of the preceding claims, characterized in that the training data used for training the autoencoder (12) are normalized before training. 202414792 13 5. Computer-implemented method for anomaly detection in a complex system (A1, A2, A3) according to one of the preceding claims, characterized in that the training data used for training the autoencoder (12) are previously divided into time series sequences (102) of fixed length and the new data are divided into time series sequences (112) of the same length for a time series sequence.

6. Computer-implemented method for anomaly detection in a complex system (A1 , A2, A3) according to one of the preceding claims, characterized in that the projection of the vectors onto 2D is carried out using Principal Component Analysis PCT (105).

7. Computer-implemented method for anomaly detection in a complex system (A1, A2, A3) according to one of the preceding claims, characterized in that the data are measured data from the complex system (A1, A2, A3), in particular temperature, motor or generator current, speed, active power, frequency, torque, DC link voltage.

8. Computer-implemented method for anomaly detection in a complex system (A1, A2, A3) according to one of the preceding claims, characterized in that, depending on the anomaly score, the controller (S) triggers a suitable action in the complex system (A1, A2, A3) to prevent damage to the system.

9. Computer program product for anomaly detection in a complex system (A1 , A2, A3) suitable for carrying out the features of the method according to one of claims 1 to 8.

10. Device (11) for anomaly detection in a complex system (A1, A2, A3) with a controller (S), wherein the controller receives data (S1, S2, S3) from the system, processes data and sends data to the system, by means of an autoencoder (12), wherein: the autoencoder (12) consists of an encoder (121), a decoder (123) and a hidden layer, the autoencoder (12) is trained on data (101) to be monitored from the complex system and is suitable and configured to generate state vectors (105) calculated from the data by the encoder (121) and hidden in the hidden layer (122) of the autoencoder, and to project the generated vectors into 2-dimensional space 202414792 14 project, and generate a first path (13) based on the vectors projected into the 2-dimensional space, and the autoencoder (12) is suitable and configured to calculate new further data (111) through the encoder (121) and to generate (15) states hidden in the Hidden Layer (122) of the autoencoder into high-dimensional vectors and compare them with the first path (110), and a comparator (C) is suitable and configured to determine a detected deviation and calculate an anomaly score, and depending on the anomaly score, instruct the controller (S) of the complex system (A1, A2, A3) to trigger an alarm.

11. Device for anomaly detection in a complex system (A1 , A2, A3) according to claim 10, characterized in that the complex system (A1 , A2, A3) essentially performs cyclically recurring movements.

12. Device for anomaly detection in a complex system (A1 , A2, A3) according to claim 10 or 11 , characterized in that the complex system is in particular an industrial plant for the manufacture of goods or an energy generation plant or an amusement ride.

13. Device for anomaly detection in a complex system (A1 , A2, A3) according to one of the preceding claims 10 to 12, characterized in that the training data used for training the autoencoder are normalized data before training.

14. Device for anomaly detection in a complex system (A1 , A2, A3) according to one of the preceding claims 10 to 13, characterized in that the training data used for training the autoencoder are previously divided into time series sequences of fixed length and the new data are divided into sequences of the same length and for a time series sequence.

15. Device for anomaly detection in a complex system (A1 , A2, A3) according to one of the preceding claims 10 to 14, characterized in that the projection of the vectors onto 2D is carried out using Principal Component Analysis PCT (105). 202414792 15 16. Device for anomaly detection in a complex system (A1 , A2, A3) according to one of the preceding claims 10 to 15, characterized in that the data are measured data from the complex system, in particular temperature, motor or generator current, speed, active power, frequency, torque, DC link voltage.

17. Device for anomaly detection in a complex system (A1 , A2, A3) according to one of the preceding claims 10 to 16, characterized in that, depending on the anomaly score, a suitable action is triggered in the complex system by the control system to prevent damage to the system.

Images