A method for collaborative machine learning of analytical models

The invention relates to a method for performing collabora tive machine learning of analytical models which can be de ployed on customer computing devices of customer premises such as manufacturing plants of different customers.

Machine learning is a tool for optimization of industrial processes which can be used in a wide variety of different applications, e.g. for the optimization of machine tools, for fault detection in digital grids, for increasing an efficien cy of wind turbines, for performing factory automation pro cess monitoring, for performing analysis of sensor data or e.g. the emission reduction in gas turbines.

The development of machine learning algorithms is data driven and involves typically the creation of a parameterized data model of a system of interest, and training the data model with large amounts of process data. The data model effective ly learns a behaviour of the investigated system, for example to make predictions or to optimize processes. The quality of the data models is in general directly related to an amount of data available to train the respective data models. Usual ly, if more data is available, the training can result in better performing data models.

Consequently, there is an interest of different customers performing similar processes to pool their data to train data models used commonly by different customers to generate data models which provide a higher performance. However, different customers performing similar processes are often competitors and have an interest in keeping their local data undisclosed and wish to keep the industrial data within its local custom er premises. Accordingly, it is an object of the present invention to pro vide a method for machine learning of analytical models which allows to optimize industrial processes of different custom ers .

This object is achieved according to a first aspect of the present by a method for machine learning of analytical models comprising the features of claim 1.

The invention provides according to the first aspect of the present invention a method for machine learning of analytical models comprising core model components shared between tasks of different customers and comprising specialized model com ponents specific to customer tasks of individual customers, wherein the machine learning of the analytical models is per formed collaboratively based on local data provided by ma chines of customer premises of different customers without the local data leaving the respective customer premises.

In a possible embodiment of the method for machine learning of analytical models according to the first aspect of the present invention, the analytical models specific to associ ated customer tasks are deployed by a third-party backend on assigned customer computing devices, in particular edge com puting devices located at the customer premises of the cus tomers and connected to processing entities, in particular machines of the respective customers which provide local da ta, in particular industrial data and/or machine data gener ated by the respective machines.

In a further possible embodiment of the method according to the first aspect of the present invention, the deployed cus tomer task specific analytical models can be executed on the assigned customer computing devices based on the local data, in particular the local industrial data, to provide model up dates of the analytical models, wherein the updated shared core model components are communicated by the customer compu ting devices via an interface as candidate core model compo nents to the third-party backend.

In a further possible embodiment of the method according to the first aspect of the present invention, the third-party backend combines the communicated received candidate core model components to provide global candidate core model com ponents .

In a further possible embodiment of the method according to the first aspect of the present invention, analytical models deployed on assigned customer computing devices of customers are replaced by candidate analytical models comprising the provided global candidate core model components if it is ver ified that the deployed analytical models are outperformed by the respective candidate analytical models.

In a possible embodiment of the method according to the first aspect of the present invention, the analytical models com prise neural networks including several network layers.

In a possible embodiment of the method according to the first aspect of the present invention, the core model components comprise one or more bottom layers of the neural network shared between tasks of different customers.

In a further possible embodiment of the method according to the first aspect of the present invention, the specialized model components comprise one or more top layers of the neu ral network specific to associated customer tasks.

In a still further possible embodiment of the method accord ing to the first aspect of the present invention, the verifi cation is performed by the third-party backend using availa ble test data provided by the third party and/or provided by the customers. In a still further possible embodiment of the method accord ing to the first aspect of the present invention, the verifi cation is performed by analyzing the candidate analytical models comprising the provided global candidate core model components .

In a further possible embodiment of the method according to the first aspect of the present invention, the verification is performed by testing candidate analytical models deployed on customer computing devices of customer premises.

In a possible embodiment the verification is performed in a secure computing device.

In a further possible embodiment of the method according to the first aspect of the present invention, multiple model versions of each complete analytical model comprising the core model components and comprising the specialized model components are maintained and managed at the third-party backend and/or on the customer premises of each customer.

In a possible embodiment of the method according to the first aspect of the present invention, the model versions of the analytical models comprise a production model version of the analytical model,

a local model version of the analytical model and

a global model version of the analytical model.

In a still further possible embodiment of the method accord ing to the first aspect of the present invention, the produc tion model version of the analytical model is executable in a production mode on process or industrial data during a pro duction process at a customer premises.

In a further possible embodiment of the method according to the first aspect of the present invention, the local model version of the analytical model is executable in a develop ment mode having the specialized model components specific to the associated customer tasks updated on the basis of the task specific local data and having fixed core model compo nents .

In a still further possible embodiment of the method accord ing to the first aspect of the present invention, the global model version of the analytical model is executable in the development mode and has specialized model components specif ic to the associated customer task updated on the basis of task specific local data and having core model components up dated on the basis of local data throughout all compatible tasks across the customer premises of all customers.

In a further possible embodiment of the method according to the first aspect of the present invention, a performance pro vided by the global model version of the analytical model and a performance provided by the global model version of the an alytical model are locally monitored using local test data.

In a further possible embodiment of the method according to the first aspect of the present invention, if the performance provided by the global model version of the analytical model is superior to the performance provided by the local model version of the analytical model, the core model components and the specialized model components of the local model ver sion are replaced by the corresponding model components of the global model version of the analytical model.

In a further possible embodiment of the method according to the first aspect of the present invention, if either the per formance provided by the global model version of the analyti cal model or the performance provided by the local model ver sion of the analytical model is superior to the performance provided by the production model version of the analytical model, the production model version of the analytical model is replaced by the model version of the analytical model providing the best or highest performance.

In a still further possible embodiment of the method accord ing to the first aspect of the present invention, the re placement of model versions of the analytical model is per formed automatically depending on the performance provided by the model versions of the analytical model and/or depending on anonymity thresholds.

In a still further possible embodiment of the method accord ing to the first aspect of the present invention, the tasks comprise inference tasks where the analytical model is ap plied to receive local data and learning tasks to improve the analytical model.

In a further possible embodiment of the method according to the first aspect of the present invention, the customer com puting devices comprise edge computing devices which supply the received local data of machines and/or industrial pro cesses located at the customer premises to a local data con centrator of the customer premises which collects and/or ag gregates the local data received from the edge computing de vices and forward them via a customer premises gateway to a central third-party cloud backend.

The invention further provides according to a second aspect an industrial system comprising the features of claim 17.

The invention provides according to the second aspect an in dustrial system comprising

customer premises of different customers,

wherein each customer premises comprises one or more machines providing local data applied to customer computing devices having deployed analytical models comprising core model com ponents shared between tasks of different customers and com- prising specialized model components specific to customer tasks of individual customers, and comprising

a third-party backend adapted to combine candidate core model components formed by updated shared core model components of the analytical models trained on local data to generate glob al candidate core model components, and to replace analytical models deployed on assigned customer computing devices by candidate analytical models comprising the global candidate core model components if it is verified that the deployed an alytical models are outperformed by the corresponding candi date analytical models.

In the following, possible embodiments of the different as pects of the present invention are described in more detail with reference to the enclosed figures.

Fig. 1 shows a schematic diagram for illustrating the operation of a system and method accord ing to the present invention;

Fig. 2 shows a flowchart for illustrating a possible exemplary embodiment of a method for machine learning of analytical models according to the first aspect of the present invention;

Figs. 3, 4, 5 illustrate block diagrams for explaining dif ferent steps performed by the method illus trated in Fig. 2;

Fig. 6 shows a further schematic diagram for illus trating different versions of an analytical model which can be used in a specific embodi ment of the method and system according to the present invention.

As can be seen in Fig. 1, an analytical model AM can comprise two types of model components. The analytical model AM can comprise different kinds of analytical models, for instance neural networks NN comprising several neural network layers. There is a wide variety of different data models and/or ana lytical models AM which can be used for a wide range of pur poses and applications implemented in industrial systems. The analytical model AM illustrated in Fig. 1 comprises core mod el components CMCs which are shared between tasks t of dif ferent customers Cust. The analytical model AM further com prises specialized model components SMCs specific to customer tasks t of individual customers Cust. In the illustrated ex ample of Fig. 1, there are m different customers Cust which may run different shop floors or manufacturing plants com prising each industrial devices or machines generating ma chine or industrial or process data as local data LD of the respective customer premises as also illustrated in Fig. 1. Each customer Cust can perform a number n of different tasks. The specialized model components SMCs of the respective ana lytical data model AM are specific to customer tasks t as al so illustrated in Fig. 1. In the example shown in Fig. 1, the first customer premise site Custl of the first customer can perform nl tasks t on the basis of local data LD of the re spective customer premise site.

The analytical model AM illustrated schematically in Fig. 1 can for instance comprise a neural network NN including sev eral neural network layers. In this case, the core model com ponents CMCs can comprise one or more bottom layers of the neural network NN which may be shared between different tasks t of different customers Cust. The bottom layers of the neu ral network NN are the layers on the receiving side of the neural network NN. Further, the specialized model components SMCs can comprise one or more top layers of the neural net work NN specific to associated customer tasks t and using process data provided by the one or more bottom layers of the neural network NN. The data model or analytical model AM con sists of model components shared between the tasks t, i.e. core model components CMCs, and specialized model components SMCs that are specific to the task t and customer Cust, re spectively.

With the method according to the present invention, the ma chine learning of the analytical model AM such as a neural network NN, is performed collaboratively based on local data LD provided by the machines or industrial devices at the cus tomer premises or manufacturing plants of different customers Cust without the local data LD leaving the respective custom er premises.

The shared model components, i.e. core model components CMCs, can be updated using the machine data or industrial data available throughout all compatible tasks t and customers serving the purpose of a general feature extractor beneficial across all tasks t. Compatible refers to the assumption that solving two different tasks t involves common (abstract) sub goals. In contrast, the task and customer specific model com ponent SMC is learned solely or exclusively from the locally available local data LD serving as a refinement module that builds on top of the globally operating core model components CMCs. The model core of the analytical model AM can consist of core model components CMCs and can have a complex struc ture that requires large amounts of data to be effectively trained. Given the core model, the local learning task can be dramatically reduced in complexity requiring only data models of low complexity in these specific or specialized model com ponents SMCs and does require an order of magnitude less data to be effectively trained.

Fig. 2 shows a flowchart of a possible exemplary embodiment of a method for machine learning of analytical models AMs ac cording to the first aspect of the present invention. In the illustrated embodiment of the method, the method comprises four main steps. In a first step SI, analytical models AMs specific to associated customer tasks t are deployed by a third-party backend 7 on assigned customer computing devices located at the customer premises of the respective customers and connected to machines or industrial devices of the re spective customers which provide local data LD. The local da ta LD can comprise machine data generated or provided by ma chines connected to the customer computing devices.

In a further step S2, the deployed customer task specific an alytical models AMs are executed on the assigned customer computing devices based on the local data LD to provide model updates of the analytical models AMs. The updated shared core model components CMCs are communicated as candidate core mod el components in step S2 to the third-party backend 7.

In a further step S3, the third-party backend 7 combines the received communicated candidate core model components to pro vide global candidate core model components.

In a further step S4, analytical models AMs deployed on as signed customer computing devices of customers Cust are re placed by candidate analytical models AMs comprising the pro vided global candidate core model components if it is veri fied that the deployed analytical models AMs are outperformed by the respective candidate analytical models AMs. The veri fication performed in step S4 can be performed in a possible embodiment by the third-party backend 7 using available test data provided by the third party or provided by the custom ers. The verification can be performed in a possible embodi ment by analyzing the candidate analytical models AMs com prising the provided global candidate core model components. The testing can be performed in a possible embodiment by testing candidate analytical models AMs deployed on customer computing devices at different customer premises.

Figs. 3, 4, 5 illustrate different steps of a method for col laborative machine learning of analytical models AMs accord ing to the first aspect of the present invention. Figs. 3, 4, 5 illustrate schematically an industrial system 1 comprising different customer premises 2A, 2B of two different customers Cust A, B. Each customer Cust premise can comprise a shop floor or manufacturing plant including a plurality of differ ent industrial devices or machines as also illustrated in Fig. 3. In the embodiment shown in Fig. 3, the customer prem ise 2A of the first customer A comprises 3A-1 to 3A-N differ ent industrial machines. The other customer premise 2B of the second customer B comprises 3B-1 to 3B-M different industrial devices or machines. Each customer premise 2A, 2B can com prise several customer computing devices (CCM) , in particular edge computing devices. In the example illustrated in Fig. 3, the customer premise site 2A of the first customer A compris es N customer computing devices 4A-1 to 4A-N connected to as sociated industrial devices 3A-1 to 3A-N. It is also possible that several industrial devices are connected to one common customer computing device. The different customer computing devices 4A, 4B are connected via a plant network or local network 5A, 5B in the illustrated embodiment to a processing unit 6A, 6B which can be adapted to perform data aggregation or data concentration and which can serve optionally as a gateway providing an interface to a third-party backend 7 of a third trusted party being different from the customers A,

B. The third-party backend 7 can be implemented in a cloud.

As illustrated in Fig. 3, (dashed lines) analytical models AMs can be deployed by the third-party backend 7 into the customer computing devices CCDs, 4A, 4B on the customer prem ises 2A, 2B. The customer computing devices 4A, 4B of the customer premises 2A, 2B can be connected to the industrial devices 3A, 3B to receive machine or industrial data. The different customer computing devices 4A, 4B can perform in ference tasks, learning tasks or both inference and learning tasks. In a learning task, an analytical model AM is applied to new received industrial data. In a learning task, the re ceived data is used to improve the analytical model AM. The customer computing devices 4A, 4B can comprise in a possible embodiment edge computing devices. These edge computing de vices can be connected to the industrial devices or machines 3A, 3B directly. Alternatively, the customer computing devic- es 4A, 4B can receive the machine data, i.e. the local data LD, of the industrial devices 3A, 3B via a network interface. The processing unit 6A, 6B can act as a data concentrator and collect data from many different customer computing devices 4A, 4B of the respective customer site. Further, the pro cessing unit 6A, 6B can operate as a gateway to provide data connection to the third-party backend 7 of the industrial system 1. As illustrated in Fig. 3, the third-party backend 7 deploys in step SI analytical models AMs on the customer com puting devices 4A, 4B and/or on the processing units 6A, 6B which can be used by different tasks t of the customer prem ises 2A, 2B. The analytical models AMs are deployed to the customer computing devices 4A, 4B and/or processing units 6A, 6B of the customer sites 2A, 2B and are tailored specifically to individual customer tasks t. Analytical models AMs can be deployed in step SI by the third-party backend 7 which may be installed on a server of a network cloud. The analytical mod els AMs are assigned to different customer computing devices 4A, 4B on the customer premises, e.g. manufacturing plant.

Fig. 4 illustrates a further step S2 of the method according to the first aspect of the present invention. Fig. 4 illus trates the execution and local training for a model update which takes place directly on customer premises 2A, 2B based on their own machine or industrial local data LD. The de ployed customer task specific analytical models AMs are exe cuted in step S2 on the assigned customer computing devices 4A, 4B based on the local data LD provided by the industrial devices 3A, 3B to provide model updates of the analytical models AMs. The updated shared core model components CMCs of these analytical models AMs are then communicated as candi date core model components cCMCs to the third-party backend 7 via a data interface or gateway 6A, 6B . The customer compu ting devices 4A, 4B apply the local analytical models AMs to their own local data LD and can perform in parallel learning tasks in order to produce model updates based on their own local data LD. The updates delivered by each customer premise 2A, 2B include at least updates to the shared core model com ponents CMCs of the analytical model AM. In a possible embod iment, the updates delivered by each customer premise can al so optionally comprise the specific specialized model compo nents SMCs of the updated analytical model AM. The updated model components can comprise for instance weight values w of a neural network NN forming an analytical data model AM. The information or data sent to the third-party backend 7 contain at least updates for the shared core model components CMCs of the analytical model AM. In a possible embodiment, it is pos sible that first an aggregation of the model updates from several machines takes place before sending the updates to the third-party backend 7. Further, it is possible to perform an averaging over time after several identical manufacturing steps have been performed. The customer Cust of the customer premise site 2A, 2B can optionally apply its own privacy measures at this stage, for example add certain perturbations to the model updates.

In a further step S3, the third-party backend 7 can combine the communicated (local) candidate core model components cCMCs to provide global candidate core model components gcCMCs . A third party can replace in a step S4 analytical models AMs deployed on the assigned customer computing devic es 4A, 4B of customers by candidate analytical models com prising the global candidate core model components gcCMCs if it is verified that the deployed analytical model AMs are outperformed by the respective candidate analytical models AMs. In a possible embodiment, the verification can take place in the central third-party backend 7. The verification can be performed by the third-party backend 7 using in a pos sible implementation available test data TD or test datasets provided by the third party itself or by using test data TD provided by the different customers A, B. Further, the third- party backend 7 can be adapted to analyze the updates them selves, i.e. performing a statistical analysis and performing a comparison between them. In a further possible embodiment, the verification can be performed by analyzing the candidate analytical models cAMs comprising the provided global candidate core model compo nents gcCMCs . The verification can be performed by testing in a possible embodiment candidate analytical models cAMs de ployed on customer computing devices 4A, 4B of the different customer premises 2A, 2B. Optionally, the verification can be performed by securely deploying and executing partial model updates on the customer premises of third parties in order to test them. Based on the test results, the third-party backend 7 can maintain model versions for each customer task t and updates the models used in production.

In a possible embodiment, different model versions of each complete analytical model AM are managed and maintained at the third-party backend 7 and/or on the customer premises 2A, 2B of the customers A, B. The complete analytical model AM comprises both the core model components CMCs and the spe cialized model components SMCs . In a possible embodiment, three different model versions of each analytical model AM are maintained and managed by the third-party backend 7 or at the customer premises 2A, 2B of the customers A, B. These model versions include a production model version PMV-AM of the analytical model AM, a local model version LMV-AM of the analytical model AM and a global model version GMV-AM of the analytical model AM. These three different model versions of the analytical model AM are also illustrated in Fig. 6.

The production model version of the analytical model PMV-AM illustrated in Fig. 6 on the left side can be executed in a production mode on industrial data LD during a production process performed at a customer premises.

The local model version of the analytical model LMV-AM illus trated in the middle of Fig. 6 is executable in a development mode. The local model version of the analytical model LMV-AM comprises specialized model components SMCs specific to the associated customer tasks t updated on the basis of the task specific local data LD and comprises fixed core model compo nents CMCs .

The global model version of the analytical model GMV-AM is also executable in the development mode and comprises spe cialized model components SMCs specific to the associated customer task t updated on the basis of task specific local data LD and further comprises core model components CMCs up dated on the basis of local data LD throughout all compatible tasks t across the customer premises of all customers.

In Fig. 6, the model component updates on the basis of the local data LD are illustrated. The lock symbol and the update symbol shown in Fig. 6 indicate if the respective model com ponents gets updated by data.

The production model version of the analytical model PMV-AM (Fig. 6, left side) is solely updated by copying the local model version of the analytical model LMV-AM and not by data.

In the local model version of the analytical model LMV-AM (Fig. 6, in the center), only the task specific model compo nents SMCs are updated from the task specific local data LD and the core model components CMCs are fixed (lock symbol) .

In the global model version of the analytical model GMV-AM (Fig. 6, right side), the core model components CMCs are up dated based on the data from all compatible tasks t across all customers and the task specific data is updated based on the task specific local data LD.

In case that the global model version of the analytical model GMV-AM outperforms the local model version of the analytical model LMV-AM, the local model version of the analytical model LMV-AM is replaced by the global model version of the analyt- ical model GMV-AM. The illustrated mechanism is adapted to protect the local productive model performance on a task t at a customer Cust. In a possible embodiment, the third-party backend 7 or each customer Cust maintains a local label da taset (test dataset) of sufficient size for each task t to which neither the core model components CMCs nor the task specific model components SMCs were exposed to for training purposes. This test dataset can serve as an independent test set to approximate and to perform benchmarking of the perfor mance provided by the different model versions on the corre sponding task t.

Using this test dataset, it is possible to implement a semi automatic or fully automatic versioning system for the core model components CMCs and the specialized model components SMCs. The update of the operating data model can be performed on demand or automatically based on the performance of the model version on the locally provided benchmark test dataset. For this purpose, the third-party backend 7 or each customer Cust can maintain three local copies or versions of the com plete analytical model AM including the core model components CMCs and the specialized model components SMCs for each indi vidual customer and each task t. These three local copies are illustrated in Fig. 6. The first local copy, i.e. the produc tion model version of the analytical model PMV-AM, is run in a production mode during operation of the industrial system 1. The other two local copies comprising the local model ver sion of the analytical model LMV-AM and the global model ver sion of the analytical model GMV-AM are run in a development mode of the system. The production model version of the ana lytical model PMV-AM is the model operating on each local task t for each customer and its update can be scheduled on demand or automatically. The update can be scheduled on de mand by either the customer itself or by the third-party backend 7. Alternatively, it is possible to schedule the up date automatically, e.g. based on observed performance. The two model versions executable in the development mode, i.e. the local model version of the analytical model LMV-AM and the global model version of the analytical model GMV-AM, do not operate on a local task t but serve as synchronization candidates for the model running during production, i.e. the production model version of the analytical model PMV-AM. For the first development analytical model, e.g. the local model version of the analytical model LMV-AM illustrated in Fig. 6 in the middle, only the specific model component SMC of the illustrated task t is updated based on the local data LD gathered from the local task t. The local model version of the analytical model LMV-AM resembles an updated model that can operate on a stable version of the core model components CMCs .

On the other hand, the second model version which can be run in the development mode, i.e. the global model version of the analytical model GMV-AM illustrated in Fig. 6 on the right side, can be completely updated, wherein the specialized mod el components SMCs are updated using the local data LD gath ered from the local task t and the core model components CMCs are asynchronously updated based on the industrial or machine data LD of all compatible customers and tasks t as illustrat ed in Fig. 6. The performance of both the local and global model version of the analytical model AM (LMV-AM, GMV-AM) can be locally monitored using a local test dataset. In a possi ble embodiment, different update rules are implemented.

In a possible embodiment, a performance provided by the local model version of the analytical model LMV-AM and a perfor mance provided by the global model version of the analytical model GMV-AM are locally monitored using the local test da taset. If the performance provided by the global model ver sion of the analytical model GMV-AM is superior to the ob served performance provided by the local model version of the analytical model LMV-AM, the core model components CMCs and the specialized model components SMCs of the local model ver- sion of the analytical model LMV-AM are replaced by the cor responding model components of the global model version of the analytical model GMV-AM. Accordingly, if the global model version is superior over the local model version, the core model components CMCs and the specialized model components SMCs of the local model version LMV-AM are replaced by the ones from the global model version GMV-AM as also illustrated in Fig. 6.

A further update rule is as follows. If either the perfor mance provided by the global model version of the analytical model GMV-AM or the performance provided by the local model version of the analytical model LMV-AM is superior to the performance provided by the production model version of the analytical model PMV-AM, the production model version of the analytical model PMV-AM is replaced by the model version of the analytical model AM providing the best performance.

These updates can be executed either automatically as soon as pre-specified conditions are met (e.g. performance or anonym ity thresholds) or manually by the customer or by the third party .

The management of the different model versions provided for each customer and task specific model can be performed either at the third-party backend 7 or directly on the customer premises of each customer.

If the different model versions are managed at the third- party backend 7, it is necessary that the test dataset from each customer is made available to the third-party backend 7. In this case, updates for both the shared core model compo nents CMCs as well as the specific model components SMCs are sent by the customer premises 2A, 2B to the third-party backend 7 which implements the update rules. In this embodi ment, the third-party backend 7 only needs to deliver the production model version of the analytical model PMV-AM back to each customer premises 2A, 2B after each update.

In an alternative embodiment, the management of the multiple model versions is performed directly on the premises 2A, 2B of each customer. This option can be applied when the test dataset from each customer is not available at the third- party backend 7. In this case, monitoring performance of the different model versions can be based on the test dataset and is performed directly on the customer premises. To do this, the third-party backend 7 can deploy all the management model versions for each analytical model AM to customer premises. Alternatively, these model versions may be directly generated at the customer premises. For this last alternative embodi ment, customers may only send updates for the shared core model parts CMCs of the analytical model AM to the third- party backend 7, and the third-party backend 7 distributes these updates to other customers in order to allow them to independently implement the update rules on their premises.

For the different implementation options described above, the third-party backend 7 can optionally take measures to ensure that no sensitive data from any given customer is exposed to any of the other customers. Sensitive data about the process es of a customer can be contained in the model updates, i.e. specifically in the core model components CMCs that are de livered to the customers, as these are based on data received from many different customer premises.

In an alternative embodiment, the third-party backend 7 en sures anonymization of each core model component part CMC be fore delivering it to other customers, for example by pooling many updates from different customers together, or by per forming perturbations of the updates.

In a further alternative embodiment, the updates of the mod els are managed at customer premises in a secure way such that the sensitive parts of the analytical models AMs and the updates are not visible to the receiving customer. To make this possible, in a possible embodiment a secure computing element or device 8A, 8B can be operated by the third-party and deployed on the customer premises 2A, 2B, i.e. its manu facturing plant as illustrated in Fig. 5. This secure compu ting device 8A, 8B can provide in a possible embodiment an execution environment which is fully under the control of the third-party running the backend 7 where model updates take place. The secure computing devices 8A, 8B can be formed by conventional computing devices or in some cases requiring higher security guarantees, the secure computing devices 8A, 8B can comprise hardware security modules or any other type of tamper-proof computing devices. The secure computing de vices 8A, 8B can comprise physically protected devices where all internal data is encrypted and where any attempt to phys ically access the secure computing devices 8A, 8B results in a destruction of the encryption keys.

In a possible embodiment, the third-party running the backend 7 is able to deploy to the secure computing device 8A, 8B en crypted and signed analytical models AMs and updates for evaluation. The third-party backend 7 can deploy directly up dates of the shared core model components CMCs of the analyt ical models AMs from other customers, or directly entire ana lytical models AMs, i.e. local or global model versions of the analytical models AMs. The customer A, B can retain full control over the traffic that goes into and out to the secure computing device 8A, 8B. That is, the customer A, B controls the delivery of model updates (even if it does not have visi bility over the content) and the in-feed of test data TD to the secure computing devices 8A, 8B. More importantly, a cus tomer A, B can control the amount of traffic generated from the secure computing device 8A, 8B itself towards the third- party backend 7. This provides assurance to the customer that its own data does not leave its customer premises 2A, 2B. For example, for each analytical model AM to be tested, the se- cure computing device 8A, 8B may only produce a small re sponse or test result TR containing the test set performance. It is possible to provide a generic analytical model AM per forming a function f(x,w), wherein x is the input data and w comprises the model coefficients. The test performance can for example be given by a mean squared error

wherein _Xi is the i-th test input and yi is the i-th expected output. The sum can be calculated across all N test datasets.

Independent of the size of the test dataset, a small packet can be sent back as a test result TR to the third-party backend 7. The size of the messages fed back to the third- party backend 7 can provide a guarantee to the customer A, B that their test process data TD has not been leaked to the third-party backend 7, even if they are not able to see the encrypted messages. The secure third-party device 8A, 8B can perform a model update validation using supplied test data TD which may be read from a local database 9A, 9B as shown in

Fig. 5.

In a possible embodiment, the secure computing devices 8A, 8B can perform the following steps.

In a first step, the secure computing device 8A, 8B receives analytical models AMs from the third-party backend 7 (includ ing decryption and integrity verification) . Alternatively, the secure computing device 8A, 8B can receive only model up dates, and generate and manage multiple model versions of each analytical model AM internally based on the updates.

In a further step, the secure computing device 8A, 8B can ex ecute the model versions on test datasets TD provided by the customer .

In a further step, the secure computing device 8A, 8B can generate responses or test results TR for the third-party backend 7 with the test performance (including encryption and signing) .

In a further possible embodiment, the secure computing device 8A, 8B can perform a verification of the integrity of the test dataset TD (for example, to ensure that the same test dataset has been selected by the customer for different up dates or that the update has been performed upon agreement with the third party) . In a possible implementation, the ver ification of the integrity of the test dataset TD can include the storage of hash values for different datasets.

The method according to the first aspect of the present in vention enables a collaborative development of analytical models AMs (e.g. machine learning analytical models) based on local data LD provided by many different parties, i.e. cus tomers, hence achieving a higher performance. At the same time, the method according to the first aspect of the present invention ensures that process data LD is processed locally by each party or customer A, B without a need to share the local data LD with a third party, hence being more efficient for large data volumes and more suitable for customers with privacy concerns .

Further, the method according to the first aspect of the pre sent invention ensures that there is no performance degrada tion, as multiple model versions of each analytical model AM are managed, their performance is monitored and only the best model candidates are used during operation of the industrial system 1.

Further, the method according to the present invention en sures that each customer A, B is not able to see individual model updates from other parties or customers, hence the method preserves the privacy of potentially sensitive process data or local data LD contained in the analytical models AMs. Different distributed model training techniques are combined in the method and system 1 according to the present invention with a model verification and/or model versioning step per formed by the third-party backend 7. The third-party backend 7 is able to update a part of the analytical model AM used for each individual customer on tasks t based on relevant up dates provided by other customers. The verification step can be performed in different ways and may comprise the combina tion of different techniques such as using test data (e.g. test data belonging to the third party or test data provided by customers) , analyzing of the updates (statistical analy sis, comparison) or by securely deploying partial analytical model AM updates on other customer premises to implement in dividual model updates without exposing sensitive information or data.

With the method and system according to the present inven tion, it is possible to improve data analysis services pro vided in different applications including for instance the optimization of machine tool systems, fault detection in dig ital grids, wind turbine efficiency increase, factory automa tion process monitoring, real-time analysis of train sensor data or emission control in gas turbines. It is possible to provide improved analytical data models AMs by using a larger set of available data even from customers A, B which are not willing to share their own process data or industrial data LD, or which are concerned about privacy leaks or which fear malicious actions taken by competitors.

The model execution on the process data or industrial data LD can be performed locally on edge computing devices 4A, 4B or in a dedicated device such as a server data concentrator or gateway 6A, 6B belonging to the customer premises 2A, 2B. The process data or industrial data LD is executed in a possible embodiment on a production model version of the analytical model PMV-AM. Model updates can be generated on the customer computing de vices 4A, 4B or on separated dedicated devices or on both.

For example, a concentrator or a gateway unit 6A, 6B can per form a first consolidation of customer model's updates before sending them to the third-party backend 7. In a possible em bodiment, the customer premises 2A, 2B can provide a filter to perform filtering of data or to perform perturbation on model coefficients for privacy reasons at this stage.

The verification of the received model updates and the gener ation of updated task and customer specific models by the third-party backend 7 can take place in different ways. The verification can take place directly in the third-party backend 7 if test data is available or by securely deploying and executing partial analytical models AMs on the customer premises, for instance on a secure computing device 8A, 8B run by the third party.

In a possible embodiment, even the operational model versions of the analytical model AM can be kept and managed. In this case, model execution and learning can take place directly on the secure computing devices 8A, 8B controlled by the third party .