Under CopyrightNiggemann, OliverOliverNiggemannWindmann, StefanStefanWindmannVogelmann, SörenSörenVogelmannBunte, AndreasAndreasBunteStein, BennoBennoStein2022-03-1220.3.20152014https://publica.fraunhofer.de/handle/publica/38688410.24406/publica-fhg-386884The diagnosis of Cyber-Physical Production Systems (CPPS) comprises two main steps: (i) The identification of anomalous system behavior und (ii) the deduction of the underlying root cause. While step (i) requires only models of the OKbehavior of the system, step (ii) requires models that can predict the system behavior in OK and especially in fault situations. Over the last years, the question where such models originate has become a major research topic-due to the highly adaptable nature of CPPS which renders a manual modeling infeasible. Because of the infeasibility of manual modeling, algorithms have been developed for step (i) which learn an OK-model based on system observations. Theoretically, also fault models for step (ii) could be learned, but practically we incur a dilemma since fault events occur too seldom to learn a fault model from them. This paper introduces the new algorithm MoSDA which shows a way out of this dilemma. MoSDA does not use fault models but extracts more information from learned OK-models than previous algorithms: The main idea is to go from easy-computable anomalies on the system level to hard-computable anomalies on the component level. In practice, efficient heuristics for the deduction of root causes can be given if anomalies are known on a component level while a root cause analysis is hard if anomalies are only known on a system level.en004670conference paper