Abstract: A computer-implemented method for determining an abnormal technical status of a technical system includes: receiving, from the technical system, a plurality of signals, each signal being sampled over time and reflecting the technical status of at least one system component; computing, for each signal with associated high and low alarm thresholds obtained from an alarm management system, at every sampling time point, a univariate distance to its associated alarm thresholds as a maximum of the distances between a value of the respective signal and its associated alarm thresholds to quantify a degree of abnormality for the respective at least one system component; computing, at every sampling time point, based on the univariate distances at the respective sampling time points, an aggregate abnormality indicator reflecting the technical status of the technical system; and providing, to an operator, a comparison of the aggregate abnormality indicator with a predetermined abnormality threshold.