Learning normal instead of learning faults
Faults are rare and varied. Healthy operation is common and repetitive. Anomaly detection exploits that asymmetry: train a model only on healthy data, then score every new window by how far it is from what the model has seen.
Classical baseline · alarm limits and statistical control
Fixed limits on one feature, or a control chart with ±3σ bands on its history. Both look at features one at a time. They miss faults that show up as an unusual combination of normal-looking values, such as normal RMS together with unusually high kurtosis at low load.
Industrial anomaly detectors fall into four families. They differ in how they define "far from normal".
| Family | Normal means | Examples | Good for |
|---|---|---|---|
| Isolation-based | hard to separate from the crowd | Isolation Forest | tabular features, fast, few assumptions |
| Reconstruction-based | can be compressed and rebuilt | PCA, autoencoders | many correlated sensors, raw waveforms |
| Boundary and distance | inside the learned region | one-class SVM, k-nearest-neighbour distance, Mahalanobis | small, clean feature sets |
| Forecasting residual | predictable from the recent past and context | regression, LSTM, gradient boosting | process variables, slow trends |
Isolation Forest: anomalies are easy to isolate
Isolation Forest builds many random trees. Each tree splits the data with random cuts until every point sits alone. A normal point lives in a dense crowd and needs many cuts to isolate. An anomaly sits far away and is cut off in a few. The average number of cuts across trees becomes the anomaly score: fewer cuts means more anomalous.
Strengths: no distance metric to tune, fast on large tables, handles dozens of features. Weaknesses: axis-aligned cuts struggle with anomalies hidden in correlations between features, and the score has no physical unit, so thresholds must be set from data.
Autoencoders: anomalies are hard to rebuild
An autoencoder is a neural network trained to copy its input to its output through a narrow bottleneck. Because the bottleneck is too small to memorise everything, the network learns the structure of normal data: which frequencies go together, how sensors co-vary. Shown something new, it rebuilds what it expected to see, and the reconstruction error becomes the anomaly score.
Variants matter in practice. PCA is a linear autoencoder and is often good enough for correlated process sensors. Convolutional autoencoders work on raw waveforms or spectrograms. LSTM autoencoders capture sequences. Variational autoencoders add a probabilistic score. Start simple and only move up when the simple model demonstrably misses things.
Forecasting residuals
For slow process variables such as bearing temperature, motor current or pressure drop, a regression model predicts the expected value from context (load, ambient temperature, speed) and recent history. The residual between measured and predicted value is the anomaly signal. This is the approach used in the load-aware example on the first page. Gradient-boosted trees are a strong default; LSTMs and temporal convolutional networks help when long time dependencies matter.
Setting thresholds you can live with
Every detector outputs a score, and someone must decide where "alert" begins. Three practical methods:
- Percentile of healthy scores. Set the threshold at the 99.5th percentile of scores on held-out healthy data. You accept about one alert per 200 healthy windows, so smooth before alerting.
- Persistence. Require the score to stay high for several consecutive windows, or for k out of n. Real faults persist; noise does not.
- Alert budget. Ask the team how many alerts per month they can investigate, and set the threshold so that the fleet produces about that many.
Key takeaways
- Anomaly detection needs only healthy data and is the usual first step.
- Isolation Forest isolates outliers with few random cuts; autoencoders fail to rebuild them.
- A detector says "unusual", not "which fault". Sensor problems and process changes also trigger it.
- Thresholds, smoothing and persistence rules decide whether people trust the alerts.
Try it in the apps
The Anomaly Detection Lab injects bearing wear, cooling loss, spikes or sensor drift into pump data and compares Isolation Forest, PCA and an autoencoder with a fixed alarm.