ML
Without fault labels: unsupervised machine learning in industry
Learn what unlabelled sensor history can and cannot tell you, how to evaluate a detector without labels, and why operating modes need attention first.
How do I reduce false alarms in an anomaly detection model?
Short answer
Reduce false alarms by putting decision rules after the raw model: require several consecutive out-of-range samples, use hysteresis between entry and exit thresholds, keep separate models per operating mode, and suppress known events such as start-up. Tune these rules on a validation period, not the training data, and check that real events are still caught.
Where false alarms come from
A raw anomaly model decides on each measurement separately. Sensor noise, a momentary electrical disturbance, or a value that wobbles around a limit creates one-sample spikes. Operating mode changes, such as warm-up or shutdown, cause sustained deviations that are normal at that moment. Setting the threshold at a fixed percentile of the training data also turns every value in the tail of normal data into an alarm, by design.
False alarms are therefore often a missing decision rule rather than a poor model. The model says a sample is unusual. The alarm logic must decide whether that unusualness lasted, where it occurred, and which operating mode it belongs to.
Hypothetical day with a compressor
Suppose a compressor’s raw model raised 40 alarms in one day. Of these, 34 lasted a single one-minute sample, and 6 lasted at least three consecutive minutes.
Rule: raise an alarm only after three consecutive out-of-range samples. The 34 single-sample alarms disappear and 6 remain. That is a reduction from 40 to 6, or 85 % (34 / 40 = 0.85).
Hysteresis adds a second improvement. Suppose the entry threshold is 3.0 and the exit threshold is 2.5. Once the score crosses 3.0, the alarm stays active until it falls below 2.5. A signal hovering around 3.0 then appears as one alarm, not many on-and-off alarms.
Trade-offs and common mistakes
Every rule adds delay. A three-minute persistence rule postpones an alarm by three minutes, which matters for fast events such as a seal leak or a sensor disconnection. Choose the persistence length from how quickly the event develops.
Suppression carries its own risk. If alarms are silenced during start-up or maintenance, a real fault in that window stays invisible. Thresholds should be tuned on a validation period with known outcomes, not on the training data, and each change should be checked against past events. An alarm budget per shift, with operator verdicts fed back, keeps the rules honest over time.
Follow-up questions
Will reducing false alarms also reduce detection of real events?
It can. Every persistence rule, delay or suppression removes some real events along with the noise. Re-measure each change on labelled or operator-confirmed past events, and compare the count of missed events, not only the count of alarms.
What if two anomaly models disagree?
Requiring two detectors to agree before alarming can lower false alarms. The gain is smaller if both models rely on the same features and the same training window, because their errors are then correlated. Choose detectors that work on different principles.
Sources
Example numbers are hypothetical, not measured field results.
Read the full guide.
Full library
Control
Alarm management: fix the alarm system before adding AI
Alarm floods are solved with an alarm philosophy first, not a model. AI works better on an orderly alarm list.
ML
Alert thresholds, precision and recall
Why a single accuracy percentage can hide failure on rare events.
Related questions
All questionsHow can I detect sensor drift in an industrial process?CUSUM, EWMA or Shewhart: which should I use, and when?What is anomaly detection in sensor data?How does Isolation Forest work for sensor anomaly detection?What are Hotelling T2 and SPE in multivariate process monitoring?How do I split time series data into training and test sets?