Fixed thresholds, 3 sigma or a learned baseline: how alarms in condition monitoring are triggered

Every condition monitoring system ultimately has to answer one simple question: is this reading still normal? The answer decides whether the maintenance engineer receives an alert. Set too strictly, the system produces so many false alarms that nobody looks any more. Set too loosely, and the bearing damage is only reported once you can hear it anyway. This article is about how alarms in condition monitoring are triggered: with fixed limits, with the well-known 3-sigma rule or with a learned baseline for each machine. At the end comes the question of when machine learning is the better choice.

Fixed limits: simple, but blind to the individual machine

The simplest approach is a fixed limit: if the RMS vibration velocity exceeds a threshold, an alarm is raised. Such values come from standards such as the ISO 20816 series, from manufacturer data or from experience. They have real advantages. Everyone understands them, they need no learning phase, and they are useful for an initial assessment of the machine. More on this in the article on ISO limits for machine tools.

For early detection on spindles, however, they are not enough. Two spindles of the same design vibrate to different degrees, depending on installation, age, tool and speed. A limit that suits the quieter spindle trips constantly on the louder one. A limit that suits the louder one only detects damage on the quieter spindle once its level has multiplied. In addition, incipient bearing damage barely changes the overall level. It first appears as a faint line at a bearing frequency, as described in the article on envelope analysis and bearing frequencies. A fixed limit for that line cannot be set sensibly without knowing the individual machine.

The 3-sigma rule and its pitfalls

The obvious next step: measure the healthy machine for a while, calculate the mean μ and standard deviation σ and report everything above μ + 3σ. The rule comes from statistical process control. With normally distributed data, only about 0.13 per cent of values lie above this limit. That sounds like a clean criterion and is a good starting point for many features. In practical vibration monitoring, however, the rule runs into four limitations.

• Outliers in the learning phase: a single impact during a tool change or a run-up pulls the mean and standard deviation upwards. The limit becomes so wide that real damage stays below it for a long time.
• Skewed distributions: vibration features are never negative. Spectral amplitudes, kurtosis and crest factor are usually right-skewed: many values close to the typical level, a few well above it. The assumption of a normal distribution, on which the 0.13 per cent is based, then no longer holds.
• Speed dependence: at 12,000 rpm a spindle vibrates differently from at 3,000 rpm. Lump all speeds together and you get a huge spread, and therefore a limit that no longer detects anything.
• Many checks add up: the 0.13 per cent applies to a single check. A system, however, checks many features with every measurement.

The last point is often underestimated. A simple calculation with assumed values: if ten features are checked every ten minutes, that is 1,440 checks a day. Even with perfectly normally distributed data, this results on average in almost two exceedances a day, without anything having changed on the machine. Without further measures, the 3-sigma rule turns into a system that reports false alarms every day.

Robust statistics: median, MAD and upper quantile

The first two problems are solved by replacing the mean and standard deviation with robust measures. Robust means that individual outliers barely shift the result. Our system scores each feature with a deviation score built exactly like this:

Each building block has a clear purpose:

• Median instead of mean: the median is the middle value of the sorted series. A single outlier hardly changes it at all.
• MAD instead of standard deviation: the median absolute deviation from the median is just as insensitive to outliers. The factor 1.4826 makes it exactly as large as the standard deviation for normally distributed data. A deviation score of 3 therefore remains comparable with "3 sigma".
• Upper quantile: for right-skewed features, the MAD underestimates the spread upwards. We therefore also check the distance of the 90th percentile from the median. The divisor 1.2816 is the 90th percentile of the standard normal distribution, so with normally distributed data this value also corresponds to the standard deviation.
• Lower bound: if a spindle is extremely quiet during the learning phase, the spread would be tiny and the smallest changes would produce large deviation scores. We therefore set the spread to at least 5 per cent of the median.

Only increases count, because bearing damage raises features. A drop below the learned baseline is not a sign of damage for this assessment.

Worked example

A simplified example shows how big the difference is. For illustration we use only 13 values; the system requires at least 20 for a baseline. Twelve measurements of a feature lie between 0.90 and 1.20. A thirteenth measurement coincided with an impact and gave 5.0. Then a new value of 2.0 arrives, roughly twice the normal level.

The single outlier inflates the standard deviation to more than ten times what the other twelve values show. The 3-sigma limit is then 4.65. A doubling of the feature remains invisible. The robust assessment, by contrast, detects it clearly. This is not an edge case: impacts during tool changes, run-ups or from chips occur on every machining centre.

Baseline per machine, measuring point and speed range

The third problem, speed dependence, is not solved by a formula. It is solved by dividing the data correctly. Our system does not learn the baseline for a machine as a whole, but separately according to three attributes:

1. Machine: each spindle gets its own learned baseline, i.e. the normal state of this spindle. There is no comparison with an average of other machines.
2. Measuring point: a sensor at the front of the spindle housing sees different levels from one at the rear. Each measuring point is assessed separately.
3. Speed class: the speed comes from the CNC control. Measurements are grouped into speed classes, and each class has its own baseline. A measurement at 8,000 rpm is therefore only compared with earlier measurements at 8,000 rpm.

For each of these combinations, the system first collects measurements from healthy operation. Until there are enough measurements, the combination is marked "learning" and produces no alerts. Measurement windows during run-up, i.e. while the speed is changing, and at very low speed are not assessed at all. This takes a little patience at the start, but it prevents comparing apples with oranges.

Four levels and persistence over several measurements

The deviation score is mapped to one of four levels. The thresholds between them are starting values, not values from a standard or from the bearing manufacturer. They are calibrated on the test rig and with feedback from operation.

The thresholds are deliberately well above 3. That is the answer to the problem of many checks. The second answer is persistence: a level is only reported once it has held over several consecutive measurements. The default is three. The level reported is the lowest of these last measurements. So if two measurements are in the "Alarm" range and one in the "Warning" range, the alert reads "Warning".

Persistence costs a little time, because a real change is only reported after the third measurement. For bearing damage, which develops over much longer periods, this does not matter. A false alarm that rings the shift supervisor's phone at three in the morning, on the other hand, matters a great deal for trust in the system.

Explanation and feedback from the maintenance team

A deviation score on its own helps nobody at the machine. Every alert therefore states the location (machine, measuring point, speed class), the urgency, a specific inspection instruction and the explanation. The explanation shows the most conspicuous features with reading, baseline, factor and deviation. An example with assumed figures:

This leads to an inspection instruction in the language of the maintenance team, for example: inspect the spindle bearing, check running noise, bearing temperature and lubrication, discuss the finding with the spindle service provider. The maintenance engineer therefore sees what has changed and against which baseline. There is no need to trust the system blindly.

For each alert, the maintenance team can give feedback: That's right, False alarm or Not sure yet. This feedback is the most important basis for calibrating the starting thresholds for a machine or machine type. A system that never learns whether its alerts were right cannot get any better.

Where machine learning fits and where it does not

Methods such as Isolation Forest, autoencoders or other anomaly detection models can look at many features together. They can recognise, for instance, that a particular combination of kurtosis and RMS is unusual, even though each value on its own is unremarkable. That is a real advantage. It is offset by three drawbacks that weigh particularly heavily on spindles.

• Few failure cases: a single spindle suffers only a few bearing failures in its lifetime. A model that is supposed to learn to distinguish damage from them has hardly any examples.
• Explainability: an anomaly score of 0.7 does not tell the maintenance engineer whether to look at the outer race, the tool or the workholding.
• Apparent accuracy: a model tested on the same data it was trained on always looks good. That says nothing about how it will behave on the next machine.

We therefore rely first on transparent methods: physically grounded features, envelope analysis, bearing frequencies and the robust baseline. Machine learning is only added where it is demonstrably better. Demonstrably means: tested on held-out data, i.e. on machines or time periods the model never saw during training, and in a direct comparison with the robust method. We see sensible applications with many machines of the same type and in classifying findings, once enough feedback from the maintenance team is available as a basis for evaluation. The difference between condition detection and prediction is described in the article Condition monitoring or predictive maintenance.

Frequently asked questions