Anomaly detection

Anomaly detection asks whether current behavior is unusual relative to what has been established as normal, rather than whether it matches a known fault. In wind that framing is a necessity rather than a preference: catastrophic failures are rare, so there are few labeled examples to learn from, and the ones that exist are spread across manufacturers, models, and operating regimes.

Practically it is the consumption layer on top of a normal behavior model. The residual between predicted and measured is monitored for a persistent shift in level or variance, usually with a smoothing window, so that a single unusual interval does not raise an alert but three weeks of drift does.

The hard part is not detection but ranking. A fleet of four hundred machines and twenty monitored channels each will generate more statistical anomalies than any team can investigate, and an alert list nobody works through is worse than no list because it teaches people to ignore it. A useful system therefore attaches consequence to every anomaly - the energy at stake, the component at risk, the cost of the intervention - and sorts by that.

It is also why precision matters more than recall here. The cost of a false positive is a technician day, or offshore a vessel mobilization, so a detector tuned to miss nothing will be switched off within a month. The right operating point is the one an O&M team can actually act on every week.