Anomaly Watch: Anomaly Detection for Ignition Tag History

Five checks

What it looks for

Each measurement is screened in 5-minute steps over the window, against a baseline built from the 30 days before it. Three sensitivities ship (fewer, standard, more), and every threshold can be set per playbook.

Check	Fires when	What it usually means
Drift	The 3-hour rolling median has moved more than 3.2 standard deviations from the baseline	Wear, fouling, a slow leak, a sensor losing calibration. For exampleHydraulic oil on die cast machine 6 creeping 4 °C over nine days as the heat exchanger fouls, still inside the alarm limit.
Outside normal band	Several values in a row sit far from the baseline on one side	A step change: a setpoint, a recipe, a valve, a different feedstock. For exampleFurnace zone 3 holding 12 °C above its normal for this alloy since Monday’s recipe edit, which nobody mentioned at the handover.
Stuck	18 identical values in a row, about 90 minutes	A frozen transmitter, a dead PLC tag, a stalled scan. For exampleA flow transmitter reading exactly 412 gpm for three hours while the pump cycled, so the totalizer and the chemical dosing were wrong all morning.
Rate of change	Several large sample-to-sample swings in a row	Hunting control, a loose connection, a failing pump. For exampleA chiller’s discharge pressure swinging 15 psi every few seconds as the expansion valve hunts, a week before the compressor trips on it.
Quality	9 or more Good to not-Good flips within 2 hours	A device dropping off the network, a flaky OPC connection. For exampleA VFD’s tags flipping between Good and Bad eleven times in an hour on a loose Ethernet connector, days before it fails for good.

Where two checks overlap on one tag, one finding stands. Every anomaly is stored with the check’s own numbers, whether or not the model writes about it, so what you review is the measurement, not a paragraph.

The Anomaly Watch review queue filtered to drifts: two cards for press DCM-304, each with its trend and verdict buttons — The review queue, filtered to drifts. Each card: the tag, the trend with the span shaded, how far outside the baseline it sat and for how long, in plain words.

One week, one anomalyMonday 06:00, the hourly run files a drift on machine 6’s hydraulic oil temperature: running baseline 52 °C, last three hours 56 °C, 3.6 standard deviations, with the trend. Tuesday, the maintenance lead opens the queue, sees the slope, marks it a real issue and schedules the heat exchanger. Ten minutes later a proposal run has replayed a 55 °C running-only alarm over 180 days of history: it would have fired 3 times, 2 of them in the week before each of the last two exchanger cleanings, 1 false alert. Wednesday, she downloads the tag import, imports it into the machine’s folder, and from then on that alarm pages the shift a week before porosity scrap would have. Numbers are illustrative.

Baselines

It knows when the machine is running

Each asset can name a run signal, a changeover signal and a product tag. Baselines are kept per state and per product, so a torque reading is compared with running torque on the same product, not with an average that includes the weekend. A stopped or changeover period never raises an anomaly, and neither does a value the historian filled in across a gap. An old anomaly is left out of the baseline once a day of data is in, so a problem cannot widen its own normal.

Data health

It checks the historian too

A screening is only as good as the history behind it, so every run also reports gaps in a tag’s samples, duplicate samples, and a sample rate that changed. These are configuration findings about your historian, and they join the daily Gateway Health email so the person who owns the gateway sees them.

From a verdict to an alarm

A confirmed anomaly becomes an alarm you can import

This is the part a dashboard cannot do. When an engineer marks an anomaly a real issue, Artekis proposes the alarm that would have caught it, and shows how it would have behaved on your own history before anyone imports it.

1 Review

The queueOpen anomalies as cards with their trend, filtered by kind. Real issue, Known, or Not an issue.

2 Propose

A detectorA real issue proposes a rule at the playbook’s sensitivity, armed only while the machine runs.

3 Replay

180 days of historyThe rule is replayed over your history and scored: times it would have fired, real issues matched, false alerts.

4 Download

A tag importOne expression tag and its alarm, in Ignition’s own import format, checked before it is offered.

5 Import

Your engineerImports it into the folder of their choice. From then on its fires come from your alarm journal.

Artekis never imports the detector or writes to your tag providers. The proposed tag is checked first: only the allowed alarm settings, an expression that references tags by absolute path, a parent folder that exists and is not inside a UDT instance, and a path that is free.

Setup

Set up from a sentence

The Setup view lists each asset’s tags that keep history and suggests a run signal. Or type “set up anomaly watch on the stamping area” into Ask, and the answer carries a button that opens the form filled in. Nothing is written until someone at the admin level presses Save.

Anomaly Watch is new in Artekis 1.2. Its thresholds were set on our acceptance data, not yet on a plant’s own historian, so plan on tuning the sensitivity during the first weeks of verdicts. Every anomaly keeps its numbers, so the tuning is visible rather than guessed.

Questions

Common questions

Does it train a model on our data?+

No. The baselines are a mean and a standard deviation per measurement, per operating state and product, rebuilt from your own history on every run. The language model only writes the explanation of what the arithmetic found, and that is the run’s only model call.

What does it need?+

Tag history on the measurements you want screened, at least 30 days of it before the first useful run (the baseline length is adjustable from 7 to 365 days). A run signal per machine is optional and recommended, so a stopped machine never raises an anomaly.

Does it create alarms on our gateway?+

Never by itself. A confirmed anomaly produces a detector: one expression tag and its alarm, offered as an Ignition tag import with a score from history. Your engineer downloads it and imports it. Artekis never writes to your tag providers.

How often does it run?+

Hourly or daily, over the last 24 hours, from the Setup view’s schedule. A run screens at most 31 days and stores at most 50 anomalies, strongest first.

Every measurement, checked against its own normal.