Fixed Limits or Learned Baselines: Choosing a Detection Approach

Your BMS already does anomaly detection. Every configured alarm limit is a detector, and it has the enormous advantage that everybody understands what it means and can argue about where it should sit. The pitch for a statistical approach is that fixed limits miss things: a value well inside its band but behaving unlike itself, a relationship between two signals that has changed, a slow drift that never trips anything. That pitch is sound. What usually goes unexamined is what you give up, and the thing you give up is not accuracy.

The message up front: choose on the basis of what each approach can be held to, not on sensitivity. Fixed limits are explainable, auditable, cheap to maintain per point and expensive to maintain across an estate, and they answer only the question they were set to answer. Learned baselines find departures nobody configured and come with a continuing obligation to maintain, explain and re-validate them. Run both, with limits owning the conditions that matter contractually or for safety and learned methods confined to advisory output.

1. What each approach can and cannot see

Framing this as sensitivity obscures the real distinction, which is about the question being asked.

• A fixed limit answers an absolute question. Is this value outside the range we decided was acceptable. That question is independent of history, which is exactly why it is reliable and why it cannot notice a change in behaviour inside the range.
• A learned baseline answers a relative question. Is this value unusual for this point under these conditions. That is a different and often more useful question, and the answer is only as good as the history behind it, which is the argument in data readiness for anomaly detection.
• Neither answers a causal question. Both report that something departed from an expectation. Why it departed, and whether it matters, is work for somebody who understands the plant.

That last point is worth dwelling on, because it is where most disappointment originates. A detection method tells you where to look. It does not tell you what you will find.

2. Side by side on the dimensions that decide it

3. Fix the limits before replacing them

There is an awkward fact about most estates considering this: the existing limits have never been reviewed.

They were set at commissioning, often at product defaults, occasionally tightened during a troubleshooting exercise and never relaxed, and in some cases they relate to plant that has since been replaced. An estate in that condition has not exhausted what fixed limits can do, and comparing a learned method against unreviewed limits flatters it in a way that will not survive a second look.

A limit review is cheap, it improves the operating picture immediately whether or not anything else follows, and it produces the alarm frequency data that any later comparison needs. It also tends to reveal that a substantial share of the current alert volume comes from a small number of badly configured points, which is a finding worth more than most pilots.

4. The approaches between the two poles

The debate is usually framed as a binary and most of the useful ground is in between, where methods remain explainable.

• Conditional limits. A limit that differs by operating mode, time of day or season. Still fully explainable, and it closes a large share of the gap people reach for learned methods to close.
• Rate-of-change checks. Detect how fast something moved rather than where it is. Simple, explainable, and catches a class of behaviour fixed limits structurally miss.
• Cross-signal consistency. Compare related signals against each other rather than against a limit, which is the approach in signal consistency checks, and which is frequently the highest-value and least glamorous option.
• Duration and persistence rules. Requiring a condition to persist before it counts, which removes a great deal of noise and is the mechanism behind much of alert deduplication.
• Simple statistical baselines per point. A learned expectation for one point under stated conditions, which is explainable in a sentence and much easier to validate than a multivariate model.

These are worth exhausting first, not because sophistication is bad but because each one you adopt is explainable, auditable and cheap to keep, and whatever remains uncovered afterwards is a much better defined problem.

5. Running both without confusing anybody

The workable arrangement on most estates is both, with a clear separation that holds under pressure.

• Limits own anything contractual or safety-related. Where a commitment or an obligation attaches, the detection has to be a defensible fact, and some limits exist for statutory reasons that remove the discretion entirely.
• Learned output stays advisory, in its own queue, reviewed on a cadence rather than responded to on arrival.
• Never let advisory output create work orders automatically. It should create a review item that a person converts, or the false-positive rate becomes a planning problem and the classification problem described in alarm code mapping gets much harder.
• Label the source on every item. A responder who knows which detector produced an alert calibrates their own expectations, and that is healthy rather than undermining.
• Promote findings deliberately. When a learned detection proves itself repeatedly, the right outcome is often a new conditional limit, which converts an advisory signal into an operational one everybody can audit.

6. Comparing them honestly

A comparison is only meaningful against a definition of what counts as a true finding, and that definition is the hard part rather than the measurement.

Three things keep it honest. Agree in advance what a correct detection is and who decides, because the question is genuinely ambiguous and deciding afterwards invites the answer to follow the result. Count the cost of both error directions, since a missed condition and a wasted visit are both real and they are not equivalent. And measure over a period that includes a regime change, because performance during one stable season tells you very little about the first cold week. The evaluation design is the subject of pilot evaluation, and the labelling problem underneath it is in labelling BMS anomalies.

The idea to walk away with

Fixed limits and learned baselines answer different questions, absolute against relative, and the choice between them turns on explainability, auditability and maintenance obligation rather than on sensitivity.

Review the limits you already have before replacing them, exhaust the explainable middle ground of conditional limits and cross-signal checks, run both with limits owning anything a commitment attaches to, keep learned output advisory and in its own queue, and promote proven findings into auditable limits.

Final thoughts

Before any of this, count last month's alarms by source and see how many came from the ten noisiest points.

On most estates that share is large, and it is a configuration problem rather than a detection problem. Fixing it costs a morning, makes the operational queue usable again, and leaves you in a far better position to judge whether a learned method adds anything, because the comparison will be against limits that somebody has actually looked at.

Related reading: Data readiness, Pilot planning, Pilot evaluation, Severity and escalation design, Communication versus equipment anomalies, AI anomaly detection overview.