What is machine learning?
Normally you tell a computer the rule: if vibration goes above 4.5, raise an alarm. Machine learning turns that around. You show it examples of what happened and it works out the rule itself.
That is the entire idea. Everything with a name, regression, random forests, clustering, neural networks, is a different answer to one follow-up question: what shape is the rule allowed to be?
Why turn it around at all
Because for most interesting questions, nobody knows the rule well enough to write it down, and the ones we do write down go stale.
A threshold is a rule an expert wrote from experience. It works until the machine is replaced, the duty changes, the season turns or the same alarm has to cover forty pumps that are not quite alike. Then it either misses things or cries wolf, and people start ignoring it, which is worse than not having it.
The catch is in the last box: a learned rule is harder to read. A threshold explains itself. A model, depending on which kind, may or may not. That trade-off runs through everything below and is the main thing to hold on to.
The five words you need
| Word | What it means |
|---|---|
| Feature | An input: a number that means something. Vibration level, hours since last start, ambient temperature. Where they come from → |
| Label | The answer for a past example: it failed, it did not, it lasted nine days. In this platform, labels are usually events |
| Training | Showing the method the features and the labels together, so it can work out the rule |
| Model | The rule it arrived at, saved so it can be used on new data |
| Overfitting | The failure mode: memorising the examples instead of learning the pattern. Looks brilliant on the data it has seen, useless on Tuesday |
Overfitting is why you always keep some examples back and test on those. A model scored on the data it trained on is a student marking their own exam.
Three methods that are the same idea
The first three belong together, because each is the previous one asked a harder question.
Linear regression: predict a number
The oldest and still the most used. Draw the straight line that best fits the points, then read predictions off it. Given this load and this ambient temperature, this bearing runs at about 71 degrees.
It is worth more respect than it gets. It is fast, it needs little data, and above all it is readable: the model is literally "so much per unit of this, plus so much per unit of that", which an engineer can sanity-check against physics and a regulator can accept. A great many production models that get described as AI are a linear regression with good features in front of it, and there is nothing wrong with that.
Its limit is in the name. If the real relationship bends, a straight line will describe it badly and do so with total confidence.
Logistic regression: predict a yes or a no
Most operational questions are not "how much" but "will it". Will this pump fail this month? Is this batch out of spec? Is this reading a genuine excursion?
Logistic regression takes the same straight-line machinery and bends it into an S so the answer lands between 0 and 1, which you read as a probability. That is more useful than a bare yes, because you get to choose where to act: a maintenance planner might act at 30 per cent, a shutdown decision might need 90.
It keeps most of linear regression's readability, which is why it is the workhorse of medicine, credit and safety, three fields that are obliged to explain themselves.
Support vector machines: draw the best boundary
Now the question changes shape. Instead of a value or a probability, you want the dividing line between two groups: healthy against failing, good weld against bad.
Many boundaries separate two groups. A support vector machine picks the one that leaves the widest empty corridor either side, on the reasoning that a boundary with room to spare is more likely to survive contact with next month's data. The striking part, and the thing worth remembering about it, is that only the few points nearest the boundary matter, the ones the figure rings. Everything comfortably inside its group could be deleted without moving the boundary at all.
It also does not have to be straight. Through a trick that effectively bends the space until the groups can be split cleanly, the boundary can curve, which is what lets a support vector machine separate groups that no straight line could. That buys real power and costs some of the explainability, the same trade appearing again.
A fair note on the comparison: logistic regression can bend too, if you feed it features that bend, such as a squared term. The difference is where the work goes. With logistic regression you have to know which curve to supply; with a support vector machine the shape is part of what gets fitted.
Trees, forests and boosting: what people actually run
Ask what is inside a working model built on a table of numbers, and this family is the answer more often than everything else on this page put together.
The table in question is the ordinary kind: one row per pump per day, or per turbine per hour, with a column for each feature and a column holding what happened, taken from the event log. Nearly every operational question arrives in that shape.
A decision tree: questions it wrote itself
A decision tree is a flowchart of yes-or-no questions, except that nobody wrote the questions. Training picks, at each step, the question that best separates the examples it has left, and keeps going until the groups are clean enough or too small to split further.
The result is the most readable model there is. You can print it, hand it to a control room, and somebody can follow it without knowing what a model is. In a plant where a prediction has to be believed before it is acted on, that is not a small thing.
Its weakness is that it is unstable. Change a handful of examples and the tree can redraw itself completely, because one different question near the root changes everything beneath it. Let it grow deep and it stops finding patterns and starts memorising, which is overfitting in its purest form.
Random forest: hundreds of trees, voting
The fix sounds too simple to work. Train hundreds of trees; give each one a random sample of the rows, and let each split choose from only a random handful of the columns. Then take the majority vote, or the average when the answer is a number.
Because every tree grew on a different slice, they make different mistakes, and different mistakes cancel when you average them, while the pattern they all found survives. That is why a random forest built out of an unstable component is one of the most dependable models in practice.
Three reasons it is often the right first model:
- It works without tuning. The defaults are usually close to the best you will do, so there is very little room to get it wrong.
- It takes your table as it is. Mixed units, no scaling needed, a few gaps, and several columns that turn out to be useless: none of that derails it.
- It tells you what it leant on. A forest reports feature importance, which inputs it relied on most. Read that as a description of the model, not of the process: importance is not causation, and two features that move together split the credit between them arbitrarily.
Gradient boosting: a queue, each tree fixing the last
Gradient boosting keeps the trees and changes the arrangement. Rather than hundreds of trees in parallel, it builds them one at a time, and each new tree is trained on what the ones before it are still getting wrong. The error left over shrinks with every tree added.
On a table of numbers this is usually the most accurate model available, which is why XGBoost and its relatives LightGBM and CatBoost win most competitions decided on tabular data, and why they sit behind a great many production models in credit, insurance, demand forecasting and industrial prediction.
The price is attention. Boosting has far more settings than a forest and will cheerfully overfit if you let it keep adding trees, so it needs held-out data and somebody watching the score on it. Reach for a forest when you want a good answer with few ways to get it wrong, and for boosting when the last few percentage points are worth the tuning.
The two limits worth knowing before you rely on either
Both inherit the same blind spots from the trees inside them, and both bite in exactly the situations an industrial user cares about.
They cannot extrapolate. A tree answers by averaging examples it has seen, so it can never return a value outside the range it was trained on. Ask what happens at a load 20 per cent above anything ever run, and it will answer, confidently, with the edge of what it knows. Linear regression, for all its simplicity, at least keeps going in the right direction. That gap matters most when equipment is being pushed somewhere new, which is often precisely when a prediction is wanted.
They have no sense of time. A boosted tree sees rows, not a sequence: shuffle them and nothing changes for it. Order has to be put into the features by hand, as lags, rolling averages, time since the last start, rate of change. When the shape over time is the finding, the next section is what you want instead. Where features come from →
Sequences: LSTM, and why time series need it
Everything so far judges a reading on its own merits, and industrial data rarely works that way. The interesting failures are changes of shape, not changes of value. A pump whose daily cycle quietly flattens is in trouble long before any reading leaves its normal band, and every method above will look at that plant and see nothing wrong.
A long short-term memory network, always called an LSTM, is a neural network with a memory running along the sequence. At each step it decides what to keep from what it has already seen, what to forget, and what to add, and carries that forward. Designed in the 1990s to fix the fact that earlier sequence models forgot anything more than a few steps back, it remains one of the best tools available for the shape of data this platform holds.
How that becomes anomaly detection. The model is trained to predict the next value from the sequence so far. Once it is good at that, you run it forward against live data and watch the gap between what it expected and what arrived. A small gap is normal operation. A gap that opens and stays open is the finding, and it is available while every individual reading is still perfectly ordinary.
Where it earns its place:
- Anomaly detection in sequences. The case above: something is wrong with the pattern while every value is in range. This is the one that finds problems no alarm limit can.
- Early warning. Recognising the shape of a run-up to a failure, days before any single reading crosses a limit.
- Forecasting. What this signal will do over the next hours, which is the same machinery used forwards rather than as a comparison.
- Sequences of events, not just numbers: a particular order of alarms, starts and interventions that has ended badly before.
- Classifying free text, where the order of the words carries the meaning: what was asked, about what, and by whom.
Text is a sequence too, and this is where LSTMs became famous. Three requests, built from almost the same words:
That is a hard problem for anything that treats a sentence as a bag of words, and a natural one for a model that reads left to right while remembering what it has seen.
Which is why sequence models are the workhorse of classifying, labelling and tagging. Your operation is full of text that nobody has time to categorise by hand, and every item of it has a structured answer hiding inside it:
| What arrives as text | What a classifier can assign |
|---|---|
| Inspection reports and datasheets | Which equipment it concerns, what kind of finding it is, how serious |
| Work permits | The hazard class, the isolations implied, the equipment affected |
| Free-text alarms and notifications | An event type and sub type, and the resource it belongs to |
| Maintenance notes | A failure mode, and whether it records a repair, an inspection or a deferral |
| Spare part descriptions | The part class, so stock can be matched to the equipment that needs it |
Every row turns prose into something you can filter, count and trace. It is also how labels get applied consistently across a decade of documents rather than reflecting whoever happened to type each one, and how a document ends up attached to the right asset, which is contextualization done to text.
Have the model propose a classification and let a person confirm the first few hundred, because a mislabelled permit is worse than an unlabelled one.
And the obvious question: why not just use a large language model? Often you should, but the trade is real and worth stating plainly:
| A trained LSTM | A large language model | |
|---|---|---|
| Getting started | Needs labelled examples and a training run before it does anything | Works from a written instruction, today, with no training |
| Accuracy on your categories | Higher once trained, because it only knows your label set and has seen your language | Good, and occasionally confidently wrong |
| How it fails | Predictably, and you can measure the rate on held-out examples | It can hallucinate: invent a category, misread a negation, or attach a finding to the wrong asset |
| Running it | Small and fast: your own hardware, scoring a stream as it arrives | Usually a call out per item, with the cost and latency that implies |
A properly trained classifier is the more accurate and more auditable of the two on a fixed set of labels, and the language model is by far the easier to start with. In practice the two combine well: use the language model to label a few thousand examples quickly, have people check them, then train the small model on the result and run that in production. You get the language model's convenience once and the trained model's reliability every day after.
Its big brother, xLSTM. In 2024 the original LSTM's inventors published an extended version, xLSTM, which adds exponential gating and a richer memory so the architecture scales to the sizes that made transformers famous, while keeping the property that makes LSTMs attractive here: they process a sequence step by step, so they suit a signal that arrives continuously rather than a document that arrives whole. If you are choosing a sequence model for industrial time series today, it belongs on the shortlist.
The caveat is the one from the section above, sharpened. Sequence models need a lot of history, they need that history to be clean, and they are hard to interrogate afterwards. A run-up they flag should point at the resources and the window it was reading, so a person can look at the same evidence.
Clustering: learning without being told the answer
Everything above is supervised: it needs labelled examples, meaning somebody, or some event, recorded what actually happened. Unsupervised learning drops that requirement. You hand it the data with no answers attached and it finds structure on its own.
Where this earns its place in an operation:
- Grouping equipment that behaves alike, which often cuts across how the plant is organised on paper and is a genuinely useful discovery.
- Anomaly detection. A reading that belongs to no group is unusual by definition, and this is how "unusual" gets defined without anybody writing a threshold.
- Making sense of a mess before you have any labels, which is exactly the position most operations are in at the start.
The honest limitation: clustering finds groups, not meaning. It cannot tell you that group two is "pumps approaching cavitation". Somebody who knows the plant has to look and name it, and that naming is worth capturing in the model as a label rather than losing in a slide deck.
k-means: the one to know by name
k-means is the clustering method you will meet first and the one a supplier most likely means by "we cluster the data". The whole procedure fits in four lines: choose how many groups you want, drop that many centres anywhere at all, let every point join the centre nearest to it, then move each centre to the middle of the points that joined it. Repeat the last two steps until nothing moves, which normally takes seconds.
Three things decide whether it works on your data:
- You pick k, and the data will not tell you. Run it across a range of values and watch how much tighter the groups get with each extra one. The point where the improvement flattens is the usual choice, known as the elbow. Ask the plant too: people who run the equipment usually know roughly how many ways it runs.
- Distance has to mean something, so scale the features first. This is the trap. A column measured in thousands of running hours and one measured in tenths of a millimetre are not comparable, and left unscaled the bigger number decides every group on its own.
- It assumes roughly round groups of similar size. Where the real groups are long, curved or nested, it will cut straight through them. DBSCAN finds shapes instead, and has the useful habit of leaving genuine outliers in no group at all.
The payoff is larger than the grouping itself. Once the centres exist, the distance from a new reading to the nearest centre is an anomaly score nobody had to define, and the groups usually turn out to be operating modes: start-up, steady load, recirculating. Name them with somebody who knows the plant, keep the names as labels, and every later question can be asked per mode, which is most of what makes a comparison fair.
Neural networks: when the rule is a shape nobody can describe
A neural network stacks many simple calculations in layers, and each connection carries a number that training adjusts until the answers come out right. With enough layers it can express almost any relationship, including ones no person could write down.
This is what "deep learning" means, and it is behind the things that made AI famous: images, speech, and the large language models underneath the agents described elsewhere on this site.
Two things to keep in view before reaching for one in an industrial setting:
- They are hungry. They need far more examples than the earlier methods, and industrial failure data is usually scarce, which is exactly the problem synthetic data exists to soften.
- They are hard to interrogate. "Why did it say that?" has no short answer. In a safety-relevant or regulated decision, that is not a detail, and a slightly less accurate model you can defend often beats a slightly better one you cannot.
Which one should you reach for?
| If the question is | Start with | Because |
|---|---|---|
| How much, how long, how many? | Linear regression | Fast, honest, and readable by the people who will be held to it |
| Will this happen, and how sure are we? | Logistic regression | A probability lets you choose the threshold per decision |
| Which of these two is it? | Support vector machine | Optimises the boundary itself, and copes with few examples |
| I have a table of numbers and a deadline | Random forest | Close to the best answer with almost no tuning, and it survives messy columns |
| The same table, and the last few per cent matter | Gradient boosting, meaning XGBoost or a relative | Usually the most accurate model on tabular data, in exchange for tuning and vigilance |
| I do not know what I am looking for | Clustering, usually k-means | Needs no labels at all, which is where most operations begin |
| The pattern is complicated and I have lots of data | Neural network | Expresses shapes nothing else can, at the cost of explaining itself |
| The answer depends on what came before | LSTM, or xLSTM | Carries a memory along the sequence, which is what time series, event chains and sentences need |
The professional habit is to start at the top of that table and move down only when the results demand it. A simple model that ships, that operators trust and that an auditor accepts beats a sophisticated one still being tuned. It is also the honest way to judge a supplier: if a demonstration will not say which of these is inside, the answer is usually the simplest one, dressed up.
What all of them need from you
Every method above depends on the same three things, and none of them are the method:
- Features that mean something, which come from understanding the process, not from the algorithm. How features are found and kept →
- Labels you can trust, meaning a record of what actually happened, attached to the thing it happened to. This is what an event log is, and most organisations have one without realising it is also a training set.
- Data that is not quietly wrong, because a model trained on a frozen sensor learns the sensor. What dirty data looks like →
Which is why this page sits in the concepts section rather than in a developer manual. The gap between organisations that get value from machine learning and organisations that get demonstrations is almost never the choice of method. It is whether the data has meaning attached, and that is a modelling job.
Worth keeping straight, because the words get used interchangeably. A model takes one input and returns one output: a number, a class, a probability. An agent is given a goal, has tools, and decides what to do next, and it may call several models along the way. The distinction, drawn out →
- Machine learning
- Linear regression
- Logistic regression
- Support vector machine
- Decision tree learning
- Random forest
- Gradient boosting
- XGBoost
- Cluster analysis
- k-means clustering
- DBSCAN
- Artificial neural network
- Long short-term memory
- xLSTM: Extended Long Short-Term Memory
- Recurrent neural network
- Time series forecasting
- Natural language processing
- Text classification
- Deep learning
- Overfitting
- Supervised learning
- Anomaly detection
- Data cleaning: the prerequisite everything else inherits
- Feature extraction: where a model's inputs come from
- Synthetic data: what to do when the examples are too few
- Building AI agents: what to do with models once you have them
- Relationship analysis: statistics rather than learning, and often the better first answer
- Time series: where features come from
- Events: where labels come from
- Lineage and data quality: why a model is only as good as what it was trained on
- Knowledge graphs: the context that decides whether a model has anything meaningful to learn from