Contents
What is an early warning system in manufacturing?
An early warning system is the combination of sensors, rules and alerting that surfaces a process deviation before it turns into downtime, scrap or a customer complaint. It is reactive on the clock — milliseconds to minutes — but proactive in impact: the whole point is to intervene while the defect is still preventable.
In the ISA-95 world this sits on Level 2 and 3. Level 2 (PLC, SCADA) provides the raw signals — temperatures, pressures, cycle counts, torque, current draw. Level 3 (MES) aggregates those signals, applies business rules and routes the alert to the operator, the shift lead or the maintenance crew. Without both layers working together, you get either noisy alarms with no context or beautiful dashboards nobody watches.
Why do most early warning systems fail?
Not because the technology is missing. Because three things go wrong almost universally: too many alarms, no clear ownership, and signals that describe symptoms instead of causes. The result is alarm fatigue — operators mute notifications within a week and the system becomes decorative.
The EEMUA 191 benchmark from the process industries is still the best reference: a well-designed alarm system produces on average one alarm every 10 minutes per operator, with a peak of no more than 10 alarms in the first 10 minutes after an upset.
What are the four layers of a working early warning system?
| Layer | What it does | Typical technology |
|---|---|---|
| 1. Signal capture | Reads raw process data from machines and sensors in real time | PLC I/O, OPC UA, MQTT, digital I/O gateways for brownfield |
| 2. Rule & model layer | Decides what counts as a deviation worth alerting on | Fixed thresholds, SPC control limits (UCL/LCL), Nelson rules, process capability indices (Cp/Cpk), trend detection, anomaly models |
| 3. Correlation & context | Links the deviation to an order, shift, operator, batch — so the alert means something | MES / cloud MES (order context, BOM, routing) |
| 4. Notification & escalation | Reaches the right person on the right channel and escalates if nobody reacts | Andon, mobile push, SMS, email, Teams/Slack; time-based escalation rules |
If any of the four is missing, the system does not work. A perfect anomaly model that emails a shared mailbox nobody reads is no better than no system at all.
Threshold, SPC or anomaly detection — which one do you need?
All three, but in a specific order. Thresholds are the floor. SPC is the workhorse for stable, repetitive processes. Anomaly detection earns its keep in complex, multivariate situations where a threshold would be either blind or too noisy.
- Fixed thresholds — "temperature > 180 °C triggers alert". Simple, fast, interpretable. Fails when the normal operating range shifts between products or shifts.
- Statistical Process Control (SPC) — X̄/R charts, UCL/LCL, Nelson rules. Catches trends (7 points in a row rising) and shifts before they cross a hard limit. Requires a stable process and enough data to establish control limits. For most discrete manufacturing this is the highest-ROI layer.
- Anomaly detection / ML — multivariate models that flag "this combination of pressure, torque and cycle time has never looked like this before". Useful when 20+ sensors interact. Useless without clean data and an operator who trusts the model. Start here only after SPC is running.
What does a realistic alarm architecture look like?
| Tier | Response time | Who reacts | Example |
|---|---|---|---|
| Critical | < 60 sec | Operator at the line | Temperature out of limits on welding cell — risk of immediate scrap |
| High | < 15 min | Shift lead, maintenance | Cycle time drifting upward — bearing wear warning |
| Medium | End of shift | Production manager, CI team | Micro-stops accumulating on line 3 — candidate for Pareto |
Everything below "medium" does not become an alarm. It becomes an entry in a daily report. Putting low-priority events into the same notification channel as critical alarms is the fastest way to kill a warning system.
What numbers actually matter?
Stop measuring "number of alarms". It tells you nothing. The three KPIs that predict whether a warning system will survive the first year:
- Alarm-to-action ratio — share of alarms that trigger a documented operator action. Target > 80 %. Below 50 %, the system is noise.
- Mean time to acknowledge (MTTA) — from alarm firing to operator confirmation. For critical tier, target < 60 seconds. If MTTA climbs over weeks, fatigue is setting in.
- Prevented defect rate — defects that would have occurred without early intervention, measured against alarm-confirmed interventions. Hardest to quantify honestly; the one that actually matters.
How does an MES change the picture?
A PLC can fire an alarm. It cannot tell you which order was running, which operator was on shift, or whether this is the third time this week. That context lives in the MES. Without it, every alarm is an isolated event and no pattern ever emerges.
FAQ
Is an early warning system the same as condition monitoring?
No. Condition monitoring watches the health of a machine (vibration, temperature, oil quality). An early warning system watches the process — product quality, cycle deviations, throughput. Condition monitoring feeds the early warning system, but it is not the whole thing.
Can we start with thresholds and add SPC later?
Yes — and you should. Hard thresholds for the critical tier give you visible wins in week one. SPC requires clean historical data and a stable process baseline, which takes 4–8 weeks to establish honestly. Starting with SPC on a process you have never measured before produces nonsense control limits and destroys operator trust.
How many false positives are acceptable?
Industrial practice tolerates a false-positive rate below 5 % on critical alarms. Anything higher and operators start ignoring the tier, which is worse than having no alarm at all. For anomaly-detection models, the same 5 % target applies but is harder to hit — budget 3–6 months of tuning before the model is trustworthy.
Does an early warning system replace operators?
No. It replaces the need for operators to constantly watch screens. The operator still makes the judgement call when the alarm fires. The system's job is to make sure they look at the right thing at the right moment — not to decide for them.
What's the realistic ROI timeline?
Signal capture and threshold alarms pay back in weeks — typical first-year savings from avoided scrap and faster reaction are in the range of 3–7 % of production cost on the targeted lines. SPC adds another 2–5 % over 6–12 months. Anomaly-detection models rarely pay back in under 12 months and only on lines with enough data volume and process complexity to justify the effort.
- Live demo
- 30 minutes
- Free
See early warnings from machine and process data
In a live demo we show how process values are recorded at the machine and an alarm notifies your team when a value crosses a limit you set.
- Live OEE
- Downtime and reasons
- Connecting machines and ERP
About the author
Uwe KobbertFounder & CEO
In manufacturing IT since 1989; since 1995 he has been building MES solutions for controlling and digitalising production. Dipl.-Ing. in communications engineering and electronics.
All articles by Uwe Kobbert