Monitoring guide · 03 / Anomalies

When the pattern departs

An anomaly detector asks whether a measurement resembles its reference experience. That is a narrower question than whether a component is damaged or a bridge is safe.

Read the score before reading a cause

AI-assisted monitoring often turns a complex collection of signals into a score. That score might represent prediction error, distance from a learned cluster or difficulty reconstructing an observation. A high value means something specific within that method. It does not automatically express the probability of damage, the severity of a defect or the time remaining before a failure.

Some systems use supervised learning with labelled examples. Others learn patterns from largely unlabelled operating data. Real examples of structural damage are often scarce, and their labels may be incomplete or uncertain. Laboratory damage scenarios, simulated changes and public research datasets can help test ideas, but their performance does not transfer automatically to a working bridge with different materials, sensors and loading.

Principal component analysis, isolation forests and autoencoders are examples of methods that can support anomaly detection. Their usefulness depends on the data and question. A model that detects an unfamiliar temperature regime may be doing exactly what it was trained to do, while still providing no direct evidence of structural deterioration.

Separate a signal event from a structural hypothesis

Illustrative departure—not a diagnosis

Schematic only; no actual readings, units or operational thresholds. Several explanations could produce this shape.

Begin with the raw measurements and data-quality flags. A step change may coincide with sensor replacement, a firmware update or a new conversion factor. A flat line may indicate lost communication rather than stable behaviour. A sudden spike could be an electrical disturbance or an actual transient response. These possibilities require evidence rather than a preferred explanation.

Next compare related channels. A response seen consistently across an appropriate group of sensors may carry different weight from an isolated change. Even then, shared power, networking or processing can create common faults. Check weather, traffic, maintenance and inspection records. Preserve the original event window so that later reviewers can test competing explanations rather than relying on a screenshot.

Evaluate alerts as operational events

A threshold creates a trade-off between unnecessary enquiries and missed changes. Lowering it may increase sensitivity while overwhelming the review team. Raising it may reduce workload while overlooking subtle behaviour. The balance should reflect the monitored mechanism, the consequences of error and the actions available—not a generic threshold copied from another asset.

Accuracy alone can be misleading when genuine target events are rare. Evaluation should distinguish false alerts, missed events, detection delay and the amount of human review required. Precision and recall can be useful where trustworthy event labels exist. They should not be reported as established field performance when only synthetic or retrospectively selected examples were tested.

Count events as well as individual data points. One persistent excursion may generate thousands of flagged samples but only one investigation. Persistence rules, grouped alerts and suppression periods can reduce repeated notifications, although they can also delay or conceal new information. Any such logic belongs in the documented monitoring specification, with its consequences tested.

The Federal Highway Administration's Long-Term Bridge Performance Program and the US National Bridge Inventory provide useful context for bridge information and research. They are not universal training datasets containing continuous sensor records for every monitored mechanism. Data availability, licensing, definitions and suitability must be checked rather than inferred from an authoritative organisation's name.

Keep uncertainty visible as conditions change

Model drift describes a change in the relationship between a model and the data it encounters. The cause might be a sensor adjustment, an unusual operating regime, a structural change or a combination. Automatically retraining on every new pattern risks erasing the very departure under investigation. Freeze relevant evidence and involve the responsible reviewers before adopting a new reference.

Explanations generated by a model also need limits. A feature-attribution plot can show which inputs influenced a score, but it does not establish a physical cause. Correlated inputs can make such explanations unstable. Engineering interpretation must connect the observations to plausible behaviour, supported where appropriate by inspection, testing or analysis.

The NIST AI Risk Management Framework offers a general vocabulary for governance, measurement and management of AI risks. ISO/IEC 23894 provides guidance on AI risk management. Neither certifies a bridge-monitoring system or replaces asset-specific engineering requirements. Their value here is in prompting explicit responsibility, traceability and ongoing evaluation.

A well-formed alert therefore states what changed, where and when it changed, what checks have been completed, and which uncertainties remain. It avoids naming a defect without supporting evidence. The final stage is to place that record into an agreed engineering review and escalation process.

Reference starting points

Next interpretation stage

Give the enquiry a responsible owner

Continue to engineering review →