Chapter 9Time-Domain Analysis

This chapter describes the analyses on the Analysis tab of the sidebar that examine how values change over time. Frequency analysis (FFT, STFT, Wavelet, Freq. anomaly) and filters are described in Chapter 8.

The examples in this chapter use the sample data sample_endurance_run_en.csv. At 380–400 seconds, Vibration RMS and Current rise temporarily.

9.1Common flow on the Analysis tab

The upper part of the Analysis tab is common to all analyses. It is divided into three stages: Target, Run, and Results. This part does not move when you scroll the sidebar, so you can always see what is being analyzed over which range, even while looking at the analysis cards below.

1. 1Analysis target: Choose the series to analyze. Enter part of a name to filter
2. 2Range: The X range to analyze (All data, Visible, Selected)
3. 3Full diagnosis: Runs the analyses all at once (described later)
4. 4Analysis guide: Choose which analysis to use based on what you want to find out
5. 5Result count: The number of analyses with results, and the total number of findings
6. 6Clear all results: Clears all analysis results and the marks on the graph (including the results of Known event investigation)
7. 7Hide range band: Hides the light-blue display showing the Selected range (the range itself remains)

1. Choose the target

• Analysis target: All analyses target the one series chosen here. Hidden series can also be chosen. Series of data sources hidden on the Sources tab are not listed. When you change the target, the previous results of each analysis and of Full diagnosis (summary and findings) are cleared, and the count above returns to 0.
• Range: Choose the X range to analyze.

Corr. break and Known event investigation have their own separate ranges in their cards (described later). The number of specified ranges is shown in the Clear all ranges button (the button does not appear when there are none), and this button clears all specifications at once. Analysis results are not cleared.

2. Run

Analyses are run one at a time in the cards listed below. Click a card's heading to open it. In every card, set the conditions and click the run button (for example, Detect change points). Clear clears only that card's results.

Enter time fields such as the window width in the X unit of the loaded data (the unit is shown to the right of the field). For data with X in milliseconds, 5 seconds is 5000.

Click Analysis guide to see a list of goals, such as "Pinpoint sudden jumps / spikes" and "Extract series that move around an anomaly timing". Choose one to open the cards of the analyses suited to it.

3. View the results (the investigate screen)

When you open the Analysis tab, the screen switches to the Investigate layout. Below the graph, an overview waveform and a table of analysis results appear. In 2 panes, opening the Analysis tab of Pane B shows Pane B in this layout (click 2 panes to return).

1. 1Investigate: The screen switches to this layout automatically when you open the Analysis tab
2. 2Result marks: One row per kind of analysis, showing the detected positions
3. 3Overview waveform: A frame shows the range you are currently viewing. Drag the frame to move it, and drag its edges to zoom in or out. Click outside the frame to move to that position
4. 4Analysis tabs: Switch between the results of each analysis. The number is the count of findings (– means the analysis has not been run yet)
5. 5Results table: Sort by clicking a column heading. Drag the border between columns to change column widths
6. 6Analysis cards: Set conditions and run

• Collapse the table with Collapse at the top right of the results table to use more of the screen for the graph. Drag the border between the table and the graph to change the table height.
• The "Shape" column in the table is a small drawing of the waveform around the detected position.
• Click Show chart at the top right of the table to also show the results as a chart (trends or rankings).

If you do not want this switch, open Display & bulk actions under Other below the cards and uncheck Open the Investigate view when the Analysis tab opens. This setting is kept in the browser you use. When you return to 1 pane or another layout, the results are shown inside the cards in the sidebar.

Working with the results table

Some results tables have one row per "position" (Change point, Outlier, Corr. break, and others), and some have one row per "series" (Correlation, the candidates of Event analysis, Known event investigation).

You can also remove the highlight by clicking outside the table or pressing Esc.

Tidy up displayed series

When some series have been displayed by clicking rows, Tidy up shown series appears below the result count. Click it to hide again only the series that were displayed by clicking rows. Series you displayed by checking them yourself stay displayed.

Turn intermediate values into series

Click Add score series (Add to series for Moving stats) to add intermediate values of the analysis as a new series. Added series can be displayed, saved, and exported like ordinary series, and can also be the target of another analysis.

Data used for calculation (Filtered (as displayed), Raw data)

The Outlier, Correlation, and Corr. break cards have a Data field.

Handling missing values and the direction of X

• Empty or non-numeric values: Those points are not used. Analyses that use a window width arrange the points on a grid at the X step (the median step) for calculation, so missing positions remain empty. A window never spans a gap to put distant points into the same window. For results with missing points, the count is shown above the results, like "100 missing points left empty".
• Time jumps: Time gaps wider than 1.5 times the step are also treated as missing. When matching series by time (correlation, correlation break, event analysis), values are never filled in across missing values or gaps.
• Data where X goes backward: Series in which X becomes smaller than the previous point, or the same X repeats, are not analyzed. When the analysis target is such a series, you are notified with a message like ""…" cannot be analysed: X goes backward (1) or repeats (0)". Narrowing Range does not change this (the whole series is checked before the range is cut out). When a non-target series is like this, that series does not appear in the results.
• Right before and after a gap, fewer points are in the window, so Change point and others may produce extra candidates. Check on the graph whether a candidate position falls on the edge of a gap.

Full diagnosis

Click Full diagnosis to run the following analyses in order under the Analysis target and Range conditions. Window widths and similar settings are determined automatically from how quickly the target series changes (the reference time constant). The chosen values are written in the summary. The fields in the Change point and Event analysis cards (method, window width, threshold, and so on) are not overwritten.

1. Change point (⚙ Auto run)
2. Event analysis (⚙ Auto run)
3. Outlier
4. Freq. anomaly
5. Corr. break
6. Correlation
7. Moving stats
8. STFT peak
9. Wavelet
10. Known event investigation (only when an abnormal interval is specified)

The results are collected on the Full diagnosis tab. Click a row to move to that analysis's tab and zoom in on the corresponding position. The results of each analysis are also placed on their own tabs.

1. 1The Full diagnosis tab: The summary is on the left, and the findings of each analysis are listed one per row on the right

Freq. anomaly is run with five window widths, and only the places that at least half of them mark as anomalous become findings (with a single window width, places where nothing happens can be counted as anomalies).

Full diagnosis is the starting point when you do not know where to begin. For analyses that produced findings, change the conditions in their cards to confirm.

Practice with the analysis tutorial

Click Demo in the pane bar, choose Analysis tutorial in Type, and click Generate to create practice data for analysis (6 series, 120 seconds, step 0.01 seconds). The analysis cards are filled with conditions suited to this data. If you run each analysis as-is, the following positions are detected.

The series names (Normal tracking, Delayed response, Leading event, Unrelated noise, and so on) indicate the role of each series.

Full diagnosis also finds the positions above for Outlier, Change point, and Freq. anomaly. It does not find the Corr. break, because Full diagnosis chooses the other series automatically (the most correlated one, Normal tracking). To find the break with Correlation break, choose it as the other series in the card.

If you add ?demo=tutorial to the end of the address when you open the file in a browser, the analysis tutorial data is created at startup (only when Pane A has no data).

9.2Moving stats

Calculates statistics within a window for the target series. The window is "that point and the window width before it". The results are shown in the sidebar and on the Moving stats tab, and can be added as a series with Add to series.

• The initial value of Window is 5 (in X units).
• The results show the number of points in the window, the number of points output, and the mean, maximum (position), and minimum (position).
• Results appear only at positions where the original series has points. Missing positions remain empty.

9.3Change-point detection

Finds times when the level (or slope) of the values changed. For each point, windows are taken before and after it, the difference between the before window and the after window is calculated point by point, and places where that difference is larger than usual become candidates.

1. 1Method: Choose Level shift (mean diff) or Slope change (trend diff)
2. 2Window, Threshold, Results shown
3. 3Detect change points: Detects with these conditions
4. 4⚙ Auto run: Determines the window width, threshold, and method automatically, then detects
5. 5Clear: Clears this card's results

Z (robust Z-score)

The thresholds of Change point, Outlier, and Event analysis are set in Z. Z is a number that expresses "how many times the usual spread a value deviates".

• Z = (value − median) ÷ (MAD × 1.4826). MAD is the median of the absolute differences from the median. Multiplying by 1.4826 gives a size equivalent to the standard deviation of a normal distribution.
• Because the median and MAD are used instead of the mean and standard deviation, the yardstick is not pulled by the abnormal values themselves.
• As a guideline, 2 is sensitive (more candidates), 3 is standard, and 4–5 catches only definite anomalies.
• In Change point, Z is calculated over the sequence of differences between the before and after windows. Open About Z-score in the card to read the same explanation.

Reading the results

When points above the threshold are consecutive, they are merged into the single point with the largest Z within the window width. A line above the results such as "238 pts over threshold -> merged to 1 per 5s window: 3 shown" gives this breakdown.

When you examine Vibration RMS in the sample data with the initial conditions (Level shift (mean diff), window width 5, Z 3), three places are found: 239.4 seconds (where speed was raised to 3000 rpm), and 380.0 and 400.0 seconds (where vibration rose and returned) (see the figure of the investigate screen).

9.4Outlier detection

Finds points that stand out from the surrounding points (the Hampel method). A window is taken centered on each point, and the point's Z is calculated from the median and MAD within the window.

1. 1The Outlier tab
2. 2Results table: Position, Score (Z), Value, the window Median, Assessment

• "Spike (recovers within 3 samples)" in Assessment means that the value returned close to the median within 3 points.
• When the window contains almost the same value throughout (MAD is 0), points that differ from the median are reported as strong outliers with a score of 99. For signals with constant stretches or coarse resolution (quantized signals), even a one-step difference becomes a candidate.

9.5Correlation analysis

Calculates the correlation between the Analysis target and all other series, and lists them in order of correlation strength. It can also search for a time offset (lag).

The partner series are compared at the times of the target series. When searching for offsets, offsets at which the overlapping points are fewer than half of the total (at least 10 points) are not used.

1. 1Correlation: The correlation coefficient r (−1 to +1). The bar length is |r|
2. 2Lag: The time offset adopted
3. 395% CI, p-value: The 95% confidence interval and the p-value (corrected for the number of offsets searched)
4. 4Assessment: Strength, direction, significance, and the direction of the time offset

Significance (95% CI, p-value)

Points in a time series are not independent of each other, so using the number of points as-is makes even chance correlations look significant. LOGADEC calculates the confidence interval and p-value with an effective number of points that takes the autocorrelation of the series into account. When offsets are searched, the p-value and confidence interval are corrected for the number of offsets searched (Bonferroni). The corrected confidence interval spans 0 when the corrected p-value is greater than 0.05.

Significance is shown in one of the following three ways.

• Strength is "Strong" when |r| is 0.7 or more, "Moderate" when 0.3 or more, and "Weak" when smaller.
• No significant evidence does not mean "there is no correlation". It means that with this number of points and this spread, you cannot say there is a correlation.
• Series whose confidence interval spans 0 are shown in gray in the chart.

Direction of the time offset

When Lag is positive, the partner series moves before the target (a candidate for the cause). When it is negative, the partner follows later. Assessment adds the direction in words.

In the analysis tutorial, Delayed response is "Moderate positive (partner lags by 1.11 s)", and Correlation break, Leading event, and Unrelated noise are No significant evidence (figure above). With Vibration RMS in the sample data as the target and Max lag set to 30, Coolant temp and Oil temp are "partner lags by 30.00 s". This is because temperatures follow changes in rotation with a delay. Conversely, with Coolant temp as the target, Speed, Current, Voltage, and Vibration RMS are "partner leads by 30.00 s" (Voltage is negatively correlated). When the offset equals Max lag, it has hit the edge of the search range. Widen the range to confirm.

How full diagnosis reports it

The Correlation row of Full diagnosis counts only series that are significant with |r| of 0.3 or more.

• When there are matching series: It reports the number of matching series and the strongest series, like "Correlation: 5/5 series significant (|r|≥0.3). Strongest: Current (r=0.80, Strong positive)".
• With Difference correlation, when no series has significance computed: It reports "Correlation: significance not computed with the difference method (5 series; …)".
• Otherwise: It reports "Correlation: none significant (5 series)".

View candidates on the graph

Click a row to display that series on the graph and highlight it. Click Show top in the sidebar card to display only the target series and the series checked in the table, hiding the other series.

9.6Correlation break

Finds time periods when the usual co-movement of two series broke down. It is suitable for finding changes that begin as a shift in the relationship, even if they are small in amplitude.

1. Calculates the correlation of the two series over the whole range (the baseline correlation).
2. Shifts a window and calculates the correlation in each window.
3. Windows where the drop from the baseline correlation (measured in the direction of the baseline correlation) is at least Drop threshold become candidates. When the direction of the correlation reverses, the drop exceeds 1 (for example, +0.9 → −0.9 gives 1.8).

1. 1Target series, Comparison series
2. 2Range: A range for this card only
3. 3Results table: Interval, Pair, r before → after (baseline correlation → window correlation), Assessment

9.7Event analysis

Finds "events" in the target series and examines whether other series moved at the same time, before, or after them.

Up to 80 events are found. For each other series, the place with the largest Z of change within the range before and after the event is found, and if it exceeds the matching criterion, it counts as a "match". The matching criterion is set taking into account how much that series moves where there are no events. This makes it harder for noisy series to match even unrelated events.

1. 1Events: The events found (close events are merged and shown with start, end, and duration)
2. 2Candidate series (check to show on chart): The matching series, in descending order of matches

For Vibration RMS in the sample data, around 380 and 400 seconds and 239.4 seconds become events, and Current and Voltage match 7/7. With Sudden change (diff Z) left as-is, the fine fluctuations of vibration also become events, reaching 80. In that case, raise Threshold, or use Change-point candidate or Specified time (known event).

Click Show candidates to display only the target series and the checked candidate series.

9.8Known event investigation

Use this when the interval in which an anomaly occurred is already known. It compares that interval (the abnormal interval) with a normal interval (the baseline), examines all series, and lists the series likely to be related together with the evidence. It is used differently from Full diagnosis, which searches the whole data for anomalies.

1. 1Anomaly interval: Enter numbers, or specify it on the graph with Pick on chart
2. 2Baseline, Baseline length: The normal interval to compare against
3. 3Recovery window, Recovery length (×): The interval after the abnormal interval (to see whether things returned to normal)
4. 4Detailed evaluations: The maximum number of series to examine in detail
5. 5Run investigation: Runs the investigation

How it examines

1. Stage 1 (all series): For the abnormal interval and the normal interval, calculates the difference in medians (as a multiple of the usual spread) and the ratio of spreads. Series that do not cover at least half of the abnormal interval, and series that hardly move in either (the median difference is less than 1.5 times the usual spread, and the spread ratio is between about 0.7 and 1.4), are excluded here.
2. Stage 2 (in descending order of change, up to the number set in Detailed evaluations): Calculates the change-point time, the correlation with a search for time offset, and a spectrum comparison. The range for the correlation offset search is the length of the abnormal interval (at least 20 data steps) when Max lag in Correlation is 0.
3. Using the change-point time (or the correlation offset if there is none), the series are classified as Leading, Simultaneous, or Lagging. The width for "simultaneous" is the larger of 3 times the data step and 5% of the length of the abnormal interval. Series whose level hardly changed and whose correlation offset hit the edge of the search range are classified as Unrelated.

Reading the results

1. 1Related candidates: The evidence for each series. Sort by clicking a column heading
2. 2Switches between Event timing, Three-window comparison, and Spectrum comparison. Choose the series to view in detail in the field on the right
3. 3Event timing: 0 is the start of the abnormal interval. Dots are change-point times, and lines extend to the correlation offset

In the sample data, Current (+19.0 σ) and Voltage (−2.9 σ) are Simultaneous and returned. Oil temp and Coolant temp appear as Leading, but this is because the temperatures keep rising slowly. Series that keep moving slowly can appear as Leading, so check their shape on the graph.

• Three-window comparison lists the median, spread, slope, and number of points of the three intervals (normal, abnormal, recovery), and states whether things returned to normal.
• Spectrum comparison overlays the spectra of the three intervals. When X is in a time unit (s, ms, and so on), frequencies are shown in true Hz (fixed in 1.0.28 so that ms data shows the same Hz as the FFT).
• Show all and Hide all above the table show or hide all candidate series on the graph at once.
• The results indicate temporal association and do not guarantee causation.

Export the results to CSV

Click Export candidates + event window (CSV) to save logadec_known_event.csv. This button is in the sidebar card, so it is not shown on the Investigate screen. Switch to 1 pane, open the Known event investigation card, and click it (the results remain).

The CSV consists of three parts.

• Units of Δt and offset: When the X unit is known to be a time unit (s, ms, and so on), the values are converted to seconds and written in the dt_sec and lag_sec columns. Otherwise they are written in X units as dt_x and lag_x. Interval values and data X stay in X units.
• Series with different steps: If all series have the same X as the target, an x column is followed by the value columns of the series. If even one series has a different step (such as a series from another file), each series is written as a pair of an x:series name column and a value column. This is because aligning by row number would put values from different times on the same row (fixed in 1.0.27; before that, rows were aligned, and ms values were written in the dt_sec column).