4. Feature engineering for industrial signals

Raw industrial signals are rarely suitable for direct use by anomaly detection algorithms. A vibration waveform sampled at 25.6 kHz, a three-phase current signal, or a thermal image sequence each contains far more information than a model can efficiently consume, and much of that information is redundant or dominated by operating conditions rather than by the fault we care about. Feature engineering is the process of transforming raw measurements into a compact, interpretable representation that preserves the discriminative structure of normal and abnormal behavior. In unsupervised anomaly detection, this step is especially critical: because we never see labeled faults during training, the feature space itself must encode the physical signatures that distinguish healthy operation from degradation.

This chapter surveys four families of representations — time-domain, frequency-domain, time-frequency, and domain-specific — and explains when each is appropriate, how to compute it, and how to validate that it actually helps.

Time-Domain Features

Time-domain features are computed directly from the sampled waveform x[n] without any transform. They are cheap, interpretable, and often surprisingly effective for detecting amplitude or shape changes. The most common set includes:

• Statistical moments: mean, variance, skewness, kurtosis. Kurtosis is particularly valuable for bearing diagnostics because impulsive faults raise the fourth moment well above the Gaussian baseline of 3.
• Peak and RMS: peak value, root mean square, and their ratio (crest factor). Crest factor increases when sharp impacts appear against a stable background.
• Shape indicators: shape factor (RMS / mean absolute value), impulse factor, clearance factor. These are dimensionless and therefore robust to load changes.
• Zero-crossing rate and waveform length: useful for detecting changes in dominant frequency content without a full spectral transform.

For a healthy bearing running at constant speed, RMS might sit near 0.8 g with kurtosis around 3.0. As an outer-race defect develops, kurtosis can rise to 6–10 while RMS increases more slowly, so the ratio between them becomes an early indicator. The practical rule is to compute a feature vector per window (e.g., 1-second frames with 50% overlap) and track its trajectory over time.

Frequency-Domain Features

Frequency-domain features come from the discrete Fourier transform (DFT) or its fast implementation, the FFT. They expose periodic structure that is invisible in the time domain. For a signal sampled at fs with N points, the FFT produces N/2+1 bins spaced fs/N apart. Typical features include:

• Spectral centroid: the amplitude-weighted mean frequency, indicating where the energy concentrates.
• Spectral spread and entropy: bandwidth and disorder of the spectrum; entropy rises as energy spreads across many bins.
• Harmonic ratios: energy at multiples of a known fundamental (e.g., shaft rotation frequency fr) relative to total energy.
• Sideband energy: energy at fr offsets around a carrier, a classic signature of modulation from gear or bearing faults.

Frequency-domain features assume the signal is stationary over the analysis window. For steady-state machinery this holds well; for run-up, coast-down, or variable-speed drives it does not, and the spectrum smears.

Time-Frequency Representations

When the signal's spectral content changes over time, a time-frequency representation (TFR) is required. The short-time Fourier transform (STFT) slides a window along the signal and computes a spectrum per frame, producing a spectrogram. The continuous wavelet transform (CWT) uses scalable, translatable mother wavelets and gives better time resolution at high frequencies and better frequency resolution at low frequencies. Both convert a 1-D signal into a 2-D image.

From a TFR you can extract scalar features: instantaneous dominant frequency, spectral flux (frame-to-frame change), time-frequency entropy, and ridge energy along a known fault-frequency curve. Alternatively, the TFR image itself can be fed to a convolutional autoencoder, which learns its own features. The trade-off is computational cost and the need for more training data.

# Example: STFT feature extraction (Python, scipy)
from scipy.signal import stft
import numpy as np

fs = 25600          # sampling rate, Hz
f, t, Zxx = stft(x, fs=fs, nperseg=1024, noverlap=768)
mag = np.abs(Zxx)                       # magnitude spectrogram
centroid = (f[:, None] * mag).sum(0) / mag.sum(0)   # per-frame centroid
flux = np.sqrt(((np.diff(mag, axis=1))**2).sum(0))  # spectral flux

In this example, nperseg=1024 gives a frequency resolution of 25 Hz and a time resolution of 40 ms, a reasonable balance for bearing tones between 1 and 5 kHz. If the fault signature is a low-frequency shaft harmonic, increase the window length; if it is a transient impact, shorten it.

Domain-Specific Representations

Domain-specific features encode physical knowledge that generic transforms miss. Examples across industrial domains include:

Envelope analysis deserves special attention. A bearing defect excites a structural resonance at, say, 3 kHz. The repetition rate of the impacts — the defect frequency — modulates this carrier. Band-pass filtering around 3 kHz, then applying the Hilbert transform and taking the magnitude, yields the envelope. The FFT of the envelope shows a peak at the defect frequency and its harmonics. This is far more sensitive than looking at the raw spectrum, where the defect frequency may be buried under noise.

Practical Workflow and Validation

A reproducible feature-engineering workflow for industrial signals follows these steps. First, define the analysis window and overlap based on the physical process: a 1-second window with 50% overlap is a common starting point for rotating machinery, while thermal processes may need minutes. Second, compute a candidate feature set spanning all four families. Third, normalize each feature using statistics from the training (normal) data only — z-score or robust median/IQR scaling — and store the scaler for inference. Fourth, reduce redundancy with correlation filtering or PCA if the feature count exceeds a few dozen. Fifth, train the unsupervised detector and evaluate on held-out normal data plus any available labeled anomalies.

Validation should check both detection performance and feature stability. A feature that drifts with ambient temperature or load will generate false alarms. Plot each feature's distribution across operating conditions; if the distributions overlap heavily, the feature is not discriminative. For the bearing example, a well-chosen envelope-spectrum feature at BPFO should show a clear separation between healthy and faulty windows, while raw RMS may show only a modest shift.

Common failure symptoms and their causes: (1) the model flags every load change as an anomaly — operating condition was not included as a feature or used for normalization; (2) detection performance collapses when speed varies — frequency-domain features were used without order tracking; (3) the feature vector is dominated by one large-magnitude feature — normalization was skipped or applied incorrectly; (4) envelope analysis shows no defect peaks — the band-pass range does not cover the actual resonance, which should be identified from the spectrum or a bump test.

The central lesson is that feature engineering for industrial anomaly detection is not a generic preprocessing step. It is where physical understanding of the machine, the sensor, and the failure mode is encoded into the model. The four representation families are complementary, and the strongest systems typically combine a small number of well-understood features from each rather than relying on a single transform.