TimeSeriesSPCDetector

Detect subsequence anomalies in time series using statistical process control

Since R2026a

Description

Add-On Required: This feature requires the Time Series Anomaly Detection for MATLAB add-on.

TimeSeriesSPCDetector creates an anomaly detector based on statistical process control (SPC) techniques.

SPC techniques track the values or statistics of a time series over time against mean and standard deviation limits that bound normal data. The visual tracking mechanism is called a control chart, which shows both the boundaries and a representative statistic to track. The control rules determine when a violation occurs. For example, the control rule "n1" reports a violation if the statistic is three standard errors from the specified center line

Creating a TimeSeriesSPCDetector detector is the first step in a workflow that includes training the detector with normal data, testing the detector with anomalous data, and validating the model by visualizing detection effectiveness on anomalous data using plotting functions. To improve detection performance, you can use updateDetector to change certain properties, such as control limits, by updating the trained model without retraining. To change other properties, you must create a new detector object and specify the new properties using name-value arguments. You cannot modify detector properties using dot notation.

For more detailed information on the statistical process control functions that this detector is based on, see controlchart and controlrules in Statistics and Machine Learning Toolbox™.

Creation

Create a TimeSeriesSPCDetector object by using the timeSeriesSpcAD function.

Properties

Input

NumChannels — Number of input channels

1 | positive integer

Number of input channels in each time series, specified as a positive integer. All time series inputs must have the same number of channels.

This property is read-only after object creation.

Window

WindowLength — Length of training and detection window

1 (default) | positive integer scalar

Window length for batch-means computation, specified as a positive integer scalar. Adjust WindowLength to improve results for high-frequency time-series data.

This property can be set only during detector construction and training.

Window

WindowLength — Length of batch-means computation window

10 (default) | positive integer

Window length for batch-means computation, specified as a positive integer scalar. Adjust WindowLength to improve results for high-frequency time-series data.

This property can be set only during detector construction and training.

Stride

Stride length — Length of sliding window

positive integer

Length of sliding window used for training. The software always sets this property to WindowLength.

Time Series Processing

Method — Method for batch-means computation, represented as a positive integer

"individual" (default) | "ewma"

Method for evaluating anomaly state of time series data , represented as "individual" or "ewma".

• When Method is set to "individual", the detector uses the batch-means data (a time series containing the means of the data windows) to compute and display the control chart statistics.

• When Method is set to "ewma", the detector uses the exponentially-weighted batch-means data to compute the control chart parameters and statistics.

This property can be set only during detector construction.

Lambda — Forgetting factor

0.4 (default) | numeric value between (0,1]

Forgetting factor of the EWMA model standard error, represented as a numeric value between (0,1]. Lambda acts as a smoothing parameter by controlling how much each moving average value is influenced by past measurements. A higher Lambda value gives more weight to the more recent measurements.

This property can be set only during detector construction and training.

Training-Derived Values

CenterLine — Estimated sample mean

nonnegative numeric vector

Vector of estimated sample means of the window (batch) means, represented after training as a nonnegative numeric vector with one value for each channel. CenterLine provides the basis from which time series deviations are measured during detection.

After training, you can use updateDetector to change these values to tune the detection process. You can also overwrite the values manually.

StandardError — Estimated sample standard error

nonnegative numeric vector

Estimated sample standard error of the window (batch) means, represented after training as a nonnegative numeric vector with one value for each channel.

After training, you can use updateDetector to change these values to tune the detection process. You can also overwrite the values manually.

Mean — Raw mean statistic of batch-means data

numeric vector

Estimated sample mean of the window (batch) means, represented after training as a numeric vector with one value for each channel.

After training, you can use updateDetector to change these values to tune the detection process. You can also overwrite the values manually. Without custom modifications, Mean is generally equal to CenterLine.

Sigma — Raw standard deviation statistic of batch-means data

numeric vector

Estimated sample standard deviation of the window (batch) means, represented after training as a numeric vector with one value for each channel.

When Method is set to "individual", Sigmais equal to StandardError. However, when Method is set to "emwa", Sigma and StandardError are not equal.

After training, you can use updateDetector to change these values to tune the detection process. You can also overwrite the values manually.

Mean Range — Raw mean of ranges statistic of batch-means data

numeric vector

Mean of ranges of sliding windows, represented after training as a numeric vector with one element per channel. This property is useful for detecting the range of variation.

Detection Control

Level — Number of standard errors

3.0 (default) | positive scalar

Number of standard errors around the center line, or mean, of the batch-means data, represented as a numeric scalar.

DetectionRules — Rules for detecting anomalies

centerline +/- level*StandardError (default) | string vector | character vector

Detection rules, represented as a string vector. Values containing "we" are Western Electric rules, and values containing "n" are Nelson rules. The default rule, which is centerline +/- level*StandardError, is always computed. If you do not want to use the default value, set Level to be a large number.

Value	Violation Condition
"n"	All Nelson rules
"we"	All Western Electric rules
"n1"	One point below cl – 3*se or above cl + 3*se
"n2"	Nine of nine points on the same side of cl
"n3"	Six of six points increasing or decreasing
"n4"	Fourteen points alternating up or down
"n5"	Two of three points below cl – 2*se or above cl + 2*se, all on the same side
"n6"	Four of five points below cl – se or above cl + se, all on the same side
"n7"	Fifteen of fifteen points between cl – se and cl + se
"n8"	Eight of eight points below cl – se or above cl + se, on either side
"we1"	One point above cl + 3*se
"we3"	Four of five points above cl + se
"we4"	Eight of eight points above cl
"we5"	One point below cl – 3*se
"we6"	Two of three points below cl – 2*se
"we7"	Four of five points below cl – se
"we8"	Eight of eight points below cl
"we9"	Fifteen of fifteen points between cl – se and cl + se
"we10"	Eight of eight points below cl – se or above cl + se

For the control rules that involve more than a single point:

• A rule violation at point i indicates that the set of consecutive points ending at point i triggers the rule. R(i) is true only if point i is one of the points that violates the rule's condition.

• Any point whose X, cl, or se value is NaN is not counted and always has an R value of false (logical 0).

Read-Only Properties

IsTrained — Training status

Read-only: 0 (false) | 1 (true)

This property is read-only.

Training status, represented as 0 (false) or 1 (true). Once you train the detector, IsTrained is equal to 1.

Object Functions

train	Train statistical process control (SPC) anomaly detector and obtain detection threshold
detect	Detect anomalies in time series using a trained time statistical process control (SPC) detector model
plot	Plot detected anomalies and anomaly scores generated from time series anomaly detectors that are based on statistical process control
plotHistogram	Plot histogram of anomaly scores and detection threshold for statistical process control (SPC) anomaly detector
updateDetector	Update settings of a trained statistical process control anomaly detector

References

[1] Nelson, Lloyd S. “The Shewhart Control Chart—Tests for Special Causes.” Journal of Quality Technology 16, no. 4 (1984): 237–39. https://doi.org/10.1080/00224065.1984.11978921.

[2] Alexopoulos, Christos, and Andrew F. Seila. “Implementing the Batch Means Method in Simulation Experiments.” Proceedings of the 28th Conference on Winter Simulation - WSC ’96, ACM Press, 1996, 214–21. https://doi.org/10.1145/256562.256608.

[3] Runger, George C., and Thomas R. Willemain. “Batch-Means Control Charts for Autocorrelated Data.” IIE Transactions 28, no. 6 (1996): 483–87. https://doi.org/10.1080/07408179608966295.

[4] Hunter, J. Stuart. “The Exponentially Weighted Moving Average.” Journal of Quality Technology 18, no. 4 (1986): 203–10. https://doi.org/10.1080/00224065.1986.11979014.

Version History

Introduced in R2026a