The problem with thresholds alone
A threshold is a single comparison: is this value past this limit? It is cheap, unambiguous, auditable, and it is the right foundation for a safety alarm. It is also, by construction, late. The alarm fires when the dangerous condition already exists, which means every threshold-only system is a system that tells you about a hazard you now have.
For a fast event - a flame, an explosion - late is unavoidable and the threshold is doing the only job available. For a developing one - a leak opening, a bearing degrading, a motor heating - the entire useful window sits before the crossing, and a threshold discards it.
Time to threshold
The mechanism is not exotic, which is a point in its favour. Take a window of recent readings for a channel. Fit a line through them by least squares. The slope is the rate of change. If the slope is positive and the threshold is above the current value, the time until the projection meets the threshold is an estimate of how long you have.
That estimate carries a strong assumption - that the trend continues as it is - and it is wrong whenever the assumption is. A leak that opens further will arrive sooner than predicted; one that gets plugged never arrives at all. This is not a flaw to be engineered away. It is what the number means, and a system that presents it as a countdown rather than a projection is misrepresenting it.
Used properly it changes the question an operator is asked from 'is there a hazard' to 'is this heading somewhere bad, and how fast', which is a question that can be acted on while acting is still cheap.
Baseline deviation and z-scores
The second half of prediction is not about direction but about normality. Every space has its own character: a solvent-handling area has a higher ambient VOC reading than a packing line, and neither figure means anything without knowing which room you are in.
So the system captures a baseline per device and expresses current readings as deviation from it, in units of that channel's own variability - a z-score. A reading two standard deviations above a node's own norm is notable regardless of whether it is anywhere near an absolute limit.
This catches the case a threshold cannot see at all: the abnormal-but-legal reading. Nothing has crossed a line, and something has changed.
Movement as a signature
Extended further, the shape of a change becomes identifying in its own right. Alfa HazardX computes a twelve-dimensional behaviour signature from a window of readings, built from velocities and accelerations rather than raw values - how fast each channel is moving, whether that movement is itself accelerating, how long the episode has run.
Because the features are movement rather than level, a signature is portable across sites with different baselines. A rise of a given steepness is the same rise in a paint shop and a machine shop, which is what makes a library of hazard signatures worth building at all.
Where prediction does not help
Four cases, stated plainly, because a predictive system that oversells itself is worse than a threshold that does not.
Fast events. A flame appears faster than any trend can be fitted. Threshold detection is the only mechanism that helps, and prediction contributes nothing.
Genuinely discontinuous changes. A rupture is not a trend; it is a step. Nothing in the prior readings forecasts it, and claiming otherwise after the fact is hindsight rather than prediction.
Insufficient history. A node that has just booted has no window to fit. Prediction has a warm-up period, and during it the system is threshold-only.
A wrong baseline. If a node learns its baseline in an already-contaminated room, it treats contamination as normal, and every deviation measured against that baseline is measured against the wrong zero.
Why the prediction stays deterministic
All of the above is arithmetic - regression, standard deviations, distance between vectors. It runs on stored readings, produces the same answer twice for the same input, and can be checked afterwards by anyone with the data.
That is a deliberate choice over a learned model. Not because models are inferior at forecasting, but because a safety prediction that cannot be explained after an incident is a liability at exactly the moment it matters most. In Alfa HazardX the deterministic layer holds authority, and the generative model is used only to explain its conclusions in language - never to reach them.
