What is Machine Learning?
Machine Learning (ML) is a branch of artificial intelligence (AI) in which a computer learns a model from example data that makes predictions, classifies information or detects anomalies, without a programmer writing out every rule and scenario in advance. The term was coined in 1959 by IBM researcher Arthur Samuel, who built a checkers program that played better the more games it had played. In industrial environments, Machine Learning is the foundation of Predictive Maintenance, visual inspection, anomaly detection and process optimisation.
An ML model discovers patterns in historical data and applies that knowledge to new data. The result is always a probability, never a certainty.
🧠 How does Machine Learning work?
A widely used definition comes from Tom Mitchell (1997): a program learns from experience E with respect to a task T if its performance P on that task improves with more experience. In practice, this means an algorithm adjusts the parameters of a model until the error on example data is as small as possible.
An ML application has two clearly separated phases:
- Training - the algorithm learns relationships from historical data, for example from a historian or time series database. This takes a lot of computing power and usually happens in a data centre or the cloud.
- Inference - the trained model is applied to live data and produces an outcome such as “bearing failure within three weeks” or “reject product”. This can run locally on an edge device or IPC, close to the machine.
A common misconception: a deployed model does not keep learning by itself. It stays the same until someone retrains it. When the process changes, for example through a new raw material or a replaced pump, its predictions gradually get worse. This is called data drift (the input changes) or concept drift (the relationship between input and outcome changes).
🔍 What types of Machine Learning are there?
| Type | How it learns | Industrial examples |
|---|---|---|
| Supervised learning | From labelled data: both the input and the correct outcome are known | Quality classification (pass/reject), predicting the remaining useful life of a pump, forecasting energy consumption |
| Unsupervised learning | Without labels; finds structure or clusters by itself | Clustering operating states, finding anomalies in sensor data or network traffic |
| Semi-supervised learning | A little labelled and a lot of unlabelled data | Defect recognition when only a few images of faults are available |
| Reinforcement learning | Through rewards and penalties for actions in an environment | Learning robot movements, testing strategies in a simulation or digital twin |
Supervised learning is the most common type in factories, because the question is usually concrete: is this product good or bad, and how many days will this bearing last? Unsupervised learning is valuable when failures are rare and there are hardly any examples of “bad”. In OT, reinforcement learning is mostly used offline, in a simulation, and rarely directly on a running plant.
🧱 Which algorithms are used most?
| Algorithm | Type | Typical OT application |
|---|---|---|
| Linear and logistic regression | Supervised | Soft sensor that estimates a lab value from process variables |
| Decision trees and random forests | Supervised | Classifying downtime causes, explainable predictions |
| Gradient boosting | Supervised | Predicting quality or energy use from tabular data |
| Support Vector Machines (SVM) | Supervised | Classification with small datasets |
| K-means clustering | Unsupervised | Grouping the operating states of a machine |
| Isolation forest | Unsupervised | Flagging abnormal measurements or network traffic |
| Neural networks | Both | Image and sound recognition through Deep Learning |
For tabular and time series data from sensors, classic algorithms such as random forests and gradient boosting often perform as well as neural networks, with less data and better explainability. Deep learning pays off mainly with camera images (Vision), sound and vibration spectra.
🏭 Where is Machine Learning used in industry and IT?
- Predictive Maintenance - predicting failures from vibration, temperature and current draw, as the next step after condition monitoring
- Visual inspection - recognising scratches, stains or wrong labels with cameras and Vision AI
- Process optimisation - advice on setpoints for lower energy use or higher yield, alongside classic control such as MPC
- OEE analysis - finding patterns in micro-stops and downtime reasons
- Cyber anomaly detection - flagging abnormal traffic from a PLC or SCADA system, linked to a SIEM as part of Cybersecurity
- Text analysis - automatically classifying fault reports, log files or maintenance tickets
- Demand forecasting - aligning production planning and inventory with expected demand
For the wider context of these applications in factories and process plants, see Industrial AI.
🔧 How do you set up an ML project in OT step by step?
Many teams follow a variant of CRISP-DM, a process model from 1996 that was later developed in a European ESPRIT project. It has six phases: business understanding, data understanding, data preparation, modelling, evaluation and deployment. Translated to a plant:
- Define a measurable question - for example “warn two weeks before pump P-101 fails”, not “do something with AI”.
- Collect and understand the data - pull time series from the historian or through a Unified Namespace; check sample rates, units and timestamps.
- Clean the data - remove sensor faults, fill gaps and label failures with help from maintenance technicians. This often takes most of the project time; Industrial DataOps helps to organise it structurally.
- Train and validate - split the data, for example 70/15/15 or 80/20 for training and testing. With time series, split chronologically, otherwise the model “looks into the future” and seems better than it is.
- Review with process experts - a model that is 95% accurate but misses every rare failure is useless. Look at missed detections and false alarms.
- Deploy the model - usually in an advisory role through edge computing or at level 3 of the Purdue Model, never inside the safety function. The PLC and the safety system stay in control.
- Monitor and retrain - watch for drift and plan retraining after process changes, maintenance or seasonal effects.
🔐 What risks and rules apply to Machine Learning?
- Data quality - a model is never better than its training data; wrong timestamps or manipulated measurements directly affect data integrity.
- Explainability - neural networks in particular are a “black box”. Operators must be able to understand a recommendation and overrule it.
- Attacks on ML - NIST describes in NIST AI 100-2 E2025 (March 2025) attacks such as evasion (manipulating input so the model makes a mistake), poisoning (contaminating training data) and privacy attacks. MITRE ATLAS catalogues such techniques along the lines of ATT&CK.
- No safety function - an ML model is statistical rather than deterministic, so it does not simply fit within functional safety.
- Regulation - the AI Act (Regulation (EU) 2024/1689) has been in force since 1 August 2024. AI literacy has been mandatory since 2 February 2025. ML used as a safety component in critical infrastructure or in a machine can count as high-risk. Following the digital omnibus, those obligations apply from 2 December 2027 for critical infrastructure (Annex III) and from 2 August 2028 for products such as machinery (Annex I).
| Standard or framework | Year | What it covers |
|---|---|---|
| ISO/IEC 22989 | 2022 | Concepts and terminology for AI and ML |
| ISO/IEC 23053 | 2022 | Framework for AI systems using machine learning |
| ISO/IEC 23894 | 2023 | Risk management for AI |
| ISO/IEC 42001 | 2023 | Management system for AI, comparable to ISO 27001 |
| NIST AI RMF 1.0 | January 2023 | Four functions: Govern, Map, Measure, Manage |
✅ What are the benefits and limitations?
| Benefits | Limitations |
|---|---|
| Recognises patterns across thousands of signals at once | Requires sufficient, representative and labelled data |
| Early warning before failures or quality deviations | Degrades with drift and must be retrained |
| Automates repetitive inspection and analysis tasks | The outcome is a probability, not a guarantee |
| Improves with new data, provided you retrain | Explainability and operator acceptance are difficult |
❓ Frequently asked questions
What is the difference between AI, Machine Learning and Deep Learning?
AI is the umbrella term for systems that infer from their input how to generate predictions or decisions. Machine Learning is the branch in which models learn this from example data. Deep Learning is a form of Machine Learning that uses multi-layer neural networks and is particularly strong with images and sound.
Does a Machine Learning model keep learning while in use?
A Machine Learning model in production usually does not learn by itself; it stays the same until it is retrained. When the process changes, its performance gradually declines through data drift or concept drift. That is why monitoring and scheduled retraining belong in every ML application.
How much data does Machine Learning need?
How much data Machine Learning needs depends on the algorithm and the question. Classic algorithms often work with a few months of process data, while deep learning for image recognition requires hundreds to thousands of labelled images per defect class. More important than volume is that the data covers all relevant operating states and failures.
Can Machine Learning control a machine or plant?
In OT, Machine Learning is almost always used in an advisory role, while the PLC or DCS keeps actual control. An ML model behaves statistically, which makes it hard to validate for safety functions. If ML does form a safety component, it may fall under the high-risk requirements of the AI Act.
Where does a Machine Learning model run in a factory?
A Machine Learning model is usually trained centrally in a data centre or the cloud and then deployed for inference on an edge device or industrial PC close to the machine. This keeps response times short and means process data does not have to leave the plant continuously. Preferably run that connection through a separate network zone in line with IEC 62443.
How can an attacker fool a Machine Learning model?
An attacker can fool a Machine Learning model by contaminating its training data (poisoning) or by subtly manipulating its input so that it produces a wrong outcome (evasion). NIST describes these attacks in NIST AI 100-2 E2025. Protect data pipelines, model files and access to training environments as carefully as any other OT system.
📌 In summary
Machine Learning lets systems learn patterns from data and apply them to new situations, for predictive maintenance, visual inspection, anomaly detection and process optimisation. In OT, ML mostly works in an advisory role alongside the control system; success depends on good data, review with process experts, monitoring for drift and securing the model, within the framework of the AI Act and standards such as ISO/IEC 23053. It connects the worlds of IT and Cybersecurity with the plant floor.