Chapter 17 — Contained laboratory II
Lesson map
Lesson 17 published. Map, example, EX065.
flowchart TD
N0["Learning outcomes"]
N1["17.1 Why baselines help"]
N2["Lab — Transfer rate against a baseline"]
N3["17.2 Reading the result"]
N4["17.3 Improving the alert"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX065"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["17.1 Why baselines help"]
N2["Lab — Transfer rate against a baseline"]
N3["17.2 Reading the result"]
N4["17.3 Improving the alert"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX065"]
[Learning outcomes]
|
v
[17.1 Why baselines help]
|
v
[Lab — Transfer rate against a baseline]
|
v
[17.2 Reading the result]
|
v
[17.3 Improving the alert]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX065]
Learning outcomes
You will (1) build a transfer-rate baseline; (2) flag unusual hours; (3) investigate an alert calmly.
17.1 Why baselines help
Many problems show up as unusual activity: a stuck service retrying transfers, a mistaken batch or misuse of an account. To recognise unusual activity, Aiko first measures normal activity. She takes ten hours of synthetic transfer counts from a normal week as a baseline, computes the mean and standard deviation, and sets an alert limit at the mean plus three standard deviations. Then she checks a new day's hourly counts against the limit. The lab is read-only and uses only Python's standard library and synthetic data.
Lab — Transfer rate against a baseline
"""Flag hours whose transfer count is far above a baseline (synthetic, read-only)."""
import statistics
BASELINE = [12, 15, 11, 14, 13, 16, 12, 14, 15, 13] # transfers per hour, normal week sample
TODAY = {9: 14, 10: 17, 11: 13, 12: 41, 13: 15, 14: 12}
def main():
mean = statistics.mean(BASELINE)
sd = statistics.stdev(BASELINE)
limit = mean + 3 * sd
print(f"baseline mean {mean:.1f}; sd {sd:.2f}; limit {limit:.1f}")
for hour, n in TODAY.items():
if n > limit:
print(f"hour {hour}: {n} transfers above limit")
if __name__ == "__main__":
main()
Run with python3 lab_rate.py. Verified output:
baseline mean 13.5; sd 1.58; limit 18.2
hour 12: 41 transfers above limit
17.2 Reading the result
The baseline mean is 13.5 transfers per hour with a standard deviation of 1.58, giving a limit of 18.2. Hours 9, 10, 11, 13 and 14 are within normal range, but hour 12 shows 41 transfers, far above the limit. Aiko does not assume misuse. She checks the deposit service logs and finds that at noon a community repair event returned 27 tools at once, each releasing a deposit. The spike is real but legitimate. She records the alert, the explanation and the evidence in the monitoring log. Writing the explanation down lets the next technician recognise a similar event quickly instead of escalating it from scratch.
17.3 Improving the alert
Aiko notes that simple statistical limits cannot know about planned events. She adds a calendar of community events to the monitoring notes, so duty technicians can check it first, and suggests that the library tells technicians in advance about large return days. She keeps the limit unchanged, because it caught a genuine spike and would catch an unplanned one too. Mr Kowal praises her for investigating before acting and for improving context rather than weakening the alert to avoid one explained false alarm.
Worked example
The rate lab sets a limit of 18.2 from a 13.5 mean and flags 41 transfers at hour 12, explained by a repair event returning 27 tools.
Synthetic case. The counts and event are synthetic.
Errors and limits
Raising an alert limit to silence one explained spike weakens detection of unplanned ones.
Exercises
- EX065 — Baseline values. What are the baseline mean and limit? Rubric: 3 = mean 13.5, limit 18.2;; 2 = 13.5/18.2;; 1 = 41;; 0 = none.
- EX066 — Flagged hour. Which hour is flagged and with how many transfers? Rubric: 3 = hour 12 with 41;; 2 = hour 12;; 1 = hour 9;; 0 = none.
- EX067 — Spike explanation. What explained the spike? Rubric: 3 = a repair event returning 27 tools;; 2 = repair event;; 1 = misuse;; 0 = none.
- EX068 — Alert improvement. How is the alert improved? Rubric: 3 = adding an events calendar for context;; 2 = context;; 1 = raising the limit;; 0 = none.
Synthesis
Baselines detect unusual activity, and context explains it without weakening alerts.
Continue studying — chapter 17 of 18
← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →