Choosing an algorithm by what the data doesn't have

The obvious approach to fault detection is a supervised classifier. Label the faults, train on them, predict the next one.

Fleet data doesn't arrive that way. Readings stream in continuously and nobody labels them, and a fault gets recorded, if it gets recorded at all, in a maintenance note written once the vehicle is already in the workshop. There was nothing to train on.

So the problem became unsupervised: learn what normal looks like across a 10-dimensional feature space, and flag what departs from it. I ran Isolation Forest and Local Outlier Factor together rather than picking one, because they fail differently. Isolation Forest catches globally rare readings; LOF catches readings that are only unusual relative to their local neighbourhood.

The cost of that choice is real. With no labels there's no precision or recall to quote, and the alert threshold is a judgement call I tuned by inspection. I can tell you the system flags things. I can't yet tell you how often it's right.