## 1 Introduction  
With the rapid development of high-tech, modern machinery and equipment are becoming more complex in structure and abundant in functions. The operating status of key components is directly related to the performance of machinery and equipment, so the failure in the timely detection of abnormalities of components may cause the malfunction of the entire system [1]. To ensure long-term efficient operation, online monitoring of the entire equipment is usually replaced by monitoring key components, which benefits normal equipment operation under full load and helps improving production efficiency. Therefore, monitoring and evaluation of key equipment components is of great importance for maintaining safe operation and reducing asset losses [2]. At present, fault diagnosis is the most commonly used method for health management of mechanical equipment. As the \"afterwards maintenance technique,\" fault diagnosis needs to conduct classified diagnosis on the fault type and position after the equipment breaks down [3, 4]. This post-examination technique requires disassembling the equipment to verify the fault location and damage degree. On the one hand, the components in equipment during the disassembly will be manually damaged; on the other hand, the disassembly and verification process will also increase enterprise time and maintenance costs [5]. Many researchers have studied in the field of fault diagnosis [6, 7, 8, 9, 10, 11, 12, 13, 14, 15], and published the research results in detail from qualitative and quantitative perspectives. However, a few researchers have studied the fault early warning problem for mechanical equipment. Fault early warning is a kind of detection technology involving prediction in advance, which needs to identify the possible symptom of equipment in the next stage according to the historical operation rule of the equipment and data change. Fault early warning can help operators in the field determine early signs of equipment failure and implement corresponding measures to prevent further failure [16, 17]. The existing warning methods mainly adopt the method based on a fixed threshold. Generally, a benchmark value is set according to the normal state of equipment or its factory index. The equipment is periodically monitored to determine whether it will fail or not, according to whether the observed value exceeds the benchmark value. Through field investigation, it is found that the false alarm and missing alarm rates of this method are directly related to the setting of the alarm threshold to a great extent, and there are notable shortcomings in practical applications:  
1. Threshold value is fixed and independent of the actual running state. The fixed threshold value of the existing method mainly depends on the factory index of the equipment or the experience of professionals in the enterprise and does not depend on the current actual operating conditions or changes in the field environment of the equipment. A reasonable alarm threshold should consider these changes and apply dynamic adjustments. 2. State demarcation is not clear. After the equipment monitoring value exceeds the fixed threshold, this can only indicate that the current equipment may be operating abnormally, but it cannot explain the current state of the equipment or the level of failure from the perspective of physical meaning, which inhibits field operators from performing more detailed repair operations. In practical applications, in addition to identifying equipment abnormalities, the current state of the device should be determined, rather than simply the dichotomy [18] (normal or fault). 3. Unreasonable division standard. At the factory site, different types, different working loads, and the historical application of equipment will affect the equipment itself. It is clearly unreasonable to set the same threshold based on approximate standards or experience without considering the equipment status. From the perspective of fault warning, many researchers have performed relevant research.