Some of the most valuable facts in a plant are not events at all. They are relationships between events: the stop that follows the same visual precursor every time, the two cameras that both have to show trouble before the yard actually gridlocks, the condition that only matters when it persists past ten minutes. No single detection can state any of these, because each lives across cameras, across minutes, or across systems, and the live pipeline that excels at firing on this frame is structurally the wrong tool for a fact whose evidence has not finished arriving. This article is about the correlation layer, rules evaluated over recorded events rather than inside the inference loop, which is how those relationships become expressible, alertable, and eventually preventable. It closes the integration thread of this series, following the downtime and plant-systems articles, under our pillar guide to AI-powered video analytics for manufacturing.
Why correlation runs on recorded events
The real-time alerts this series has described come out of the live pipeline one detection at a time, and their virtue is immediacy: the zone entry pages as it is tracked. The correlation layer works the other way on purpose. Events are written to persistent storage first, and user-defined queries evaluate against what is recorded, raising a notification on match. The delay is the point, not a limitation to apologize for, because a condition that depends on two cameras agreeing, or on a situation persisting, cannot be decided from a single frame no matter how fast the inference runs. The evidence has to accumulate before the question can be answered, and the correlation layer is the mechanism that keeps asking as it does.
Three shapes of condition cover most of what plants want to express. Cross-attribute matches join properties of different detections: a specific vehicle seen together with a specific condition, the contractor truck's plate read at the gate paired with work in a zone whose permit expired. Multi-camera correlation requires agreement: cameras A, B, and C each showing a defined situation before the compound event exists, which is how the yard-gridlock pattern, trucks queuing at the gate and the staging area full and the dock aisle blocked, becomes one alert instead of three ignorable ones. And time-window persistence requires duration: the situation holding continuously for a defined period, which separates the transient buffer spike from the sustained accumulation that predicts the stop, and the briefly stationary crew from the line that has quietly ceased to move. Matches notify by email or by webhook, which means a correlated finding enters the same routing, triage, and system-of-record paths as every other event in this series.
Reconstructing a stop as a sequence of events
Apply the shapes to the article's title case and the value becomes concrete. A line stop, as the downtime article establishes, is usually the end of a sequence, and the sequence is exactly what correlation rules can watch for. The persistence shape catches the precursor: product accumulating at the wrapper buffer continuously for four minutes is a rule, and its match arrives while the stop is still avoidable, which converts the downtime article's post-hoc diagnosis into a standing early warning. The multi-camera shape catches the compound signature: the erector camera showing deformed cartons and the transfer camera showing dwell is a different, more specific fact than either alone, and it is precisely the pattern the weekly downtime review keeps rediscovering by hand. The cross-attribute shape joins the video record to the rest of the plant's systems: a stop event paired with a particular material lot's arrival, read from the dock camera's text recognition, expresses the stops-follow-that-supplier hypothesis as a rule rather than a suspicion, and every match thereafter is evidence filed automatically.
This is also where the plant's machine data joins the picture on equal terms. Because correlation evaluates over recorded events, and because the integration layer of the previous article carries events in both directions, the population being correlated is not limited to what cameras saw: the fault code from the historian, the works-order change from the Manufacturing Execution System (MES), arriving as events, sit in the same store with the same timestamps, and a rule can span the boundary, the visual precursor and the fault code within the same window, which is the joined record the downtime article promised, expressed as standing logic rather than one-off investigation.
Writing rules that hold up
Correlation rules concentrate the tuning wisdom of this series into its sharpest form, because a compound rule multiplies the assumptions of its parts, and a few disciplines keep the layer honest.
Rules earn their existence from patterns the record has already demonstrated, never from imagination in a meeting. The productive path runs through the reviews this series has built: the downtime review that keeps seeing the same two-event sequence, the near-miss map that shows the same three-condition cluster, the anomaly register whose recurring finding has stabilized into a pattern. A rule is the industrialization of a pattern the record has already demonstrated, per the lifecycle the anomaly article describes, and a rule proposed without a demonstrated pattern is a hypothesis that should run silent until the record votes.
Windows and thresholds inherit the same baseline discipline every other layer of this stack runs on. The four minutes in the persistence rule, the agreement window in the multi-camera rule, come from the measured distributions of the silent period, not from a meeting's intuition, and they get revisited on the quarterly retuning pass with everything else, because the plant the rule describes keeps changing. And every correlated alert carries its evidence: the match notification links the constituent events and their clips, so the recipient adjudicates a documented relationship rather than trusting a black box's assertion, and the disposition feeds back into the rule's own health metrics exactly as the escalation-chain article prescribes for every tier.
The governance note lands here as everywhere: correlation can join detections about people as easily as detections about product, and the cross-attribute shape in particular, plates paired with persons paired with places, is capable of assembling profiles no safety or operations purpose requires. The question register and scope agreements that govern the open-question layer govern rule authorship identically, the worker-privacy commitments bind compound facts as they bind simple ones, and the rule inventory belongs in the same reviewed document as the rest of the program's watching.
How correlation and the escalation chain differ
It helps to place this layer inside the architecture the escalation-chain article draws, because the two are easily confused and deliberately different. The chain's middle tier answers a question about one moment: this flagged clip, examined closely, is or is not worth a person. The correlation layer answers a question about the record: these events, in this arrangement, across these cameras and minutes, constitute a compound fact. One is depth on a single event; the other is breadth across many, and mature deployments run both, with correlation matches feeding the chain like any other event, escalated for a closer look when ambiguous, assembled into briefings when confirmed. The practical division for a rule author: if the condition can be judged from one clip, it belongs to the chain's question register; if it only exists across events, it belongs here, and a condition that seems to need both usually decomposes into a correlation rule whose match then earns the model's second look.
Clock synchronization comes first
Everything this article describes assumes the events being joined agree about time, and that assumption deserves one paragraph of engineering respect. Camera streams, detection processing, historian entries, and MES events each carry their own clocks, and a correlation window of minutes forgives small drift while a cross-attribute join at seconds does not. The deployment checklist therefore includes the unglamorous items: time synchronization across cameras and servers, timestamps preserved rather than rewritten as events cross the integration seams, and the correlation layer's windows chosen with the site's real clock discipline in mind. Sites with tight Network Time Protocol (NTP) hygiene can write tight rules; sites without it should write generous windows and fix the hygiene, in that order, because a rule that joins misaligned clocks produces confident nonsense, which is the only output worse than silence.
The rule inventory becomes plant knowledge
Run this layer for a few quarters and something larger than its alerts emerges. The rule inventory becomes an explicit catalog of the plant's known causal relationships, the sequences that precede stops, the conditions that compound into gridlock, the pairings that predict quality escapes, each rule carrying its match history as an evidence file. New engineers read it the way the anomaly article's question register gets read, as codified operational knowledge, and the improvement program mines it, because a rule that matches often is a process defect wearing a monitoring badge, and the correct trajectory for the best rules is retirement: the barrier installed, the buffer resized, the supplier conversation had, and the rule's match rate falling to zero as the verification chart the investigation article prescribes. A correlation layer whose oldest rules keep firing is a plant collecting evidence instead of acting on it, which by this point in the series is a familiar warning with a familiar remedy: resource the response side to match the measurement side.
Ownership completes the authorship discipline: every rule carries a named owner, the person whose review its matches feed, because an orphaned rule is an alert nobody adjudicates and a window nobody retunes. The rule inventory's quarterly review walks owners as well as thresholds, reassigning what turnover orphaned, and a rule that cannot find an owner willing to read its matches has answered the retirement question by itself.
Rule testing has a gift the live layer lacks: history. Because correlation evaluates over stored events, a candidate rule can be run against the past before it ever runs against the present, and the backtest, how often would this have matched last quarter, and against what outcomes, is the cheapest validation in this entire series. A rule that backtests clean earns its silent month; a rule that would have fired nightly gets rewritten before it wastes anyone's attention, and the discipline of demanding the backtest turns rule authorship from speculation into analysis.
A note on scale expectations keeps the design grounded: the correlation layer's value concentrates in a small rule set, and that is a feature. A plant's operational physics contains a modest number of genuinely predictive relationships, and the mature deployments run dozens of rules, not thousands, each traceable to a demonstrated pattern and an owner. Rule count is therefore not a maturity metric, and a review that finds the inventory growing faster than the retirement list should read it the way the alert-fatigue article reads a growing dashboard: as scope drift, to be pruned back to the rules whose matches change what someone does next.
How VIDIZMO fits
In VIDIZMO's platform, the correlation layer evaluates user-defined queries over the persistent event store that AI Live Insight and the integration paths populate, with the three condition shapes, cross-attribute, multi-camera, and time-window persistence, expressible per rule and matches notifying by email or webhook into the same routing fabric as every other alert. Constituent events keep their clips in the Nexus portal under the access and audit discipline this series specifies, so a correlated finding is reviewable down to its frames, and the event-driven workflows of AI Intelligence Hub can subscribe to matches like any other event, which is how a correlated precursor becomes an assembled briefing by the time a person reads it.
And because matches notify by webhook as well as email, the first rule's output can flow straight into the downtime review's existing channel, which is the quiet trick for adoption: the new capability arrives inside a meeting the plant already holds, as a better agenda item rather than another system to check.
The first rule writes itself at most plants: take the sequence the last significant stop investigation uncovered, express it as a persistence or multi-camera condition, and let it run silent for a month against live traffic. Either it matches, and the plant has its early warning with evidence attached, or it stays quiet, and the investigation's conclusion earns a useful asterisk. Both outcomes are worth more than the meeting that would otherwise have argued about it.