What do k and h mean in a CUSUM chart?

k is the reference value, the per-point drift the chart deliberately ignores — deviations must exceed k standard deviations on average to accumulate. h is the decision interval: the accumulated sum, in z-units, at which the chart fires. Small k catches subtle drifts but re-arms slowly; large h trades detection speed for fewer false warnings.

Is CUSUM's average run length (ARL) a guarantee?

No — an ARL is a model-based calibration, not a guarantee: it is the average time to a false alarm computed under an assumed model, usually independent Gaussian observations. When real data is autocorrelated or heavy-tailed, the actual false-warning rate can be orders of magnitude above nominal, which is why ValidAnytime runs CUSUM as an unbudgeted warning and reserves paging for the anytime-valid e-process tier.

CUSUM vs EWMA — which should I use?

They are close cousins: CUSUM accumulates deviations linearly and is typically a touch faster on moderate-to-large sustained shifts, while EWMA exponentially discounts old data and is often preferred for very small shifts and for its single smoothing knob. ValidAnytime's warning tier runs both, because the honest answer is that neither one's calibration survives realistic data — the tiering matters more than the choice.

Why does ValidAnytime treat CUSUM as a warning, not a page?

Because a page should come with a stated false-alarm budget, and CUSUM cannot honestly offer one on real data: its calibration is tied to an iid-Gaussian model. So CUSUM warns — early and sensitively — and the e-process page tier, whose false-alarm control is anytime-valid by theorem, decides what pages you.

All detectors

CUSUM

CUSUM (the cumulative sum control chart) detects a change by adding up small deviations from a baseline until their running sum crosses a decision threshold — which makes it one of the fastest classical detectors for a persistent shift in a metric's mean. A single noisy point barely moves it; a sustained drift, even a subtle one, accumulates relentlessly until the statistic fires.

WARN

Also known as: cumulative sum control chart

In ValidAnytime, CUSUM runs in the warning tier: it is sensitive and early, and its false-warning calibration is model-based — computed for independent Gaussian data — so it warns without a false-alarm budget. The budgeted page comes from the e-process tier.

The rule, exactly

z_t = (x_t − μ̂) / σ̂        μ̂, σ̂ frozen after the first 30 points
S⁺_t = max(0, S⁺_{t−1} + z_t − k)
S⁻_t = max(0, S⁻_{t−1} − z_t − k)
warn when S⁺_t > h or S⁻_t > h, then reset that side to 0

k is the reference drift (deviations smaller than k·σ per point are ignored); h is the decision threshold in z-units. The cloud suite runs k = 0.5 with h ≈ 5.75, the value Siegmund's approximation gives for a nominal in-control average run length of 2,000 points on iid Gaussian z.

Live playground — synthetic data, labeled as such; runs entirely in your browser

break size3σ

reference value k0.50decision threshold h5.75

0 warnings on the 80 calm points · catches the break 2 points after onset.

Synthetic standard-normal noise (seeded, 160 uncadenced points — points, not minutes), with a labeled break at point 81 when one is enabled. The detector code running here is the same TypeScript implementation the /try bake-off runs, parity-tested against the cloud suite.

WARN

What is — and is not — guaranteed

Its calibration is a model-based promise: under independent, Gaussian, correctly-standardized data, the threshold is tuned so false warnings arrive on average once per 2,000 in-control points.

That promise is not anytime-valid and not distribution-free: on autocorrelated or heavy-tailed data — which is what production metrics look like — the false-warning rate can exceed the nominal rate by orders of magnitude, a gap we measure openly in our benchmark.

Warning tier: classical control charts — sensitive and fast, but calibrated against a model rather than a guarantee, so warnings arrive unbudgeted. See how it scores in the benchmark.

When it wins

A real shift is persistent: CUSUM accumulates evidence point after point, so it is typically the fastest classical chart to catch a sustained mean change — including pure steps.
In the textbook setting (iid, known baseline, shift size near 2k·σ), classical theory says a CUSUM of this form is essentially the quickest detector you can build.
You need something cheap and interpretable: two accumulators, one threshold, and a statistic you can read directly in z-units.

When it lies

The data is autocorrelated or heavy-tailed: the ARL calibration silently collapses, and warnings arrive far more often than the textbook rate — with no warning that the calibration itself has failed.
An incident persists: CUSUM resets after each fire and immediately re-accumulates, so one unresolved regression produces a stream of repeat warnings — the classic alert-fatigue generator.
The baseline goes stale: μ̂ and σ̂ are frozen after training, so a legitimate level change keeps it firing forever until someone re-trains it.

Where it comes from

CUSUM was introduced by E. S. Page in 1954 in Biometrika (“Continuous inspection schemes”) and became a cornerstone of statistical process control. The version here is the standard two-sided, self-standardizing form practitioners run on residuals — the warning-tier chart the ValidAnytime cloud suite ships; the playground runs a line-for-line TypeScript port of it, golden-tested against the cloud implementation's own outputs.

Questions engineers ask

Related detectors

In the glossary: Changepoint detection · The peeking problem · Anytime-valid inference

Run it on your own history — free, in your browser.

The /try bake-off replays your metric history through this detector and the rest of the suite side by side — false alarms and catch lag, honestly graded, nothing uploaded.

Backtest your history Start free