Regardless of the application of this, the algorithm you describe later (and only now the question makes some sense), it seems that on the computation of the shift average it is assigned a larger weight to the failure than to the normal operation, so that after the occurrence of few events of fails the threshold to trigger the alarm is reached, whereas to pass the test, it is necessary to have a much greater number of successful events to cancel the effect of the failures.