A Field-Feasible Early Warning Framework for Excavation Threat Detection near Underground Petrochemical Pipelines Using Vibration Spectrograms

Abstract

Underground petrochemical pipelines face severe risks from unreported third-party damage during excavation. Existing monitoring systems based on supervised deep learning or distributed acoustic sensing often require expensive hardware and large volumes of labeled defect data, and they exhibit high false-alarm rates in noisy urban environments. To overcome these limitations, this study proposes a cost-effective, field-feasible early warning framework utilizing attached acceleration sensors. High-frequency transient vibrations from physical impacts are demodulated into low-frequency rhythms using a Hilbert transform-based envelope algorithm, and these rhythms are then converted into 2D spectrograms via the Short-Time Fourier Transform. A 2D Convolutional Neural Network-Variational Autoencoder (2D CNN-VAE) is employed for unsupervised anomaly detection, trained specifically on normal background data. Furthermore, a hierarchical alarm classification logic is implemented to evaluate the reconstruction error, incorporating impulse noise rejection and temporal continuity checks. In a field demonstration, the proposed framework effectively suppressed false alarms caused by severe continuous noise, such as ground compacting, while reliably detecting sustained asphalt-breaking threats. This methodology demonstrates practical feasibility for isolating genuine excavation activities from transient environmental noise, offering a promising predictive maintenance approach that reduces alarm fatigue without requiring labeled defect data.

1. Introduction

The underground pipeline network within petrochemical complexes serves as a vital arterial system, facilitating the rapid and continuous transport of essential raw materials between various industrial processes [1,2]. These pipelines allow limited surface space to be used efficiently while ensuring an uninterrupted supply of resources, which is critical for the coordinated operation of the entire complex. However, failure to promptly detect pipeline anomalies can lead to severe leakage accidents, resulting in cascading domino effects, significant economic losses, and severe threats to public safety [3,4,5]. As the physical backbone of the petrochemical industry’s productivity and safety, this network represents a national infrastructure that demands rigorous and systematic management.

Over decades of development, these pipeline networks have become extremely dense and complex. This high-density environment necessitates frequent excavation activities for additional installations and routine maintenance. In this context, external impact accidents—often referred to as third-party damage (TPD)—account for a significant portion of all pipeline failures [6,7]. A particularly critical issue is that more than half of these excavation works are conducted unofficially, bypassing legal reporting procedures. Such unauthorized excavations create serious information gaps in safety management systems, posing a substantial risk to the overall stability of industrial complexes.

The fundamental limitation of existing anomaly detection studies stems from a deep misalignment with operational realities. In the broader context of structural health monitoring (SHM), recent approaches have increasingly utilized distributed sensing and fiber-optic modalities to convert sensing signals into comprehensive condition-assessment decisions [8]. While these distributed alternatives provide extensive spatial coverage, they often require expensive hardware and complex deployment. Conversely, most studies on localized monitoring focus primarily on increasing the complexity of deep learning architectures, treating the monitoring task as a generic data-classification problem [9,10,11]. This model-centric approach overlooks two critical field challenges: the intricate physical acoustic signatures of excavation activities buried in harsh environments, and the necessity of a structured decision-making workflow for actual site supervisors. Industrial complexes are constantly exposed to intense, non-malicious ambient noise—such as passing heavy freight trucks and ground compacting—that carries substantial kinetic energy. Without an intimate understanding of excavation physics and a robust post-inference decision framework, even the most sophisticated AI models suffer from erratic frame-level threshold breaches. This results in severe ‘alarm fatigue’, substantially eroding operator trust and rendering the system practically ineffective for field deployment.

To overcome these operational bottlenecks, this study proposes a cost-effective, field-feasible early warning framework that shifts the paradigm from model-centric optimization to domain-specific signal preprocessing and advanced hierarchical alarm logic. The core of our system is built upon two distinct operational pillars. First, based on a rigorous physical analysis of third-party damage (TPD), we exploit the fact that while an excavator’s mechanical movement occurs at low frequencies, the physical fracturing of pavement emits wideband high-frequency transient shocks. We implement a full-signal Hilbert transform-based envelope preprocessing technique to explicitly demodulate these fracture impulses into prominent low-frequency mechanical strike rhythms, which are then mapped into 2D spectrograms via Short-Time Fourier Transform (STFT). Second, to bridge the gap between abstract statistical anomaly scores and actionable field intelligence, we develop an advanced, domain-informed hierarchical alarm classification logic. This post-processing architecture strictly filters out high-energy transient spikes and verifies multi-window temporal continuity, converting raw reconstruction errors into reliable, graded warning levels that field supervisors can intuitively understand and act upon. An unsupervised 2D CNN-VAE is integrated as an internal decoding mechanism to link these two core components by reconstructing the complex spatial–temporal textures of the envelope features.

The primary contributions of this paper are explicitly summarized as follows:

• Domain-informed Preprocessing via Excavation Dynamics Analysis: We present a full-signal envelope STFT preprocessing technique derived from a thorough analysis of excavation acoustic mechanics. By capturing the unique energy release and continuous strike rhythms of actual pavement destruction, this approach demonstrates practical feasibility in isolating genuine pipeline threats from severe industrial ambient noise more effectively than conventional raw or velocity-based vibration analysis.
• Operational Hierarchical Alarm Classification Logic for Field Supervisors: We design and validate a sophisticated, field-deployable decision matrix incorporating base thresholding, a $10\times$ impulse noise rejection filter, and a multi-window temporal continuity check $(K\ge 3)$. This advanced logic effectively translates raw reconstruction errors into meaningful operational alerts, substantially mitigating false alarms caused by sequential heavy traffic or equipment vibrations, thereby providing site operators with an actionable and trustworthy predictive maintenance metric.
• Synergistic Validation of Field Feasibility: Through a cross-pipeline field demonstration, we empirically demonstrate that alternative anomaly detection models fail to suppress false alarms or detect threats even when utilizing the proposed envelope preprocessing. This vital finding confirms that our framework—integrating domain-specific feature extraction, deep VAE reconstruction, and operational alarm hierarchy—is an essential component for navigating the fundamental trade-off between sensitivity and false positives, establishing a promising practical approach for industrial safety networks [12].

2. Proposed Field-Feasible Early Warning Framework

To systematically address the limitations of conventional anomaly detection algorithms in noisy industrial environments, this study proposes a comprehensive, field-oriented early warning framework. As outlined in Section 2.1, the system is not merely a standalone AI model, but an integrated diagnostic pipeline. It begins with extracting physically meaningful features from raw vibrations (Section 2.2), leverages an unsupervised network to decode these dynamic spatial–temporal patterns (Section 2.3), and culminates in a stringent hierarchical decision logic to effectively mitigate alarm fatigue.

2.1. Overall Architecture and Hierarchical Alarm Logic

To ensure the system’s viability for continuous field pipeline monitoring, the diagnostic algorithm was designed to be both computationally efficient and highly robust. As illustrated in the flowchart (Figure 1), the overall architecture is constructed upon a sequential pipeline comprising domain-specific feature extraction, unsupervised inference, and a post-processing hierarchical alarm logic.

Figure 1. Flowchart of the proposed early warning algorithm, illustrating the sequential process from data acquisition, Hilbert envelope STFT, ROI extraction (1–100 Hz), and 2D CNN-VAE inference, to the final hierarchical alarm classification logic utilizing base thresholding, impulse noise rejection $({Th}_{impulse}=10\times {Th}_{base})$, and a temporal continuity check $(K\ge 3)$.

• Data Acquisition and ROI Extraction: The algorithm begins by acquiring raw vibration data from field-deployed sensors. These raw signals undergo Hilbert envelope processing and Short-Time Fourier Transform (STFT) to generate 2D spectrograms. To optimize both computational efficiency and memory utilization for practical edge computing, the algorithm systematically extracts a Region of Interest (ROI) confined to the 1–100 Hz frequency band, where the demodulated mechanical impact rhythms are predominantly concentrated.
• Model Inference: The extracted ROI spectrogram is then fed into the proposed 2D CNN-VAE model. Because the network is trained specifically on normal baseline data, it outputs a Reconstruction Error ($RE$) that quantitatively represents the anomaly score of the input sequence.
• Hierarchical Alarm Classification Logic: To substantially reduce false alarms induced by complex environmental noises, the calculated RE is evaluated through a stringent three-tier decision matrix:

  •

  Normal State: If the RE does not exceed the predefined base threshold $\left(T{h}_{base}\right)$, the signal is classified as “Normal.” To ensure mathematical reproducibility and prevent data leakage, $T{h}_{base}$ is established using a completely independent normal validation dataset during the training phase. Specifically, it is defined as the upper control limit of the validation reconstruction error distribution: $T{h}_{base}={\mu }_{val}+6·{\sigma }_{val}$, where ${\mu }_{val}$ and ${\sigma }_{val}$ represent the mean and standard deviation of the reconstruction errors on the validation set, respectively. This highly rigorous $6\sigma$ bound effectively encloses natural background fluctuations while preserving high sensitivity to abnormal mechanical impacts.

  •

  Impulse Threshold ($\mathit{T}{\mathit{h}}_{\mathit{i}\mathit{m}\mathit{p}\mathit{u}\mathit{l}\mathit{s}\mathit{e}}$) for Noise Rejection and Severity Estimation: If the $RE$ exceeds $T{h}_{base}$, it is subsequently evaluated against an upper-bound impulse threshold ($T{h}_{impulse}$), which is empirically defined as $10\times T{h}_{base}$. This upper-bound constraint is strategically implemented to serve a dual operational purpose. First, it acts as an absolute magnitude indicator for physical impacts. During genuine excavation or road repair works where rhythmic impacts trigger an “Active Fault” alarm, the frequency of events exceeding this impulse threshold allows operators to quantitatively estimate the scale, danger level, and severity of the ongoing construction. Second, it serves as a robust filter against non-malicious false alarms. Passing heavy freight trucks generate massive transient shocks that introduce extreme noise spikes during non-construction periods [13]. If such heavy traffic occurs sequentially, it poses a critical risk of falsely satisfying the temporal continuity condition. By setting $T{h}_{impulse}$ to ten times the base threshold, the system explicitly distinguishes between the bounded, continuous mechanical energy of true excavation works and the singular, explosive kinetic energy of extreme transient shocks. Consequently, this distinct thresholding approach safely rejects extreme heavy traffic noise by classifying it as an “Impulse Warning,” while simultaneously empowering field operators with a practical metric to assess the intensity of confirmed pipeline threats.

  •

  Temporal Continuity Check: If the $RE$ falls within the critical anomaly range ($T{h}_{base}<RE\le T{h}_{impulse}$), the system executes a final temporal continuity verification. Rather than triggering an immediate alarm based on point-wise anomalies—which are highly susceptible to stochastic environmental artifacts—the system evaluates whether the anomaly persists for $K$ consecutive time windows. In continuous time-series anomaly detection, enforcing such a multi-window constraint effectively acts as a temporal low-pass filter, drastically mitigating false positive rates caused by isolated outliers [14]. Specifically, based on the reported parameters (sampling rate of 25,600 Hz, 1024-point window, 80% overlap, and 120 time frames per input), one input sample spans approximately 0.96 s. Therefore, the parameter $K=3$ corresponds to a physical duration of roughly 3 s. This value was mathematically derived from the deterministic kinematic characteristics of heavy vehicles prevalent in petrochemical complexes. When a heavy multi-axle truck or trailer traveling at typical intra-plant speeds passes over an irregular surface, it generates sequential impact vibrations from the front and rear wheel axles. Considering the standard wheelbase dimensions of such commercial vehicles and the ground-borne vibration wave propagation speed, the time interval between these dual-axle impacts typically spans 1 to 2 s [15]. Consequently, an anomaly sustaining for only 1 or 2 windows ($K=1$ or $2$) can be effortlessly triggered by a single passing truck. By intentionally setting the continuity threshold to $K\ge 3$, the system structurally ensures that these realistic, dual-impact vehicle signatures are securely absorbed and safely classified as an “Initial Caution.” The final “Active Fault” (Danger) alarm is triggered specifically when the signal maintains a continuous periodic rhythm for at least 3 windows, effectively supporting the isolation of genuine, sustained excavation threats.

2.2. Domain-Informed Preprocessing: Envelope and STFT

In underground pipeline monitoring, standard velocity conversion or global frequency analysis (e.g., FFT) of raw acceleration signals often amplifies massive low-frequency background noises (e.g., traffic, factory vibrations) and obscures crucial temporal dynamics [16,17,18]. To address these fundamental limitations, this study designs a domain-informed preprocessing pipeline combining Hilbert envelope analysis with Short-Time Fourier Transform (STFT).

The core physical insight is that while an excavator’s mechanical movement occurs at low frequencies, the actual ground fracturing generates wideband high-frequency shock impulses. To exploit this, we apply the Hilbert transform to the raw discrete-time acceleration signal $x\left[t\right]$. Rather than analyzing the highly noisy raw signal, we calculate its analytic signal and extract the instantaneous magnitude contour, $E\left[t\right]=\sqrt{x^2\left[t\right]+H^2\left\{x\left[t\right]\right\}}$, where $H\left\{\cdot \right\}$ denotes the Hilbert transform [19,20,21]. This envelope signal $E\left[t\right]$ explicitly demodulates the high-frequency fracture impulses into distinct macroscopic mechanical energy rhythms, effectively suppressing generic low-frequency ambient noise [22,23,24,25].

Subsequently, to decode the spatial–temporal dynamics of these continuous impacts, STFT is applied to the extracted envelope $E\left[t\right]$ using overlapping sliding windows. This transformation maps the 1D envelope into a 2D time-frequency spectrogram $S\left(t,f\right)$, which serves as the direct input tensor for our downstream deep learning model [26,27,28]. To effectively balance temporal and frequency resolutions while securing the continuity of dynamic impact rhythms (given a sampling rate of 25,600 Hz), we utilized a Hanning window (length of 1024), a notably high overlap ratio of 80%, and zero-padding with 2048 FFT points. Ultimately, this specific sequence—demodulating high-frequency shocks via the envelope and mapping their chronological persistence via STFT—provides a robust and distinctive 2D feature representation that effectively isolates sustained third-party damages from generic environmental artifacts.

2.3. Spatial–Temporal Decoding via 2D CNN-VAE

Although Convolutional Neural Networks (CNNs) and Variational Autoencoders (VAEs) are well-established deep learning techniques, simply combining them is insufficient to address the complex dynamics of industrial pipeline monitoring. In real-world environments, two primary bottlenecks persist: the extreme scarcity of labeled pipeline damage data (data imbalance) and high false-alarm rates caused by transient urban noises [29]. To systematically overcome these, we propose a domain-tailored 2D CNN-VAE architecture designed to effectively integrate with the domain-informed envelope spectrograms generated in Section 2.2.

The core necessity of this specific architecture lies in its ability to decode the physical characteristics of excavation acoustics. The preprocessed 2D spectrograms encapsulate the chronological mechanical impact rhythms as distinct spatial–temporal textures. Traditional 1D signal processing models often struggle to capture this structural continuity. By employing a 2D-CNN as the foundational feature extractor, the network seamlessly learns the intricate dynamic patterns and localized frequency shifts in ongoing mechanical strikes [30].

Furthermore, to circumvent the unrealistic reliance on pre-collected abnormal defect data, the framework operates strictly as an unsupervised condition-monitoring algorithm trained specifically on normal ambient data [31]. Crucially, a VAE is adopted over standard deterministic Autoencoders (AEs) to construct a highly resilient boundary of ‘normalcy’. Standard AEs frequently overfit to generic transient noises, exacerbating alarm fatigue. In contrast, the VAE compresses the spatial–temporal features into a probabilistically continuous latent space. Driven by its objective function—which minimizes the sum of the Reconstruction Loss (Mean Squared Error) and the Kullback–Leibler (KL) Divergence—the network applies rigorous statistical regularization, forcing the latent variables to approximate a standard normal distribution [32,33]. This probabilistic topography grants the model promising performance, allowing it to safely accommodate harmless daily noise variations while strictly isolating the structural energy anomalies of unauthorized excavations.

As detailed in Figure 2 and Table 1, the proposed network features an asymmetrical bottleneck configuration comprising three sequential stages. The encoding phase deeply compresses the input envelope spectrograms through three consecutive 2D convolutional layers. These feature maps are flattened and projected into a low-dimensional probabilistic latent vector parameterized by mean and log-variance. The decoder then reconstructs the original spatial–temporal input from this latent vector through transposed 2D convolutional layers.

Figure 2. Schematic diagram of the proposed 2D CNN-VAE architecture for unsupervised anomaly detection. The network architecture features an asymmetrical bottleneck configuration consisting of three essential components: (1) The Encoder stage, which sequentially extracts and compresses spatial–temporal features from the input envelope-based spectrograms using 2D convolutional layers; (2) The Probabilistic Latent Space, which maps the compressed features into a low-dimensional distribution parameterized by mean and log-variance vectors; and (3) The Decoder stage, which systematically reconstructs the original spectrogram dimension from the latent vector through 2D transposed convolutional layers for reconstruction error derivation.

Table 1. Detailed architecture of the proposed 2D CNN-VAE model.

Network	Layer (Type)	Output Shape	Kernel Size/Stride	Activation
Encoder	Input	(8, 120, 1)	-	None
	Conv2D_1	(4, 60, 16)	$3\times 3/2$	ReLU
	Conv2D_2	(2, 30, 32)	$3\times 3/2$	ReLU
	Conv2D_3	(1, 15, 64)	$3\times 3/2$	ReLU
	Flatten	(960)	-	-
	FullyConnected (Out)	(40)	-	Linear
Latent Space	Sampling $\left(Z\right)$	(20)	-	-
Decoder	Input	(1, 1, 20)	-	None
	Conv2DTranspose_1	(1, 15, 64)	$1\times 15/1$	ReLU
	Conv2DTranspose_2	(2, 30, 32)	$2\times 2/2$	ReLU
	Conv2DTranspose_3	(4, 60, 16)	$2\times 2/2$	ReLU
	Conv2DTranspose_4	(8, 120, 1)	$2\times 2/2$	Sigmoid

Through this architectural synergy, the system becomes more than a simple combination of algorithms. The discrepancy between the input and the decoded output, quantified as the Reconstruction Error ($RE$), serves as the robust primary anomaly score. Ultimately, this unsupervised spatial–temporal decoder effectively feeds the necessary dynamic intelligence into our final hierarchical alarm logic, obviating the dependency on supervised damage datasets.

3. Experimental Setup and Data Acquisition

3.1. Field Environment and Utilization of Existing Infrastructure

The vibration data used in this study were acquired during an actual excavation project aimed at installing sensors for pipeline corrosion and micro-crack detection. Crucially, the data were collected using acceleration sensors that were already installed on an adjacent parallel pipeline within the same industrial zone. This setup practically demonstrates a significant advantage of the proposed early warning framework: it does not require the costly and labor-intensive deployment of an independent, dedicated sensor network. Instead, the algorithm can be readily integrated into existing structural health monitoring (SHM) infrastructures [34].

To accurately reflect the scope of this field demonstration, it should be noted that all experimental data derive from a continuous 6-h recording session. This session explicitly captured distinct operational phases: an asphalt-breaking episode, a ground-compacting episode, and a normal baseline period. While this single-event, single-site dataset effectively validates sensor-to-sensor transfer and field feasibility, it serves as a foundational demonstration rather than a generalized proof across varying soils, seasons, or distances. As depicted in the satellite imagery in Figure 3, the active excavation site was located 55 m away from the sensor installation point, providing a realistic scenario where the physical impact signals are naturally attenuated by the soil medium.

Figure 3. Satellite imagery of the industrial site demonstrating the spatial relationship between the active excavation area and the existing sensor installation point on the buried pipeline (55 m separation distance).

3.2. Data Acquisition Specifications and Construction Scenarios

Continuous field monitoring was conducted over a 6-h period within an active industrial zone. Vibration signals were captured using two high-sensitivity accelerometers (Vibrasens, Besancon, France, $100\mathrm{m}\mathrm{V}/\mathrm{g}$ sensitivity) attached directly to two parallel underground pipelines, designated as Channel 1 and Channel 2. The analog vibration responses were digitized via a high-performance data acquisition module (NI DAQ9223) at a high sampling rate $\left(f_s\right)$ of 25,600 Hz to ensure the reliable retention of high-frequency transient shock components. Throughout the operation, on-site personnel maintained a detailed field log recording the exact timeline of each construction activity, which provided reliable ground truth for precise data annotation.

From this 6-h field demonstration dataset, three distinct operational states were categorized for analysis and model training. The specific labeling criteria and their physical implications are defined as follows, with corresponding on-site conditions illustrated in Figure 4:

Figure 4. On-site photographic documentation of the operational states categorized for data acquisition: (a) target threat involving an excavator breaking asphalt; (b) false alarm trigger caused by ground compacting operations utilizing identical heavy machinery; (c) normal baseline showing conduit arrangement work embedded within a high-traffic industrial environment without active excavation impacts.

• Target Threat (Asphalt Pavement Breaking—Figure 4a): This class represents the primary third-party damage (TPD) mechanism that the system must detect. The physical shattering and fracturing of the pavement via a heavy excavator generate sharp, high-frequency impact impulses that pose a severe risk to adjacent pipeline integrity.
• False Alarm Trigger (Ground Compacting—Figure 4b): This operation generates massive, continuous ground vibrations. Crucially, this activity utilizes the exact same heavy construction machinery employed in the asphalt breaking task. Among various field operations, these two scenarios represent ground-striking activities executed by identical equipment, yet they possess distinct risk profiles: one is a critical pipeline threat, while the other is a non-destructive activity. This class serves as a practical benchmark to test the system’s pattern discrimination capability, ensuring that alarms are not erroneously triggered based merely on high vibration amplitudes or the presence of identical heavy machinery.
• Normal Baseline (Conduit Arrangement Work—Figure 4c): This dataset represents the baseline background environment, captured during cable layout work where no active excavation or ground-striking occurred. Despite the absence of structural threats, this environment was heavily contaminated with severe ambient noise, primarily caused by heavy freight trucks and general passenger vehicles frequently transiting directly over the sensor installation zone. This data serves as a highly realistic, noise-dense baseline to train the unsupervised VAE model, ensuring its robustness against non-malicious industrial traffic.

3.3. Cross-Pipeline Validation for Sensor-to-Sensor Transferability

To ensure that the proposed framework is practically deployable, it is critical to verify that the unsupervised deep learning model does not simply overfit to the specific mechanical resonance of a single sensor or its immediate physical attachment point. Taking advantage of the dual-channel setup (Channel 1 and Channel 2 on adjacent parallel pipelines), a cross-pipeline validation strategy was employed. As noted, because this setup observes the same physical events at the same 55 m standoff distance on the same day, it does not evaluate generalization across diverse sites, soils, or seasons; nevertheless, it provides a rigorous test of sensor-to-sensor transferability—a crucial requirement for field feasibility.

Specifically, the VAE model was trained using 1000 samples of the “Normal Baseline” (conduit arrangement work) dataset acquired from Channel 1. To ensure robust model optimization and prevent data leakage, this baseline dataset was strictly partitioned into training, validation, and testing sets at a ratio of 8:1:1. The proposed 2D CNN-VAE model was optimized using the Adam optimizer with a learning rate of 0.0001, and the training was executed over 150 epochs with a mini-batch size of 32; the complete training configuration and resulting loss metrics are summarized in Table 2.

As illustrated by the training loss curves in Figure 5, the model achieved stable convergence, concluding with a Total Loss of 0.0988. Notably, the Reconstruction Loss (MSE) reached a highly minimized value of 0.0116, indicating that the decoder successfully learned to reconstruct the normal ambient noise patterns, while the Kullback–Leibler (KL) Divergence stabilized at 0.0872.

Figure 5. Training loss curves of the proposed 2D CNN-VAE model over 150 epochs. The graph illustrates the stable convergence of the Total Loss, explicitly detailing the minimization of the Reconstruction Loss (MSE) and the KL Divergence.

Following this unsupervised optimization phase, the anomaly detection performance was evaluated using the unseen testing dataset (comprising the normal baseline, target threat, and false alarm scenarios) collected solely from the adjacent pipeline (Channel 2). This evaluation strategy effectively demonstrates the practical sensor-to-sensor transferability of the proposed architecture, ensuring that the model identifies genuine structural anomalies rather than merely memorizing localized hardware noise.

Table 2. Hyperparameters and training loss evaluation of the proposed 2D CNN-VAE model.

Category	Parameter/Metric	Value
Training Configuration	Optimizer	Adam
	Learning Rate	0.0001
	Batch Size	32
	Epochs	150
Training Results (Loss)	Total Loss	0.0988
	Reconstruction Loss (MSE)	0.0116
	KL Divergence	0.0872

Table 2. Hyperparameters and training loss evaluation of the proposed 2D CNN-VAE model.

Category	Parameter/Metric	Value
Training Configuration	Optimizer	Adam
	Learning Rate	0.0001
	Batch Size	32
	Epochs	150
Training Results (Loss)	Total Loss	0.0988
	Reconstruction Loss (MSE)	0.0116
	KL Divergence	0.0872

4. Data Analysis and Feature Extraction

4.1. Limitations of Raw Signal Analysis via Time-Domain Features

To initially evaluate the characteristics of the acquired vibration data, a time-domain analysis was conducted using the High-Resolution Root Mean Square (HRMS) feature extraction technique. As depicted in Figure 6, the HRMS feature plot visualizes the overall energy magnitude across the continuous data stream, with the three specific Regions of Interest (ROIs) explicitly highlighted for comparison.

Figure 6. HRMS feature plot of the entire continuous vibration data stream. The plot highlights three specific Regions of Interest (ROIs): normal conduit arrangement, asphalt breaking, and ground compacting. The severe amplitude overlap across different operational segments clearly demonstrates the unreliability of simple time-domain thresholding in a noisy industrial environment.

Inspection of the plotted dataset reveals a significant limitation. While relatively high HRMS amplitudes are clearly observable during the asphalt breaking phase (Target Threat), similarly large, or even higher, energy peaks frequently emerge in other operational segments, particularly during the normal baseline (conduit arrangement work) process. This substantial overlap in energy levels demonstrates that the time-domain metric quantifies only the overall magnitude of the vibration energy without identifying its physical source.

Due to the inherent characteristics of the active field environment, the raw data is frequently affected by substantial mechanical noise and transient shocks. Consequently, distinguishing actual excavation impacts from ambient noise through simple time-domain value verification (e.g., amplitude thresholding) is highly challenging and degrades system reliability. Therefore, to effectively extract and analyze the specific characteristics of the target signals while mitigating false alarms, it is essential to transition to frequency spectrum analysis, which can identify hidden periodic patterns.

4.2. Effectiveness of Envelope Preprocessing: Demodulation of Fracture Energy

Given the limitations of time-domain analysis, the signals were subsequently evaluated in the frequency domain. However, directly applying the Fast Fourier Transform (FFT) to the raw acceleration signals often fails to reveal distinct operational signatures, rendering the analysis vulnerable to environmental noise. Furthermore, converting the raw acceleration into velocity via integration—a conventional method used for low-frequency mechanical analysis—mainly amplified the overall signal magnitude without revealing clear structural patterns.

The fundamental reason for the limitations of these conventional methods lies in the acoustic duality of excavation activities. While the mechanical engine movement (RPM) of an excavator operates at low frequencies, the actual physical threat—the shattering and fracturing of asphalt pavement—emits wideband high-frequency transient shock waves. When analyzing raw or velocity-converted spectra, these critical high-frequency fracture signatures are often obscured by prominent, non-malicious low-frequency environmental noises (e.g., passing traffic). Consequently, relying solely on such methods makes it highly challenging to distinguish genuine excavation threats from harmless, high-amplitude disturbances.

To overcome this limitation, a full-signal envelope processing technique was applied prior to the FFT. Rather than solely evaluating the overall amplitude of the vibration, this envelope approach explicitly extracts and demodulates the high-frequency fracture energy, projecting it down into the low-frequency band. This mechanism uncovers the underlying macro-level impact rhythms (i.e., the operational strike rate of the excavator) that are otherwise difficult to discern in raw spectra.

This full-signal strategy is grounded in the physical characteristics of both the sensing hardware and the excavation dynamics. The deployed accelerometers possess a wideband frequency response (up to 10 kHz at a 25.6 kHz sampling rate). Because extreme transient impacts from excavation excite multiple, unpredictable structural resonances depending on soil conditions and distance, applying the Hilbert transform to the full-bandwidth signal—rather than a narrow, pre-selected resonance band—ensures that no shifted high-frequency impact energy is missed. Furthermore, mechanical excavators typically operate with a fundamental strike rhythm between 5 and 30 Hz. Therefore, strictly retaining the 1–100 Hz region (ROI) of the envelope spectrum is highly effective. This specific band comprehensively captures the fundamental strike frequency and its critical low-order harmonics, providing a robust technical basis for filtering out uninformative high-frequency ambient noise while preserving the essential mechanical signature.

The effectiveness of this envelope demodulation is visually demonstrated in Figure 7. While the normal baseline (Figure 7a) exhibits no specific rhythmic pattern, the asphalt breaking operation (Figure 7b) displays a distinct rhythmic signature characterized by clear harmonic peaks. This periodicity makes it readily distinguishable from the ground compacting operation (Figure 7c), which possesses a substantial absolute vibration amplitude but lacks this specific structural fracture rhythm. This empirical contrast demonstrates that the proposed preprocessing step does not merely respond to simplistic signal loudness; instead, it accurately targets and decodes the specific frequency characteristics of structural destruction, establishing a reliable foundation for threat recognition.

Figure 7. Comparison of envelope-processed frequency spectra in the low-frequency band (1–100 Hz): (a) normal baseline (conduit arrangement) exhibiting no specific impact rhythm; (b) target threat (asphalt breaking) revealing highly distinct and prominent periodic peaks corresponding to mechanical strikes; (c) false alarm trigger (ground compacting) showing a less prominent but visible periodic pattern compared to the target threat.

4.3. Spatial–Temporal Mapping via STFT Spectrograms

As demonstrated in Section 4.2, the full-signal envelope processing successfully demodulates hidden fracture rhythms into the low-frequency band. However, relying solely on a 1D global frequency spectrum (FFT) obscures the crucial chronological sequence of these impacts. Because differentiating a systematic, continuous excavation threat from isolated transient noise relies heavily on temporal recurrence, the Short-Time Fourier Transform (STFT) was applied to map the 1D envelope signals into a 2D spatial–temporal domain.

4.3.1. Limitations of Amplitude-Based Detection and Necessity of Spatial–Temporal Textures

To evaluate the temporal dynamics, three distinct Regions of Interest (ROIs)—(1) normal conduit arrangement, (2) asphalt breaking, and (3) ground compacting—were sequentially concatenated into a continuous 2D spectrogram, as illustrated in Figure 8.

Figure 8. Continuous 2D STFT spectrogram mapping three Regions of Interest (ROIs): asphalt breaking, ground compacting, and normal conduit arrangement. Notably, the normal baseline exhibits intermittent high-amplitude spikes, and the target threat (asphalt breaking) is visually indistinguishable from the false alarm trigger (ground compacting) by amplitude alone. This highlights the fundamental limitations of simple amplitude-based detection and the necessity for pattern-based AI models.

A visual inspection of this spectrogram reveals an important operational characteristic. Rather than maintaining a consistently quiet baseline, the “normal” non-excavation scenario frequently exhibits substantial transient spikes comparable in absolute magnitude to actual excavation signals. Furthermore, when evaluating solely based on signal intensity, the ground compacting operation (a false-alarm trigger) and the asphalt breaking operation (the target threat) manifest with highly similar high-energy amplitudes.

This phenomenon highlights the limitations of conventional amplitude-based monitoring systems (e.g., standard RMS thresholding). If an early warning framework relies primarily on signal loudness, it is highly susceptible to alarm fatigue, repeatedly misclassifying routine industrial vibrations or passing heavy traffic as pipeline threats.

Therefore, robust anomaly detection benefits from shifting the focus from absolute energy intensity to the morphological spatial–temporal textures of the signal. As observed in the envelope spectrogram, the true distinction lies in the structural pattern: asphalt breaking presents as distinct, periodic impact ridges along the time axis, whereas normal operations and compacting display stochastic spikes or continuous energy bands without this specific mechanical rhythm. Consequently, these 2D spectrogram matrices serve as effective input tensors for the proposed 2D CNN-VAE, enabling the deep learning network to robustly capture the structural shape of the temporal rhythm rather than being overly influenced by fluctuating amplitude levels.

4.3.2. Human Interpretability via 3D Waterfall Plots

While 2D spectrogram matrices serve as effective, high-dimensional input tensors for deep learning architectures, establishing intuitive human interpretability remains a valuable feature for real-world industrial safety systems. A field-deployable early warning framework benefits from addressing the limitations of a “black-box” AI; it should function as a transparent diagnostic tool that provides physically verifiable evidence to site engineers.

To bridge the gap between mathematical feature extraction and operational interpretability, the 2D STFT spectrograms were topographically projected into 3D Waterfall plots (Figure 9). This multi-dimensional visualization clearly renders the temporal dynamics and energy contours of the demodulated signals. By examining these topographical structures, field operators can visually differentiate complex signal morphologies that are otherwise difficult to distinguish when relying solely on 1D amplitude thresholds.

Figure 9. 3D Waterfall plots demonstrating human interpretability of the different construction scenarios: (a) normal baseline (conduit arrangement) showing sporadic, unevenly distributed transient spikes caused by passing heavy traffic; (b) target threat (asphalt breaking) revealing frequent, continuous high-amplitude peaks corresponding to mechanical strikes; (c) false alarm trigger (ground compacting) exhibiting a highly flattened, continuous high-amplitude plateau without distinct breaks.

As illustrated in Figure 9a, the normal baseline (conduit arrangement) exhibits stochastically distributed, isolated high-energy spikes. This topographical signature identifies them as transient impulses—typically induced by heavy freight trucks frequently passing through the industrial zone—rather than sustained mechanical threats. In contrast, the actual threat scenario (asphalt breaking, Figure 9b) displays a dense, continuous chain of sharp harmonic peaks, closely reflecting the periodic mechanical strike rate of an excavator. Meanwhile, the primary false-alarm trigger (ground compacting, Figure 9c) manifests as a broad, flattened plateau of sustained kinetic energy without distinct rhythmic breaks, forming a distinctly different morphological topography.

This 3D visualization demonstrates that the proposed domain-informed preprocessing does not merely yield abstract mathematical features for machine learning. Instead, it successfully extracts verifiable structural signatures, facilitating a diagnostic process that human operators can visually verify and interpret with greater confidence.

5. Results and Discussion

5.1. Performance Evaluation of the Proposed Early Warning System

The evaluation dataset (Table 3), which remained entirely unseen during the training phase, was processed through the proposed 2D CNN-VAE and the subsequent hierarchical alarm logic. The classification results, detailing the frequency of triggered states across the three operational scenarios, are summarized in Table 4. Furthermore, the time-series distribution of the reconstruction error, evaluated against the defined thresholds, is visually presented in Figure 10. These results demonstrate the filtering robustness and threat detection capability of the proposed system.

Figure 10. Time-series monitoring charts of the reconstruction error $\left(RE\right)$ processed through the hierarchical alarm logic: (a) conduit arrangement work (normal baseline) filtering transient spikes as impulse warnings; (b) asphalt breaking (target threat) successfully triggering early active fault alarms through continuous threshold breaches; (c) ground compacting (false alarm trigger) generating zero active faults, proving the model’s robust noise suppression.

Under the normal baseline scenario (conduit arrangement), the system registered 8 “Initial Caution” and 3 “Impulse Warning” signals. As clearly observed in Figure 10a, these triggers correspond to momentary energy spikes induced by realistic ambient factors, such as passing heavy commercial vehicles. Crucially, because these sporadic spikes did not satisfy the stringent temporal continuity condition, zero “Active Fault” (Danger) alarms were falsely triggered. Most notably, during the ground compacting scenario (Figure 10c)—an operation that generates massive kinetic energy and often acts as a primary source of continuous false alarms in conventional thresholding systems—the proposed framework recorded zero “Initial Caution” or “Active Fault” signals. This indicates that the unsupervised AI model successfully absorbed the ground compacting’s specific spatial–temporal texture as a non-threatening environmental variance, preventing false positives under the evaluated configuration.

For the actual target threat (asphalt breaking), the system successfully captured the activity by generating 9 “Active Fault” window-level triggers. To address the operational definitions clearly, these 9 triggers do not denote 9 independent excavation events; rather, they represent 9 distinct consecutive overlapping output windows that satisfied the continuity condition during the single asphalt-breaking episode. While 9 alarms out of 1621 raw frame samples might initially be misconstrued as a low frame-level detection rate, a temporal analysis of the monitoring chart (Figure 10b) reveals the practical effectiveness of the algorithm. The hierarchical logic dictates that an “Active Fault” is declared specifically after the temporal continuity condition ($K=3$) is rigorously satisfied. Consequently, these 9 output windows represent a highly reliable, continuous tracking of the event rather than erratic frame-level noise. As evident in the time-series plot, while 19 “Impulse Warnings” were triggered instantaneously upon the initial heavy strikes, the definitive alert was activated shortly after, ensuring early detection before pipeline damage could occur.

Therefore, the distinction between window-level outputs and event-level detections must be clearly defined. At the event level, the single ground-truth excavation event was successfully detected (Event-level $TP=1,FN=0$), with no event-level false alarms observed during the entire monitoring period ($FP=0$). During this single event, the system generated 9 consecutive window-level triggers (Window-level $TP=9$). Consequently, the event-level metrics calculate to 100% Precision, 100% Recall, and an F1-score of 100% for this dataset.

However, these 100% performance metrics should be interpreted with caution. As they are based on a single positive excavation event during an approximately six-hour field demonstration, they do not imply a statistically established generalized performance across multiple independent events. Rather, they demonstrate that the single ground-truth excavation event was successfully detected without any false alarms under the evaluated conditions. This highlights the system’s robust predictive maintenance capability while substantially reducing the risk of alarm fatigue within the scope of the current field study.

Table 3. Detailed distribution of the dataset for the cross-pipeline evaluation strategy, categorized by operational classes for training (Channel 1) and evaluation (Channel 2).

Class	Train Dataset (Ch. 1)	Test Dataset (Ch. 2)
Conduit Arrangement Work	1000	1000
Asphalt Breaking	-	1621
Ground Compacting	-	431

Table 3. Detailed distribution of the dataset for the cross-pipeline evaluation strategy, categorized by operational classes for training (Channel 1) and evaluation (Channel 2).

Class	Train Dataset (Ch. 1)	Test Dataset (Ch. 2)
Conduit Arrangement Work	1000	1000
Asphalt Breaking	-	1621
Ground Compacting	-	431

Table 4. Quantitative evaluation results of the proposed 2D CNN-VAE through the hierarchical alarm logic across the unseen dataset.

Class	Total	Initial Caution	Active Fault	Impulse Warning	Event Alarm Triggered	Field Diagnosis
Conduit Arrangement Work	1000	8	0	3	False	True Negative
Asphalt Breaking	1621	14	9	19	True	True Positive
Ground Compacting	431	0	0	0	False	True Negative

Table 4. Quantitative evaluation results of the proposed 2D CNN-VAE through the hierarchical alarm logic across the unseen dataset.

Class	Total	Initial Caution	Active Fault	Impulse Warning	Event Alarm Triggered	Field Diagnosis
Conduit Arrangement Work	1000	8	0	3	False	True Negative
Asphalt Breaking	1621	14	9	19	True	True Positive
Ground Compacting	431	0	0	0	False	True Negative

5.2. Comparative Analysis and Architectural Synergy Validation

To rigorously validate the effectiveness of the proposed framework and address the question of whether conventional signal representations could suffice under alternative machine learning models, an extensive ablation study was conducted. The proposed 2D CNN-VAE was evaluated against three well-established unsupervised anomaly detection baselines: a standard VAE, a One-Class Support Vector Machine (OC-SVM), and an Isolation Forest. To ensure a fair and rigorous evaluation, all input features for the baseline models were standardized, and the 2D spectrograms were flattened into 1D vectors with a feature dimensionality of 960 for the Standard VAE, OC-SVM, and Isolation Forest. Furthermore, the hyperparameters for the classical machine learning baselines were meticulously optimized via grid search over the validation set (e.g., tuning the regularization parameter ν and kernel coefficient γ for the OC-SVM, and the contamination rate for the Isolation Forest). Crucially, to ensure an equitable event-level evaluation, the statistical base threshold $(\mu +6\sigma )$ and the temporal aggregation method $(K\ge 3)$ were applied consistently across all evaluated models. The “Standard VAE” was defined utilizing flattened 1D inputs (960 dimensions) and dense fully connected layers, but configured with an identical latent dimensionality and equivalent parameter capacity to the proposed model to prevent confounding the architecture with sheer input dimensionality. Each network was subjected to three distinct signal preprocessing variants: Raw Acceleration, Velocity-Converted, and the proposed Envelope-Processed data. The quantitative anomaly detection results are summarized in Table 5, and the localized frame-level alarm behaviors for each framework are topographically illustrated in Figure 11, Figure 12, Figure 13 and Figure 14.

Table 5. Comprehensive performance comparison between the proposed model and traditional anomaly detection baselines.

Model	Data Type	Environment Class	Initial Caution	Active Fault	Impulse Warning	Event Alarm Triggered	Field Diagnosis
Proposed 2D CNN-VAE	Raw Acceleration	Conduit Arrangement Work	7	3	4	True	False Positive
		Asphalt Breaking	29	11	9	True	True Positive
		Ground Compacting	2	0	0	False	True Negative
	Velocity- Converted	Conduit Arrangement Work	3	0	3	False	True Negative
		Asphalt Breaking	14	0	4	False	False Negative
		Ground Compacting	0	0	0	False	True Negative
	Envelope- Processed	Conduit Arrangement Work	8	0	3	False	True Negative
		Asphalt Breaking	14	9	19	True	True Positive
		Ground Compacting	0	0	0	False	True Negative
Standard VAE	Raw Acceleration	Conduit Arrangement Work	0	0	0	False	True Negative
		Asphalt Breaking	0	0	1	False	False Negative
		Ground Compacting	0	0	0	False	True Negative
	Velocity- Converted	Conduit Arrangement Work	1	0	0	False	True Negative
		Asphalt Breaking	2	0	1	False	False Negative
		Ground Compacting	0	0	0	False	True Negative
	Envelope- Processed	Conduit Arrangement Work	2	0	0	False	True Negative
		Asphalt Breaking	2	0	1	False	False Negative
		Ground Compacting	0	0	0	False	True Negative
One-Class SVM	Raw Acceleration	Conduit Arrangement Work	0	0	0	False	True Negative
		Asphalt Breaking	0	0	0	False	False Negative
		Ground Compacting	0	0	0	False	True Negative
	Velocity- Converted	Conduit Arrangement Work	0	0	0	False	True Negative
		Asphalt Breaking	0	0	0	False	False Negative
		Ground Compacting	0	0	0	False	True Negative
	Envelope- Processed	Conduit Arrangement Work	0	0	0	False	True Negative
		Asphalt Breaking	0	0	0	False	False Negative
		Ground Compacting	0	0	0	False	True Negative
Isolation Forest	Raw Acceleration	Conduit Arrangement Work	11	3	0	True	False Positive
		Asphalt Breaking	25	30	0	True	True Positive
		Ground Compacting	11	3	0	True	False Positive
	Velocity- Converted	Conduit Arrangement Work	17	3	0	True	False Positive
		Asphalt Breaking	42	52	0	True	True Positive
		Ground Compacting	12	0	0	False	True Negative
	Envelope- Processed	Conduit Arrangement Work	20	7	71	True	False Positive
		Asphalt Breaking	55	87	2	True	True Positive
		Ground Compacting	20	3	0	True	False Positive

Figure 11. Dynamic monitoring and alarm generation results of the proposed 2D CNN-VAE framework: (a–c) using Raw Acceleration features, demonstrating severe frame-level false positives during normal operations; (d–f) using Velocity-Converted features, exhibiting fatal false negatives during asphalt breaking; and (g–i) using the proposed Hilbert-Envelope STFT features, demonstrating robust, zero-false-alarm isolation of genuine excavation threats.

Figure 12. Dynamic monitoring and alarm generation results of the standard VAE baseline framework across all preprocessing variants, exhibiting severe under-sensitivity and a significant limitation in triggering definitive “Active Fault” alarms due to structural regularizer overfitting.

Figure 13. Dynamic monitoring and alarm generation results of the One-Class SVM (OC-SVM) baseline framework across all preprocessing variants, demonstrating severe underfitting and a failure to detect the target event under the evaluated configuration, failing to capture anomaly trajectories or trigger any operational states.

Figure 14. Dynamic monitoring and alarm generation results of the Isolation Forest baseline framework across all preprocessing variants, demonstrating extreme over-sensitivity and acute alarm fatigue via continuous false positives across normal baselines and ground compacting scenarios.

The empirical results reveal a critical architectural synergy between the preprocessing technique and the deep model framework. As demonstrated by the proposed 2D CNN-VAE framework (Figure 11), utilizing Raw Acceleration (Figure 11a–c) successfully triggers alerts during target threat windows but suffers from frequent false positives during normal operations due to stochastically fluctuating ambient noise. Conversely, employing Velocity-Converted representations (Figure 11d–f) successfully suppresses baseline false alarms but introduces significant false negatives, struggling to recognize the high-frequency fracture signatures of asphalt breaking. It is specifically when the proposed Hilbert-Envelope preprocessing is applied (Figure 11g–i) that the 2D CNN-VAE achieves the intended synergy: reliable early warning of genuine excavation threats.

Furthermore, the results of the alternative baseline models establish that advanced signal preprocessing alone is insufficient without a well-matched neural architecture. As depicted in the standard VAE results (Figure 12), although the envelope representation extracts denser fault features, the network structurally fails to accumulate sufficient reconstruction errors to trigger definitive “Active Fault” alarms across any of the preprocessing types.

For the OC-SVM (Figure 13), despite rigorous hyperparameter tuning, the model suffered from severe underfitting and failed to register a single frame-level threshold breach across the entire evaluation period, confirming its structural limitations in capturing the continuous spatial–temporal dynamics of this challenging field dataset.

In contrast, the Isolation Forest (Figure 14) exhibits extreme hypersensitivity; while it successfully triggers active alarms during the target threat windows, it induces substantial alarm fatigue by generating continuous false positives during normal Conduit Arrangement Work and even misclassifying non-threatening ground compacting operations when using raw and envelope representations.

Taken together, these comparative evaluations demonstrate that the proposed early warning system is not a simple combination of independent technologies. While domain-informed feature extraction is vital for isolating threat contours from background artifacts, selecting a domain-tailored neural decoder capable of reconstructing these delicate spatial–temporal textures is highly beneficial. Ultimately, these findings confirm that the structural integration of full-signal envelope STFT with an unsupervised 2D CNN-VAE represents an integrated framework, well-suited to handle the severe noise profiles of petrochemical safety networks.

5.3. Parameter Sensitivity Analysis for Field Deployment

5.3.1. Optimization of the Temporal Continuity Condition ($K$)

The temporal continuity parameter, $K$, acts as the final deterministic gatekeeper in the proposed hierarchical alarm logic. To empirically validate the selection of $K=3$ and analyze the system’s sensitivity to this parameter, a comparative ablation study was conducted using relaxed ($K=2$) and tightened ($K=4$) continuity conditions. The quantitative results across the different continuity scenarios are summarized in Table 6, and the corresponding time-series evaluations are depicted in Figure 15 and Figure 16.

Table 6. Quantitative Evaluation of Detection Performance by Temporal Continuity Parameter ($K$).

Parameter ($\mathit{K}$)	Environment Class	Initial Caution	Active Fault	Impulse Warning	Event Alarm Triggered	Field Diagnosis
2	Conduit Arrangement Work	2	6	3	True	False Positive
	Asphalt Breaking	12	11	19	True	True Positive
	Ground Compacting	0	0	0	False	True Negative
3	Conduit Arrangement Work	8	0	3	False	True Negative
	Asphalt Breaking	14	9	19	True	True Positive
	Ground Compacting	0	0	0	False	True Negative
4	Conduit Arrangement Work	8	0	3	False	True Negative
	Asphalt Breaking	23	0	19	False	False Negative
	Ground Compacting	0	0	0	False	True Negative

Figure 15. Time-series evaluation of the proposed alarm logic under a relaxed temporal continuity threshold ($K=2$): (a) false alarms triggered by transient vehicle shocks during the normal baseline scenario; (b) hypersensitive detection during the asphalt breaking operation; and (c) responses during the ground compacting operation.

Figure 16. Time-series evaluation of the proposed alarm logic under a strict temporal continuity threshold ($K=4$): (a) complete suppression of false alarms during the normal baseline scenario; (b) critical false negatives (missed detections) during the asphalt breaking operation; and (c) successful suppression during the ground compacting operation.

When the continuity threshold was relaxed to $K=2$ (Figure 15), the system exhibited operational hypersensitivity. While it successfully generated a higher frequency of “Active Fault” alarms during the asphalt-breaking operation (Figure 15b), it struggled to maintain the zero-false-alarm objective. Specifically, during the normal baseline (conduit arrangement) scenario, the sequential transient shocks from passing heavy multi-axle vehicles easily satisfied this loose $K=2$ condition, triggering multiple false “Active Fault” alarms (Figure 15a). This empirically demonstrates that $K=2$ is insufficiently strict, rendering the framework vulnerable to typical industrial traffic and increasing the risk of alarm fatigue.

Conversely, when the condition was tightened to $K=4$ (Figure 16), the system became structurally overly conservative. Although it successfully suppressed all false alarms in both the normal (Figure 16a) and ground compacting (Figure 16c) scenarios, it failed to detect the actual target threat. As shown in Figure 16b, the system missed the asphalt-breaking events, resulting in critical False Negatives. This failure mechanism occurs because real-world mechanical excavation rhythms naturally contain slight operational pauses, equipment repositioning shifts, and micro-intervals between strikes. Consequently, sustaining a strict 4-window continuous anomaly is highly improbable in an unconstrained field environment.

Therefore, this parameter sensitivity analysis indicates that $K=3$ represents a practical balance that is justified both empirically and physically. It effectively handles the fundamental operational trade-off: providing a temporal window just flexible enough to accommodate the natural rhythmic variations in genuine continuous excavation, while remaining rigorous enough to effectively filter out the dual-axle transient noises of passing commercial vehicles.

5.3.2. Robustness of the Impulse Threshold Multiplier

The impulse threshold (${Th}_{Impulse}$) acts as a critical metric designed to serve a dual operational purpose: preventing false alarms from transient extreme noises and assessing the severity of construction activities. Given its significant impact on the reliability of the system, optimizing the multiplier applied to the base threshold is essential. To empirically justify the selection of the $10\times$ multiplier, a comparative ablation study was conducted using lower ($5\times$) and higher ($15\times$) factors. The state transitions and detection performances across these parameters are summarized in Table 7, with the corresponding time-series evaluations depicted in Figure 17 and Figure 18.

Table 7. Comprehensive comparative summary of the system’s operational states and detection efficiency under three different multiplier conditions ($5\times$, $10\times$, and $15\times$). While the strict $5\times$ multiplier successfully suppresses false positives during the normal state, it introduces a critical functional flaw by delaying the excavation alarm. Conversely, although the loose $15\times$ multiplier shows immediate detection for the current dataset, it compromises the system’s robustness by increasing the risk of false positives from unforeseen environmental shocks. The $10\times$ multiplier emerges as the empirical optimum, ensuring immediate target detection while maintaining a generalized noise-rejection capability.

Parameter ($\mathit{T}{\mathit{h}}_{\mathit{i}\mathit{m}\mathit{p}\mathit{u}\mathit{l}\mathit{s}\mathit{e}}$)	Environment Class	Initial Caution	Active Fault	Impulse Warning	Event Alarm Triggered	Field Diagnosis
5.0	Conduit Arrangement Work	6	0	5	False	True Negative
	Asphalt Breaking	15	3	24	True	True Positive
	Ground Compacting	0	0	0	False	True Negative
10.0	Conduit Arrangement Work	8	0	3	False	True Negative
	Asphalt Breaking	14	9	19	True	True Positive
	Ground Compacting	0	0	0	False	True Negative
15.0	Conduit Arrangement Work	8	0	3	False	True Negative
	Asphalt Breaking	16	9	17	True	True Positive
	Ground Compacting	0	0	0	False	True Negative

Figure 17. Time-series evaluation of the monitoring system when an insufficiently low impulse threshold ($5\times$ multiplier) is applied. As shown in (a,c), the tight upper bound effectively suppresses false alarms during non-excavation periods. However, in the actual asphalt breaking scenario (b), it induces a critical alarm delay. Because the threshold boundary is too low, the high-energy, continuous mechanical impacts produced by the excavator are misclassified as transient impulse noise and prematurely rejected. Consequently, the system fails to accumulate the required temporal continuity, issuing the first warning only after 20 min of ongoing operation, which severely threatens pipeline safety.

Figure 18. Monitoring charts under an excessively loose impulse threshold ($15\times$ multiplier). In this configuration, the system achieves immediate threat detection during the asphalt breaking work (b) and maintains zero false alarms in the baseline scenarios (a,c) within the scope of the collected dataset. Despite this apparent success, the excessively high upper boundary presents a latent vulnerability regarding generalization. In unconstrained field environments, massive, non-excavation transient shocks—such as sequential heavy freight truck movements—could easily pass through this loose primary filter. This increases the probability of false alarms, indicating that the $15\times$ setting is overfitted to the current experimental scale and lacks environmental robustness.

Initially, a lower multiplier of $5\times$ was experimentally tested (Figure 17). While this strict filter successfully suppressed all false positives during normal states (Figure 17a) and ground compacting operations (Figure 17c), it exhibited a significant limitation during asphalt-breaking operations (Figure 17b). The alarm was significantly delayed, triggering only after 20 min into the 30 min excavation process. This occurred because the excessively low impulse threshold erroneously classified genuine, high-energy impact signals as mere transient noise, thereby rejecting them. In the context of an early warning framework, a 20-min delay after the onset of unauthorized excavation is operationally unacceptable, as it fails to provide sufficient time to prevent potential pipeline damage.

Subsequently, a higher multiplier of $15\times$ was evaluated (Figure 18). Under this condition, the system achieved immediate threat detection during excavation (Figure 18b) and maintained zero false alarms within the collected dataset (Figure 18a,c). However, while $15\times$ appears effective within the scope of our current data, this excessively high upper boundary presents a latent vulnerability regarding generalization. In unconstrained industrial environments, large transient shocks—such as severe collisions from heavy freight trucks—could potentially bypass this loose primary filter. Although the system employs the temporal continuity check ($K\ge 3$) as a secondary defense mechanism, constructing a reliable field-deployable system necessitates a fundamentally strict primary filter.

Therefore, to maximize the capability to reject unpredictable noise artifacts while maintaining prompt detection, the threshold must remain as low as possible without causing operational delays. Consequently, this parameter sensitivity analysis empirically validates that the $10\times$ multiplier is a practical choice. It strikes an effective balance—ensuring prompt threat detection while providing a strict, generalized upper boundary that effectively filters out unpredictable environmental shock noises.

5.4. Operational Viability and Mitigation of Alarm Fatigue

From an algorithmic perspective, maximizing frame-by-frame detection sensitivity is often prioritized in anomaly detection. However, in the complex acoustic environments of petrochemical facilities, such hypersensitivity frequently introduces a high False Positive Rate (FPR). Frequent false alarms contribute to “alarm fatigue” among control room operators, potentially reducing trust in automated safety systems and causing delays in responding to genuine pipeline threats [35]. This operational challenge was demonstrated by the Isolation Forest baseline in Section 5.2, which generated numerous false alerts in response to benign ground compacting vibrations. Conversely, relying on models that are overly conservative or structurally limited for spatial–temporal data—such as the standard VAE and One-Class SVM baselines—can result in the opposite extreme: an inability to breach thresholds during actual pavement destruction, leading to significant False Negatives.

The proposed field-feasible early warning framework addresses this operational trade-off by shifting the focus from frame-level thresholding to systematic event-level verification. Consequently, the relatively low number of definitive “Active Fault” frames recorded during the asphalt-breaking event is not a deficiency in detection capability, but rather a deliberate design choice embedded within the hierarchical continuity logic $(K\ge 3)$. By enforcing this multi-window temporal verification, the system intentionally filters out isolated stochastic anomalies to maintain a minimized false-positive rate against prominent industrial noise. For site engineers, receiving a constant stream of hypersensitive alerts holds less practical value than receiving reliable, event-level notifications confirming that unauthorized excavation is likely occurring. By translating abstract statistical reconstruction errors into actionable field metrics, the proposed framework demonstrates the practical reliability necessary for deploying effective predictive maintenance systems in industrial networks.

6. Conclusions and Future Work

This study proposed a novel, field-oriented early warning framework that leverages existing attached accelerometers and a domain-tailored 2D CNN-VAE architecture to protect underground petrochemical pipelines from unauthorized third-party damage (TPD). By combining domain-informed envelope STFT preprocessing with hierarchical, unsupervised anomaly detection logic, the system effectively addresses the fundamental vulnerabilities of conventional threshold-based pipeline monitoring. The primary contributions and future perspectives of this research are summarized as follows:

• Ensuring Pipeline Integrity via Domain-informed Early Detection: Underground pipelines are perpetually exposed to the unpredictable threat of structural damage from unauthorized excavations. The proposed framework effectively identified high-risk vibration loads—specifically isolating the wideband high-frequency transient shocks and periodic impact rhythms of actual asphalt breaking—even at a challenging monitoring radius of 55 m. This empirical validation highlights the practical effectiveness of the system as a true “Early Warning” mechanism, capable of triggering halt-work orders and preventing potential accidents well before any physical rupture or structural degradation occurs.
• Mitigating Alarm Fatigue and Maximizing Operational Efficiency: Conventional amplitude-based monitoring systems suffer from high false-alarm rates, frequently misclassifying routine, high-energy ambient noises (e.g., passing heavy vehicles or ground compacting) as critical threats. Such hypersensitivity inevitably induces “Alarm Fatigue,” severely degrading operators’ situational awareness. By meticulously decoding the spatial–temporal textures of the signals through envelope spectrograms and strictly verifying temporal continuity ($K\ge 3$), the proposed framework achieved zero false alarms within the evaluated field dataset. This strategic minimization of false positives not only restores operator trust but also has the potential to significantly reduce Operational Expenditure (OPEX) by preventing the unnecessary field dispatch of maintenance personnel.
• Scalability toward a Smart Monitoring Network (Future Work): While the anomaly detection logic in this study was evaluated at individual measurement points via cross-pipeline evaluations, it is explicitly acknowledged that the current class-level statistics and performance metrics are derived from a single-site, single-event field demonstration. This explicitly serves as a preliminary test of sensor-to-sensor transferability and field feasibility, rather than a proof of broad network-level generalization. However, it establishes a robust technical foundation for deploying multi-sensor arrays across extensive pipeline networks. Although the proposed model successfully detected threats using field data acquired from a 55-m distance, the exact spatial relationship and environmental conditions are inherently variable in real-world scenarios. Therefore, systematic follow-up research is imperative to verify the comprehensive detection limits and algorithmic reliability against varying physical factors, including pipe material, diameter, wall thickness, burial depth, soil type, sensor coupling, construction distance, and equipment type.

To address this, subsequent studies will be conducted utilizing a newly constructed 200-m long-distance underground pipeline testbed. By quantitatively measuring signal attenuation between external impacts and the sensors over various distances, we will further generalize the algorithm to ensure robust monitoring under diverse environmental conditions. In addition, the system must account for near-field scenarios in which excavation occurs in close proximity to the sensors, which requires a rigorous analysis of signal amplification and its correlation with false-alarm generation.

By comprehensively decoding these distance-dependent signal dynamics, future research will focus on integrating time-synchronized data from multiple distributed sensors to enable the precise spatial tracking (localization) of excavation equipment. Ultimately, this scalable architecture is designed to be readily integrated with existing SCADA (Supervisory Control and Data Acquisition) infrastructures, evolving into a highly reliable, field-feasible intelligent pipeline monitoring platform for actual industrial deployments.