A Generic Framework for Multivariate Anomaly Detection and Root-Cause Analysis Using Slow and Fast Detection in Process Industries

Abstract

The digitalization of process industries via the Industrial Internet of Things (IIoT) has introduced challenges like poor generalization, lack of interpretability, and complex multi-frequency sensor data. Most existing systems struggle to simultaneously detect anomalies and trace their root causes, resulting in over-specialized, inflexible solutions. To address this, we present a generic framework for multivariate anomaly detection and root-cause analysis (RCA) featuring dual detection pathways. The Slow Anomaly Detection System (SADS) blends physics-based models with a data-driven LSTM to detect gradual anomalies in the absolute domain. Meanwhile, the Fast Anomaly Detection System (FADS) identifies abrupt deviations in the derivative domain. When anomalies occur, an RCA module identifies the probable input cause using model-weighted deviation scoring, which amplifies baseline deviations by their target sensitivity. Validated on an operational Reverse Osmosis (RO) plant dataset using synthetic anomaly injections, SADS showed high precision for severe anomalies, and both systems achieved strong AUC scores of 0.85–1.00. The framework is designed for transferability across continuous process industries through its modular architecture, with the physics-based component requiring the most substantial process-specific redevelopment; validation beyond the RO case study presented here is identified as a priority direction for establishing this transferability empirically.

1. Introduction

The emergence of Industry 4.0 and the rapid expansion of the Industrial Internet of Things (IIoT) have fundamentally transformed process industry operations [1]. Real-time data collection across thousands of sensors now generates vast volumes of process data, creating both opportunities for intelligent fault detection and new challenges that existing anomaly detection (AD) frameworks are not equipped to address. Figure 1 shows the Industry 4.0-based predictive maintenance system [2]. Sensor and operator data are analyzed to detect failures and trigger maintenance.

1.1. Current Research Status of Anomaly Detection (AD) and Root-Cause Analysis (RCA)

Early AD focused on univariate analysis and relied on expert-defined thresholds for monitored time series, which eventually evolved into statistical methods such as Seasonal Autoregressive Integrated Moving Average (SARIMA) [3], which depend on the variable and standard deviation to identify deviations from historical data. However, these methods struggle to capture nonlinear and higher-order dependencies, which leads to the advent of classical machine learning supervised models like Support Vector Machines (SVMs) and Random Forest (RF) [4], which improve generalization but require extensive labeled data, which is impractical in the process industry. Unsupervised methods like Isolation Forest (IForest) and Local Outlier Factor (LOF) eliminate this need, adapting to evolving patterns and handling high-dimensional or clustered data [5,6]. However, they struggle with segregation between noise and true anomalies. Consequently, deep neural networks such as Long Short-Term Memory (LSTM) and Autoencoders (AEs) have contributed to remarkable progress in time-series AD. More recently, Transformer-based methods excel at long-range dependencies and high-dimensional data [7]. However, deep learning methods are computationally expensive to train, hindering deployment on real-time edge devices without significant optimization [8]. To balance the pros and cons of methods, the current trend shifts towards fusing deep learning with statistical or physics-based models and XAI to improve accuracy and interpretability for precise root-cause analysis. However, these systems can be complex to design and require close collaboration between the data scientists and process engineers.

1.2. The Process Industry and the Focus on Water Treatment and Economic Impacts

The process industry is a manufacturing sector that produces goods through a series of steps or processes, ranging from pharmaceuticals to water treatment supplies. Recently, water treatment has earned significant research interest due to global concerns such as water scarcity and water stress [9]. Membrane-based water treatment, like Reverse Osmosis (RO) in particular, exemplifies the challenges facing modern anomaly detection. As of 2022, approximately 109,000 wastewater treatment plants are present globally, serving 35% of the global population [10]. RO accounts for approximately 70% of global desalination capacity [9], and is subjected to progressive membrane fouling that accounts for approximately 24% of total operating expenditure (OPEX) in full-scale installations [11]. A medium-brackish-water RO plant with an annual OPEX of USD 10.28 million could save USD 0.26–1.75 million per year through early and accurate anomaly detection and targeted maintenance [12]. This study focuses on applying the proposed AD framework to RO data as our case study. Figure 2 shows the economic impact of membrane fouling in RO water treatment operations.

1.3. Challenges in Industrial-Scale AD

Despite significant research effort, current anomaly detection frameworks for process industries remain fragmented, with individual solutions addressing only a subset of the challenges operators face. We identified six specific challenges as follows:

• Generalization across different plants and processes is limited [13]. Process industries use varied equipment and sensor configurations, leading to inconsistencies in data dimensionality and AD analysis [14]. This makes data-driven models difficult to deploy universally, requiring a systematic approach to handle such variations.
• Industrial anomalies manifest across diverse timescales [15], from seconds to hourly intervals, yet most AD models are optimized for a specific data frequency. Thus, an approach offering multi-timescale AD detection is required.
• The lack of a model that fuses process knowledge with time-series data. While physics-informed and hybrid approaches exist for systems with well-defined physical or chemical equations [8], such as the KESA-AD model [16], which uses chemical knowledge to enhance fault detection, there remains a need for methods that effectively integrate domain expertise with sequential data to improve anomaly detection.
• The interpretability of detected anomalies remains insufficient [17]. Deep learning models for time-series anomaly detection, including LSTMs, Transformers, and Autoencoders, operate as black boxes that cannot explain which input variable caused a detected deviation. Without interpretable root-cause attribution, operators cannot distinguish genuine faults from false positives or identify appropriate corrective actions.
• Anomaly labels are almost universally absent in real industrial settings [18], making supervised approaches impractical, leading to the utilization of unsupervised methods.
• Industrial processes are inherently cyclic, with regular non-operational interruptions for maintenance and cleaning that conventional static-baseline anomaly detectors misinterpret as faults, causing alarm fatigue and leading to the necessity of a temporal cyclic analysis.

Based on our review of 10 relevant literature surveys, none of them address all six challenges mentioned above. For instance, graph neural network (GNN)-based methods like LSGA have emerged to explicitly model inter-sensor dependencies that sequence models treat only implicitly, learning sparse association structures between sensors rather than assuming full connectivity, and do not have root-cause analysis [19]. However, these methods infer sensor relationships statistically from data rather than from governing process equations, which is the gap the present physics-grounded framework addresses, as is the gap for the establishment of a root-cause analysis module. Thus, we are motivated to develop a generic, hybrid, and interpretable framework that addresses all six challenges through a systematic six-step pipeline combining domain physics, LSTM-based machine learning, and statistically grounded detection and attribution methods. The framework is based on a dual-pathway architecture, Slow Anomaly Detection System (SADS) for slow drift detection on low-frequency data and Fast Anomaly Detection (FADS) for abrupt deviation detection on high-frequency data, and a domain-consistent RCA module. These modules are designed to be adaptive across diverse industrial units with some reconfiguration. The rest of this paper is organized as follows: Section 2 describes the proposed framework step by step. Section 3 presents the RO case study application with quantitative results. Section 4 evaluates detection performance via synthetic anomaly injection and qualitative analysis. Section 5 discusses the contributions, limitations, and conclusions.

2. Proposed Generic Framework for Multivariate Anomaly Detection and Root-Cause Analysis

The proposed framework consists of six-sequential steps pipeline with two options for anomaly detection systems, illustrated in Figure 3. This framework consists of data preprocessing, temporal cyclic analysis, feature engineering, feature selection, two systems of anomaly detection, SADS and FADS, and RCA modules. Further in-depth introduction of each step is as detailed below.

2.1. Step 1: Data Preprocessing

The first step partitions all process variables into input variables $X=\{x_1,\dots ,x_p\}$ and output variables $Y=\{y_1,\dots ,y_q\}$ based on process knowledge and engineering judgment. Output variables are those whose anomalous behavior is of primary monitoring interest, typically product quality metrics or key performance indicators. Input variables are the remaining sensors, operational setpoints, and control signals that drive the outputs. This partitioning defines the structural assumption of the framework: anomaly detection focuses on whether outputs deviate from their expected behavior given current input conditions, rather than treating all variables symmetrically.

Preprocessing addresses three issues. Missing values, which typically correspond to sensor dropouts or non-operational shutdown periods, are removed by listwise deletion rather than imputation, since filling sensor readings with estimated values risks introducing artificial patterns that distort the learned normality boundary. Physically unreasonable readings, values outside the physically feasible operating range determined by equipment specifications and domain knowledge, are flagged and removed. Finally, timestamps are verified for consistency, and the dataset is resampled to a uniform sampling interval where necessary [20].

2.2. Step 2: Temporal Cyclic Analysis

Industrial processes are inherently cyclic, with normal operation periodically interrupted by planned non-operational events such as maintenance procedures and system startup and shutdown routines. If left unaddressed, models trained on historical data incorrectly interpret abrupt cycle-transition transients as anomalies, increasing false positive rates and contributing to alarm fatigue [21]. Figure 4 shows the pictorial of temporal cyclic analysis.

To address this, the proposed framework uses a temporal cyclic analysis to identify the operational cycle structure of the process and encodes it as explicit contextual features before training. Cycle boundaries are identified by a change-point rule applied to a designated indicator variable $x_{ind}\left(t\right)$, selected as a process variable that reliably approaches zero or exhibits a sharp discontinuity during non-operational periods. The absolute first-order difference is computed at each timestep:

$$d\left(t\right)= \mid x_{ind }\left(t\right)-x_{ind}(t-1)\mid$$

A change point is flagged at a time $t$ where $d\left(t\right) > {\delta }_{cyc}$, where ${\delta }_{cyc}$ is a fixed sensitivity threshold. Consecutive change points partition the record into candidate segments; a segment is accepted as a valid operational cycle only if its length satisfies $L_{seg} \ge L_{min}$, the minimum acceptable cycle length in timesteps. Segments shorter than $L_{min}$ are discarded and merged into the search for the next boundary, preventing brief transients from being misclassified as distinct cycles. Accepted segments are assigned sequential Cycle IDs, and the Cycle Time is set to $0, 1, 2, \dots$ from the start of each segment.

Cycle identification requires domain knowledge since each process differs. Using the RO process as an example, for prolonged shutdowns like deep cleaning, sensors are turned off, and missing data rows are simply dropped. For short transitions like brief backwashes [22], two to three key parameters, such as feed flow, feed pressure, and Differential Pressure, are used to detect cycle boundaries. Cyclic features are used in the model to prevent false positives arising from cycle-transition effects and improve the detection of genuine process anomalies within the operational phase.

2.3. Step 3: Feature Engineering

Raw process variables are often insufficient to characterize the dynamic behavior of industrial systems. Two categories of engineered features are constructed from $p$ input variables to expose the autocorrelative and interactive structures that drive process behavior. Temporal lag features capture the autocorrelated dependencies of each variable across lag orders of $l=1, 2, 3, 6, 12$, providing the model with an explicit representation of process delay and multi-rate dynamics.

$$x_i^{lag}\left(t\right)=x_i\left(t-l∆t\right)$$

(1)

Pairwise cross-features capture nonlinear inter-variable interactions, such as hydraulic power resulting from pressure $\times$ flow rate, which governs energy transfer in pump or membrane systems.

$$x_{ij}^{\times }\left(t\right)=x_i\left(t\right)·x_j\left(t\right),\hspace{1em}\hspace{1em}\forall i,j \in \left\{1,\dots , p\right\}, i<j$$

(2)

For $p$ inputs and five lag orders, these yield $5p$ lag features and $\left({\displaystyle \genfrac{}{}{0pt}{}{p}{2}}\right)={\displaystyle \frac{p(p-1)}{2}}$ cross-features. Now, the original set of preprocessed input variables is extended with the full set of engineered features, yielding an expanded feature matrix $X^{\ast }\in {\mathbb{R}}^{T\times M}$, where $T$ is the number of observations and $M$ is the total number of original and engineered features. This expanded matrix serves as the input to the feature selection step.

2.4. Step 4: Feature Selection

The expanded feature matrix may contain numerous features, many of which are redundant and weakly correlated with the target output. A two-stage procedure combining Random Forest (RF) and Shapley Additive exPlanations (SHAP) is applied independently for each output variable $y_k$. RF captures complex, nonlinear relationships in industrial data without requiring strict assumptions [23], while SHAP provides theoretically grounded, model-agnostic feature attribution that is consistent, locally accurate, and accounts for feature interactions [24,25]. The two-stage design improves computational efficiency: RF first screens the large feature space to reduce candidates, and then SHAP performs precise ranking on this smaller set, producing more reliable and interpretable results than using either method alone.

In stage 1, a full Random Forest (RF) regression model is trained on all engineered features, and the top 4K features are retained by mean decrease in impurity (MDI) importance. Cycle ID is excluded from the selection process because, as a categorical identifier, it would receive artificially inflated impurity-based importance scores regardless of its genuine predictive relevance. In stage 2, a SHAP TreeExplainer is applied to a subsample of the training data on the Stage 1 reduced set, and the final top $K=5$ features are selected as the specific output feature subset $S_k$ by mean absolute SHAP value. The resulting feature subsets $S_k$, together with Cycle Time, serve as inputs to all subsequent anomaly detection and RCA steps.

2.5. Step 5: Anomaly Detection

We recognize that industrial anomalies span fundamentally different timescales and that relying on a single detection system is insufficient for a generic process-monitoring application. To address the limitation, the proposed framework offers a dual-pathway architecture of two subsystems: SADS targets gradual, long-term deviations such as membrane fouling, sensor calibration drift, and performance degradation, and is used for lower data frequency. FADS targets abrupt, short-duration deviations that manifest within minutes. Both systems share the same $3\sigma$ anomaly threshold mechanism for methodological consistency. The usage of SADS or FADS is determined by the frequency of the data collected from the unit operation. For any sampling frequency of less than 5 min, FADS is used. Otherwise, SADS is preferred. In general, to identify the deviations within a cycle, the cycling times differ vastly, even in any membrane processes. For instance, semi-batch RO has a cycle time of 10–20 min, whereas general RO can have hours of operational cycle length. If the cycle is above 5 min, SADS is unsuitable as it only detects deviation after a while.

2.5.1. Slow Anomaly Detection System (SADS)

SADS is built around a two-component hybrid predictive model. The physics predictive component computes the expected output value from the first-principle equations:

$${\widehat{y}}_k^{phys}\left(t\right)=f_k^{phys}\left(x\left(t\right)\right)$$

(3)

Here, $f_k^{phys}(·)$ is the physics equation specific to output $y_k$, and $x\left(t\right)$ is the vector of relevant input variables at time $t$. The specific form of $f_k^{phys}(·)$ is determined by the governing physical laws of the process and varies across output variables and application domains.

Next, the physics residual is computed as the pointwise difference between the actual values and the physics-based prediction:

$$e_k^{phys}\left(t\right)=y_k\left(t\right)-{\widehat{y}}_k^{phys}\left(t\right)$$

(4)

This residual captures the portion of the output behavior that the deterministic physics equation cannot explain, arising from modeling simplifications, sensor offsets, or process nonlinearities.

Rather than detecting anomalies directly on the physics residual, an ML model is employed to first learn the expected pattern of this residual. In complex process industries, sensor data is characterized by long-term temporal dependencies and nonlinear lags. Traditional Recurrent Neural Networks (RNNs) often fail to capture these due to the vanishing gradient challenge [26]. To address the issue, we introduce an LSTM network with additive attention trained to predict the expected pattern of this residual. Figure 5 shows LSTM’s unique mechanisms, including the input gate $i_t$, forget gate $f_t$, output gate $o_t$, and cell state $c_t$. Such a structure allows for the effective capture of both short-term and long-term dependencies in time-series data, which is essential for modeling process dynamics of the industrial processes. Mathematically, for each time step $t$, the LSTM update equations are as follows:

$$f_t=\sigma \left(W_f{h}_{t-1}+U_f{x}_t+b_f\right)$$

(5)

$$i_t=\sigma \left(W_i{h}_{t-1}+U_i{x}_t+b_i\right)$$

(6)

$$o_t=\sigma \left(W_o{h}_{t-1}+U_o{x}_t+b_o\right)$$

(7)

$${\widehat{c}}_{\mathrm{t}}=tan h\left(W_c{h}_{t-1}+U_c{x}_t+b_c\right)$$

(8)

$$C_t=f_t\odot c_{t-1}+i_t\odot \widetilde{c_t}$$

(9)

$$h_t=o_t\odot \mathrm{tan\; h}\left(C_t\right)$$

(10)

Here, $W,U$ and $b$ are learnable weight matrices, $x_t$ is the input vector, bias vectors $\sigma (·)$ are the sigmoid activation function, and $\odot$ is elementwise multiplication.

The attention mechanism adaptively weights the relevance of each time step in the input sequence, allowing the model to focus on the most informative observations for each prediction. The attention weights are computed as follows:

$${\alpha }_t=Softmax\left(w_2^T\mathrm{tan\; h}\left(W_1{h}_t+b_1\right)\right)$$

(11)

Here, $W_1,w_2$, and $b_1$ are learnable parameters. Then, the final residual is computed by a two-layer fully connected head given a selected feature subset $S_k$ as inputs:

$$\begin{array}{c}{\widehat{e}}_k^{ML}\left(t\right)=W_{4}ReLu\left(W_{3}c+b_3\right)+b_4\end{array}$$

(12)

where $c$ represents the context vector resulting from the sum of all hidden states.

Sequence construction is cycle-aware: sliding windows of length $L$ are generated strictly within individual cycles, preventing the model from learning spurious cross-cycle dependencies. The LSTM is trained using Huber loss, which is less sensitive to residual outliers than mean squared error (MSE) [27], with early stopping and validation-based model selection. Mathematically, Huber loss is as follows:

$${\mathcal{L}}_{Huber}=\left\{\begin{array}{cc}{{\displaystyle \frac{1}{2}}a}^2\hfill & \hfill if \left|a\right|\le {\delta }_H\\ {\delta }_H(\left|a\right|-{\displaystyle \frac{1}{2}}{\delta }_H)& \hfill otherwise\end{array}\right.$$

(13)

where $a=e_k^{phys}\left(t\right)-{\widehat{e}}_k^{ML}\left(t\right)$ and ${\delta }_H$ is a threshold parameter used in Huber loss.

The hybrid total prediction combines the physics baseline and the ML residual correction:

$${\widehat{y}}_k^{total}\left(t\right)= {\widehat{y}}_k^{phys}+{\widehat{e}}_k^{ML}\left(t\right)$$

(14)

To determine an anomaly, the anomaly score is computed as the absolute deviation between the actual data and the total prediction.

$$r_k\left(t\right)=\left|y_k\left(t\right)-{\widehat{y}}_k^{total}\left(t\right)\right|$$

(15)

In accordance with industrial Statistical Process Control (SPC) practice [28], an $3\sigma$ anomaly threshold is used and is calibrated on the validation set residual distribution. An anomaly is flagged for output $y_k$ at timestamp $t$ if the absolute anomaly score exceeds the threshold:

$$Anomaly\left(y_k\left(t\right)\right)=\left\{\begin{array}{cc}1\hfill & \hfill if \left|r_k\left(t\right)\right|> {{\delta }^{SADS}}_k\\ 0\hfill & \hfill otherwise\end{array}\right.$$

(16)

where:

$${\delta }_k^{SADS}={\mu }_{r_k}+3{\sigma }_{r_k}$$

(17)

Here, ${\mu }_{r_k}$ is the mean and ${\sigma }_{r_k}$ is the standard deviation during a validation phase.

2.5.2. Fast Anomaly Detection System (FADS)

FADS operates in the derivative domain, computing the discrete rate of change for each variable:

$${\dot{x}}_i\left(t\right)={\displaystyle \frac{x_i\left(t\right)-x_i\left(t-∆t\right)}{∆t}}$$

(18)

The theoretical justification for applying linear regression in the derivative domain follows from the first-order Taylor expansion: even if the relationship between absolute process variables is nonlinear, the relationship between their derivatives is locally linear at each operating point. This provides a principled basis for multivariate linear regression:

$${\widehat{\dot{y}}}_k\left(t\right)=w_k^T{\dot{X}}_k\left(t\right)+b_k$$

(19)

which is fitted by ordinary least squares on normal operating data. The simplicity of linear regression makes FADS computationally lightweight and suitable for real-time edge deployment. An anomaly is flagged when the derivative residual exceeds its $3\sigma$ threshold.

$${\rho }_k\left(t\right)={\dot{y}}_k\left(t\right)-{\widehat{\dot{y}}}_k\left(t\right)$$

(20)

$$Anomaly\left(y_k\left(t\right)\right)=\left\{\begin{array}{cc}1\hfill & \hfill if \left|{\rho }_k\left(t\right)\right|>{\delta }_k^{FADS}\\ 0\hfill & \hfill otherwise\end{array}\right.$$

(21)

where:

$${\delta }_k^{FADS}={\mu }_{{\rho }_k}+3{\sigma }_{{\rho }_k}$$

(22)

2.5.3. Relationship Between SADS and FADS

Table 1. Summary of SADS and FADS.

Property	SADS	FADS
Operating domain	Absolute value	Rate of change (derivative)
Predictive model	Physics model + LSTM with attention	Multivariate linear regression
Justification for model choice	Nonlinear long-range temporal dependencies	Local linearity of derivatives
Target timescale	Slow drift, gradual degradation or slow timestamp interval	Sudden spikes, abrupt faults or fast timestamp interval
Computational cost	Relatively high	Low
Real-time suitability	No	Yes
Anomaly score	$r_k\left(t\right)=y_k\left(t\right)-{\widehat{y}}_K^{total}(t)$	${\rho }_k\left(t\right)={\dot{y}}_k\left(t\right)-{\widehat{\dot{y}}}_k(t)$
Detection threshold	${\mu }_{r_k}+3{\sigma }_{r_k}$	${\mu }_{{\rho }_k}+3{\sigma }_{{\rho }_k}$

summarizes the key distinguishing characteristics of the two anomaly detection systems and their complementary roles within the framework.

Both systems use the same anomaly-threshold mechanism, the three-sigma rule, to ensure methodological consistency across the framework. An observation is considered anomalous if flagged by either SADS or FADS. The source system provides an initial indication of the anomaly timescale, which informs the subsequent root-cause analysis described in the next section.

2.6. Step 6: Root-Cause Analysis (RCA)

Anomaly detection alone is insufficient for effective industrial process management. Operators must also identify the source of the anomaly. The root-cause analysis (RCA) module traces the detected anomaly back to its most probable contributing input features. A key design principle is domain consistency: the feature deviation is assessed in the same mathematical domain as the detecting system, ensuring that the RCA attribution is physically coherent with the detection signal.

2.6.1. SADS-RCA

For an anomaly at timestamp $t^{\ast }$, a rolling pre-event baseline window of width $W_{baseline}$ is constructed from normal observations preceding the event.

$$B_i\left(t^{\ast }\right)=\left\{x_i\left(t\right): t\in \left[t^{\ast }-W_{baseline}, t^{\ast }\right),t\in T\right\}$$

(23)

The Z-score is computed to measure how many standard deviations each input feature has deviated from its recent baseline.

$$Z_i\left(t^{\ast }\right)={\displaystyle \frac{x_i\left(t^{\ast }\right)-{\mu }_i^B}{{\sigma }_i^B}}$$

(24)

To account for the differential influence of each feature on the target output, proxy sensitivity weights ${\beta }_i$ are estimated by fitting a linear regression on non-anomalous rows and normalized to sum to unity:

$$y_k\approx {\displaystyle \sum _i}{\beta }_i{x}_i+\epsilon$$

(25)

$$\widetilde{{\beta }_i}={\displaystyle \frac{\left|\widehat{{\beta }_i}\right|}{{\sum }_j\left|\widehat{{\beta }_i}\right|}}$$

(26)

The model-weighted contribution score is:

$${\mathsf{\Omega }}_i\left(t^{\ast }\right)=\widetilde{{\beta }_i}\times \left|Z_i\left(t^{\ast }\right)\right|$$

(27)

Because the contribution score ${\Omega }_i(t\ast )$ is computed for every input feature simultaneously (Equation (27)), the module is not restricted to reporting a single cause. The primary root cause is the feature with the highest score:

$$Root Caus{e}^{SADS\left(t^{\ast }\right)}={\displaystyle \underset{\mathit{i}}{\mathrm{argmax}}} {\mathsf{\Omega }}_i\left(t^{\ast }\right)$$

(28)

and the module additionally reports the ranked top 5 contributing features by enabling identification of simultaneous multi-feature deviations rather than a forced single-cause attribution. The direction of the deviation is reported alongside the score: a positive Z-score ($Z_i>0$) indicates the feature is anomalously high relative to the recent baseline, whereas a negative Z-score ($Z_i<0$) indicates it is anomalously low. With this directional information, the operators can make an immediate physical interpretation.

2.6.2. FADS-RCA

Unlike RCA in SADS, FADS-RCA assesses the deviation of each input feature in the derivative domain for each anomaly detected. The baseline rate of change for each is defined as the mean derivative during non-anomalous observations across the full dataset:

$${\mu }_i^{normal}=\left({\displaystyle \frac{1}{T_{normal}}}\right){\displaystyle \sum _{i\in T_{normal}}}\dot{x_i}\left(t\right)$$

(29)

The derivative deviation is computed to measure how fast the feature is changing at the anomalous moment compared to its normal operating behavior:

$$∆\dot{x_i}\left(t^{\ast }\right)={\dot{x}}_i\left(t^{\ast }\right)-{\mu }_i^{normal}$$

(30)

The contribution score is weighted by the FADS regression coefficient $W_i$:

$${\mathsf{\Psi }}_i\left(t^{\ast }\right)=w_i\times ∆{\dot{x}}_i\left(t^{\ast }\right)$$

(31)

As with SADS-RCA, the ranked top 5 features by $\left|{\mathsf{\Psi }}_i\right(t\ast \left)\right|$ are reported, allowing for identification of simultaneous contributing sensors in the derivative domain, with the highest score as the primary root cause:

$$Root Caus{e}^{FADS\left(t^{\ast }\right)}={\displaystyle \underset{\mathit{i}}{\mathrm{argmax}}} {|\mathsf{\Psi }}_i\left(t^{\ast }\right)|$$

(32)

The sign of ${\mathsf{\Psi }}_i$ indicates whether the feature drove the output rate upward or downward.

The RCA results are presented through a stacked time-series dashboard: the top panel shows the target output with anomaly timestamps highlighted, and each subsequent panel shows an input feature time series with root-cause timestamps marked. This visual layout allows operators to verify RCA attributions against raw sensor traces and correlate anomaly events with known operational activities such as chemical dosing or maintenance.

3. Application of Framework: Real-World Case Study

3.1. Step 1: Dataset and Preprocessing

The case study employs a real-world industrial dataset obtained from the SCADA system of an operational RO water treatment plant located in China. The dataset characteristics are summarized in

Table 2. Data characteristics.

Property	Description
Source	SCADA system, RO water treatment plant, China
Duration	2 years
Sampling intervals	1 h (SADS dataset); 5 min (FADS dataset), independently recorded
Number of variables	11 (process variable) + 1 (timestamp)

. The dataset is fully unlabeled, which is representative of the real-world deployment conditions the framework is designed for. The plant’s SCADA system stores the same sensors at two native recording rates, and both files were obtained directly from the plant: an hourly interval export spanning the full two-year period, used for SADS, and a 5-minute-interval export from the same instruments, used for FADS. Neither file was derived from the other, and no interpolation, upsampling, or resampling was applied to produce either dataset.

Figure 6 illustrates a schematic of an RO system where feed water is first pretreated and then pushed through a semi-permeable membrane with external high pressure to obtain purified water known as permeate and leave contaminated water in the concentrate stream.

The complete datasets, including raw SCADA recordings, derived feature sets, trained model parameters, evaluation metrics, and preprocessing pipelines, are publicly available on GitHub at (accessed on 10 June 2026). https://github.com/naruesornd/generic_framework_ad.git (release v1.0) The repository also contains the full implementation code, reproducibility guidelines, and Supplementary Materials accompanying this paper. Researchers are encouraged to access and utilize the dataset for academic and non-commercial purposes under the terms specified in the repository license.

Variable classification followed the process physics and control architecture of the RO system (

Table 3. List of process variables used in this paper.

Variable Name	Unit	Type	Justification
Concentrate Flow	gpm	Output	Resultant from mass balance
Concentrate Pressure	psi	Output	Resultant from pressure balance
Feed Flow	gpm	Input	Flow of source water entering the RO system
Feed Pressure	psi	Input	Hydraulic pressure in the feed side of the RO membrane
Feed Conductivity	µS/cm	Input	Reflects source water quality; not controlled by the RO system itself
Feed Temperature	°F	Input	Ambient-dependent variable that affects membrane permeability
Differential Pressure	psi	Output	Fouling state indicator
Permeate Flow	gpm	Input	Operationally setpoint; controller compensation statistically entangled with fouling
Permeate Pressure	psi	Input	Operationally setpoint
Permeate Conductivity	μS/cm	Output	Conductivity of purified permeate stream
Recovery	%	Input	Ratio of permeate flow to feed flow

). The four output variables selected for anomaly monitoring are: Differential Pressure (primary fouling indicator), Permeate Conductivity (primary water quality indicator), Concentrate Flow (volumetric balance indicator), and Concentrate Pressure (hydraulic state indicator). Permeate Flow and Permeate Pressure were classified as inputs because they are operationally controlled at setpoints with a mean of 297.1 gpm and 34.4 psi, respectively, making them externally driven rather than emergent process responses.

To assess this classification empirically, we performed cycle-aware Granger causality tests between Differential Pressure (our primary fouling indicator) and each candidate input, using first-differenced series confirmed stationary by the Augmented Dickey–Fuller test, at lags 1–12 matching our feature-engineering lag set. Permeate Pressure showed a dominant Permeate Pressure → Differential Pressure direction (p < 0.05 at all tested lags) with only marginal evidence of reverse influence, consistent with its classification as an externally driven input. Permeate Flow, however, showed significant bidirectional causality (p < 0.01 at all lags in both directions), indicating that despite setpoint control, Permeate Flow is statistically entangled with the fouling process.

We attribute this bidirectional signature to closed-loop control rather than to Permeate Flow being an emergent process output: because Permeate Flow is actively regulated to a fixed setpoint, the controller’s compensating actuation as membrane resistance rises inherently correlates with the fouling process it is responding to, even though Permeate Flow itself remains a directly manipulable, actively controlled quantity rather than a free process response. We retain Permeate Flow’s classification as an input on this basis, consistent with the framework’s actionability-based partitioning criterion.

Preprocessing removed 379 observations (2.29%) corresponding to non-operational shutdown periods identified as simultaneous missing values across all variables. Physical bounds filtering flagged and removed 21 observations: six Feed Temperature readings outside the range 40–120 $°\mathrm{F}$, 13 Feed Temperature missing values, and two Permeate Conductivity readings of exactly 0 $\mathsf{\mu }\mathrm{S}/\mathrm{c}\mathrm{m}$. Sampling intervals were verified as uniformly 1 h and 5 min throughout the two datasets.

3.2. Step 2: Temporal Cyclic Analysis

Cycle boundaries were identified using simultaneous drops in Differential Pressure, Feed Pressure, and Feed Flow as indicators of system shutdown and cleaning events, consistent with the backwash and chemical cleaning procedures standard in RO operation [22]. A total of 89 operational cycles were identified across the full dataset, with a mean cycle length of 127.4 timestamps and individual cycle lengths ranging from 3 to 370 timestamps, reflecting the variable interval between scheduled maintenance events. Each observation was assigned a Cycle ID and Cycle Time. Figure 7 shows the cycle structure of three representative process variables, where different colors correspond to different cycle IDs.

3.3. Step 3: Feature Engineering

Feature engineering produced 59 candidate features from the 7 input variables: 35 lag features (lags $t-1$, $t-2$, $t-3$, $t-6$, and $t-12$), 21 pairwise cross-features, and 2 cycle features (Cycle ID, Cycle Time). Figure 8 shows examples of a lag feature and a pairwise cross-feature.

3.4. Step 4: Feature Selection

The two-stage RF+SHAP procedure was applied independently for each output variable. The selected feature subsets are physically interpretable and align with the governing RO process equations. Figure 9 shows the top 5 features for all four outputs. For Differential Pressure, the selected features include Feed Flow and Feed Temperature, consistent with the Hagen–Poiseuille law for flow resistance with an Arrhenius-type viscosity correction. For Permeate Conductivity, Feed Conductivity and Feed Temperature dominate, consistent with the Solution-Diffusion model for salt transport. Concentrate Flow and Concentrate Pressure are predominantly driven by Feed Flow and Feed Pressure, respectively, consistent with their governing mass and pressure-balance equations. This physics-SHAP consistency validates that the data-driven selection recovers the correct physical drivers without requiring explicit physics constraints.

3.5. Step 5: Anomaly Detection

At this step, both the 1-hour-interval and the 5-minute-interval datasets undergo SADS and FADS, respectively. The following two subsections explain the application of SADS and FADS on the target outputs.

3.5.1. SADS: Physics Models, LSTM Training, Detection Results

RO-Specific Physics Models

Due to data sensitivity, plant specifications such as membrane area and osmotic pressure are unavailable; so, calibrations are used to build physics models for Differential Pressure and Permeate Conductivity. For Differential Pressure, the Hagen–Poiseuille equation for viscous flow resistance in spiral-wound membrane channels is combined with an Arrhenius-type temperature correction for water dynamic viscosity.

$$∆P_{phys}=k·Q_{feed}^{\beta }·e^{\alpha ·T_c}+\gamma C_{feed}+c$$

(33)

Here, $Q_{feed}$ is the feed flow rate, $T_c$ is the feed temperature in Celsius, $C_{feed}$ is the feed conductivity, and $\gamma$, $k$, $\beta$, $\alpha$, $C$ are parameters calibrated by nonlinear least squares on steady-state calibration data. For Permeate Conductivity, the Solution-Diffusion model is applied with a dynamic salt permeability coefficient $B\left(t\right)$ updated via a 168 h (1 week) rolling median.

$$C_{phys}=B\left(t\right)·∆C_{log }·{\displaystyle \frac{TCF}{Q_{perm}}}$$

(34)

where:

$$TCF=\exp \left(2640·\left({\displaystyle \frac{1}{298}}-{\displaystyle \frac{1}{273+T_C}}\right)\right)$$

(35)

Here, $∆C_{log }$ is the log-mean concentration driving force, $Q_{perm}$ is the permeate flow rate, and $TCF$ is the Arrhenius temperature correction factor for salt diffusivity.

For Concentrate Flow and Concentrate Pressure, their physics models are derived from mass balance and pressure balance equations:

$$Q_{conc,phys }=Q_{feed}-Q_{perm}$$

(36)

$$P_{conc,phys}=P_{feed}-∆P_{phys}$$

(37)

Here, $Q_{feed}$, $Q_{perm}$, and $P_{feed}$ are the feed flow rate, permeate flow rate, and feed pressure, respectively.

ML Model: Hyperparameters and Training

The LSTM architecture and training hyperparameters are reported in

Table 4. Hyperparameters used in this application.

Hyperparameters	Value
Hidden dimension	64 units
Number of LSTM layers	1
Sequence length	12-time steps (12 h)
Dropout	0.2
Optimizer	AdamW ($lr=5\times {10}^{-4},$ $weight decay={10}^{-4}$)
Loss function	Huber loss
Batch size	64
Seed	42
Train/validation split	80%/20%
Train/test split	80%/20%

. The dataset was split into 80% and 20% chronologically for train and test sets, respectively. The validation set was then obtained chronologically from the last 20% of the training set. Sequences of length $L_{seq}=12$ were created in a cycle-aware manner. Sliding windows were generated strictly within individual operational cycles to prevent any sequence from spanning a non-operational gap between cycles. A cycle buffer of $\pm$6 timesteps was applied in the test set to suppress false positives at cycle transitions.

Hybrid Prediction and Anomaly Detection Results

The SADS results on the test set (2988 timesteps) are reported in

Table 5. SADS hybrid model performance on the test set (2988 timestamps).

Output	Hybrid ${\mathbf{R}}^2$	MAE	Threshold ${\mathit{\delta }}_{\mathit{k}}$	Anomalies
Differential Pressure	0.543	2.48	9.36	0
Permeate Conductivity	0.403	1.35	6.28	78
Concentrate Pressure	0.932	6.72	17.7	41
Concentrate Flow	0.997	0.65	1.65	1

. The hybrid model consistently improves upon the physics-only baseline across all four outputs. The most dramatic improvement is for Differential Pressure, where the hybrid R² rises from −1.12 to 0.543. The strongly negative physics-only R² reflects progressive membrane fouling across the test period that systematically increases the actual Differential Pressure above the calibrated clean-membrane baseline; the LSTM successfully learns this fouling trajectory as a structured residual, converting a physics model that performs worse than a mean predictor into one that explains 54.3% of test-set variance. Concentrate Pressure also shows substantial improvement (0.688 to 0.932), confirming that the LSTM effectively corrects the approximation in the pressure balance equation. For Permeate Conductivity, the hybrid model’s test-set ${\mathrm{R}}^{\mathrm{2}}$(0.403) is lower than the physics-only baseline (0.443), presenting a decrease of 0.040 ${\mathrm{R}}^{\mathrm{2}}$ units (approximately 9% relative). This indicates that, for this output, the LSTM residual correction degrades rather than improves prediction performance. A plausible explanation is that the LSTM, trained via validation-based model selection, fits residual patterns specific to the validation period that do not generalize to the test period, effectively overfitting to noise in a physics residual that is only weakly structured for this output.

The anomaly rates reveal physically interpretable differences across output variables. Permeate Conductivity has the highest anomaly rate (2.61%), corresponding to periods where permeate salt passage deviates from what the dynamic $B\left(t\right)$ physics model predicts, potentially indicating membrane integrity events or unusual salt-loading conditions. Concentrate Pressure flags 1.37% of test timesteps, consistent with its strong hydraulic coupling to the feed-side pressure that makes it sensitive to hydraulic anomalies. Differential Pressure and Concentrate Flow are flagged at 0.00% and 0.03%, respectively, indicating that their hybrid models characterize most of the test period as normal. Figure 10 shows a visualized example of the SADS result for Concentrate Flow.

3.5.2. Fast Anomaly Detection System (FADS)

FADS was applied to the 5 min resampled dataset with a cycle buffer of $\pm 6$ timesteps. From the process point of view, a fast system will have low residence time, which means that the engineered lag features and cross-features become inconsequential. Hence, only base sensor features (not engineered lag or cross-features) were used as inputs to FADS, as reported in

Table 6. List of input features used in model training for FADS.

Target Output	Input Features (After Extracted from Top 5 Features by SHAP)
Differential Pressure	Feed Pressure, Permeate Flow, Feed Flow, Feed Conductivity, Feed Temperature, Recovery
Permeate Conductivity	Feed Conductivity, Permeate Pressure, Feed Temperature
Concentrate Flow	Recovery, Feed Flow
Concentrate Pressure	Feed Pressure, Feed Flow, Recovery, Feed Conductivity

.

The derivative-domain linear regression R² values are reported in

Table 7. Summary of FADS results for each output.

Output Variable	Anomalies Detected	${\mathbf{R}}^2$
Differential Pressure	75	0.650
Permeate Conductivity	154	0.234
Concentrate Flow	95	0.940
Concentrate Pressure	125	0.993

. Concentrate Pressure and Concentrate Flow achieved high derivative R² (0.993 and 0.940), indicating that their rates of change are strongly explained by the selected input derivatives, making the residual-based anomaly flags highly reliable. Differential Pressure showed moderate R² (0.650), and Permeate Conductivity showed low R² (0.234), the latter consistent with nonlinear conductivity dynamics not captured by the linear derivative model. FADS complements SADS by detecting abrupt deviations that the physics-LSTM model’s temporal smoothing would absorb. Figure 11 shows the results on 5 min interval data for Concentrate Flow.

3.6. Step 6: Root-Cause Analysis (RCA)

3.6.1. SADS-RCA

The RCA module was applied to all anomaly timestamps identified by SADS and FADS. For Differential Pressure, since there was no sign of anomaly, the RCA module was inapplicable here. For Concentrate Flow, the only anomaly, presenting in Cycle 87, is a sudden deviation of the true sensor value from the hybrid baseline (Figure 12). Based on the RCA dashboard (Figure 13), the RCA module indicates that Recovery was the root cause, marked with a black cross with a similar anomaly as in Concentrate Flow, but in the opposite direction.

For Permeate Conductivity (Figure 14 and Figure 15), most anomalies cluster in Cycle 76 due to long and large deviations between the true sensor values and the predictions. The RCA module identified Feed Conductivity (lag 12) as the root cause for all eight clustered anomalies. This was consistent with a gradual rise in predictions versus a sudden spike in the sensor value, with a peak of 274.50 $\mathsf{\mu }\mathrm{S}/\mathrm{c}\mathrm{m}$ against a baseline mean of 272.17 $\mathsf{\mu }\mathrm{S}/\mathrm{c}\mathrm{m}$.

For Concentrate Pressure (Figure 16 and Figure 17), all 41 anomaly timestamps across Cycles 74–76 were attributed to Feed Pressure as the primary root cause. This attribution is physically plausible: since $P\_conc \approx P\_feed - \Delta P$, any deviation in Feed Pressure propagates directly to the concentrate pressure side.

3.6.2. FADS-RCA

For Differential Pressure (Figure 18), four anomalies in Cycle 55 were attributed to Feed Pressure, with relative changes of 4.3–7.4% in Feed Pressure compared to 3.0–5.6% in the output, confirming the attribution quantitatively.

For Permeate Conductivity (Figure 19), Cycle 6 showed that the root cause of the only anomaly was Feed Conductivity by the RCA module. This was consistent with a sudden sharp spike in Feed Conductivity, from the mean baseline of 244.03 $\mathsf{\mu }\mathrm{S}/\mathrm{c}\mathrm{m}$ to 252.95 $\mathsf{\mu }\mathrm{S}/\mathrm{c}\mathrm{m}$ at the anomalous timestamp.

For Concentrate Flow (Figure 20), the RCA module identified Feed Flow as the root cause for both anomalies in Cycle 26, with contributions of −16.99 and −19.50, respectively. This was visually confirmed by steep downward spikes in Feed Flow at the anomalous timestamps, where Feed Flow was changing faster than other input features.

4. Evaluation via Synthetic Anomaly Injection

Since the RO dataset contains no ground-truth anomaly labels, detection performance was evaluated by injecting known synthetic anomalies into verified clean windows of the test period and measuring whether each detector correctly identifies them. This approach provides a fully controlled evaluation with explicit ground truth that is independent of the primary detection results in Section 3. Goswami et al. [29] mentioned, “A good anomaly detection model will perform well on data with synthetically injected anomalies.”

4.1. Experimental Setup

Three fault patterns representative of real industrial failure modes were injected: (1) mean shift: a sustained step change in magnitude $m$ over six consecutive timestamps, representing sensor bias or sudden membrane fouling onset; (2) trend drift: a linear ramp from zero to m over six timestamps, representing slow performance degradation; and (3) spike: a single-point impulse of magnitude $m$, representing transient sensor faults or hydraulic disturbances. Each pattern was tested at three severity levels: weak ($2\sigma$), medium ($3\sigma$), and strong ($5\sigma$), where $\sigma$ is the detector’s residual standard deviation on normal test rows. Twenty non-overlapping clean evaluation windows were selected per output variable, subject to three constraints: no existing SADS or FADS flags within the window, no missing values in the target variable, and a minimum separation of six rows from any cycle boundary. Clean windows were verified with assistance from the plant operator. The timeline of verified windows can be found in the Supplementary Materials. Figure 21 shows examples of synthetic injected anomalies of Differential Pressure for SADS.

SADS and FADS were benchmarked against three established baselines: Isolation Forest (IForest), Local Outlier Factor (LOF), and Shewhart Statistical Process Control (SPC). SPC was included as the traditional process-engineering baseline currently used in industrial practice. All baselines used the same feature subsets as the corresponding primary detector and operated in the same signal domain (absolute values for SADS comparisons; derivatives for FADS comparisons). A true positive is credited if at least one score exceedance occurs within ±1 timestamp of the injection zone. Precision, recall, F1 score, and area under the curve (AUC) were computed as primary metrics.

4.2. Results and Analysis

Figure 22 and Figure 23 show heatmaps of F1 score, precision, and recall of FADS against three baselines for all output variables, severity $3\sigma$ and $5\sigma$, respectively. Figure 24 and Figure 25 show ROC curves for SADS and FADS and their baselines for Permeate Conductivity, respectively. Full heatmaps and ROC curves are in the Supplementary Materials. Both SADS and FADS consistently achieved an AUC of 0.85–1.00 across all output variables and severity levels, demonstrating that both detectors assign higher anomaly scores to injected positions than to clean positions, regardless of the threshold decision. The most important finding from the ROC analysis was a systematic AUC-F1 divergence: high AUC coexisted with low F1 at weak and medium severity. This pattern indicates a threshold calibration issue rather than a score quality problem. The 3$\sigma$ threshold, calibrated against the noisier training distribution, was overly conservative for the stable test period. Adaptive threshold calibration at inference time would substantially recover the latent detection performance already demonstrated by the AUC. In contrast, IForest exhibited near-random AUC (0.50–0.53 for most variables), indicating a fundamental score quality failure: IForest cannot separate injected anomalies from normal observations at a single-timestamp resolution because its global partitioning structure is insensitive to local point deviations.

SADS achieved very high precision across all output variables, anomaly types, and severity levels, meaning every SADS flag was a true positive with zero false positives. At strong severity ($5\sigma$), SADS recall recovered substantially, reaching F1 of 0.947–0.974 for Differential Pressure and 1.000 for Permeate Conductivity, Concentrate Flow, and Concentrate Pressure. Mean shift was consistently the most detectable anomaly type for SADS (sustained residual accumulation across multiple timestamps), and spike was the most difficult (single-point exceedance only). FADS achieved F1 = 0.974–1.000 for Concentrate Flow and F1 = 1.000 for Concentrate Pressure at strong severity, and an AUC of 0.966 for Differential Pressure despite near-zero F1 at that variable due to a very conservative threshold (threshold/$\sigma =12.4\times$ caused by noisy startup period calibration). LOF was the strongest baseline for Differential Pressure (AUC 0.926–0.961), exploiting the structured clustering of normal operating points in the feature space. SPC showed competitive recall for Permeate Conductivity (0.950) but poor precision and failed for Differential Pressure due to distribution drift from membrane fouling that violated its stationarity assumption.

No single baseline method dominates across all output variables, reinforcing the need for the complementary SADS-FADS dual-pathway approach. SADS excels on Concentrate Flow; FADS outperforms SADS on Concentrate Pressure at medium severity; LOF is most reliable for Differential Pressure; and SPC provides competitive recall for Permeate Conductivity. The consistent F1 = 0.000 for IForest confirms that global outlier detectors should not be applied where per-timestamp point resolution is required.

4.3. Component Ablation Study

To isolate the contribution of each architectural component, we compared five configurations for Differential Pressure (

Table 8. Component ablation (Differential Pressure).

Variant	R2	MAE	F1 @$2\mathit{\sigma }$	F1 @$3\mathit{\sigma }$	F1 @$5\mathit{\sigma }$
Physics only	−1.12	8.612	0.113	0.297	0.792
Standalone LSTM (no physics)	0.104	3.738	0.160	0.219	0.725
Hybrid (full model)	0.543	2.478	0.088	0.227	0.750
Hybrid, no attention	0.542	2.649	0.000	0.000	0.500
Hybrid, no cyclic features	(identical to full model not used)

): the physics model alone, a standalone LSTM without physics correction, the full hybrid model, the hybrid model without attention, and confirmation that cyclical time-encoding features are not used by this target’s model. The physics-only model is the weakest (${\mathrm{R}}^{\mathrm{2}}=-0.17$, confirming it cannot be used alone. The standalone LSTM improves substantially but remains below the hybrid model, indicating the physics prior contributes beyond what the LSTM recovers unaided. Removing attention improves raw regression accuracy (${\mathrm{R}}^{\mathrm{2}}=0.54$ vs. the standalone LSTM’s $0.10$), but F1 score collapses to zero at weak/moderate severity despite strong AUC (0.89–0.94), showing attention specifically benefits detection sensitivity rather than only prediction accuracy. Cyclical time-encoding features were confirmed, via two independent selection runs, not to contribute to this target’s model.

We additionally compared single-pathway (SADS-only, FADS-only) against the dual-pathway design using existing ground-truth injection results. For Differential Pressure, FADS’s detection F1 is at or near zero across all anomaly types (

Table 9. SADS vs. FADS detection F1 (Differential Pressure).

Anomaly Type	SADS F1 (Avg.)	FADS F1 (Avg.)
Mean shift	0.467	0.061
Spike	0.434	0.032
Trend drift	0.434	0.000

); so, SADS alone accounts for essentially all detections for this target, a direct consequence of the FADS threshold-calibration limitation discussed in Section 4.5. We report this as an honest scope limitation of the dual-pathway claim for this specific target while noting that FADS contributes non-trivial detection performance for the other three monitored targets (e.g., Concentrate Flow FADS F1$=0.79$ at mean-shift severity 3$\sigma$), consistent with the framework’s design rationale.

4.4. Quantitative Validation of Root-Cause Attribution

To move beyond the qualitative case studies presented above, we quantitatively evaluated RCA attribution accuracy using a ground-truth injection protocol. For each of the four SADS targets, synthetic anomalies (mean-shift, trend-drift, spike; severities $2\sigma , 3\sigma , 5\sigma )$ were injected individually into each of the target’s top 5 selected input sensors at 15 fixed clean evaluation windows, yielding 29,25 labeled trials per target (11,700 total). For each trial, the RCA module’s ranked output (was compared against the known injected sensor to compute Top 1 and Top 3 attribution accuracy.

Table 10. Top 1/Top 3 accuracy results for RCA module validation.

Target	Top 1 Accuracy	Top 3 Accuracy	Dominant Sensor (β)
Differential Pressure	0.290	0.947	Recovery (0.890)
Permeate Conductivity	0.400	0.776	Recovery (0.614)
Concentrate Flow	0.607	0.889	Recovery (0.666)
Concentrate Pressure	0.359	0.703	Feed Pressure (0.869)

summarizes the results. Top 1 accuracy ranged from 0.29 (Differential Pressure) to 0.61 (Concentrate Flow), while Top 3 accuracy remained consistently high (0.70–0.95) across all four targets. Attribution accuracy correlated with the concentration of the linear proxy weights ${\beta }_i$ used in the scoring function: targets whose weight distribution was dominated by a single sensor (Differential Pressure: Recovery, $\beta =0.89$; Concentrate Pressure: Feed Pressure, $\beta =0.87$) exhibited lower Top 1 accuracy than targets with weight shared across multiple correlated sensors (Permeate Conductivity, Concentrate Flow). Confusion matrix analysis further indicated that misattributed cases were not random: errors consistently redirected toward the dominant physical driver of the target, or toward temporally adjacent features of the true cause (e.g., lagged recovery terms), rather than toward physically unrelated sensors. This confirms the mechanism underlying limitation (Section 5.3) and demonstrates that, while single-cause (Top 1) attribution is sensitive to proxy-weight dominance, the ranked output reliably surfaces the true root cause among its top few candidates.

To assess whether this attribution behavior is specific to SADS’s Z-score-weighted formulation, we repeated the ground-truth validation protocol for the FADS root-cause module, which instead ranks candidate causes by unnormalized signed contribution (coefficient × derivative deviation from baseline). Because FADS’s candidate sensor sets vary in size across targets (2–6 features, versus SADS’s fixed top 5), we report Top 1 accuracy relative to its target-specific chance baseline (1/n) for both systems (

Table 11. SADS-vs.-FADS chance-normalized comparison.

System	Target	Candidates	Top 1 Accuracy	Top 1/Chance	Dominant Driver (Share)
SADS	Differential Pressure	5	0.290	1.45×	Recovery (0.89)
SADS	Permeate Conductivity	5	0.400	2.00×	Recovery (0.61)
SADS	Concentrate Flow	5	0.607	3.04×	Recovery (0.67)
SADS	Concentrate Pressure	5	0.359	1.80×	Feed Pressure (0.87)
FADS	Differential Pressure	6	0.567	3.40×	Recovery (0.64)
FADS	Permeate Conductivity	3	0.679	2.04×	Feed Temperature (0.65)
FADS	Concentrate Pressure	4	0.256	1.02×	Feed Pressure (0.92)
FADS	Concentrate Flow	2	0.845	1.69×	Recovery (0.93)

). Averaged across all four targets, SADS and FADS achieved comparable chance-normalized Top 1 accuracy (2.07× and 2.04× chance, respectively), and both exhibited the same dominant-driver failure mode: attribution accuracy fell to near-chance level (1.02× for FADS) for Concentrate Pressure, the target for which a single sensor (Feed Pressure) accounts for the overwhelming majority of model-derived influence in both formulations (87% of SADS proxy weight; 92% of FADS coefficient magnitude). This cross-system consistency indicates that dominant-driver attribution bias is a structural property of weighted single-cause ranking under a physically dominated target, rather than an artifact of either system’s specific weighting scheme.

4.5. Residual Distribution Diagnostics and Threshold Sensitivity

We examined residual distributions used for threshold calibration across all eight target–system combinations: SADS validation residuals and FADS training residuals. All eight depart significantly from normality and show substantial non-stationary variance (3×–383× across the evaluation period). We compared the fixed $3\sigma$ threshold against a nonparametric 99th-percentile threshold via synthetic injection at weak, moderate, and strong severities (

Table 12. F1 by severity, fixed $3\sigma$ vs. 99th-percentile quantile threshold.

System	Target	Method	Weak ($2\mathit{\sigma }$)	Moderate ($3\mathit{\sigma }$)	Strong ($5\mathit{\sigma }$)
SADS	Differential Pressure	$3\sigma$/Quantile	0.067/0.188	0.175/0.493	0.759/0.850
SADS	Concentrate Flow	$3\sigma$/Quantile	0.237/0.606	0.583/0.785	0.852/0.894
SADS	Concentrate Pressure	$3\sigma$/Quantile	0.074/0.074	0.175/0.175	0.805/0.805
SADS	Permeate Conductivity	$3\sigma$/Quantile	0.081/0.060	0.136/0.129	0.815/0.794
FADS	Differential Pressure	$3\sigma$/Quantile	0.000/0.000	0.000/0.000	0.015/0.000
FADS	Permeate Conductivity	$3\sigma$/Quantile	0.023/0.000	0.060/0.000	0.278/0.052
FADS	Concentrate Pressure	$3\sigma$/Quantile	0.160/0.116	0.349/0.261	0.827/0.815
FADS	Concentrate Flow	$3\sigma$/Quantile	0.205/0.188	0.341/0.301	0.823/0.810

).

Threshold effectiveness tracked the sign of excess kurtosis. For the two SADS targets with bimodal (negative kurtosis) residuals, the quantile threshold substantially improved weak/moderate-severity F1 (Differential Pressure: up to +182%; Concentrate Flow: up to +156%), showing that the reported AUC/F1 gap reflects threshold placement rather than a limitation of the underlying score. For targets with outlier-driven (strongly positive kurtosis) residuals (all four FADS targets and SADS Permeate Conductivity), the quantile threshold offered no benefit since it is pulled upward by the same extreme values driving the kurtosis. One target (SADS Concentrate Pressure) was unaffected by either method, consistent with variance non-stationarity exceeding what a static threshold can address. FADS Differential Pressure remains an open case: F1 score stays near zero under both methods despite an AUC ≈ 0.99.

5. Discussion and Conclusions

5.1. Framework Contributions

Table 13. Summary of challenges identified and framework response.

Challenges Identified in Section 1	Framework Response
Lack of fusion model integrating process physics with time-series data	Hybrid SADS combines domain-specific physics equations with an LSTM residual model calibrated on normal operating data; the physics component provides an interpretable, first-principle baseline, while the LSTM corrects the structured residual
Insufficient interpretability of detected anomalies	Domain-consistent RCA attributes each anomaly to its most probable input feature with direction (HIGH/LOW or rate up/down)
Limited generalization	Adaptation effort is tiered by pipeline step (Section 5.2): reconfiguration-only steps require hours; retraining on target-process data requires additional data collection and compute time; physics equation rederivation is the dominant cost, estimated at days to weeks depending on the maturity of existing process physics literature
Multi-timescale anomalies	Dual pipeline: SADS for slow drift on hourly data; FADS for abrupt deviations on 5 min data; combined flag from either system
Data label scarcity	Fully unsupervised: $3\sigma$ threshold requires only normal operating data; no anomaly labels required at any stage
Absence of cyclic analysis	Cycle-aware sequence construction prevents cross-cycle contamination; cycle buffer ($\pm$6 timesteps) suppresses false positives at transitions

maps each of the six motivating challenges to the specific framework component that addresses it, providing a direct traceability link from the identified gaps to the technical contributions.

5.2. Applicability to Other Process Industries

The framework’s modular architecture is designed to support transfer across continuous process industries, though most of the work is done within the water treatment system, and this transferability has not yet been empirically demonstrated beyond the RO case study presented here. Table 13 distinguishes three tiers of adaptation effort when applying the framework to a new process. First, several components require only reconfiguration, not redevelopment: variable partitioning into inputs and outputs, the cycle-detection threshold, and feature-engineering parameters such as lag order are set by the practitioner but use unchanged algorithms. Second, several components require retraining on target-process data without algorithmic modification: the RF+SHAP feature selection, the LSTM residual model, the FADS regression, and the $3\sigma$ detection thresholds are all fit directly to the new process’s historical data using the procedures described in Section 2. Third, the physics-based component of SADS requires rederivation: process-specific governing equations must be identified from first principles or the relevant engineering literature and recalibrated on steady-state reference data from the target process, as illustrated for RO in the Section RO-Specific Physics Models.

While no formal time-motion study was conducted, our own development experience building this framework for the RO case study provides a qualitative indication of the relative effort across these three tiers. Reconfiguration-tier steps (variable partitioning, cycle-detection threshold selection, lag-order specification) required on the order of hours to a few days, dominated by data familiarization and variable classification rather than method redevelopment. Retraining-tier steps (feature selection, LSTM training, FADS regression, threshold calibration) require additional data collection time from the target process plus computation time, but no algorithmic redevelopment since the procedures of Section 2.4, Section 2.5 and Section 2.6 apply unchanged. Physics-equation rederivation was the dominant cost in our own development: deriving, implementing, and calibrating the four RO-specific equations (Section RO-Specific Physics Models) required consulting membrane transport literature, selecting appropriate functional forms, and calibrating parameters against steady-state data, on the order of weeks.

For well-characterized unit operations like heat exchangers and distillation columns (energy and mass balances) [30], stirred-tank reactors (reaction kinetics) [31], or other membrane-based separations such as ultrafiltration and nanofiltration, which share the pressure-driven transport and fouling-induced drift mechanisms exploited here, governing equations are generally available in standard references. For processes with less mature physical characterization, this step may be substantially more effortful, and a purely data-driven LSTM baseline without the physics component, as discussed in Section 5.3, may offer a more practical starting point.

5.3. Limitations and Future Directions

First and most significantly, the framework has been validated on a single RO plant, and the claim of cross-process generality is presently architectural rather than empirically demonstrated. While Section 5.2 outlines why the framework’s modular design should, in principle, support transfer to other continuous processes, the specific adaptation effort, the stability of feature selection and threshold calibration under a different sensor configuration or sampling regime, and the achievable detection performance on a second process are all open empirical questions that this study does not resolve.

Second, a concrete plan for cross-process validation, to be pursued in future work, is as follows: The four process-agnostic pipeline steps that require no algorithmic modification (data preprocessing, temporal cyclic analysis, feature engineering, and feature selection) would be applied unchanged to a second dataset, ideally a public benchmark with documented fault events to enable label-based evaluation in addition to the synthetic-injection protocol used here. The physics equations in SADS would be substituted with governing relationships appropriate to the target unit operation. For example, the applicable energy- and mass-balance equations for a heat exchanger, or reaction-rate expressions for a stirred-tank reactor, would be recalibrated on steady-state reference data following the nonlinear least-squares procedure of the Section RO-Specific Physics Models. The LSTM residual model, FADS regression, and detection thresholds would be retrained on the target process’s historical data using the identical procedures described in Section 2.5 and Section 2.6, without modification to the underlying algorithms. Performance would then be evaluated using the same metrics reported in Section 4 (AUC, precision, recall, and F1 score under synthetic anomaly injection), together with label-based metrics where ground-truth fault annotations are available, to allow for direct comparison of detection performance and adaptation effort against the RO case study reported here.

Third, the SADS-RCA proxy sensitivity weights are estimated by global linear regression and may misrepresent feature sensitivities at operating extremes far from the training distribution. This effect is now quantified in Section 4.3: across all four monitored targets, Top 1 root-cause attribution accuracy ranged from 0.29–0.61, correlating inversely with the concentration of proxy weights ${\beta }_i$, while Top 3 accuracy remained high (0.70–0.95), confirming that attribution errors are systematic and largely confined to the dominant-driver sensor rather than distributed randomly. This dominant-driver attribution bias is not specific to the SADS weighting scheme: an identical ground-truth validation applied to the FADS root-cause module reproduces the same failure mode, with Top 1 accuracy falling to near-chance level (1.02× baseline) for the target with the most concentrated model influence (Concentrate Pressure). Averaged across all monitored targets and both detection pathways, single-cause attribution accuracy is approximately double the random-chance baseline (SADS: 2.07×; FADS: 2.04×), a modest but consistent improvement over chance.

Fourthly, the fixed-threshold formulation assumes a stable, moderately-shaped residual distribution; across both SADS and FADS, we find this holds unevenly. Where residuals are bimodal, a simple quantile threshold recovers substantial weak/moderate anomaly sensitivity without retraining. Where residuals are outlier-driven (the majority of cases, including all FADS targets), static thresholding of any form offers limited benefit since the same extreme values that create the heavy tail also bias a naive quantile estimate. FADS Differential Pressure in particular retains near-zero F1 despite strong ranking ability (AUC ≈ 0.99) under both methods tested. Robust (e.g., MAD-based or trimmed) and locally adaptive threshold estimation are identified as concrete directions for future work.

5.4. Conclusions

In conclusion, this work has presented a generic framework for multivariate anomaly detection and root-cause analysis in process industries, addressing six identified challenges through a modular pipeline. SADS and FADS demonstrate strong detection performance, and the RCA module produces physically interpretable attributions for detected anomalies, with quantitative validation (Section 4.4) confirming that the true root cause is reliably surfaced among the top 3 ranked candidates, even where single-cause (Top 1) attribution is limited by proxy-weight dominance for certain targets. Although the framework has limitations, including heavy reliance on physics model quality, single-cause attribution sensitivity for targets with a dominant driver, and current validation on a single process type, it represents a principled and practically deployable advancement toward bridging the gap between theoretical deep learning and real-world industrial anomaly detection, grounded in process physics, interpretable by design, and modular enough to be adapted across diverse process industry applications with some reconfiguration effort.