Online Monitoring and Fault Diagnosis for High-Dimensional Stream with Application in Electron Probe X-Ray Microanalysis

TL;DR

This paper introduces a new two-stage method for monitoring and diagnosing faults in high-dimensional data streams, showing high accuracy and faster detection than existing methods.

Contribution

The novel two-stage framework combines EWMA monitoring with a precise fault diagnosis mechanism for high-dimensional sparse-change data streams.

Findings

The method detects anomalies within one or two sampling intervals with near 100% detection power.

The fault diagnosis mechanism achieves 99.1% accuracy in 200-dimensional streams, outperforming PCA-based methods by 28.0% in precision.

Abstract

This study introduces an innovative two-stage framework for monitoring and diagnosing high-dimensional data streams with sparse changes. The first stage utilizes an exponentially weighted moving average (EWMA) statistic for online monitoring, identifying change points through extreme value theory and multiple hypothesis testing. The second stage involves a fault diagnosis mechanism that accurately pinpoints abnormal components upon detecting anomalies. Through extensive numerical simulations and electron probe X-ray microanalysis applications, the method demonstrates exceptional performance. It rapidly detects anomalies, often within one or two sampling intervals post-change, achieves near 100% detection power, and maintains type-I error rates around the nominal 5%. The fault diagnosis mechanism shows a 99.1% accuracy in identifying components in 200-dimensional anomaly streams, surpassing principal component analysis (PCA)-based methods by 28.0% in precision and controlling the false discovery rate within 3%. Case analyses confirm the method’s effectiveness in monitoring and identifying abnormal data, aligning with previous studies. These findings represent significant progress in managing high-dimensional sparse-change data streams over existing methods.

Figures

Full text

1. Introduction

In recent years, the rapid advancement of modern sensing and data acquisition technologies has enabled the real-time collection of high-dimensional data streams across diverse industrial applications. Such data streams often exhibit shifts in statistical properties, transitioning from an in-control (IC) state to an out-of-control (OC) state due to anomalies. For instance, in electron probe X-ray microanalysis, real-time monitoring of compositional changes in materials requires the detection of subtle shifts in high-dimensional spectral data, which may occur either abruptly or gradually. Addressing such scenarios requires robust online monitoring and fault diagnosis methods tailored for high-dimensional and sparsely changing data streams.

Before proceeding, for an intuitive explanation, we present a simple example to illustrate IC and OC observations in a multidimensional data stream. Figure 1 illustrates a p-dimensional ( $[eqn]$ ) time series data stream recorded over $[eqn]$ time points. The IC observations, denoted as $[eqn]$ , are independently and identically distributed (i.i.d.) multivariate normal random variables with the mean vector $[eqn]$ , and a covariance matrix $[eqn]$ . After a change point $[eqn]$ , the $[eqn]$ components of the observations experience an anomaly, resulting in a shift in the data stream. The figure presents two distinct scenarios of mean-shift anomalies in a multidimensional data stream: the left subfigure depicts a mean abrupt shift scenario, where the change occurs suddenly after a time point $[eqn]$ , while the right subfigure illustrates a mean gradual shift scenario, where the shift changes in a duration of about a 50-time-point interval, ultimately stabilizing when $[eqn]$ .

In the examples mentioned, the change points in the data stream are easily identifiable due to the low dimensionality, allowing easy visual detection. However, in real-world applications, monitoring complex and high-dimensional data streams is more challenging. Anomalies may only appear in a small subset of variables at any given time, and the intricate interactions and high dimensionality of these variables complicate online monitoring and fault detection. This is especially true when pinpointing the exact time and specific elements that show abnormal variations. For instance, in semiconductor manufacturing, subtle sensor anomalies may indicate critical equipment issues, while in energy infrastructure, gradual pressure drifts could signal potential failures. Timely detection and diagnosis of such anomalies are crucial for operational safety and efficiency. Yet, the high dimensionality, sparsity of changes, and complex variable interdependencies present significant challenges to existing monitoring and diagnostic frameworks.

In order to overcome these challenges, a series of articles have been developed on the monitoring and diagnosis of high-dimensional data streams. Here, we roughly divide them into the following three categories.

(1) Statistical and Control Chart-Based Methods. Statistical and control chart-based methods are widely employed for monitoring high-dimensional data streams, with prominent techniques including Hotelling’s $[eqn]$ , Multivariate Exponentially Weighted Moving Average (MEWMA), Multivariate Cumulative Sum (MCUSUM), and principal component analysis (PCA)-based monitoring. Zou et al. (2015) [1] introduce a robust control chart utilizing local CUSUM statistics, demonstrating effective detection capabilities across both sparse and dense scenarios, albeit with certain limitations in parameter assumptions and implementation complexity. Ebrahimi et al. (2021) [2] developed an adaptive PCA-based monitoring method incorporating compressed sensing principles and adaptive lasso for change source identification, though its computational demands may be substantial for large-scale datasets. Li (2019) [3] proposes a flexible two-stage monitoring procedure with user-defined IC average run length (ARL) and type-I error rates, which requires meticulous calibration of control limits for both stages. For comprehensive reviews of online monitoring and diagnostic methods based on statistical process control (SPC), refer to studies such as [4,5,6,7,8,9,10,11,12].

(2) Information-Theoretic and Entropy-Based Methods. Entropy-based measures, including Shannon entropy, Renyi entropy, and approximate entropy, are widely used to assess the complexity and randomness of data streams in monitoring and diagnostics. Recent research has made significant progress in both theoretical and practical aspects of this field. Mutambik (2024) [13] develops E-Stream, an entropy-based clustering algorithm for real-time high-dimensional Internet of Things (IoT) data streams. By incorporating an entropy-based feature ranking method within a sliding window framework, the algorithm reduces dimensionality, improving clustering accuracy and computational efficiency. However, its dependence on manual parameter tuning restricts its adaptability to diverse datasets. Wan et al. (2024) [14] propose an entropy-based method for monitoring pressure pipelines using acoustic signals. Their approach combines Denoising Autoencoder (DAE) and Generative Adversarial Network (GAN) with entropy-based loss functions for noise reduction. While effective, the adversarial training process requires substantial computational resources, limiting its feasibility for real-time applications in resource-constrained environments. For a deeper understanding of recent advancements in entropy-based theories, methods, and applications for data stream monitoring and diagnostics, see [15,16,17,18,19]. These studies highlight the latest developments in this area.

(3) Machine Learning and Data-Driven Methods. In recent years, machine learning and data-driven methods have become increasingly important for monitoring and diagnostics in various fields. Online learning techniques, such as Online Support Vector Machines (OSVMs), Online Random Forests, and Stochastic Gradient Descent (SGD), have been successfully applied to real-time monitoring tasks. Additionally, deep learning models like Recurrent Neural Networks (RNNs), Long Short-Term Memory (LSTM) networks, and autoencoders have shown strong performance in capturing temporal patterns and detecting anomalies in high-dimensional data streams. Recent developments in this area include OLFA (Online Learning Framework for sensor Fault diagnosis Analysis) by Yan et al. (2023) [20], which provides a solution for real-time fault diagnosis in autonomous vehicles by addressing the non-stationary nature of sensor faults. Chen et al. (2024) [21] present a real-time fault diagnosis method for multisource heterogeneous information fusion based on two-level transfer learning (TTDNN), focusing on gearbox dataset, bearing dataset, etc. Another important contribution is from Li et al. (2025) [22], who propose a novel framework combining Deep Reinforcement Learning (DRL) with SPC for online monitoring of high-dimensional data streams under limited resources. Although their approach shows good scalability through deep neural networks, the computational demands of the Double Dueling Q-network training process may be a limitation for real-time applications with strict computational constraints. For comprehensive reviews of machine learning-based online monitoring and diagnostic methods, see studies such as [21,23,24,25,26,27].

Despite these advancements, three key limitations remain. First, many SPC methods face computational challenges in ultra-high dimensions due to reliance on covariance matrix inversions or extensive hypothesis testing. Second, entropy-based techniques, though effective for noise reduction, show limited sensitivity to sparse changes where only few variables deviate, while machine learning approaches often demand substantial labeled data that may be unavailable. Third, current diagnostic procedures typically emphasize either speed or accuracy, struggling to achieve both real-time alerts and precise root-cause identification. This paper bridges these gaps by proposing a two-stage monitoring and diagnostic framework designed for high-dimensional data streams with sparse mean shifts. The first issue is online monitoring, which aims to check whether the data stream has changed over time points and accurately estimate the change point $[eqn]$ after the change occurs. The second issue is the diagnosis of the fault, which aims to identify the components that have undergone abnormal changes; it will help eliminate the root causes of the change.

As the EWMA statistic is sensitive to small changes and includes the information of previous samples, we use it for online monitoring [28]. At the first stage, we construct a monitoring statistic based on the EWMA statistic. Under certain conditions, we prove the asymptotic distribution of the monitoring statistic and then obtain the threshold of online monitoring. At any time point, if the monitoring statistic value is greater than the threshold, a real-time alert is issued, indicating that the data stream is out of control. Then, we move into the second stage, to identify the components that have undergone abnormal changes over time points, which belongs to the scope of fault diagnosis. Specifically, when the monitoring procedure proposed in the first stage alerts that the data stream is abnormal, we allow the monitoring procedure to continue running for a while, and obtain more sample data, then we conduct multiple hypothesis tests on the data before and after the alarm to determine which components of the data stream have experienced anomalies. The desired two-stage monitoring and diagnosis scheme in this study can not only correctly estimate the time point in time but also accurately identify the OC components of the data stream.

The contributions of this paper are as follows: (1) Methodological Innovation: This study introduces an EWMA-based monitoring statistic that leverages max-norm aggregation to enhance sensitivity to sparse changes. After its asymptotic distribution is derived, a dynamic thresholding mechanism is established for real-time anomaly detection. (2) Integrated Diagnosis: Upon detecting an OC state, the framework employs a delayed multiple hypothesis testing procedure to isolate anomalous components. This approach minimizes false discoveries while accommodating temporal dependencies in post-alarm data. (3) Industrial Applicability: Our method is validated through electron probe X-ray microanalysis (EPXMA), a critical technique in materials science for real-time composition monitoring. The method’s efficiency in handling high-dimensional sparse shifts makes it equally viable for IoT-enabled predictive maintenance and industrial process control.

This paper is structured as follows: Section 2 formulates the monitoring and diagnosis problem, detailing the EWMA statistic, fault isolation strategy, and performance metrics. Section 3 evaluates the method via simulations, benchmarking against state-of-the-art techniques. Section 4 demonstrates its practicality through an EPXMA case study, highlighting its superiority in detecting micron-scale material defects. Conclusions and future directions are presented in Section 5.

2. Methodology

2.1. Problem Formulation

Consider a high-dimensional data stream denoted by $[eqn]$ , where each observation $[eqn]$ denotes a p-dimensional vector at time point t. In the IC state, the observations are generalized from $[eqn]$ , with $[eqn]$ and $[eqn]$ , $[eqn]$ . However, following an unknown change point $[eqn]$ , the process experiences a mean shift from $[eqn]$ to $[eqn]$ , transitioning to an OC state. In practical applications, process changes are typically driven by only a small subset of components within the data stream. Consequently, the shift vector $[eqn]$ exhibits sparsity, with most elements being zero and only a few non-zero components. It is important to note that the transition from $[eqn]$ to $[eqn]$ can occur either abruptly or gradually, representing two distinct scenarios of mean-shift anomalies: abrupt mean shifts and gradual mean shifts.

This study aims to address two critical challenges in high-dimensional data stream monitoring: The first one is to propose an effective online monitoring method that can accurately estimate the location of the change point. Once the data stream changes abnormally, it can issue an alarm in time. The second task is to accurately identify the components of abnormal changes in high-dimensional data streams while controlling the error rate.

2.2. The EWMA Statistic

As is well known, the EWMA statistic is sensitive to small changes, and it includes information from previous samples [29]. Thus, an EWMA statistic is chosen in this study to monitor a high-dimensional data stream, the EWMA sequence is defined by

$$[eqn]$$

where $[eqn]$ is a weigh parameter. As described in Feng et al. (2020) [30], a smaller value of $[eqn]$ leads to a quicker detection of smaller shifts, and the detailed comparison results are provided in the numerical simulation section.

Let $[eqn]$ , the j-th component of $[eqn]$ is denoted as

$$[eqn]$$

where $[eqn]$ is prearranged, i.e., $[eqn]$ for $[eqn]$ . It is obvious that when the data stream is IC, we have

$$[eqn]$$

As $[eqn]$ , we have $[eqn]$ , then the asymptotic distribution of $[eqn]$ is as follows,

$$[eqn]$$

Correspondingly, the j-th component of $[eqn]$ obeys the following normal distribution, i.e.,

$$[eqn]$$

where $[eqn]$ is the j-th diagonal element of $[eqn]$ . However, once the mean value has undergone abnormal changes, $[eqn]$ does not follow the multivariate normal distribution mentioned above.

2.3. Online Monitoring Procedure

Without loss of generality, we assume that the mean vectors of $[eqn]$ , $[eqn]$ , $[eqn]$ , …, $[eqn]$ , …mentioned above are $[eqn]$ , $[eqn]$ , …, $[eqn]$ ,…, respectively. Thus, the online monitoring of high-dimensional data streams can be considered as a hypothesis testing change point detection problem, with the null and the alternative hypothesis are

$$[eqn]$$

It is obvious that the monitored data stream is IC up to time point t if $[eqn]$ is accepted, but a rejection of $[eqn]$ indicates that some components of the stream have changed abnormally after the change point $[eqn]$ .

Therefore, we construct the test statistic as the following max-norm information:

$$[eqn]$$

Intuitively, the larger the value of $[eqn]$ , the more likely the observation undergoes abnormal at time point t. If $[eqn]$ exceeds a threshold, it implies that an anomaly occurred.

It should be noted that the mean and covariance values of $[eqn]$ are unknown, so the reasonable estimators of $[eqn]$ and $[eqn]$ are needed. Suppose $[eqn]$ be the initial IC data stream, the sample mean and covariance of these m observations are defined as $[eqn]$ and $[eqn]$ , respectively.

Consequently, the estimated max-normal monitoring statistic is defined as

$$[eqn]$$

where $[eqn]$ is the j-th main diagonal element of $[eqn]$ .

For simplicity, let $[eqn]$ , $[eqn]$ , it is obvious that, $[eqn]$ , $[eqn]$ . The monitoring statistic can be rewritten as

$$[eqn]$$

Let $[eqn]$ , then $[eqn]$ is a high-dimensional normal random vector with the mean vector of zero and the covariance matrix of $[eqn]$ for $[eqn]$ , where the diagonal $[eqn]$ for $[eqn]$ . In order to obtain the threshold of online monitoring, we need to prove the asymptotic distribution of the statistic $[eqn]$ when the null hypothesis holds.

To this end, this requires the following two assumptions:

A.1. 

• $[eqn]$ for some constant $[eqn]$ ;*

A.2. 

• $[eqn]$ for some constant $[eqn]$ .*

Assumptions (A.1) and (A.2) are mild and common assumptions that are widely used in the high-dimensional means test under dependence. Under the above two assumptions, Proposition 1 studies the asymptotic distribution of $[eqn]$ when the null hypothesis holds.

Proposition 1.  Under the assumptions of (A.1) and (A.2), when the null hypothesis $[eqn]$ holds, for any $[eqn]$ , $[eqn]$ follows the asymptotic distribution

$$[eqn]$$

Proposition 1 shows that $[eqn]$ follows the type I extreme value distribution with the cumulative distribution function $[eqn]$ . The proof of this proposition is similar to that of Lemma 6 in Cai et al. (2014) [31], so it is omitted here.

Thus, the data stream shows abnormal change at time point t, if

$$[eqn]$$

where $[eqn]$ is the threshold at a given significance level $[eqn]$ , and $[eqn]$

It should be noted that not all the observations of $[eqn]$ are considered as change points, and these points may also be outliers. Therefore, when $[eqn]$ occurs, we continue to monitor for a while to obtain some more observations and if all the values of $[eqn]$ are greater than $[eqn]$ . Thus, the change point $[eqn]$ can be estimated naturally by

$$[eqn]$$

In this case, we claim that the data stream changes abnormally after time point $[eqn]$ , and the process enters into an OC state.

2.4. Fault Diagnosis Procedure

To this end, we first keep monitoring a p-dimensional data stream by using the monitoring statistics $[eqn]$ . After the OC alarm is issued, we enter into the second stage of statistical fault diagnosis to identify the components that have undergone abnormal changes. To this end, we continue to monitor the data stream for a while and collect some more OC observations. The diagnostic problem can be regarded as the following multiple hypothesis testing. The null hypothesis and the alternative hypothesis are

$$[eqn]$$

It is obvious that if $[eqn]$ is accepted, the j-th component of the stream is IC; otherwise, a rejection $[eqn]$ indicates that the j-th component of the stream is OC when $[eqn]$ .

To address this problem, a diagnostic statistic $[eqn]$ is proposed in the following form,

$$[eqn]$$

where $[eqn]$ is the mean value of the observed samples, and the sample variance $[eqn]$ is defined as that in Equation (6). It can be seen that if the value of $[eqn]$ is large, it indicates that abnormal changes may occur in the data stream. Therefore, it can be inferred that the null hypothesis in Equation (11) is rejected if $[eqn]$ too large to exceed a threshold.

In many applied multiple testing problems, there are many test strategies, such as the traditional critical value test methods and some false discovery rate (FDR) controlling procedures [32,33,34]. It is obvious that $[eqn]$ , $[eqn]$ , and $[eqn]$ as $[eqn]$ under the null hypothesis $[eqn]$ . Thus, the diagnostic statistic $[eqn]$ follows Chi-squared distribution

$$[eqn]$$

In the diagnosis process, we should ensure that the global per-comparison error rate (PCER) can be controlled within a prespecified level $[eqn]$ . Without loss of generality, we assume the first $[eqn]$ components of the high-dimensional observations are IC, and the remaining $[eqn]$ components are OC when $[eqn]$ . The PCER can be defined as the expected number of type-I errors divided by the number of hypotheses, that is,

$$[eqn]$$

Therefore, we need to determine $[eqn]$ such that the Equation (14) is satisfied. The choice $[eqn]$ can be determined through numerical simulation. More specifically, we let the global per-comparison error rate equals $[eqn]$ , that is,

$$[eqn]$$

It is obvious that when Equation (15) is satisfied, the Equation (14) above is naturally controlled within $[eqn]$ and holds true.

For a given initial threshold value of $[eqn]$ , (such as $[eqn]$ ), the proportion of $[eqn]$ is denoted as $[eqn]$ when $[eqn]$ . Then, we repeat it B times ( $[eqn]$ ), the average values of $[eqn]$ over B replications can be used to approximate $[eqn]$ . Conversely, if Equation (15) is satisfied, we use numerical methods to obtain an approximate value, denoted as $[eqn]$ . Therefore, if $[eqn]$ is not larger than $[eqn]$ , we can control the global per-comparison error rate at a level $[eqn]$ , otherwise if $[eqn]$ is larger than $[eqn]$ , this indicates that the j-th component of the data stream is abnormal.

2.5. Algorithm Steps

The main algorithm is summarized as the following steps. Algorithm 1: The main algorithm steps of monitoring and diagnosis    $[eqn]$ 1    Given in-control data streams $[eqn]$ ;2    Calculate the sample mean $[eqn]$ of the IC observations;3    Observe p-dimensional data stream $[eqn]$ , the EWMA statistic as calculate       $[eqn]$ ;4    Construct global monitoring statistic $[eqn]$ ;5    If $[eqn]$ , then raise the OC alarm, the estimated change point is       $[eqn]$ .    $[eqn]$ 1    Collect n observations after the OC alarm signal occurs;2    Construct diagnostic statistic $[eqn]$ ,   $[eqn]$ ;3    Record the observations set with $[eqn]$ for $[eqn]$ as H,      let $[eqn]$ ;4    Randomly sample B times from data set H, the average of $[eqn]$ over B replications      is used to approximate $[eqn]$ ;5    Obtain $[eqn]$ , the diagnosed variables are the ones      corresponding to the indicators of $[eqn]$ .

2.6. Performance Evaluation Measures

In the online monitoring phase, in order to measure the performance of the proposed monitoring method, we choose the following three metrics: The first is the accuracy of the change point estimation, that is, when the estimated value $[eqn]$ is close to the real change point $[eqn]$ , the change point estimation is accurate. The second is the type-I error rate of online monitoring, which is the proportion of normal observations mistakenly identified as outliers. The last one is the power value of online monitoring, that is, the proportion of abnormal observations that are accurately identified. The type-I error rate can be well controlled; meanwhile, the larger of the power value, approaching 100%, the better of the proposed monitoring method.

In the fault diagnosis stage, we define two relevant metrics to verify the effectiveness of the method: One is the false positive rate (FPR), a measure of the proportion of not-faulty variables that are incorrectly identified as faulty variables. The other is the true positive rate (TPR), defined as the percentage of the ratio of the number of variables that are correctly detected as faulty over the number of all not-faulty variables.

Without loss of generality, after an change point $[eqn]$ , the IC components of the stream are denoted as $[eqn]$ , and the OC components set is $[eqn]$ . At any time point t, the estimated OC components are defined as $[eqn]$ . Thus, the TPR and FPR values at time point t are defined as

$$[eqn]$$

where $[eqn]$ represents the number of elements in set A. Correspondingly, up to time point t, the average TPR and FPR values can be defined as follows:

$$[eqn]$$

In fact, we should ensure that the higher the average TPR value, the better; meanwhile, we should also ensure that the higher the FPR value, the better the performance.

3. Simulation Studies

In this section, we conduct a comprehensive simulation study to evaluate the performance of our proposed monitoring and diagnosis framework, comparing it with several existing methodologies. For the experimental setup, we generate IC data streams from a multivariate normal distribution $[eqn]$ . To assess the effectiveness of our approach, we consider two distinct OC scenarios characterized by mean shifts:

(i) Mean abrupt shift: the OC stream follows $[eqn]$ , where $[eqn]$ is a parameter used to measure the degree of drift, and $[eqn]$ is a p-dimensional mean vector.

(ii) Mean gradual shift: the OC stream follows $[eqn]$ , where the mean vector $[eqn]$ evolves progressively over time according to the relationship, $[eqn]$ , with $[eqn]$ representing a small incremental change vector over time.

The two mean shift scenarios described above may impact only a subset of dimensions within the data. In the case of an abrupt mean shift, it is assumed that the initial mean vector $[eqn]$ is equal to $[eqn]$ , while the post-shift mean vector $[eqn]$ is a sparse p-dimensional vector. Specifically, most of its components remain zero, with only a few components assuming a value of 1. In the context of a gradual mean shift, the change in the mean vector is similarly sparse. That is, the incremental change $[eqn]$ affects only a few components, while the majority of its elements remain zero. The duration of the mean shift in each affected dimension is denoted by d, and the magnitude of the change at each time point is given by $[eqn]$ , reflecting a linear trend of increase or decrease. Over time, after a period of continuous gradual drift, the mean vector stabilizes, and the data stream enters a post-drift phase.

In both scenarios, the abnormal change occurs at a specific time point $[eqn]$ . Prior to $[eqn]$ , (i.e, when $[eqn]$ ), the process remains IC. However, for $[eqn]$ , the mean values of $[eqn]$ components undergo a change, while the remaining $[eqn]$ components remain unchanged. This sparsity in the mean shift is a critical characteristic of high-dimensional data streams, where changes are often localized to a small subset of dimensions.

The covariance matrix $[eqn]$ , which characterizes the correlation among p-dimensional random variables, plays a crucial role in the simulation study. In the experimental design, we maintain the assumption that $[eqn]$ remains invariant before and after the change point. Specifically, we investigate three distinct covariance matrix structures:

(a) Independent structure case: $[eqn]$ , where $[eqn]$ represents the $[eqn]$ identity matrix, indicating no correlation between variables;

(b) Long-range dependence structure case: $[eqn]$ for $[eqn]$ , with the correlation coefficient $[eqn]$ fixed at 0.5. This structure exhibits slowly decaying correlations between variables;

(c) Short-range correlation case: $[eqn]$ is a block-diagonal matrix, within each block matrix, $[eqn]$ , $[eqn]$ , where b is the block size and $[eqn]$ , $[eqn]$ .

The method presented in this study is fundamentally grounded in extreme value theory (EVT), henceforth referred to as the EVT method. To comprehensively evaluate its efficacy, we conducted comparative simulations with three alternative approaches, assessing their respective monitoring and/or diagnostic capabilities. The first comparative method employs an adaptive principal component (APC) selection mechanism utilizing hard-thresholding techniques, as proposed by Samaneh et al. [2]. The second method, developed by Ahmadi and Mohsen [5], incorporates a two-stage detection system combining a single Hotelling’s $[eqn]$ control chart with a Shewhart control chart, subsequently denoted as the AM method. The third approach, proposed by Aman et al. [27], presents a fault detection framework utilizing Slow Feature Analysis (SFA), specifically designed for time series models and SPC. In this study, we perform a thorough performance comparison with the Dynamic Slow Feature Analysis (DSFA) method, establishing a robust evaluation framework for our proposed methodology.

In the simulation framework, these methods are systematically applied to monitor continuous data streams and detect anomalies. The comparative analysis is performed through extensive computational experiments, with all performance metrics calculated from 1000 independent simulation runs to ensure statistical reliability and robustness.

Table 1 presents the simulated type-I error rates ( $[eqn]$ ) and power values ( $[eqn]$ ) obtained from the proposed online monitoring procedure under various model configurations. The simulation was conducted with parameters set at $[eqn]$ , $[eqn]$ , $[eqn]$ , $[eqn]$ , $[eqn]$ , and the duration of the mean shift $[eqn]$ in Scenario (ii), while examining three levels of abnormality degree $[eqn]$ , respectively. The results demonstrate that when $[eqn]$ and the proportion of abnormal data stream components ( $[eqn]$ ) ranges from 10% to 25%, the empirical type-I error rates are effectively maintained around the nominal level of 5%, in most scenarios. Furthermore, the power values exhibit a positive correlation with the abnormality degree ( $[eqn]$ ), indicating that higher degrees of abnormality facilitate easier detection of anomalous data. Notably, in Scenario (i), the power values consistently exceed 99% across all models and proportions when $[eqn]$ , demonstrating the method’s exceptional detection capability for abrupt changes. In contrast, Scenario (ii) shows relatively lower power values ranging from 86.6% to 94.0%, reflecting the increased challenge in detecting gradual changes compared with abrupt mutations. The standard deviations, presented in parentheses, indicate the stability of the monitoring results across different experimental conditions. These findings collectively validate the effectiveness of the proposed method in maintaining controlled type-I error rates while achieving high power across various abnormal data scenarios.

Figure 2 shows the change trend of the proposed monitoring statistics over time points in different model scenarios. The proportion of abnormal data stream is $[eqn]$ . The three subfigures on the left depict the mean abrupt shift model, while the three subplots on the right represent the mean gradual shift model. In the high-dimensional data stream being monitored, the real change point time $[eqn]$ . From the results presented in Figure 2, it is evident that in all three model scenarios, the values of the monitoring statistics exhibit a significant upward trend after the change point occurs. Notably, the monitoring statistic values in the left subplots show a more pronounced upward trend post-change point compared with the right subplots. This is attributed to the abrupt mean shift in the left subplots, which leads to a more substantial increase in the monitoring statistic values. It is important to note that before the change point occurs, the values of the monitoring statistics may occasionally exceed the threshold at certain time points. This phenomenon is likely caused by outliers in the data. Overall, Figure 2 demonstrates that the proposed monitoring statistic effectively captures the changing trends in high-dimensional data streams, providing a reliable method for detecting shifts in the data.

Table 2 presents a comprehensive comparison of three change point detection methods (EVT, A-M, and APC) under different scenarios and parameter settings. The evaluation is based on three key metrics: Bias (the absolute deviation between estimated and true change points), Sd (the standard deviation of estimators), and $[eqn]$ (the probability that the absolute difference between true and estimated change points is within a specified threshold j). The results demonstrate a clear trend across all methods: as the signal strength parameter $[eqn]$ increases from 1.0 to 2.0, the estimation accuracy improves significantly. This improvement is evidenced by the decreasing values of Bias and Sd, along with the increasing values of $[eqn]$ . Specifically, when $[eqn]$ reaches 2.0, all methods achieve their best performance, with $[eqn]$ values approaching or exceeding 90% in most cases.

In Scenario (i) with $[eqn]$ , the EVT method shows superior performance, particularly at higher $[eqn]$ values. When $[eqn]$ , EVT achieves a remarkably low Bias of 1.1 and Sd of 1.1, with $[eqn]$ reaching 99.5%. The APC method also demonstrates competitive performance, showing consistent improvement across different $[eqn]$ values. The A-M method, while showing improvement with increasing $[eqn]$ , generally underperforms compared with the other two methods in this scenario. For Scenario (i) with $[eqn]$ , similar patterns emerge, though the absolute values of the metrics are slightly different. The EVT method maintains its leading position, achieving a Bias of 1.2 and Sd of 0.8 at $[eqn]$ , with $[eqn]$ remaining at 99.5%. The APC method shows particularly strong improvement in this scenario, with $[eqn]$ increasing from 57.1% at $[eqn]$ to 92.7% at $[eqn]$ . In Scenario (ii), which represents a more challenging detection environment, all methods show higher Bias and Sd values compared with Scenario (i). However, the relative performance ranking remains consistent, with EVT maintaining its advantage, followed by APC and then A-M. Notably, even in this more difficult scenario, the EVT method achieves $[eqn]$ values above 90% when $[eqn]$ reaches 2.0.

These results collectively demonstrate that while all methods benefit from stronger signals (higher $[eqn]$ values), the EVT method consistently outperforms the others across different scenarios and parameter settings. The findings suggest that the choice of detection method should consider both the expected signal strength and the required precision of change point estimation.

The size of the smoothing parameter $[eqn]$ plays a crucial role in determining the performance of the EWMA-based monitoring procedure, particularly affecting the type-I error rate, detection power, and change point estimation accuracy. Table 3 presents a comprehensive simulation study evaluating these performance metrics under different $[eqn]$ values (0.2, 0.4, and 0.6) across various abnormality indicators ( $[eqn]$ = 1.0, 1.5, 2.0) and sparsity levels ( $[eqn]$ = 0.05, 0.10, 0.15) of the mean abrupt shift model. The simulation results reveal several important patterns. First, the type-I error rate remains stable around the nominal level of 5% across all $[eqn]$ values, demonstrating the robustness of the proposed method in maintaining false alarm control. However, the power $[eqn]$ shows a strong dependence on $[eqn]$ , with higher values of $[eqn]$ leading to substantially reduced detection rates. For instance, when $[eqn]$ = 1.0 and $[eqn]$ , the detection power decreases from 80.4% at $[eqn]$ = 0.2 to only 17.8% at $[eqn]$ = 0.6.

The change point estimation accuracy, measured by $[eqn]$ , also exhibits sensitivity to $[eqn]$ selection. Smaller $[eqn]$ values consistently provide more precise change point detection, particularly for smaller mean shifts ( $[eqn]$ = 1.0). For example, at $[eqn]$ and $[eqn]$ = 1.0, the estimation error increases from 9.5 (209.5–200) at $[eqn]$ = 0.2 to 90.1 at $[eqn]$ = 0.6. This pattern is particularly pronounced for smaller $[eqn]$ values, confirming the EWMA statistic’s sensitivity to small mean drifts. Interestingly, as $[eqn]$ increases, the influence of $[eqn]$ on both detection power and change point estimation diminishes. At $[eqn]$ = 2.0, even with $[eqn]$ = 0.6, the method achieves detection power above 85% across all sparsity levels, and the change point estimation error remains within 5.5 time units. This suggests that while $[eqn]$ selection is critical for detecting small changes, its impact becomes less significant when dealing with larger mean shifts. The results also indicate that higher sparsity levels ( $[eqn]$ ) generally improve detection performance, particularly for smaller $[eqn]$ values. This pattern is most evident in the $[eqn]$ = 1.0 scenario, where increasing $[eqn]$ from 0.05 to 0.15 improves detection power from 80.4% to 95.9% at $[eqn]$ = 0.2.

These findings collectively suggest that while smaller $[eqn]$ values (around 0.2) are preferable for detecting small changes and achieving accurate change point estimation, larger $[eqn]$ values may be more suitable when robustness to noise is prioritized over sensitivity to small shifts. The choice of $[eqn]$ should therefore be guided by the specific monitoring objectives and the expected magnitude of process changes.

Figure 3 illustrates a comparative analysis of the performance metrics, including power values and type-I error rates, across three monitoring methods under varying $[eqn]$ parameter values, evaluated against three distinct covariance matrix structures in the mean abrupt shift scenario. The left panel of the figure demonstrates the power values obtained by each method. When $[eqn]$ = 0.4 or $[eqn]$ = 0.8, the AM method exhibits a slight advantage over our proposed EVT method. However, as $[eqn]$ increases to 1.2 or beyond, the EVT method significantly outperforms both the AM and APC methods in terms of power values. The right panel of Figure 3 focuses on the type-1 error rates. It is evident that the EVT method effectively controls the type-1 error rate around the nominal level of 5%. In contrast, the AM method fails to maintain control over the type-I error rate. The APC method also shows suboptimal performance in controlling type-I errors. Overall, Figure 3 highlights the robustness and superiority of the EVT method, especially for larger values of $[eqn]$ , both in terms of power and type-I error control. The results underscore the limitations of the AM and APC methods in maintaining statistical control under varying conditions.

Table 4 lists the fault diagnosis results of high-dimensional data streams by using different diagnostic methods. We have calculated the values of two main indicators here: one is the correct recognition rate, and the other is the incorrect recognition rate. At the same time, we also considered the value of change point estimation during the online monitoring phase. The results show that as k increases, the change point estimation becomes closer to the true value. Regardless of the proportion of $[eqn]$ being equal to 5%, 10%, or 15%, the EVT method is significantly better than the other two methods. Furthermore, from the diagnostic results, the TPR values of the EVT method are close to 100%. It should be noted that the AM method and APC method also have good diagnostic results. As pointed out by Vilenchik et al. (2019) [35], PCA-based approaches, such as APC, face a problem of difficult interpretation, especially for high-dimensional data. Considering this, as well as the results of point estimation, our method is, overall, superior to the other two methods.

Recently, Aman et al. [27] proposed a novel methodology for fault detection based on Slow Feature Analysis (SFA), specifically tailored for time series models and SPC. Their comprehensive analysis demonstrates that Kernel SFA (KSFA) and Dynamic SFA (DSFA) significantly outperform traditional methods by offering enhanced sensitivity and fault detection capabilities.

To further evaluate the effectiveness of fault detection methods, we compare the proposed EVT online monitoring method with the DSFA method. The results of this comparison are presented in Figure 4 and Figure 5. It is important to note that, as observed in prior analyses, the DSFA method struggles to effectively monitor high-dimensional and ultra-high-dimensional sparsely changing time series data streams, primarily due to the challenges posed by the curse of dimensionality. To facilitate a more meaningful comparison, we select a data stream with a slightly lower dimensionality. Specifically, we set the parameters as follows: $[eqn]$ , $[eqn]$ , $[eqn]$ , $[eqn]$ , with 30 components exhibiting abnormal changes. We examine two scenarios of mean change: (i) mean abrupt shift and (ii) mean gradual shift. In the gradual shift scenario, the duration of the change is set to $[eqn]$ time units.

Figure 4 illustrates the performance of both the EVT and DSFA methods under these two scenarios. The left subfigure depicts the mean abrupt shift case, while the right subfigure represents the mean gradual shift case. In both subfigures, the gray lines denote IC data, and the red lines indicate OC data. From Figure 4, it is evident that both methods exhibit significant changes in monitoring statistics after the change point, indicating their ability to detect faults. In the first scenario (mean abrupt shift), the EVT method promptly reflects the abnormal changes in the data stream, with the monitoring statistics clearly exceeding the threshold at the change point. Moreover, in the absence of changes, most of the monitoring statistics remain below the threshold, demonstrating the method’s robustness. In the second scenario (mean gradual shift), both methods exhibit a delay in detection due to the gradual nature of the change. However, the DSFA method incorrectly identifies a substantial amount of normal data as abnormal before the change point occurs, highlighting its limitations in handling gradual shifts. In contrast, the EVT method demonstrates superior performance by more accurately distinguishing between normal and abnormal data, even in the presence of gradual changes.

Overall, the results in Figure 4 underscore the advantages of the EVT method over the DSFA method, particularly in terms of timely and accurate fault detection in both abrupt and gradual change scenarios. This comparison reinforces the effectiveness of the EVT approach for online monitoring of time series data streams.

Figure 5 illustrates the change trends in monitoring power and type-I error rates for the EVT and DSFA methods as the degree of abnormality $[eqn]$ increases from 0.4 to 4.0. The figure examines two types of mean changes: abrupt and gradual shifts. The top two subplots (a) and (b) depict the performance of the two methods in terms of monitoring power and type I error under abrupt mean changes, while the bottom two subplots (c) and (d) show the corresponding trends under gradual mean changes.

From Figure 5, it is evident that the monitoring power of both methods increases with the rise in $[eqn]$ , as shown in the left subplots. However, the EVT method consistently outperforms the DSFA method, demonstrating superior monitoring efficiency. Specifically, the power values monitored by the EVT method are significantly higher than those of the DSFA method, regardless of whether the mean change is abrupt or gradual. This indicates that the EVT method is more effective in detecting anomalies as $[eqn]$ increases. The right subplots focus on the type-I error rates. The EVT method effectively controls the error rate around the 5% threshold, maintaining reliability in false positive detection. In contrast, the DSFA method struggles to control the type-I error, with many monitoring statistics exceeding the threshold before the change point occurs. This aligns with the results observed in Figure 4, further highlighting the robustness of the EVT method in managing error rates. In summary, Figure 5 demonstrates that while both methods improve in monitoring power with increasing $[eqn]$ , the EVT method is significantly more effective and reliable, particularly in controlling type-I errors, making it a preferable choice for detecting mean changes in data streams.

4. Real Data Analysis

To validate the effectiveness of the proposed methodology, we apply our monitoring and diagnostic framework to a real-world industrial dataset involving archaeological glass vessel analysis. This dataset simulates a typical high-dimensional process monitoring scenario in material manufacturing industries. The data originates from Electron Probe X-ray Microanalysis (EPXMA) measurements of sixteenth- to seventeenth-century glass artifacts [36]. Previous studies have extensively analyzed this dataset for anomaly detection, including Hubert et al. (2005) [37], who applied RobPCA and identified row-wise outliers, and Hubert et al. (2019) [38], who employed MacroPCA to flag anomalous samples.

In industrial practice, EPXMA serves as a critical tool for quality control in glass production, semiconductor manufacturing, and metallurgy, where real-time monitoring of material composition ensures product consistency and enables early anomaly detection. For instance, modern glass manufacturing requires precise detection of elemental composition deviations caused by raw material impurities or furnace temperature fluctuations, which could otherwise lead to defective batches. Our case study treats the glass artifact data as a high-dimensional production process stream, containing 180 sequential time points (analogous to production cycles) and 750 spectral intensity variables. These EPXMA intensities reflect elemental composition characteristics comparable to real-time spectroscopic monitoring in industrial production lines. Each time point corresponds to a manufactured batch, with variables representing critical quality indicators such as SiO_2_, CaO, and trace element concentrations.

During preliminary analysis, we excluded 13 variables with missing values or measurement artifacts (e.g., sensor dropout events), retaining 737 process variables. This preprocessing aligns with industrial protocols for dynamically excluding faulty sensors from monitoring systems. Shapiro-Wilk normality tests reveal non-normal distributions for most components (p-values < 0.01). Following previous studies, we resampled the first 30 IC observations 100 times to generate a 3000-sample IC reference set. All IC observations served as historical data, with 180 subsequent observations used for testing. To approximate normality assumptions, we applied an inverse normal transformation: $[eqn]$ for $[eqn]$ , $[eqn]$ , where $[eqn]$ denotes the empirical cumulative distribution function for the j-th IC component. Notably, this marginal transformation does not enforce joint normality.

We implement our online monitoring framework with a control limit $[eqn]$ and weight parameter $[eqn]$ . As shown in Figure 6, the system detects an OC state at $[eqn]$ , indicating a systemic process deviation. This finding corroborates Hubert et al. (2019) [38], who identified similar anomalies using offline Robust PCA methods. In industrial practice, such detection would trigger immediate production checks for potential causes like raw material contamination or equipment malfunctions.

In the second stage, to identify the root causes of data stream anomalies, we perform a detailed analysis of observations within a defined window ( $[eqn]$ = 5), covering five consecutive time points (58–62) after the change point. By using the fault diagnosis Algorithm 1 proposed in this study, we demonstrate significant intensity shifts in 36 variables, suggesting potential anomalies. While the specific chemical elements corresponding to the spectral data remain unidentified, we postulate that these shifts may indicate variations in certain chemical components, particularly those related to potassium (K) and lead (Pb) oxides. In an industrial setting, this precise diagnostic capability facilitates targeted quality adjustments for specific deviations, such as changes in K/Pb ratios due to contaminated raw materials. This diagnostic method marks a substantial improvement over conventional approaches that simply identify ‘abnormal batches’ without offering actionable insights for operational adjustments.

5. Conclusions and Discussion

This study develops a statistically rigorous framework for online monitoring and fault diagnosis in high-dimensional data streams with sparse anomalies. The proposed two-stage methodology integrates an EWMA-based monitoring scheme with the diagnostic Algorithm 1, demonstrating quantifiable improvements over conventional approaches. Numerical simulations validate that the monitoring stage achieves rapid anomaly detection (typically within 1 or 2 sampling intervals post-change) while maintaining type-I error rates at approximately 5%, aligning with conventional control limits. The diagnostic stage exhibits exceptional precision, attaining 99.1% identification accuracy for 200-dimensional anomaly streams and reducing false discovery rates to below 3–28.0% improvement over conventional approaches. These quantifiable advancements address critical limitations in existing methods, particularly in balancing sensitivity to sparse changes with stringent error control. This method demonstrates effectiveness in monitoring high-dimensional data streams characterized by abnormal mean changes.

However, its capability to detect anomalies is limited in scenarios involving covariance changes, indicating certain constraints in capturing diverse types of abnormal patterns. Consequently, the proposed approach imposes specific requirements on data quality, particularly regarding data distribution, to satisfy its theoretical assumptions. Moreover, it should be noted that several algorithmic parameters require careful calibration based on actual data characteristics in practical applications. Specifically, the transformation parameter $[eqn]$ and the diagnostic window width $[eqn]$ need appropriate adjustment according to the data quality. Future research should focus on extending the framework to address these constraints. Adaptive covariance estimation techniques and robust statistical formulations could enhance robustness to non-Gaussian noise and covariance shifts. Computational optimizations during initialization may improve scalability for ultra-high-dimensional systems. Furthermore, investigating adaptive parameter selection strategies and relaxing independence assumptions could broaden applicability to correlated anomaly patterns. Despite these limitations, the proposed method establishes a principled foundation for high-dimensional stream analysis, particularly in applications demanding sparse fault detection with controlled FDR.