Identifiability-Aware, Cost-Aware Triage of Physical Faults and Measurement-Integrity Anomalies in Energy Cyber-Physical Systems
Abstract
Highlights What are the main findings? A strictly alarm-gated, run-disjoint protocol yields conditional physical-feature AUCs of 0.873 on TEP and 0.895 on the wind-farm simulation. A separate benign-sensor-fault stress test preserves process-versus-measurement-integrity ranking but forces matched sensor-fault/attack cause AUC to 0.500. What are the implications of the main findings? Physical-consistency features provide auditable triage and reduce illustrative episode-level decision cost, but trail a raw-statistics XGBoost benchmark on clean data. Observationally equivalent causes require abstention or independent maintenance, sensor-quality, or security evidence rather than a forced telemetry-only label. Abstract After an anomaly is detected in an energy cyber-physical system, operators must decide whether to respond as if the process has physically failed or as if the measurements have lost integrity. These causes can require different actions, yet they may produce similar telemetry. We present a detection-gated triage framework that first applies a fixed canonical-variate detector and then uses nine physical-consistency features to distinguish physical process faults from measurement-integrity anomalies. Evaluations on the Tennessee Eastman Process and a wind-farm simulator yielded cause-attribution AUCs of 0.873 and 0.895 and end-to-end balanced accuracies of 0.805 and 0.792, respectively. Under the specified response-cost matrices, the policy reduced expected misattribution cost by 18.4% and 28.9% relative to blanket responses. Tests on real datasets show that ranking can transfer, but operating thresholds require plant-specific calibration. Exact matched sensor-fault/attack pairs give chance-level discrimination, demonstrating a fundamental boundary: measurement-only data cannot identify different causes that generate the same observations. The framework is therefore intended as an auditable triage aid, with ambiguous or out-of-distribution cases routed to review rather than treated as confirmed cyber attribution.