What Is Multivariate Anomaly Detection and Why Does It Matter for Industrial IoT?

What Is Multivariate Anomaly Detection?

Multivariate anomaly detection analyzes multiple sensor channels simultaneously to detect abnormal patterns in the relationships between them, not just in individual readings. It catches failures that single-sensor monitoring completely misses.

Consider a pump monitored by four sensors: vibration on the X-axis, vibration on the Y-axis, temperature, and outlet pressure. A traditional univariate monitoring system sets thresholds on each sensor independently — alert if vibration exceeds 0.5g, alert if temperature exceeds 200F. This approach works for obvious failures but misses developing faults where individual sensor readings remain within normal ranges.

The critical insight is that sensors on the same machine are physically correlated. When vibration increases due to bearing wear, friction generates heat, so temperature rises. When a pump impeller degrades, flow rate drops, so outlet pressure decreases. These correlations are the fingerprint of healthy operation. When the correlations break down — vibration rises but temperature stays flat — something has changed in the machine's physical behavior, even if no single reading looks alarming.

Why Does Single-Sensor Monitoring Miss Developing Faults?

Single-sensor monitoring fails because many mechanical failures first manifest as changes in the relationships between measurements, not as extreme values on any individual measurement. By the time a single sensor exceeds its threshold, the fault is often already severe.

Example: bearing outer race defect. In early stages, a developing spall on the outer race produces characteristic vibration frequency peaks (BPFO harmonics) that increase the X-axis vibration energy by 15-20%. This is well within normal operating range for most threshold-based systems. However, the Y-axis vibration does not increase proportionally — the defect is directional. A multivariate system detects that the X/Y vibration ratio has changed from the healthy baseline pattern.

Example: pump cavitation onset. Cavitation causes micro-bubble collapse near the impeller. Flow rate begins oscillating, but the average flow stays near nominal. Temperature increases slightly from the localized heating. Current draw shows micro-fluctuations. No single sensor triggers a threshold alarm. But the correlation between flow stability, temperature, and current has shifted from the learned healthy pattern.

Example: motor winding degradation. A developing inter-turn short increases stator temperature asymmetrically and changes the relationship between current draw and torque output. Both values remain within spec, but their ratio — the motor efficiency — has degraded. Only multivariate analysis across current, temperature, and vibration channels detects this early.

How Does Canary Edge Detect Cross-Channel Correlation Breakdowns?

Canary Edge uses a three-stage pipeline: a frozen encoder that compresses each sensor channel into a 192-dimensional embedding, a cross-channel attention module that fuses all channel embeddings into a single representation, and a predictor that learns how that fused representation evolves over time.

Stage 1: Per-channel encoding. Each sensor channel (vibration_x, vibration_y, temperature, pressure) is independently processed by the same pretrained transformer encoder. A window of 2,048 raw samples is compressed into a 192-dimensional vector that captures the temporal structure of that channel — dominant frequencies, amplitude envelope, and phase relationships. This encoder was pretrained on NASA IMS bearing run-to-failure data and is frozen (never updated) during customer fine-tuning.

Stage 2: Cross-channel fusion. The per-channel embeddings (shape: channels x 192) are fed into a cross-channel attention module. This module prepends a learnable CLS (classification) token and runs a 2-layer transformer with 4 attention heads across all channels. The CLS token attends to every channel embedding, learning how the channels relate to each other. No positional encoding is used because sensor channels have no natural order. The output is a single 192-dimensional fused vector representing the joint state of all channels.

Stage 3: Prediction. A predictor network takes the fused vector and predicts what the next fused vector should be. During fine-tuning on healthy data, the predictor learns the normal evolution of cross-channel relationships. At inference time, if the actual next fused vector diverges from the prediction, the prediction energy (squared L2 distance) rises. This energy drives the regime classification: HEALTHY (z-score < 2.0), ACTIVE (< 3.0), TRANSITION (< 5.0), SHOCK (>= 5.0).

How Does Per-Channel Contribution Scoring Work for Root Cause Diagnosis?

When Canary Edge detects an anomaly, it provides per-channel contribution scores that identify which sensor is most responsible. This turns detection into diagnosis.

During multivariate inference, Canary Edge computes two types of energy in parallel. The cross-channel energy uses the fine-tuned cross-attention model and drives the overall regime classification. The per-channel energy applies a generic predictor to each channel's embedding independently, producing an energy value per channel.

The contribution score for each channel is calculated as:

contribution_score[channel] = per_channel_energy[channel] / sum(all_per_channel_energies)

A response might show: - vibration_x: 62% contribution - vibration_y: 24% contribution - temperature: 9% contribution - pressure: 5% contribution

This tells the maintenance team that the X-axis vibration channel is the primary driver of the anomaly, with Y-axis vibration as a secondary contributor. Combined with the cross-channel regime (which detects that the vibration/temperature correlation has broken down), this provides actionable diagnostic information: the machine has a directional vibration issue that is not yet generating proportional heat, consistent with an early-stage bearing defect.

What Does Multivariate Detection Look Like on a Real Machine?

Consider a centrifugal pump monitored by four sensors: vibration (accelerometer on bearing housing), temperature (RTD on bearing cap), outlet pressure (pressure transducer), and motor current (CT on supply line). The operator creates a baseline using POST /v1/baseline/multivariate with 2 hours of healthy operating data (7,200 readings per channel at 1 Hz).

Healthy operation (week 1-3): All four channels produce stable readings. Cross-channel energy stays low. Regime: HEALTHY. The fine-tuned model has learned that when vibration is at 0.08g, temperature is 165F, pressure is 45 PSI, and current is 12.3A — these values move together in predictable patterns.

Early degradation (week 4): A bearing defect begins developing. Vibration increases from 0.08g to 0.11g on the X-axis — a 37% increase but still well within the 0.5g alarm threshold. Temperature remains at 165F because the fault has not yet generated significant friction heat. Outlet pressure is unchanged. Current is unchanged.

A univariate system monitoring each sensor independently sees all values within normal range. No alarm fires.

Canary Edge's cross-channel energy rises because the vibration/temperature correlation has broken — vibration up, temperature flat. The regime shifts from HEALTHY to ACTIVE. Per-channel contribution scores show vibration_x at 68%. The maintenance team investigates and discovers the developing defect before it progresses to a failure.

Severe degradation (week 5-6): Without intervention, vibration reaches 0.25g, temperature starts climbing to 185F (the heat is now detectable), pressure drops slightly as bearing friction absorbs energy. Cross-channel energy spikes further. Regime shifts to TRANSITION. Per-channel scores now show vibration_x at 45%, temperature at 30%, pressure at 15%, current at 10% — the fault is propagating across all channels.

This progression from HEALTHY through ACTIVE to TRANSITION gives maintenance teams a graded warning system, not a binary alarm, providing days or weeks of lead time before a catastrophic failure.

How Does This Compare to AWS Lookout's Multivariate Detection?

AWS Lookout for Equipment also supported multivariate anomaly detection, but with significantly different requirements and architecture. The most impactful difference is the minimum training data requirement.

Lookout's 6-month minimum training requirement was its biggest adoption barrier. New equipment could not be monitored until half a year of operating data was collected. Canary Edge creates a baseline from as few as 100 data points per channel — roughly 2 minutes of data at 1 Hz sampling. This is possible because the encoder was pretrained on NASA bearing data and the fine-tuning only adapts the cross-attention and predictor layers (1.35 million parameters) to the specific machine's correlation patterns.

Lookout is retiring on October 7, 2026. Teams currently using Lookout's multivariate detection can migrate to Canary Edge by exporting their healthy operating data from S3 and creating new baselines via the Canary Edge API. The per-channel contribution scoring in Canary Edge provides comparable diagnostic capability to Lookout's component-level ranking.