Fault Detection for Building Systems Under Sensor Drift: A Closed-Loop Diagnostic and Reproducible Evaluation Protocol

1. Introduction

Sensor drift remains difficult to diagnose in building systems because many monitored variables are embedded in feedback control. A temperature sensor with additive bias does not necessarily show an obvious out-of-range value. In a regulated loop, the controller can alter valve opening, damper position, or fan speed so that the measured temperature returns toward the apparent setpoint. The sensor trace may then appear normal while physical operation deviates from the fault-free condition. [1]

Prior HVAC diagnostics work describes this masking effect directly. In the virtual-sensor study synthesized here, closed-loop control is reported to drive the biased reading back toward normal values while the anomaly migrates to correlated measurements and actuator behavior. The same source summarizes benchmark evidence that a temperature bias may become visible in valve behavior rather than in the biased signal itself, and that principal component methods can struggle on this fault class under feedback masking. [1]

This manuscript therefore addresses a bounded methodological question: how should a drift-aware fault-detection protocol for HVAC and related building systems be designed and evaluated when the target fault is gradual or persistent sensor bias inside a closed loop? The manuscript is not an empirical report. It proposes a reproducible diagnostic and evaluation design that future studies can test, falsify, and revise.

2. Evidence scope and synthesis strategy

The manuscript uses targeted narrative synthesis rather than systematic review. The evidence scope is limited to strands that directly inform protocol design. First, recent work on automated virtual sensors in HVAC provides direct prior findings on closed-loop masking, residual-based detection, sensor isolation, and actuator-informed discrimination. Second, a reproducible simulation workflow for multi-building and multi-climate HVAC operation contributes a foundation for controlled benchmark generation with pinned software versions and fixed seeds. Third, predictive-modeling work on building heating load contributes methodological cautions about residual interpretation and uncertainty-aware prediction, even though that literature concerns forecasting rather than fault detection. Fourth, a smart-building runtime-governance study contributes a model for deterministic, inspectable admission rules at the control layer. Fifth, an industrial IoT federated anomaly-detection study is used here only as an architectural analogue for adaptive thresholding and distributed learning in sensor networks; its empirical results concern cybersecurity anomalies in IIoT environments, not HVAC drift. [1] [2] [3] [4] [5]

The synthesis is selective by design. It is intended to define implementable protocol elements rather than to estimate average performance across the literature. Prior findings, proposed design choices, and tests not yet performed are separated explicitly. When a design choice extends beyond the supplied findings, it is presented as a hypothesis or engineering rule for future evaluation rather than as an established result.

3. Prior findings and the protocol gap

The most directly relevant prior findings concern metadata-guided virtual sensing for closed-loop HVAC bias faults. The cited study reports that BRICK schema metadata can be used to derive virtual temperature-sensor models automatically. In that framework, LightGBM regressors are trained on fault-free inter-sensor relationships, z-scored residuals serve as detection signals, daily anomaly ranking supports isolation, and actuator command-position discrepancies support fault-type discrimination. The reported evidence is based on simulated benchmark scenarios for single-duct air handling units and fan coil units. The study also compares residual-based detection with PCA under its benchmark conditions. The proposed protocol does not assume that their relative performance transfers unchanged to other HVAC systems. [1]

Those findings do not resolve how to evaluate gradual drift under realistic operational variability. The same study states that its evidence relies on simulated data and explicitly identifies real-building noise, missing values, communication dropouts, occupancy-driven variability, and gradual drift as limitations not fully represented in the benchmark. It identifies validation on operational-building data with naturally occurring faults as the immediate priority, and it separately notes adaptive model updating as a further research direction for seasonal drift in fault-free relationships. The present protocol is directed at that unresolved methodological problem rather than at replacing the earlier residual approach. [1]

A second prior strand concerns reproducible building-operation data generation. The MethodsX workflow generates one-year multivariate HVAC time series across multiple buildings and climates using EnergyPlus-based and Modelica-based simulators under both default rule-based control and a deliberately stochastic supervisory policy. The source states that the stochastic controller introduces drift, ramps, oscillations, jumps, and noisy holds in setpoint trajectories, and that fixed seeds and pinned software versions yield deterministic regeneration. This is directly useful for protocol design because drift-aware fault detection should be assessed under diverse but reproducible state-action coverage rather than under a single schedule family. [2]

The predictive-modeling and runtime-governance strands provide narrower guidance. The heating-load study argues that residual structure and uncertainty matter in model assessment but also states that its findings are specific to one building and are not supported by significance tests. The runtime-governance study, although not a fault-detection paper, shows how explicit control-layer predicates can admit or reject sensor-driven actions based on integrity and safety conditions. These strands support a methodological proposal: residual alarms should be interpreted through calibrated rules, and any use of suspect measurements in downstream control should be governed by reproducible decision logic. [3] [4]

4. Problem formulation and operational definitions

Consider a building subsystem observed at discrete times t = 1, 2, ..., T. Let y_i(t) be the reading of sensor i, s_i(t) the latent fault-free physical quantity, u_j(t) the commanded input to actuator j, p_j(t) the measured actuator position or response if available, and x_i(t) a feature vector of correlated measurements, setpoints, actuator variables, and exogenous drivers used to predict y_i(t) under fault-free conditions. Sensor drift is defined as an additive bias process b_i(t) such that y_i(t) = s_i(t) + b_i(t) + e_i(t), where e_i(t) is ordinary measurement noise. A closed-loop masking condition exists when |y_i(t) - sp_i(t)| remains small relative to historical variability because the controller compensates, while at least one element of x_i(t), u_j(t), or p_j(t) departs from its fault-free conditional relation.

The protocol targets persistent bias in controlled measurements, especially temperature sensors but extendable to pressure and flow channels where the metadata graph and training data support prediction. Detection means deciding whether a fault episode is present. Isolation means ranking candidate faulty sensors. Discrimination means separating likely sensor faults from likely mechanical or control faults. Fault episodes may be abrupt, gradual, intermittent, or wandering. Comparator disturbances include occupancy shifts, supervisory setpoint changes, seasonal regime changes, communication gaps, and mechanical faults.

For sensor i, define r_i(t)=y_i(t)-f_i(x_i(t)), with f_i fitted on fault-free training data. Robust residual scaling uses the training median and median absolute deviation, with a positive preregistered denominator floor epsilon. Daily statistics use timezone-aware site-local calendar intervals [midnight(d),midnight(d+1)). Compute the expected point count N_exp(d) from the registered regular analysis grid inside that actual interval; do not assume 1440 minutes on daylight-saving transitions. A 15-minute grid normally contains 96 points, but the actual local-day grid can differ. A day is evaluable only when its valid count is at least ceil(0.75 N_exp(d)). Irregular observations are mapped to the fixed grid using last-observation carry-forward for at most one native sampling interval, with longer gaps left missing. Insufficient-data days emit no drift alarm. They are omitted only from conditional day-level detection and false-alarm denominators; all preregistered fault events remain in the event-level sensitivity denominator. An event with no evaluable day and no valid alarm is a missed detection, and the fraction of evaluable days is reported separately.

For sensor i on evaluable day d, define A_i(d) as the median over valid timestamps in day d of |z_i(t)| and S_i(d) as the median over valid timestamps in day d of z_i(t). A day is positive if A_i(d) > theta_A and |S_i(d)| > theta_S. Its directional sign is sign(S_i(d)). The role of S_i(d) is not to measure drift magnitude but to require directional coherence: a sustained additive bias should shift residuals predominantly to one side of zero, whereas variance bursts from regime changes can increase A_i(d) without stable sign. Because the median sign can become unstable when positive and negative residuals are nearly balanced, the protocol fixes one auxiliary rule. Let pi_i(d) denote the fraction of valid timestamps in day d for which z_i(t) > 0. If |pi_i(d) - 0.5| < delta_pi, classify the day's direction as indeterminate and set the day to non-positive even when A_i(d) exceeds theta_A; the default is delta_pi = 0.1, with sensitivity analysis over nearby values. Let E_i(d) = 1 if day d is evaluable and E_i(d) = 0 otherwise. Days with E_i(d) = 0 neither trigger alarms nor count as positive days. Persistence is evaluated on calendar days with an explicit gap rule. On calendar day d, inspect the interval [d-W+1, d] and retain only evaluable days in that interval. Let g_i(k) denote the number of consecutive non-evaluable calendar days between evaluable day k and the most recent prior evaluable day in the interval; for the earliest evaluable day in the interval, set g_i(k)=0. Discard from the interval any evaluable day k for which g_i(k) > g_max, together with all earlier evaluable days in that interval. Equivalently, only the maximal suffix of evaluable days separated pairwise by at most g_max non-evaluable days remains eligible for persistence counting. Let R_i(d;W) be the number of retained evaluable days, P_i(d;W) the number of retained positive days, and D_i(d;W) = |sum over retained positive days k of sign(S_i(k))| / P_i(d;W) when P_i(d;W) > 0, with D_i(d;W) = 0 otherwise. A drift-suspect alarm is raised on day d only if E_i(d) = 1, P_i(d;W) >= K, D_i(d;W) >= rho, and at least one retained positive day occurs among the two most recent retained evaluable days up to d. This formulation makes the restart condition unique: once a gap larger than g_max occurs, all evidence before that gap is ignored for day d even if it still lies inside the W-day calendar window. Worked example: with g_max = 2 and W = 5, suppose days 10, 11, and 14 are evaluable, while 12 and 13 are non-evaluable. On day 14, days 10, 11, and 14 are all retained because each adjacent evaluable pair is separated by at most two non-evaluable days. If instead days 10 and 14 are evaluable while 11, 12, and 13 are non-evaluable, then on day 14 only day 14 is retained because the gap between the adjacent retained evaluable days would be three, which exceeds g_max. This operational definition is proposed for future testing rather than claimed as a validated optimum. For boundary cases, require theta_A >= 0 and theta_S >= 0. Set the directional label to +1 when pi_i(d) >= 0.5+delta_pi and S_i(d)>0, to -1 when pi_i(d) <= 0.5-delta_pi and S_i(d)<0, and to zero otherwise. Equality at an A or S threshold is non-positive because those comparisons are strict. A day contributes a positive persistence count only when its directional label is nonzero and both magnitude tests pass. Mixed or inconsistent signs therefore do not enter P_i or the signed sum; no rounding of pi is performed before comparison. The W-day interval always contains calendar days, with the stated gap-reset rule applied before evaluable-day counts.

To make the rule reproducible, threshold selection is fixed by a tuning procedure with two disjoint validation subsets. On the clean-validation subset, choose admissible tuples (theta_A, theta_S, K, W, rho, delta_pi) from a prespecified grid such that the median false alarms per clean scenario-year do not exceed alpha_FA and the mean fraction of false-alarm days does not exceed beta_day. Illustratively, alpha_FA may be set to 1 and beta_day to 0.5%, but these are protocol targets rather than validated values. Among admissible tuples, select the tuple that minimizes a day-resolution event-delay objective on a separate drift-tuning subset containing injected scenarios generated from different base seeds than the clean-validation subset. For one injected fault event e with onset time tau_e, define its first valid alarm time as the end of the earliest evaluable calendar day whose day label satisfies the alarm rule and whose day interval ends at or after tau_e. If no such alarm occurs before the event ends or before scenario termination, assign the event a fixed penalty delay equal to H_e + 1 day, where H_e is the event horizon from tau_e to the earlier of event end or scenario end. When multiple alarms occur, only the first valid alarm contributes to delay. When a scenario-year contains multiple injected episodes, compute one delay per episode and summarize by the median across episodes within the scenario-year; then summarize across scenario-years by the median of those scenario-level medians. If several tuples have the same objective value, break ties in order by lower day-level false-alarm rate on the clean-validation subset, then smaller K, then smaller W, then lexicographic order of the remaining parameter values. Tune the neighborhood threshold theta_N and mechanical cutoff gamma_M by the same split logic, using clean-validation data for false-label control and separate injected scenarios when fault-specific delay or discrimination tuning is required. Under the default protocol, tuning is performed separately for online-injection and post hoc-injection benchmarks; a single frozen parameter set is not shared across those regimes unless a separate preregistered transfer test is being run. The values delta_pi=0.1, alpha_FA=1 per clean scenario-year and beta_day=0.005 are an illustrative reference configuration. Every prospective study must publish its finite tuning grid and selected constraints before test evaluation; none of these values is a validated universal operating limit.

5. Proposed diagnostic architecture

The proposed architecture has four layers: metadata-guided model construction, residual generation, sequential drift diagnosis, and sensor-quality governance. The first layer follows prior virtual-sensor work in using machine-readable metadata to derive candidate neighborhoods for each target sensor. For sensor i, the feature set x_i(t) should include physically linked upstream and downstream temperatures, relevant setpoints, exogenous weather variables, actuator commands, and measured actuator positions where available. If BRICK-like metadata are unavailable, manual mapping is permitted but must be documented because earlier HVAC work notes that, without standard metadata models, mapping BAS data points becomes labor intensive. In this manuscript, that observation is treated as a deployment implication for scaling the protocol, not as direct evidence of portfolio-level performance. [1]

In the second layer, the protocol defines one primary predictor and two comparators. The primary model is gradient-boosted trees, chosen because prior virtual-sensor work used LightGBM on simulated HVAC bias scenarios. Comparator 1 is a linear or PCA-type reconstruction model, included because prior findings show that PCA can detect some system anomalies and may be competitive for detection on some HVAC systems even while lacking isolation and discrimination. Comparator 2 is a probabilistic predictor that returns intervals or quantiles. Its inclusion is a prospective design choice for testing whether uncertainty estimates improve residual interpretation under regime change; it is not presented as an established fault-detection result. [1] [3]

The third layer adds diagnosis logic beyond pointwise residual magnitude. First, compute z_i(t), A_i(d), and S_i(d). Second, apply the persistence rule of Section 4 to obtain a sensor-level drift-suspicion state. Third, for each drift-suspect sensor, compute a cross-sensor consistency score C_i(d) equal to the fraction of metadata-linked neighboring sensors whose aggregated residual magnitude exceeds a lower neighborhood threshold theta_N on the same day. A low C_i(d) with persistent residuals suggests either model misspecification or an isolated sensor-channel issue; a moderate or high C_i(d) is consistent with redistributed closed-loop effects. The threshold theta_N is tuned on clean validation data by the same false-alarm procedure used for theta_A.

If actuator feedback is available, the protocol adds sensor-versus-mechanical discrimination. This step requires a reproducible rule for choosing the actuator channels associated with each suspect sensor. For each sensor i, define the candidate damper set J_d(i) and candidate valve set J_v(i) from metadata links that connect the sensor to controlled air or water paths. Assign every candidate actuator j a path distance L(i,j), measured as the number of metadata edges in the shortest directed control or flow path between sensor i and actuator j. The dominant damper j_d*(i) is the damper in J_d(i) with minimum L(i,j), and the dominant valve j_v*(i) is defined analogously on J_v(i). If several actuators tie on minimum path distance, break the tie by the largest permutation importance measured on the same clean-training split used to fit f_i, where the score for actuator feature a is the median increase in absolute residual |r_i(t)| after randomly permuting a within day blocks on the training split while leaving all other features unchanged. Use 30 fixed random permutations with recorded seeds and compute importance relative to the fitted predictor without refitting. This permutation step is used only for tie-breaking among actuators already tied on metadata distance; it does not otherwise weight the discrimination score. If a tie remains, choose the actuator with the largest fraction of nonmissing observations on the clean-training split; if a tie still remains, break it lexicographically by actuator identifier. If a sensor has no candidate damper or no candidate valve, the missing actuator family is recorded as unavailable rather than imputed. Because training-set idiosyncrasies could still affect tie-breaking, a sensitivity analysis should repeat the ranking on a cross-fitted clean subset or bootstrap resamples and report whether the selected dominant actuator changes. Permutations act on the raw actuator-feature columns within their registered day blocks; each permuted batch then passes through the unchanged training-fitted preprocessing pipeline before prediction. Importance is measured on the resulting predictions, rather than by shuffling separately standardized feature arrays.

For each selected actuator j linked to sensor i, define command-position discrepancy q_j(t) = |u_j(t) - p_j(t)| after scaling both variables to [0,1] over the training range. Aggregate by day as Q_j(d) = median of q_j(t). Let Delta_damper(d) = Q_jd*(i)(d) and Delta_valve(d) = Q_jv*(i)(d) for the dominant damper and valve selected above. Calibrate clean-reference medians and MADs on training data and form standardized discrepancies Z_damper(d) and Z_valve(d). A daily pattern is labeled likely sensor-bias if the suspect sensor is drift-positive and both actuator discrepancy scores remain below gamma_M. It is labeled likely damper fault if Z_damper(d) >= gamma_M and Z_valve(d) < gamma_M, and likely valve fault if Z_valve(d) >= gamma_M and Z_damper(d) < gamma_M. If both exceed gamma_M, the day is labeled ambiguous mechanical-or-multiple fault. The cutoff gamma_M is tuned on clean data to bound false mechanical labels, then stress-tested on scenarios with injected mechanical faults where available. Prior HVAC work supports actuator command-position discrepancy as a useful diagnostic signal; the standardized daily metric and decision thresholds specified here are proposed protocol elements for future testing. [1]

Automatic substitution is an unvalidated component of this proposed research design and requires three simultaneous gates. Reserve a clean calibration subset V_cal whose base simulation seeds are disjoint from training, model tuning and drift tuning. After all model and alarm settings are frozen, calculate each sensor MAE on V_cal. Within the same building/subsystem, let Q75 be the 75th percentile of those calibration MAEs. Sensor i passes the error gate only if MAE_i <= min(Q75,E_abs), where E_abs is a positive, variable-specific engineering-error cap fixed before calibration in the same units as y_i. A missing cap prevents substitution. In addition, current predictor-input completeness must be at least 0.90, and the current state must not be ambiguous mechanical-or-multiple fault. A probabilistic model must also satisfy its separately preregistered V_cal coverage tolerance. The same frozen-fold measurements are used for both error limits; neither is tuned on test data. A permitted substitute and all gate values are logged with the model version. Failure of any gate requires review and the preapproved fallback procedure. This defines a prospective test condition rather than evidence that automatic control substitution is safe or accurate in practice. [4]

6. Reproducible drift-aware data generation protocol

The benchmark protocol extends the reproducible multi-building simulation workflow reported in MethodsX. Simulations are generated under both default rule-based control and the stochastic supervisory controller, with pinned versions, fixed seeds, and recorded metadata. The extension proposed here injects sensor drift in two distinct ways because they answer different questions. Online injection alters the sensor value before the closed-loop controller reads it, thereby allowing control compensation and redistributed anomalies. Post hoc injection alters only the logged measurement after simulation, leaving plant behavior unchanged. Online injection is required for evaluating closed-loop masking; post hoc injection is reserved for tests of detector sensitivity to pure data corruption without control adaptation. Results from these two regimes must never be pooled, and the default protocol tunes thresholds separately for each regime before freezing test-time parameters. [2]

Each benchmark scenario is indexed by building model, climate file, control policy, simulator engine, random seed, target sensor, fault type, fault onset, and injection regime. Clean and faulted versions share all scenario attributes except fault parameters. To prevent leakage, the fault-free training data for residual models are drawn only from scenarios assigned to the training split, and no seed used in validation or test may appear in training for the same building-climate-policy tuple.

The drift injector is fully parameterized. For abrupt bias, choose onset day uniformly within a prespecified operational window and set b_i(t) = B after onset, where B is sampled from a signed magnitude set specific to the sensor units; for temperatures, an illustrative protocol grid may use magnitudes drawn from ordered categories such as small, medium, and large offsets defined by the benchmark curator rather than assumed field prevalence. For ramp drift, choose an onset day and duration L_ramp from a finite set such as {7, 14, 28, 56} days, then define b_i(t) to increase linearly from 0 to B over L_ramp and remain at B thereafter. For wandering drift, define b_i(t+1) = phi b_i(t) + eta(t) with phi sampled from [0.90, 0.99], eta(t) from a zero-mean bounded innovation distribution, and reflective bounds at plus or minus B_max so the process remains finite. For intermittent drift, define alternating on and off episodes with on-duration and off-duration sampled from stated finite sets and with on-state bias equal to a fixed or slowly varying signed magnitude. All parameter draws must be generated from recorded seeds and stored with scenario metadata.

Because the source workflow emphasizes reproducibility, the benchmark records for every scenario the simulator engine, software versions, building and climate identifiers, control policy, seed, sampling rate, injection regime, faulted sensor, fault type, onset, parameter values, and valid-point mask. This makes it possible to regenerate both the clean and faulted time series exactly under the same computational environment. The same source notes that simulation does not fully represent deployed-building idiosyncrasies, which is why the benchmark is positioned here as a controlled comparative testbed rather than as a substitute for operational validation. [2]

7. Split protocol, comparators, and outcome measures

The protocol uses an explicit three-way split to support tuning without leakage. Training contains only clean scenarios from a subset of building-climate-policy-seed tuples. Validation contains clean scenarios from disjoint seeds within the same building-climate-policy combinations plus a separate drift-tuning subset drawn from different seeds than training. Test contains held-out combinations in one of two forms: held-out seeds within unseen building-climate-policy tuples, or a stricter cross-domain test with at least one building or climate absent from training. At least one building-climate-policy tuple must be entirely absent from training and reserved for test. No scenario-year variant derived from the same base clean simulation seed may be split across partitions, and the clean scenario together with all of its derived variants, including online and post hoc injections, must remain in the same partition. Validation is partitioned by base seed into clean tuning, injected-drift tuning and the clean substitution/calibration subset V_cal. All hyperparameter and threshold selection uses only those validation partitions within the training-domain building-climate-policy combinations. The entirely held-out tuple and any stricter held-out building or climate belong to test only and are never used to tune, select thresholds or fit preprocessing. Cross-domain adaptation, if later studied, must be a separate preregistered experiment.

Comparator methods are defined prospectively. Comparator 1 is single-sensor threshold monitoring against setpoint deviation or historical range. Comparator 2 is a PCA-type detector or linear reconstruction baseline. Comparator 3 is metadata-guided residual detection without sequential persistence or governance logic. Comparator 4 is the full proposed protocol with persistence, cross-sensor consistency, actuator discrepancy discrimination where available, and sensor-quality governance. These comparators permit ablation of the added value of each layer rather than only head-to-head comparison with unrelated methods. [1]

Outcome units are normalized explicitly. The atomic fault event is one injected fault episode in one sensor within one scenario-year. Event-level detection delay is measured from the first timestamp at which the injected bias becomes nonzero to the timestamp assigned to the first valid alarming day for that event. Because alarms are generated at day resolution, the alarm timestamp is defined as the end of that day for every daily method; the resulting metric is therefore day-resolution delay, not sub-day detection latency. A valid alarming day is the earliest evaluable day whose alarm status satisfies the frozen rule and whose day end is at or after event onset. If a fault begins and ends within one day and no valid alarm is raised on that day, the event counts as missed at day resolution. Repeated alarms after the first are collapsed for delay metrics. When a scenario-year contains multiple injected episodes, each episode is scored separately; no alarm may be credited to an episode that ended before the alarming day. Day-level false-alarm rate is computed on clean scenario-years as the proportion of evaluable days with at least one alarm. Scenario-year false alarms are counted after collapsing contiguous alarm days into one episode when the gap between alarms is at most one calendar day. Isolation accuracy is computed per event from the sensor ranking on the first alarm day and reported as top-1 and top-k. Governance correctness is computed per decision timestamp during drift-suspect periods as correct substitution, correct rejection, incorrect substitution, or missed gating.

If probabilistic models are included, interval coverage and quantile calibration should be checked on clean validation and clean test data before fault metrics are interpreted. This is a protocol safeguard proposed here to reduce misreading of residuals from poorly calibrated predictors. The cited heating-load study motivates attention to residual behavior and uncertainty, but it does not establish this specific requirement for fault diagnosis. If actuator feedback exists, discrimination accuracy is evaluated per day and per event using the explicit discrepancy labels defined in Section 5. Stratified reporting by building, climate, control policy, operating mode, and drift type is required so that cross-domain degradation remains visible rather than averaged away. [3] [2]

8. Assumptions, boundary conditions, and failure cases

The protocol assumes that each monitored target has enough correlated covariates to permit a learnable fault-free relation, that sufficient clean data exist for training and tuning, and that the controller redistributes at least some drift effect into observed channels rather than concealing it completely. It also assumes reasonably accurate metadata or manual mappings. These assumptions may fail in sparsely instrumented zones, systems with unstable point naming, or plants that are frequently reconfigured without metadata updates. [1]

Boundary conditions in prior evidence should be retained. The virtual-sensor study reports that PCA matched the residual method for detection on one benchmark system while lacking isolation and discrimination, yet underperformed on another system type. The appropriate inference is therefore limited: richer metadata-guided residual models are proposed here because they appear advantageous when the task includes sensor localization, cross-system portability, or actuator-informed discrimination, not because simpler multivariate baselines are known to be inferior in every subsystem. [1]

Several failure modes require explicit stress tests. Seasonal regime changes can alter fault-free inter-sensor relations and create residual drift unrelated to sensor bias. Occupancy changes can mimic thermal bias when occupancy is unmeasured or poorly proxied. Missing values can interrupt persistence counts and distort daily aggregates. Mechanical faults can propagate through the same sensor neighborhoods and imitate distributed anomalies unless actuator feedback is available. Evaluation should therefore include missingness masks, occupancy perturbations, and mechanical-fault injections where the benchmark supports them. Adaptive model updating may also be necessary because earlier HVAC work identifies temporal drift in fault-free relationships as unresolved. [1]

Transfer from industrial IoT anomaly detection is similarly bounded. Adaptive thresholds, federated training, and privacy-preserving learning are plausible architectural extensions for building portfolios, but the cited IIoT evidence concerns cybersecurity anomalies under a specific federated framework. It supports the relevance of such architecture choices, not their effectiveness for HVAC sensor drift. Any adoption in buildings should therefore be treated as a separate hypothesis within the protocol rather than as borrowed proof. [5]

9. Prospective evaluation sequence

A prospective study following this protocol would proceed in seven steps. Step 1: generate or collect clean scenario-years and assign them to training, validation, and test under the split rules. Step 2: fit metadata-guided prediction models per target sensor using only clean training data. Step 3: tune theta_A, theta_S, theta_N, K, W, rho, and gamma_M on validation data under the stated false-alarm constraints, then freeze them. Step 4: inject drift under online and post hoc regimes with recorded seeds and parameters. Step 5: run all comparators on the test set without retuning. Step 6: compute event-level, day-level, discrimination, and governance outcomes with repeated alarms collapsed. Step 7: analyze failures involving insufficient data, ambiguous mechanical signatures, and cross-domain degradation.

A field-validation phase would differ from the simulation benchmark in three ways. Naturally occurring drift onset is unknown, mechanical faults are not perfectly labeled, and metadata may be incomplete. For that reason, operational deployment should begin as a shadow-mode study in which the protocol produces alarms and substitutions without affecting real actuation, while engineers review alarm episodes retrospectively. Only after the reviewed data establish whether substitute-quality criteria are conservative enough should governance actions influence live supervisory decisions. This staged progression follows from the protocol's untested status rather than from any claim that simulation evidence alone is sufficient.

10. Conclusion

This manuscript has proposed, rather than demonstrated, a research protocol for fault detection in building systems under sensor drift. The protocol is built on a specific conceptual premise supported by prior HVAC fault-detection work: when a biased sensor participates in feedback control, diagnostically useful evidence may reside in broken inter-sensor consistency and altered actuator behavior rather than in the biased measurement alone. On that basis, the manuscript specifies an implementable architecture with metadata-guided virtual sensors, robust residuals, explicit persistence and direction rules, actuator-selection and discrepancy metrics, deterministic substitution-versus-review logic, and a reproducible benchmark design that separates online closed-loop injection from post hoc signal corruption. [1] [2] [4]

What remains untested is equally important. The proposed thresholds, split rules, substitution criteria, actuator-selection rule, and drift-process parameterizations have not been validated on benchmark or operational data within this manuscript. Their adequacy under real-building missingness, occupancy variability, imperfect metadata, and naturally occurring slow drift is unknown. Future studies should therefore assess detection, isolation, calibration, and gating errors together with the operational consequences of substitution decisions. Until such tests are performed, the present contribution is a precise protocol for comparative and operational evaluation, not evidence that the alarm rule or governance logic is effective.

References

1. Chahine, Khaled; Noura, Hassan N. (2026). BRICK-Automated Virtual Temperature Sensors for Sensor Fault Detection, Isolation, and Discrimination in Smart-Building HVAC Systems. Sensors. 26(11), 3465. doi:10.3390/s26113465.
2. Domingo, Ferran Aran; Alonso, Pablo Fraile; Torrentó, Josep Rius; Batalla, Oriol Agost; Vilardell, Ignasi Barri; Mayoral, Jordi Vilaplana; Fornés, Jordi Mateo (2026). A reproducible method to generate multi-building, multi-climate HVAC operation datasets with a stochastic exploratory controller. MethodsX. 16, 103866. doi:10.1016/j.mex.2026.103866.
3. Emir, Ahmet; Topal, Halil Ibrahim; Ozturk, Suat (2026). Novel hybrid machine learning-based prediction of building space heating load: a comprehensive study. Scientific Reports. 16(1), 24924. doi:10.1038/s41598-026-55342-x.
4. Saydirasulovich, Norkobil Saydirasulov; Davronbekov, Dilmurod Abdujalilovich; Mubashirovich, Makhmudov Makhsum; Cho, Young Im (2026). A Closed-Loop Measurement Study of Runtime Governance in AI-Driven Smart Building Climate Control. Sensors. 26(15), 4921. doi:10.3390/s26154921.
5. Alqazzaz, Ali (2026). SecuFL-IoT: an adaptive privacy-preserving federated learning framework for anomaly detection in smart industrial networks. Scientific Reports. 16(1), 4107. doi:10.1038/s41598-025-11883-1.