Message passing for fault localization

"An alarm tells me the network is sick. Message passing tells me which sensor is coughing and which ones just caught the draft."

A Diagnostically Inclined AI Agent

From "something is wrong" to "here is the source"

The what: fault localization outputs a per-node score, ideally a probability that node \(i\) is the origin of the current anomaly, rather than a single global flag. The why it is hard, and why classical per-sensor thresholds fail, is fault propagation. Consider a chilled-water loop: a fouled heat exchanger raises the temperature it reports, but within minutes the downstream pump, the return-line thermometer, and the setpoint controller all read abnormally too. A detector that flags every sensor exceeding its own band lights up half the plant and localizes nothing. The origin and the collateral look identical in the marginal statistics; they differ only in the relational pattern. The origin deviates first and most, and its deviation is unexplained by its neighbors, whereas a collateral node's deviation is exactly what its upstream neighbor predicts. Message passing is the tool that makes "explained by neighbors" computable.

The standard recipe has two stages. First, a model of normal behavior (the spatiotemporal GNN of Section 54.3, trained on healthy data only, leakage-safe per Chapter 37) produces a one-step prediction \(\hat{x}_i(t)\) for every node. The residual \(r_i(t) = x_i(t) - \hat{x}_i(t)\) is large exactly where reality departs from the learned normal. Second, a message-passing localizer takes the residual graph (residuals as node features on the same topology) and scores each node for being the source. Splitting the problem this way keeps the normal model reusable and lets the localizer specialize in the relational question.

The message-passing mechanism

The how is one equation applied in rounds. A message-passing layer updates every node's hidden vector \(\mathbf{h}_i\) by gathering transformed messages from its graph neighbors \(\mathcal{N}(i)\), pooling them with a permutation-invariant aggregator, and combining the pool with the node's own state:

Here \(\psi\) is a learnable message function (often a small MLP on the concatenation of the two endpoints and the edge feature \(e_{ij}\)), \(\bigoplus\) is the aggregator (sum, mean, or max, chosen so the result does not depend on neighbor ordering), and \(\phi\) is the update function. Initialize \(\mathbf{h}_i^{(0)} = r_i\) with the node's residual and this becomes a diffusion of anomaly evidence along physical edges. The design choices matter for localization specifically. Sum aggregation preserves degree information, so a node whose many neighbors all deviate accumulates a large signal, useful for spotting a hub-level fault. Max aggregation is directional-evidence friendly: it forwards the single strongest upstream deviation, which helps trace a fault back along a flow path. And because \(\psi\) sees both endpoints, the model can learn the crucial asymmetry: a message from an already-abnormal upstream neighbor should lower a node's own source-score (its deviation is explained), while an anomaly with no abnormal upstream cause should raise it.

Scoring the source, and reading the propagation

After \(L\) rounds, a shared readout head maps each node's final vector to a source-score \(s_i = \sigma(\mathbf{w}^\top \mathbf{h}_i^{(L)})\). Two supervision regimes are common. When labeled fault injections exist (a valve you can command shut, a documented historical failure with a known root node), train the localizer supervised with a per-node binary target and a class-weighted loss, since sources are rare relative to healthy and collateral nodes. When labels are scarce, run unsupervised: rank nodes by a message-passing-refined anomaly score, for example the residual reconstruction error after the network has had a chance to explain each node from its neighbors, so that only genuinely unexplained deviations keep a high score. Either way the output is a ranked shortlist, and the graph gives you the propagation story for free: follow the edges of high-score nodes backward along the flow direction and the path terminates at the origin. That directed trace is what connects this section to the root-cause and interpretability tooling of Chapter 67, and to the edge-attribution methods of Section 54.7.

The code below implements the core loop in plain NumPy so the mechanism is visible: build a small directed graph, plant a fault at one node, propagate residuals, and score. We reference it to show that "message passing" is, at bottom, sparse matrix multiplies interleaved with a nonlinear update.

import numpy as np

# Directed line graph: 0 -> 1 -> 2 -> 3 -> 4 (flow downstream)
N = 5
A = np.zeros((N, N))
for i in range(N - 1):
    A[i + 1, i] = 1.0          # node i sends a message to its downstream node i+1

# Residuals: a fault originates at node 1 and propagates, decaying, downstream.
r = np.array([0.0, 1.0, 0.7, 0.5, 0.3])

def message_pass(h, A, W_self, W_msg):
    agg = A @ h                       # sum of upstream neighbor states (max-aggregation variant omitted)
    # Source-evidence update: own residual minus what an abnormal upstream explains.
    return np.tanh(h @ W_self - agg @ W_msg)

np.random.seed(0)
W_self = np.array([[1.6]])            # amplify a node's own unexplained deviation
W_msg  = np.array([[1.1]])            # subtract deviation already explained upstream
h = r.reshape(-1, 1)
for _ in range(2):                    # two hops: physical reach of the fault
    h = message_pass(h, A, W_self, W_msg)

source_score = h.ravel()
print("source scores:", np.round(source_score, 3))
print("localized origin -> node", int(np.argmax(source_score)))

What's Next

In Section 54.5, we confront the practical wall that a real grid, a national road network, or a utility with hundreds of thousands of nodes puts in front of message passing: full-graph training no longer fits in memory. We cover neighbor sampling, graph partitioning, and the linear-time tricks that let the mechanism you just built run on networks far too large to load at once.