Root-cause graphs

"The alarm rang on the temperature sensor. The temperature sensor was the last one to notice."

A Downstream AI Agent

This section assumes the probability and estimation background of Chapter 4, the change- and anomaly-detection machinery of Chapter 12 (something has to flag the anomaly before you can trace it), and the graph-over-sensors viewpoint of Chapter 54. A root-cause graph is that same sensor graph, but with edges that carry a causal, not merely correlational, claim.

Why correlation-based attribution cannot localize a cause

Attribution ranks inputs by how much they move the output of one model. In a plant with recirculating coolant, a pressure dip, a pump-current spike, and a downstream temperature rise are all mutually correlated and all "important" to any classifier of the fault. Attribution will happily highlight the temperature channel, because it moved the most, even though temperature is the symptom. What you need is the asymmetry: pump current changed first and caused pressure to fall, which caused temperature to climb. That asymmetry is exactly what a causal graph encodes and what a correlation heatmap discards. Formally we want a structural model in which each variable is a function of its causal parents plus noise,

so that an intervention on a parent propagates to its children but not the reverse. The time lag \(\tau\) is a gift unique to sensor streams: causes precede effects, so temporal precedence breaks many of the symmetries that make causal discovery hard in static tabular data.

Discovering the graph: from Granger to PCMCI

The oldest operational tool is Granger causality: series \(A\) Granger-causes \(B\) if past values of \(A\) improve the prediction of \(B\) beyond \(B\)'s own past. It is a predictive, not interventional, notion, and it fails badly under hidden common drivers and instantaneous coupling, but for a first directed skeleton it is cheap and often enough. The modern constraint-based replacement is PCMCI and its successor PCMCI+ (Runge et al., Science Advances 2019; UAI 2020), built on conditional-independence testing across time lags. PCMCI runs in two stages: a condition-selection stage (a PC-style search) prunes each variable's candidate parents, then the momentary conditional-independence test controls false positives by conditioning on those parents, which is what tames the high autocorrelation typical of sensor data. The output is a time-lagged graph with an edge \(A_{t-\tau} \to B_t\) for each surviving dependency and an estimated lag.

Three design choices decide whether the discovered graph is trustworthy. First, the independence test must match the physics: partial correlation for near-linear couplings, a kernel or nearest-neighbor test (for example CMIknn) for the nonlinear valves and saturating actuators common in machinery. Second, inject known structure. You usually know the piping-and-instrumentation diagram, the network topology, or the mechanical adjacency; forbidding physically impossible edges and fixing known ones shrinks the search space and kills spurious links. Third, respect leakage discipline (Chapter 65): discover structure on healthy, pre-fault data only, then hold that graph fixed when a live anomaly arrives, or you will "discover" edges that are really the fault propagating.

Walking the graph to the origin

Given the fixed graph and a set of anomaly scores (one per node, from any detector in Chapter 37), localization ranks nodes by how likely each is the origin. The workhorse family is the anomaly-aware random walk, popularized by MonitorRank and RCA systems such as CloudRanger and MicroRCA. Intuition: start a random surfer at the alarming node and let it walk backward along causal edges, biased toward neighbors that are themselves anomalous. Nodes where the walk spends the most time are the probable roots, because causal ancestors of a real fault are anomalous and sit upstream. This is a personalized-PageRank computation over a transition matrix that blends graph topology with the anomaly signal. A second family is regression-based counterfactual scoring, exemplified by CIRCA (Li et al., KDD 2022): for each node, model it from its parents on healthy data, then at anomaly time measure how far the node deviates from what its parents predict; a large residual means the fault entered here rather than being inherited from upstream. RCD (Ikram et al., NeurIPS 2022) instead frames localization as hierarchical interventional discovery on the anomalous distribution. All three beat "rank by raw anomaly magnitude," because magnitude alone always crowns the symptom.

The code below implements the random-walk localizer end to end on a tiny four-sensor loop: a causal adjacency, per-node anomaly scores, a backward-biased transition matrix, and the stationary distribution that ranks candidate roots.

import numpy as np

# Nodes: 0=pump_current, 1=coolant_pressure, 2=flow_rate, 3=bearing_temp
# Causal edges A->B mean "A drives B" (discovered offline on healthy data)
edges = [(0, 1), (1, 2), (2, 3), (0, 3)]         # pump drives pressure -> flow -> temp
n = 4
A = np.zeros((n, n))
for a, b in edges:
    A[a, b] = 1.0                                 # forward causal adjacency

anom = np.array([0.9, 0.4, 0.3, 0.95])            # detector scores; temp (3) alarms loudest

# Walk BACKWARD along causes, biased toward anomalous upstream neighbors.
back = A.T.copy()                                 # child -> parent transitions
back *= anom[np.newaxis, :]                        # prefer stepping to anomalous parents
rowsum = back.sum(axis=1, keepdims=True)
back = np.divide(back, rowsum, out=np.zeros_like(back), where=rowsum > 0)

c = 0.15                                           # restart prob -> personalized PageRank
restart = anom / anom.sum()                        # restart onto anomalous nodes
r = restart.copy()
for _ in range(200):
    r = c * restart + (1 - c) * back.T @ r         # power iteration to stationary rank

for i in np.argsort(-r):
    print(f"node {i}: root-cause score {r[i]:.3f}  (anomaly {anom[i]:.2f})")

Run it and the pump current wins even though the temperature channel screamed louder: that inversion of raw anomaly ranking is the entire point of walking the graph instead of reading a heatmap.

What a graph edge does and does not promise

A discovered edge is a claim conditioned on the variables you measured. Its three classic failure modes deserve naming so you distrust them on sight. Hidden confounders: an unmeasured driver (ambient temperature, supply voltage) makes two effects covary, and constraint-based search paints a spurious direct edge between them; only sensors you record can be parents, so instrument the plausible confounders or expect ghost edges. Instantaneous coupling: when the true lag is faster than your sampling interval, cause and effect land in the same sample and the precedence trick fails, which is why PCMCI+ adds explicit contemporaneous-link handling and why Chapter 3's sampling and synchronization discipline is a prerequisite, not a nicety: unsynchronized clocks manufacture false lags and reverse arrows. Non-stationarity: the coupling itself changes with operating regime, so a graph learned at idle misroutes at full load; discover per-regime or condition the tests on the regime label. Report edges with their independence-test p-values and lags, and treat the graph as a falsifiable hypothesis a domain expert signs off on, closer in spirit to the factor graphs of Chapter 11 than to a black box.

What's Next

In Section 67.6, we put a human in the loop: TSInterpret and Captum give reviewers the tooling to inspect attributions, counterfactuals, prototypes, and the root-cause graphs of this section side by side, so an explanation becomes something an operator can interrogate, correct, and act on rather than merely read.