Unsupervised Multivariate Anomaly Detection for Near-Real-Time Water-Quality Monitoring in District Metered Areas: A Three-Tier Benchmark Validated with Real-World Anomalies

Water utilities increasingly manage residual chlorine, conductivity, turbidity and water temperature in district metered areas (DMAs) from continuous on-line analyzers rather than from grab samples. Every decision that follows, from adjusting booster chlorination to ordering a flush or sending a crew, assumes that the analyzers are reporting the truth. In the Incheon network studied here, one year of hourly data from five DMAs contained a network-wide telemetry outage, water-temperature readings of up to 4913 °C, negative chlorine values and a turbidity channel frozen for 46 h, none of which the supervisory system had flagged. This paper asks whether such sensor and telemetry faults can be detected automatically, within the hour, at an alarm rate a control room will accept, using only the hourly data the utility already archives. Eleven unsupervised detectors from three families, statistical charts on the current reading or on time-series residuals (Hotelling T2, MEWMA, seasonal profile, VAR residual, dynamic PCA), general-purpose outlier detectors (Isolation Forest, one-class SVM, local outlier factor) and small neural networks (LSTM autoencoder, prediction-residual LSTM, a compact Transformer autoencoder), were run under one protocol and judged against the real faults and 900 injected faults of four types, with performance expressed as the operator sees it: events caught, hours to detection, and false alarms per week, counted both as alarm hours and as separate alarm episodes, with bootstrap intervals. Every family caught the real faults (seven events from three independent incidents) within the hour. They differed on the injected faults (recall 0.28–0.63) and above all on false alarms: the two LSTM models raised 0.5–0.8 alarm hours per DMA-week, and the current-reading control charts raised 9–10; counted as separate episodes, the spread was only 0.4–1.5. The prediction-residual LSTM, the Transformer autoencoder and the VAR residual chart were on the recall–false-alarm frontier in 100%, 91% and 60% of bootstrap resamples, which places the advantage in the use of the signal’s recent history rather than in any model family, and the ordering held under tuning of the baselines, other thresholds and other window lengths. Frozen-sensor faults escaped every model and were recovered by a one-parameter constancy rule. Models trained on four DMAs transferred to the fifth with a recall loss of 0.02 provided the alarm threshold was set from at least one month of local data, and the autoencoder’s error decomposition named the faulted sensor in 84% of detected injected faults. The result is a monitoring layer that flags a failed analyzer or telemetry link within the hour, names the sensor, and separates a data problem from a genuine water-quality change before dosing, flushing or field visits are decided on; it does not see flow or pressure and cannot detect leaks or shutdowns.