AI-Powered Predictive Maintenance for Urban Rail Networks – Edge Analytics on Legacy Rolling Stock Sensors

Ingestion Architecture & Real-Time Feature Extraction from Obsolete Rolling Stock Data Buses

The foundational challenge in modernizing urban rail networks lies not in the acquisition of new sensor arrays, but in the reliable, low-latency extraction of operational data from legacy rolling stock. Trains built in the late 1990s and early 2000s typically employ proprietary data buses—such as the Train Communication Network (TCN) conforming to IEC 61375, Multifunction Vehicle Bus (MVB), or even older RS-485 serial loops—which were never designed for cloud egress or real-time edge analytics. The first layer of a predictive maintenance system must therefore be an ingestion and edge abstraction layer that can bridge these deterministic, time-triggered fieldbuses with modern, packetized IP-based analytics pipelines.

A robust ingestion architecture begins with a hardware gateway node physically mounted within the train’s existing electrical cabinet. This gateway must interface directly with the MVB or Wire Train Bus (WTB) via a dedicated controller (e.g., a compliant MVB Class 4 device) capable of reading the periodic telegrams broadcast by traction controllers, brake control units, door control modules, and HVAC controllers. The data stream on a typical MVB is structured as a series of process variables—fixed-length frames (16, 32, 64, or 128 bits) with defined semantic mappings. For example, a traction converter may broadcast a 32-bit frame containing motor current (16 bits), rotor speed (12 bits), and status flags (4 bits) at a cycle time of 10 ms. The gateway’s firmware must parse these raw bitstreams according to each vehicle’s specific Configuration Database (CDB) or Train Configuration Data (TCD) , which is often stored in a proprietary format.

Once parsed, the edge gateway must apply a time-series buffering and downsampling strategy. It is impractical to stream every 10ms data point to a cloud backend over LTE/5G due to bandwidth costs and cellular tower handover gaps. Instead, the edge node must implement a dual-mode buffering scheme:

• High-fidelity circular buffer: Stores raw, unfiltered sensor data for the last 30 minutes of operation, retained locally on an industrial SSD for forensic analysis after a fault event.
• Aggregated feature buffer: Computes statistical summaries—mean, variance, max, min, root-mean-square (RMS), crest factor, and zero-crossing rate—over fixed windows (e.g., 60 seconds) for each monitored signal. These aggregated features are then transmitted via MQTT over TLS to the cloud.

The data flow must also handle data sparsity and missing telegrams. On legacy buses, intermittent connector corrosion or voltage dips can cause frame dropouts. The edge logic must implement an interpolation and imputation protocol. For simple periodic signals, linear interpolation fills gaps of up to three consecutive missed frames. For critical safety-related signals (brake pressure, door interlock), any gap exceeding 500ms must raise a local alert and trigger a fallback mode where the edge node requests a retransmission from the controller if the protocol supports it—otherwise, the missing frame is flagged with a NaN labeled with source: bus_dropout to prevent false model predictions downstream.

| Ingestion Component | Legacy Interface | Data Rate (Nominal) | Output to Edge | Failure Mode | |---------------------|------------------|---------------------|----------------|--------------| | MVB Class 4 Gateway | MVB EMD/ESD bus | 1.5 Mbps (process data) | 128-byte UDP packet per aggregated window | Bus controller timed out; gateway must reset bus master | | WTB Repeater | Wire Train Bus per IEC 61375-2-5 | 1.0 Mbps | Structured CDB-mapped JSON | Frame CRC error; packet discarded, gap imputed | | RS-485 Serial Tap | Proprietary traction controller (e.g., Siemens SIBAS) | 115.2 kbps | Modbus RTU wrapped in TCP | Voltage sag below 4V DC; buffer flush, alert raised | | I/O Breakout Board | Discrete 24V digital signals (door open, motor run) | 100 Hz (digital) | Digital state change counter | Contact bounce >10ms; debounce filter applied |

The ingestion middleware must also be clock-synchronized using IEEE 1588 Precision Time Protocol (PTP) across the edge fleet. Without sub-millisecond timestamp alignment, correlation between a traction motor vibration spike measured at the bogie and a current surge measured at the inverter becomes meaningless. The edge gateway acts as a PTP slave to a GPS-disciplined oscillator, allowing all aggregated features to carry a coordinated universal time (UTC) timestamp with ±100µs accuracy.

Intelligent-Ps SaaS Solutions (https://www.intelligent-ps.store/) provides a pre-configured Ingestion Blueprint that includes the parsing libraries for common European and Asian rolling stock CDB formats (such as those used by Alstom, Siemens, and CRRC). This abstraction allows the edge node to be deployed across a heterogeneous fleet without rewriting the low-level bit parsing for each interface.

On-Edge Anomaly Detection Using Lightweight Convolutional and Autoencoder Architectures

Transferring all raw sensor data to the cloud for anomaly detection would overwhelm network throughput and introduce latency unacceptable for real-time safety alerts. Instead, the edge node must host a lightweight inference engine capable of performing online novelty detection directly on the streaming feature vectors. The architecture of choice for this use case is a convolutional autoencoder (CAE) , which can learn the normal operating regime of each subsystem—traction, braking, door actuation—from the aggregated time-series features without requiring a large labeled dataset of fault examples.

The CAE model is designed as follows: the input layer accepts a two-dimensional tensor representing a 60-second window of features. Each feature channel (e.g., motor current RMS, bearing temperature mean, vibration crest factor) is arranged spatially in one dimension, and the 60 temporal steps are arranged in the second dimension, forming a 64x60 grid (assuming 64 monitored features). The encoder consists of three 1D convolutional layers with kernels of size 3, stride 1, and filter counts increasing from 16 to 32 to 64. Each convolution is followed by a batch normalization layer and a LeakyReLU activation. The decoder mirrors this with transposed convolutions to reconstruct the input. The model is trained exclusively on data collected during normal revenue service, with the objective of minimizing mean squared error (MSE) between input and reconstruction.

At inference time, the reconstruction error (MSE) for each 60-second sliding window is computed. Under normal conditions, the error remains below a threshold determined by the 99.7th percentile of training errors (three sigma). When a previously unseen anomaly occurs—such as a degrading bearing beginning to exhibit high-frequency harmonic content that was not present in the training set—the autoencoder fails to reconstruct the feature vector, and the error spikes. The edge node then tags that window as anomaly_detected and transmits the raw high-fidelity buffer from the preceding 30 minutes to the cloud for forensic analysis.

For safety-critical subsystems (e.g., brake pipe pressure decay), a separate rules-based engine using a one-class support vector machine (OC-SVM) serves as a fallback. The OC-SVM is trained on normal brake sequence signatures and can detect deviations even if the CAE’s reconstruction error remains low due to over-generalization. The combination of a deep generative model with a classical one-class classifier provides redundancy: the CAE captures complex nonlinear patterns, while the OC-SVM provides a robust baseline insensitive to minor distribution shifts from weather changes.

| Model Component | Input Shape | Training Data | Decision Output | Compute Requirement | |-----------------|-------------|---------------|-----------------|---------------------| | 1D Convolutional Autoencoder | (64 features, 60 time steps) | 500 hours normal operation | Reconstruction error > threshold (0.023) | 200 GFLOPS (NVIDIA Jetson Orin NX) | | One-Class SVM (RBF kernel) | (64 aggregated stats) | 200 hours normal brake sequences | Distance > -0.5 (nu=0.1) | 50 GFLOPS (CPU-only capable) | | Rule-based watchdog (pressure decay slope) | Brake pipe pressure (1 feature) | None (physics-derived) | Slope < -0.2 bar/s for 3s | <1 GFLOPS (hardware timer) |

Model quantization and pruning are mandatory for deployment on resource-constrained edge hardware (e.g., NVIDIA Jetson Orin NX or Raspberry Pi CM4 with an AI accelerator). By converting the CAE weights from FP32 to INT8 using post-training quantization, the inference latency drops from 45ms to 8ms per window on a Jetson Orin NX, enabling real-time detection with a 99.9th percentile latency under 15ms. The OC-SVM can be converted to a fixed-point representation by storing only the support vectors and performing distance computations with integer arithmetic.

The edge anomaly detection pipeline must also implement a concept drift detector. Over months of operation, the normal operating regime may shift due to seasonal temperature changes, track degradation, or changes in passenger load. Without adaptation, a static CAE would trigger false positives. A Kolmogorov-Smirnov test is run every 24 hours on the distribution of reconstruction errors from the last 24 hours compared to the training distribution. If the p-value drops below 0.01, the edge node flags a distribution_shift event and uploads the last 48 hours of high-fidelity data to the cloud for model retraining and deployment of an updated ONNX runtime model.

Intelligent-Ps SaaS Solutions (https://www.intelligent-ps.store/) provides a Model Lifecycle Manager that automates this retraining loop, deploying the updated INT8-quantized CAE model to the entire fleet via a secure OTA mechanism.

Data Integrity, Consensus, and Replication on Intermittent Cellular Backhaul

Urban rail networks operate in challenging radio environments: tunnels, deep cuttings, and dense urban canyons cause frequent LTE/5G dropouts. A predictive maintenance system must guarantee that no critical sensor data is permanently lost during cellular blackouts. This requires a distributed consensus and eventual consistency protocol across the edge nodes within the same train and across the fleet.

Each edge node stores its aggregated features and anomaly flags in a local immutable append-only log based on a simplified version of the Raft consensus algorithm. Within a single trainset, two or three edge nodes (one per car) form a Raft cluster. Each node maintains a replicated log of all aggregated feature windows. If one node goes offline (power loss or hardware failure), the remaining nodes continue to accept writes and replicate among themselves. When the failed node recovers, it downloads the missing log entries from the current leader using a snapshot-based synchronization mechanism. This ensures zero data loss for all aggregated features, even during single-node failures.

For communication with the cloud, the edge cluster uses an MQTT bridge with persistent session and QoS level 2. The MQTT broker on the edge node maintains a local store of all outbound messages that have not received a PUBREL acknowledgment from the cloud broker. If cellular connectivity drops, the messages queue on the edge broker’s local disk. Because the local storage is limited (typically 256 GB industrial SSD), the system implements a priority-based eviction policy:

• Priority 1 (Critical): Anomaly flags, safety-related sensor data, and brake system telemetry. Never evicted.
• Priority 2 (Important): Aggregated feature windows from traction and HVAC. Retained for a maximum of 72 hours.
• Priority 3 (Informational): High-fidelity raw circular buffer. Retained for maximum 12 hours unless an anomaly flag was raised, in which case it is promoted to Priority 1.

When connectivity resumes, the MQTT bridge replays the queued messages in priority order. The cloud backend must be capable of handling backfill ingestion without data corruption. This is achieved by having each message carry a monotonic sequence number (derived from the Raft log index) and a UTC timestamp. The cloud data lake uses an upsert-by-sequence-number strategy: if a message with a lower sequence number arrives after a higher one (due to reordering over the network), it is simply discarded, as the later message already contains the latest aggregated value.

Another critical integrity mechanism is digital signing of each message batch. The edge node computes an HMAC-SHA256 digest over each batch of 100 feature windows, using a per-device secret key stored in a Hardware Security Module (HSM). The cloud verifies the HMAC before committing the data to the time-series database. This prevents man-in-the-middle injection of spurious sensor data that could cause a false alarm or mask a real fault.

| Data Replication Component | Storage Engine | Consensus Protocol | Failure Tolerance | Recovery Mechanism | |----------------------------|----------------|--------------------|--------------------|---------------------| | Local immutable log per node | SQLite (WAL mode) + appended blob | Simplified Raft (3 nodes) | Single node failure out of 3 | Snapshot download from leader | | Edge MQTT queue | LevelDB (key-value) on SSD | N/A (broker alone) | 72 hr connectivity loss | Priority-based replay on reconnect | | Cloud time-series store | InfluxDB with replication factor 3 | Raft across cloud nodes | 2 out of 3 cloud nodes failure | Automatic failover to replica |

The consistency model is eventual consistency with monotonic reads. The cloud dashboard may not reflect the latest aggregated data until the edge gateway’s queue drains fully, but once a value is read, any subsequent read will return the same or a newer value (monotonic). This trade-off is acceptable for predictive maintenance, where decisions are based on trends over hours and days, not millisecond real-time control.

Systems Engineering Table: Inputs, Outputs, and Failure Propagation for the Edge-Cloud Pipeline

To ensure the predictive maintenance system behaves deterministically under all conditions, every subsystem must be modeled with precise inputs, expected outputs, and a defined set of failure modes with propagation paths. The table below delineates the core components of the pipeline from sensor to dashboard.

| Component | Input (Source) | Output (Destination) | Expected Condition | Failure Mode (Single Point) | Failure Propagation | Mitigation Strategy | |-----------|----------------|----------------------|--------------------|----------------------------|----------------------|----------------------| | MVB Interface Unit | Raw electrical frames from MVB bus | Parsed process variable frames to edge CPU | Frame CRC correct, cycle time < 15ms | Bus controller silent > 500ms | Edge CPU sees missing frames; imputation activates | Switch to redundant MVB interface on second bus | | Edge CAE Inference Engine | 64x60 feature tensor from buffer | Anomaly flag (boolean) + reconstruction error (float) | MSE < 0.023 under normal conditions | Model output NaN (numeric overflow) | Anomaly detection disabled for that window | Fallback to OC-SVM; reload model from backup partition | | Edge MQTT Bridge | Aggregated JSON features from buffer | TLS MQTT PUBLISH to cloud broker | Queue drain rate = 100% of new messages | Persistent session buffer full (SSD full) | Oldest Priority 3 data evicted permanently | Reduce feature aggregation frequency from 60s to 120s | | Cloud Data Lake (InfluxDB) | HMAC-verified MQTT messages | Time-series metrics + anomaly events | Write throughput > 10,000 points/sec | Cloud storage outage (e.g., AWS S3 outage) | Edge queue grows; eventual backpressure to edge | Multi-region write-ahead log (WAL) for cloud | | Dashboard API | Time-series query from InfluxDB | REST JSON response to frontend | Query latency < 200ms | Query timeout (>3s) | Frontend shows stale data (last query cache) | Pre-computed trending views updated every 5 min |

The failure propagation analysis reveals that the most critical single point of failure is the edge node’s SSD. If the SSD fails, the entire local buffer of high-fidelity data is lost, and the MQTT queue cannot hold new messages. To mitigate this, each train car should have two edge nodes in an active-passive configuration. The passive node mirrors the active node’s local log in real-time via a dedicated 1 Gbps Ethernet connection. If the active node’s SSD health indicator (SMART attribute 177) falls below a threshold (e.g., wear leveling count > 90%), a failover command switches the active role to the standby unit.

YAML Configuration Template for Edge Node Deployment

The deployment of an edge node across a heterogeneous fleet requires a standardized configuration file that maps train identification, sensor channel mapping, model paths, and network parameters. Below is a sample YAML template used by the Intelligent-Ps SaaS Edge Orchestrator to bootstrap a new gateway.

# edge_node_config.yaml
# Intelligent-Ps Rolling Stock Predictive Maintenance Edge Configuration
# Version 1.2.0

train:
  id: "CRRC-SF-MTR-2023-044"
  depot: "Kowloon Bay"
  rolling_stock_series: "MTR M-Train (1989-1998 mod.)"
  
ingestion:
  bus_interfaces:
    - type: "MVB_Class4"
      interface: "/dev/ttyUSB0"
      baud_rate: 1500000
      frame_timeout_ms: 15
      cycle_time_ms: 10
      process_variable_map: "configs/mvb_traction_482.json"
    - type: "RS485_Serial"
      interface: "/dev/ttyUSB1"
      baud_rate: 115200
      protocol: "Modbus_RTU"
      unit_id: 12
      registers:
        - address: 0x0010
          length: 2
          scale: 0.1
          unit: "A"
          label: "motor_current_phase_A"
  
  aggregation:
    window_seconds: 60
    features:
      - statistical: ["mean", "variance", "max", "min", "rms", "crest_factor"]
      - spectral: ["band_energy_0_50Hz", "band_energy_50_200Hz", "band_energy_200_500Hz"]
      
  high_fidelity_buffer:
    enabled: true
    capacity_seconds: 1800
    storage_path: "/mnt/ssd/hifi_buffer/"
    
inference:
  primary_model:
    format: "ONNX"
    quantization: "INT8"
    path: "/models/cae_quantized.onnx"
    input_shape: [1, 64, 60]
    threshold: 0.023
    fallback_model:
      type: "OC_SVM"
      path: "/models/oc_svm_fallback.bin"
      kernel: "rbf"
      nu: 0.1
      
  concept_drift:
    enabled: true
    test: "kolmogorov_smirnov"
    p_threshold: 0.01
    upload_trigger_hours: 48
    
network:
  mqtt:
    broker_url: "ssl://cloud.intelligent-ps.store:8883"
    client_id: "edge-crrc-2023-044"
    username: "fleet_edge"
    password_secret_arn: "arn:aws:secretsmanager:ap-southeast-1:123456:secret:mqtt_edge_pass"
    qos: 2
    persistent_session: true
    local_queue_path: "/mnt/ssd/mqtt_queue/"
    reconnect_interval_seconds: 10
    backfill_limit_priority3_hours: 12
    backfill_limit_priority2_hours: 72
    
  raft:
    cluster_id: "train_044_cluster"
    nodes:
      - id: "car1_node"
        address: "192.168.1.10:6000"
        voter: true
      - id: "car2_node"
        address: "192.168.1.11:6000"
        voter: true
    heartbeat_interval_ms: 100
    election_timeout_ms: 500
    
telemetry:
  sampled_metrics:
    - ingestion_fps
    - inference_latency_ms
    - mqtt_queue_depth
    - ssd_health_wear_level
    - cellular_signal_dbm
  upload_interval_seconds: 60

This configuration is parsed by the Intelligent-Ps Edge Agent upon boot. It validates all paths, tests MVB interface connectivity, and starts the ingestion pipeline. If any critical parameter is missing (e.g., missing process_variable_map), the agent refuses to start and logs a detailed error to the depot technician’s dashboard.

Comparative Engineering Table: Edge Runtime Options for Rolling Stock

Selecting the compute platform for the edge node involves trade-offs between power budget, thermal dissipation, inference throughput, and certification requirements (EN 50155 for railway rolling stock). The table below compares the three most viable platforms for production deployment as of 2025.

| Platform | CPU | AI Accelerator | Power Budget (Typical) | EN 50155 Certified | Inference Latency (CAE INT8) | Storage | Cost per Unit (qty 100+) | |----------|-----|----------------|------------------------|---------------------|------------------------------|---------|---------------------------| | NVIDIA Jetson Orin NX 16GB | 8-core Arm Cortex-A78AE | 1024-core Ampere GPU + 2x NVDLA | 15W - 25W | Yes (pending extended temp variant) | 8ms (batch=1) | 128GB NVMe m.2 | $850 | | Raspberry Pi CM4 + Hailo-8 | 4-core Cortex-A72 | Hailo-8 26 TOPS | 7W - 12W | No (requires secondary enclosure) | 15ms (batch=1) | 32GB eMMC + 256GB USB SSD | $350 | | Intel ADLINK IFA-250 (x86) | Intel Atom x6425E | Intel OpenVINO (integrated GPU) | 12W - 20W | Yes (extended temp, shock/vibe tested) | 22ms (batch=1) | 64GB eMMC + 256GB SATA SSD | $720 |

The Jetson Orn NX offers the best inference performance but at the highest cost and power budget. For trains where the electrical cabinet has limited cooling, the Jetson’s thermal design power (TDP) of 25W may require a heatsink and forced airflow. The Raspberry Pi CM4 with a Hailo-8 accelerator is a compelling low-cost alternative for pilot projects, but its lack of EN 50155 certification means it cannot be left unattended in a mainline train without additional regulatory approval. The x86 option (ADLINK IFA-250) provides a middle ground with full certification and a mature software ecosystem but higher inference latency.

The decision matrix across a fleet is typically:

• High-speed metro lines (>80 km/h, dense passenger load): Jetson Orin NX for maximum compute headroom.
• Light rail / tram lines (lower speed, shorter routes): ADLINK IFA-250 for certified reliability.
• Pilot / experimental deployment: Raspberry Pi CM4 + Hailo-8 for rapid iteration and low cost.

Code Mockup: Edge Anomaly Detection Inference Loop in Python

The following mockup demonstrates the core inference loop that runs every 60 seconds on the edge node. This code is production-like but simplified for illustrative purposes. It uses the ONNX Runtime environment to perform inference with the quantized CAE model.

# edge_inference_loop.py
# Runs as a systemd service on the edge node. Called by the aggregation pipeline every 60s.

import numpy as np
import onnxruntime as ort
import json
import hmac
import hashlib
import time
from dataclasses import dataclass, asdict
from typing import List, Tuple

@dataclass
class FeatureWindow:
    timestamp: int  # UTC epoch seconds
    train_id: str
    window_number: int  # monotonic sequence, derived from Raft log
    feature_array: np.ndarray  # shape (64, 60)
    anomaly_detected: bool = False
    reconstruction_error: float = 0.0

class EdgeInferenceEngine:
    def __init__(self, model_path: str, threshold: float, device_secret: bytes):
        self.session = ort.InferenceSession(model_path, providers=['TensorrtExecutionProvider', 'CUDAExecutionProvider', 'CPUExecutionProvider'])
        self.threshold = threshold
        self.device_secret = device_secret
        self.input_name = self.session.get_inputs()[0].name
        self.output_name = self.session.get_outputs()[0].name
        self.height = 64
        self.width = 60
        
    def compute_reconstruction_error(self, input_tensor: np.ndarray) -> float:
        # Input shape: (batch, 64, 60) as float32
        input_tensor = input_tensor.astype(np.float32)
        output_tensor = self.session.run([self.output_name], {self.input_name: input_tensor})[0]
        mse = np.mean((input_tensor - output_tensor) ** 2)
        return float(mse)
    
    def sign_message(self, message_bytes: bytes) -> str:
        return hmac.new(self.device_secret, message_bytes, hashlib.sha256).hexdigest()
    
    def process_window(self, current_window: FeatureWindow) -> FeatureWindow:
        # Reshape to (1, 64, 60) for ONNX
        tensor = current_window.feature_array.reshape(1, self.height, self.width)
        error = self.compute_reconstruction_error(tensor)
        current_window.reconstruction_error = error
        current_window.anomaly_detected = error > self.threshold
        return current_window
    
    def prepare_mqtt_payload(self, window: FeatureWindow) -> Tuple[bytes, str]:
        payload_dict = {
            "train_id": window.train_id,
            "ts": window.timestamp,
            "window_seq": window.window_number,
            "anomaly": window.anomaly_detected,
            "reconstruction_error": window.reconstruction_error,
            # In production, truncated features or just stats are sent, not the full 64x60 array
            "feature_stats": {
                "mean": float(np.mean(window.feature_array)),
                "variance": float(np.var(window.feature_array))
            }
        }
        payload_bytes = json.dumps(payload_dict, separators=(',', ':')).encode('utf-8')
        signature = self.sign_message(payload_bytes)
        return payload_bytes, signature

# Example usage (integration with aggregation pipeline)
if __name__ == "__main__":
    engine = EdgeInferenceEngine(
        model_path="/models/cae_quantized.onnx",
        threshold=0.023,
        device_secret=b"supersecretkey123"
    )
    
    # Simulate a received feature window from the aggregation buffer
    example_features = np.random.randn(64, 60).astype(np.float32)  # random normal, should be normal
    window = FeatureWindow(
        timestamp=int(time.time()),
        train_id="CRRC-SF-MTR-2023-044",
        window_number=4821,
        feature_array=example_features
    )
    
    processed = engine.process_window(window)
    payload, sig = engine.prepare_mqtt_payload(processed)
    print(f"Anomaly: {processed.anomaly_detected}, Error: {processed.reconstruction_error:.4f}, Signature: {sig[:16]}...")

This code runs in a loop triggered by the aggregation timer. The FeatureWindow dataclass is transmitted to the MQTT bridge after signing. In a production system, the full 64x60 array is never sent to the cloud; only the aggregated stats and the anomaly flag are transmitted, unless the high-fidelity buffer is uploaded due to an anomaly trigger. The signature ensures the cloud can verify the message originated from the authentic edge node with the correct secret.

JSON Template for Cloud Dashboard Aggregation Query

To visualize the fleet-wide health status and drill into individual train subsystems, the cloud dashboard must execute periodic aggregated queries against the time-series database. Below is a JSON template representing a typical query issued every 5 minutes by the Intelligent-Ps Fleet Monitoring Frontend. It fetches the top 10 trains by anomaly count in the last hour and the trend of reconstruction error for a specific traction motor bearing on train CRRC-SF-MTR-2023-044.

{
  "query_type": "fleet_health_overview",
  "timestamp": 1700000000,
  "time_range": {
    "start": "now - 1h",
    "end": "now"
  },
  "aggregation": {
    "metric": "reconstruction_error",
    "function": "count",
    "condition": "anomaly_detected = true",
    "group_by": ["train_id"]
  },
  "limit": 10,
  "order": "desc"
}

For the trend analysis, a second query targets a specific subsystem:

{
  "query_type": "subsystem_trend",
  "train_id": "CRRC-SF-MTR-2023-044",
  "subsystem": "traction_motor_bearing_1",
  "metric": "reconstruction_error",
  "aggregation_window": "5m",
  "function": "mean",
  "time_range": {
    "start": "now - 7d",
    "end": "now"
  },
  "output": "time_series"
}

The results are displayed on the frontend as a line chart with threshold lines. When the moving average of reconstruction error crosses the threshold multiple times within an hour, a maintenance alert is triggered and dispatched to the depot crew via the built-in notification system. This end-to-end flow—from legacy sensor ingestion to cloud visualization—is orchestrated entirely through Intelligent-Ps SaaS Solutions (https://www.intelligent-ps.store/), which provides the underlying data pipeline, model registry, and dashboard templates, enabling rapid deployment without building the infrastructure from scratch.