{"id":"ae390cb6-e70c-4929-ba87-2cef520a3e2f","arxiv_id":"2505.24047","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":5,"one_line_summary":"A triple-modular-redundant IoT architecture that substitutes software 'digital twins' (Prophet or TFT forecasts) for failed sensors to preserve majority voting, demonstrated qualitatively on the Intel Berkeley dataset.","lead":"This paper proposes a fault-tolerant IoT design that pairs each sensor with a software 'digital twin' based on time-series forecasting, so that when a sensor fails, its twin joins a three-way majority vote. The idea is to keep the voting reliable during repairs, but the evidence is only qualitative plots of two forecasting models on one dataset.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Central multiple-fault claim is unsupported: it requires the digital twin forecast to stay within the anomaly detector's acceptance band for the whole repair window, and the paper provides no threshold-based end-to-end test; Figure 3(d) is a visible counterexample.","rationale":"The reader's weakest assumption, that the time-series twin must remain close enough to true sensor values to pass the anomaly detector for the entire repair window, is exactly the load-bearing premise of the paper's central claim. My stress-test confirms this: the Section V claim of correct output under one hard fault plus one soft/transient/intermittent fault is logically valid only if the twin channel is both accepted by the detector and accurate. The paper's own results do not establish this. Prophet and TFT plots are qualitative, no error metric or threshold is given, and the TFT voltage failure is dismissed without the promised clean-data experiment. The data fusion section adds a second, independent weakness because its threshold and correctness are unspecified, but even if the fusion algorithm were exactly as described, it could not manufacture correctness from an inaccurate twin. Therefore I agree with the reader's verdict that the central claim is not established. The suggested end-to-end fault-injection test would settle the question by measuring, for concrete repair-window lengths and fault patterns, how often the twin remains within the acceptance band and the fused output stays within tolerance. If the test passes, the architecture has real merit; if it fails, the claimed fault tolerance collapses. I recommend no change to the reader's REJECT verdict, since the missing evidence is central rather than cosmetic.","tokens_in":8451,"tokens_out":4881,"duration_ms":53102,"concrete_test":"Run an end-to-end fault-injection benchmark on the Intel Berkeley dataset. For each sensor channel and for repair-window lengths W in {12, 24, 48} hours, train Prophet/TFT on the 6500-minute history; at t0 inject a hard fault in sensor A (switch to its twin) and, at a random offset in (0, W), inject a soft or transient fault (bias or spike) in sensor B. Apply the Section IV fusion rule with an explicit threshold and the anomaly detector with stated false-alarm/miss rates. Compare the fused output to ground truth at every minute, requiring e.g. 95% of timestamps within measurement tolerance. Report W-specific pass rates, including the voltage channel separately; if TFT's voltage gap exceeds the threshold before W, or if any W fails the pass criterion, the Section V claim is not supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The Section V claim that the TMR structure outputs the correct value when one sensor has a hard fault and another has a soft/transient/intermittent fault depends on a specific empirical premise: the digital twin substituted for the hard-faulted sensor must produce readings accurate enough to pass the anomaly detector's acceptance threshold for the entire repair window (Section II, bullet points 3-5). If the twin drifts beyond the threshold, the anomaly detector disconnects it, leaving only two physical sensors, one of which is faulty, so no majority vote is possible. If the twin stays within the threshold but is shifted, the data fusion block will silently incorporate a wrong value.\n\nThe paper's evidence for this premise is qualitative. Figures 2 and 3 show 'close tracking' over roughly one to two days, but no error metrics, no threshold values, and no distribution of forecast errors. Section III.C explicitly acknowledges that TFT struggles on the voltage channel, then dismisses this as an artifact of noisy training data and asserts that 'for clean data, even for voltage, the TFT model should work very well,' without running the stated test. In addition, the anomaly detector is an unpublished self-citation [17], so its false-alarm and miss rates are unknown, and the Section IV fusion algorithm uses an undefined threshold with no correctness proof. Thus the central claim rests on an unverified empirical bridge: the twin's drift behavior under realistic faults must be measured against the detector's acceptance band over the repair window, and this is not done anywhere in the paper.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes a fault-tolerant IoT architecture that combines triple modular redundancy (TMR) with software-based digital twins. Each physical sensor is paired with a twin implemented by a time-series forecasting model (Prophet or Temporal Fusion Transformer). When a sensor fault is detected by an anomaly detector, the corresponding digital twin is substituted into the voting structure until the physical device is repaired, and a centralized data fusion block combines the three inputs. The authors report qualitative forecasting results on the Intel Berkeley sensor dataset and claim that the resulting structure outputs the correct sensed value even when one sensor has a hard fault and another has a soft, transient, or intermittent fault.","tokens_in":8831,"tokens_out":3904,"duration_ms":42702,"significance":"If validated, the proposal would be an interesting low-cost extension of TMR for high-reliability IoT systems, replacing a failed physical sensor with a software twin during the repair window. The paper makes a concrete, falsifiable architectural claim and uses real-world sensor data for its forecasting examples. The strengths are a clearly described system concept and the exploration of two well-known forecasting models. However, the central claims are not supported by the presented evidence: there is no end-to-end fault-injection experiment, no quantitative accuracy assessment of the forecasting models, and no specification or evaluation of the anomaly detector and data-fusion thresholds that the architecture depends on.","major_comments":[{"comment":"The evaluation of the digital-twin forecasting models is purely qualitative. The text asserts that Prophet and TFT 'track the sensor closely' without reporting any error metric (e.g., MAE, RMSE, or maximum deviation) or any comparison against the anomaly detector's acceptance threshold, which is never defined. Figure 3(d) explicitly shows TFT deviating substantially on the voltage channel; Section III.C dismisses this as an artifact of noisy training data and asserts that 'for clean data, even for voltage, the TFT model should work very well,' but the stated clean-data test is not performed. This is a load-bearing issue because the system-level guarantee in Section V requires the digital twin's forecast to stay within the acceptance band for the entire repair window; the manuscript provides no quantitative evidence of that.","section":"Section III (Figs. 2, 3) and Section III.C"},{"comment":"The Section V claim that 'the TMR structure is able to output the correct value of the sensed parameter when one of the sensors sustains a hard fault and in addition one of the remaining two sensors experiences a soft, transient, or intermittent fault' is contradicted by the architecture's own operating rules. Section II states that if the digital twin decays and diverges, the anomaly detector disconnects it and the system continues with two physical devices; if an anomaly is detected before repair, 'the usual practice in TMR structure is to randomly select one of the devices.' In the claimed scenario, after the twin is dropped there would be only one healthy physical sensor plus one faulty sensor, so no majority vote is possible. The paper does not present any end-to-end fault-injection experiment that actually exercises this double-fault scenario, so the central correctness claim is unsupported.","section":"Section II (Figure 1 and bullet list) and Section V"},{"comment":"The TMR-based data fusion scheme is presented as a single hand-worked numerical example. The deviation threshold in step (f) is not defined, the look-back number N is chosen arbitrarily, and the rule for replacing missing or erroneous readings with the last composite value has no correctness analysis. The statement that the algorithm 'detects and corrects hard faults, soft faults, intermittent faults, and transient faults' is not backed by a proof, a simulation, or a sensitivity study. In particular, the paper does not show that the composite estimate remains equal to the true sensed parameter when two of the three inputs are faulty (one physical and one digital twin), which is the scenario claimed in the conclusion.","section":"Section IV (data fusion algorithm, steps a-f)"},{"comment":"The entire switching mechanism depends on an anomaly detector that is an unpublished, self-authored manuscript [17]. Its detection reliability, reaction time, false-alarm rate, and miss rate are unknown, yet the proposed architecture requires this detector to identify faults, substitute digital twins, and later disconnect twins that drift. Without characterizing this component or replacing it with a fully specified detector, the system-level reliability claim cannot be assessed. This is particularly serious because the anomaly detector is the block that decides when the digital twin is trusted in the majority vote.","section":"Section II and Reference [17]"}],"minor_comments":[{"comment":"The caption contains an incomplete sentence: 'TFT. TFT struggles to learn the voltage data...' The first 'TFT.' should be removed or completed.","section":"Figure 3 caption"},{"comment":"The composite output is given as 7.20, which is the average of (6.66, 7, 7.66, 7.66, 7); the rounding and precision conventions should be stated explicitly to avoid apparent arithmetic ambiguities.","section":"Section IV, step (b)"},{"comment":"The text says '6500 minutes... corresponds to 10000 total readings' and later '3400 minutes, which corresponded to 5000 real data readings.' Given the stated 31-second sampling interval, the relationship between minutes and number of readings should be clarified, as the numbers are not self-explanatory.","section":"Section III.A"},{"comment":"The manuscript uses inconsistent spelling ('IoT' vs. 'IOT') and some sentences are run-ons, e.g., in the introduction: 'The abnormal or unexpected behavior of a sensor node is called a fault in the sensor [5, 6]. The fault in active mode deviates...' A careful copyedit is needed.","section":"Throughout"}],"recommendation":"reject","confidential_remarks":"The central claim of the paper is not substantiated by the evidence. The forecasting experiments are qualitative, the anomaly detector is cited only as an unpublished self-reference, and the data-fusion algorithm is an unvalidated heuristic. The architecture's own fallback rules appear to contradict the claimed double-fault correctness. While the concept could in principle be repaired with substantial additional experiments and analysis, the manuscript in its current form does not meet the bar for publication. I also note that the anomaly detector reference [17] is self-authored and unpublished, which makes independent verification impossible."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a plausible architecture with an unproven central claim. The idea — triplicated IoT sensors with per-sensor Prophet/TFT twins to preserve majority voting after a hard fault — is a legitimate extension of analytical redundancy, and the forecasting plots on the Intel Berkeley data show that temperature, humidity, and light can be tracked for a day or two. That is real signal.\n\nThe paper does not, however, support the headline claim in Section V that the structure outputs correct values when one sensor has a hard fault and a second has a soft/transient/intermittent fault. The load-bearing assumption is that the twin stays inside the anomaly detector's acceptance band for the whole repair window. The only evidence is qualitative plots and a hand-worked averaging example. Figure 3(d) shows TFT deviating on voltage, and the authors call it a data artifact without running the clean-data test they say should work. The anomaly detector is an unpublished self-citation [17], so its threshold behavior and false-alarm rate are unknown. The data fusion threshold is also undefined. No end-to-end fault injection appears anywhere.\n\nThe paper is not incoherent. The authors even acknowledge in Section II that if the twin decays, it gets disconnected and the system drops to two sensors. So the stronger claim in Section V overreaches what the design can guarantee. With time-series forecasts that drift, the twin is a best-effort bridge, not a reliability guarantee.\n\nWho should read this: practitioners in IoT reliability who want a concrete starting point for model-based redundancy experiments. A serious referee could push the authors to add error metrics, threshold analysis, and an end-to-end fault-injection study on a public dataset. That would turn this from a sketch into a useful paper.\n\nI would not cite it yet. I would send it to peer review, though — the idea is worth testing, and the current evidence gap is fixable rather than fatal.","headline":"Plausible architecture, unproven central claim: the forecast-driven twin could in principle preserve TMR voting, but the paper never tests the threshold behavior that makes or breaks it.","tokens_in":9286,"tokens_out":2387,"would_cite":false,"duration_ms":24020,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that a triplicated IoT sensing system with software digital twins can keep outputting the correct sensed value even when one sensor fails hard and a second develops a soft, transient, or intermittent fault during the…","keywords":["fault-tolerant IoT","digital twin","triple modular redundancy","time series forecasting","Prophet","Temporal Fusion Transformer","anomaly detection","multi-sensor data fusion"],"falsifier":"Run an end-to-end fault-injection test on a real or recorded sensor stream: let one sensor fail hard, then let a second sensor develop a transient fault during the repair window, and record whether the fused output's error stays below the anomaly threshold until repair completes. The scheme is disproved if, for a realistic threshold, the digital twin's drift (for example, TFT on the voltage channel in the paper's dataset) is rejected by the anomaly detector before the repair is finished, leaving only two physical sensors.","tokens_in":8278,"feed_emoji":"🛡️","tokens_out":5781,"duration_ms":50338,"temperature":0.7,"pith_summary":"The paper proposes a way to keep an Internet-of-Things sensor system reliable without adding a fourth physical sensor: each of three triplicated sensors is paired with a software model, a 'digital twin', that learns the sensor's normal time series. When a sensor fails, its twin is switched into the triple-modular-redundancy voting structure in its place, so majority voting continues while the physical device is repaired or replaced. The authors evaluate two forecasting algorithms, Prophet and the Temporal Fusion Transformer, on a public sensor dataset and report that the twin tracks the true readings closely enough for roughly one to two days. They argue that, combined with a data-fusion block that averages readings and replaces anomalous values with a composite estimate, this arrangement can output the correct sensed value even under multiple fault conditions. A sympathetic reader would care because this claims to extend the fault tolerance of high-reliability IoT systems at software cost instead of hardware cost.","feed_headline":"A digital twin lets a tripled IoT system survive two sensor faults","feed_subtitle":"Twin forecasts replace failed sensors, so majority vote stays correct and a second fault is still masked.","key_machinery":"The load-bearing mechanism is the software-based digital twin: a forecasting model trained on a sensor's past readings that is substituted into the TMR voting structure when the sensor is flagged as faulty. The paper pairs this with a centralized anomaly detector, taken from a prior machine-learning study, and a TMR data-fusion block whose composite estimate, a running average, is used to repair anomalous individual readings. The twin carries the argument because it is what keeps the majority vote intact during the repair window; the data fusion block is what turns the three streams, including the twin, into a single corrected output.","core_discovery":"The central claim is that a triple-modular-redundant IoT structure remains correct under multiple fault conditions once each physical sensor has a software-based digital twin. The twin is a time-series forecasting model, Prophet or TFT, that continuously tracks the sensor's readings; when the anomaly detector flags a sensor, that sensor is disconnected and its twin is connected to the detector and the data fusion block. The twin's forecast readings participate in the majority vote, preserving a three-way vote even though only two physical sensors remain. The paper's data fusion layer then averages the streams and, when a reading deviates from the composite estimate beyond a threshold, replaces it with the last composite value, which the authors say detects and corrects hard, soft, intermittent, and transient faults. Because of the twin plus this fusion scheme, the paper claims the structure outputs the correct sensed value when one sensor sustains a hard fault and one of the remaining two experiences a soft, transient, or intermittent fault, and in fact under multiple fault conditions.","pith_inferences":["Editorial: the paper's own Figure 3(d) shows the TFT twin deviating substantially on the voltage channel, and the authors attribute this to noisy training data; a test on a clean voltage series would settle whether the twin degrades gracefully or fails exactly on the channel where the physical sensor is most likely to be noisy.","Editorial: the anomaly detector that decides when to swap in the twin and when to drop it is referenced as prior work but not evaluated here, so the full closed-loop claim depends on that detector's threshold behaviour; a natural extension is to inject faults end-to-end and measure the detector's swap timing against the twin's forecast horizon.","Editorial: one could push the scheme further by using ensemble forecasting or retraining the twin during the repair window from the two healthy sensors' readings, which the paper does not consider."],"forward_implications":["If the claim holds, a high-reliability IoT installation can survive a sensor failure followed by a second, different fault within roughly a day to two days of the first failure, without adding a fourth physical sensor.","The repair or replacement window for the failed device becomes a designed parameter: about one day for a Prophet twin and about two days for a TFT twin, based on the reported tracking behaviour.","The system's failure mode shifts from 'second fault during repair breaks majority voting' to 'twin drift exceeding the anomaly detector's threshold before repair completes'.","Because the twin is software, the marginal cost of the added fault tolerance is computation and memory rather than another sensing device, which the paper identifies as the main advantage.","A system that already collects historical sensor data for monitoring can reuse that data to train the twins, so the scheme is applicable where time-series history exists."],"supporting_citations":[{"why":"Supplies the digital twin concept that the paper adapts from a virtual model of a physical object to a software stand-in for each sensor.","marker":"[15]"},{"why":"Supplies the triple modular redundancy and majority voting scheme that the proposed structure builds on.","marker":"[16]"},{"why":"Supplies the machine-learning anomaly detector type used to flag faulty sensors and trigger the digital twin switch.","marker":"[17]"},{"why":"Supplies the Prophet forecasting algorithm used as one implementation of the digital twin.","marker":"[19]"},{"why":"Supplies the Temporal Fusion Transformer forecasting algorithm used as the other digital twin implementation.","marker":"[20]"},{"why":"Supplies the sensor dataset used for training and evaluating both forecasting twins.","marker":"[22]"},{"why":"Supplies the multi-sensor data fusion and averaging approach used in the TMR data fusion block.","marker":"[24]"}],"fun_headline_variants":["Digital twins keep tripled IoT system correct after two faults","Triple IoT plus digital twins masks sensor faults","Software twins let tripled IoT survive multiple faults","Digital twin redundancy boosts IoT fault tolerance","Triplicated IoT with twins stays correct under faults"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that a forecasting model trained on a sensor's past readings will keep producing values close enough to the true ones to pass the anomaly detector's threshold for the whole repair window, which can be hours to days.","fun_headline_variants_meta":{"raw":{"variants":["Digital twins keep tripled IoT system correct after two faults","Triple IoT plus digital twins masks sensor faults","Software twins let tripled IoT survive multiple faults","Digital twin redundancy boosts IoT fault tolerance","Triplicated IoT with twins stays correct under faults"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000139,"raw_usage":{"total_tokens":1111,"prompt_tokens":850,"completion_tokens":261,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":466,"completion_tokens_details":{"reasoning_tokens":190}},"tokens_in":466,"tokens_out":261,"duration_ms":3035,"temperature":1.0,"reasoning_tokens":190,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T12:37:04.368795+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run an end-to-end fault-injection test on a real or recorded sensor stream: let one sensor fail hard, then let a second sensor develop a transient fault during the repair window, and record whether the fused output's error stays below the anomaly threshold until repair completes. The scheme is disproved if, for a realistic threshold, the digital twin's drift (for example, TFT on the voltage channel in the paper's dataset) is rejected by the anomaly detector before the repair is finished, leaving only two physical sensors.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the digital twin concept that the paper adapts from a virtual model of a physical object to a software stand-in for each sensor."},{"cited_title":"Wikipedia, The Free Encyclopedia, 16 Feb","cited_arxiv_id":null,"evidence_quote":"Supplies the triple modular redundancy and majority voting scheme that the proposed structure builds on."},{"cited_title":"Ma- chine Learning-Based Anomaly Detection of Correlated Sensor Data: An Integrated Principal Component Analysis-Autoencoder Approach","cited_arxiv_id":null,"evidence_quote":"Supplies the machine-learning anomaly detector type used to flag faulty sensors and trigger the digital twin switch."},{"cited_title":"Time Series Analysis using Facebook Prophet","cited_arxiv_id":null,"evidence_quote":"Supplies the Prophet forecasting algorithm used as one implementation of the digital twin."},{"cited_title":"Interpretable Deep Learn- ing for Time Series Forecasting","cited_arxiv_id":null,"evidence_quote":"Supplies the Temporal Fusion Transformer forecasting algorithm used as the other digital twin implementation."},{"cited_title":"Intel Berkeley Research Lab Sensor Data","cited_arxiv_id":null,"evidence_quote":"Supplies the sensor dataset used for training and evaluating both forecasting twins."},{"cited_title":"Mitchell, Multi-Sensor Data Fusion, 2010, Section 3.3, Pages 33-44","cited_arxiv_id":null,"evidence_quote":"Supplies the multi-sensor data fusion and averaging approach used in the TMR data fusion block."}],"review_version":1}