Fault Detection and Diagnosis (FDD) is the process of finding a fault by comparing current behavior with an expected normal baseline. First, a system detects that something is wrong; then it diagnoses likely causes by checking signals, trends, and dependencies against what “healthy” operation should look like. In industrial environments, that can mean comparing temperature, vibration, flow, or control outputs to known-good measurements. In cyber security, the same idea is used in anomaly detection, endpoint monitoring, network telemetry, and ICS defense.
FDD matters because many attacks and failures begin as subtle deviations before they become obvious outages. A compromised host may show unusual login patterns, process trees, or outbound connections; a tampered controller may produce values that drift from expected physical behavior. Good FDD helps defenders separate noise from real faults, test competing explanations, and avoid locking onto the first plausible theory. That makes diagnosis more reliable, whether the cause is a broken component, a misconfiguration, or malicious activity.