A method for identifying a cause of a machine operating anomaly including creating a reduced order model (ROMs) for a digital twin model of a selected machine type and feeding current data from a deployed machine into the ROM. The method can include comparing a current output from the selected ROM with a measured output from the current data and determining that an operating anomaly exists when the difference between the current output and the measured output exceeds a selected anomaly threshold. The cause of the operating anomaly can be identified by feeding the current data into a plurality of fault models, wherein each fault model includes a particular component failure, comparing a fault model output from each of the plurality of fault models with the measured output from the current data, selecting the fault model with the fault model output most closely matching the measured output, and displaying the identified component failure associated with the selected fault model as the cause of the operating anomaly.