Power Anomaly Detection Architecture

• Power anomaly detection architecture is a robust system combining sensor data acquisition, on-device feature extraction, and statistical inference to identify deviations in electrical signals.
• It employs domain-specific feature engineering and real-time processing to ensure low-latency, transparent detection across diverse power-system assets and appliances.
• Empirical evaluations highlight near-real-time performance, high detection accuracy with Z-score models, and potential for adaptive, fleet-based system enhancements.

A power anomaly detection architecture is a dedicated hardware–software system or algorithm pipeline engineered for identifying departures from nominal patterns in electrical, control, or side-channel signals associated with power-system assets, appliances, or controllers. These architectures span from ultra-lightweight microcontroller-based Z-score detectors for appliance load monitoring (Albaiz et al., 28 Mar 2026), through context-agnostic statistical pipelines that handle complex grid topologies (Park et al., 2024), to hybrid deep learning–causal frameworks for explainable grid-wide detection and root-cause analysis (Sun et al., 13 Feb 2026). Modern research increasingly emphasizes the convergence of embedded autonomy, transparency, statistical rigor, domain physics, and scalability in the design of power anomaly detection infrastructure.

1. Architectural Principles and System Workflows

Power anomaly detection systems typically adopt a layered workflow structured to align with embedded, real-time, and grid-scale monitoring requirements. The canonical pipeline includes:

• Sensing and Data Acquisition: Non-intrusive sensors (e.g., Hall-effect current sensors, voltage taps, PMUs) coupled with high-rate ADCs or fieldbus interfaces collect continuous measurement streams representative of system states (Albaiz et al., 28 Mar 2026, Sadi et al., 3 Apr 2026).
• On-Device Feature Extraction: Embedded compute platforms (e.g., STM32, ARM Cortex-M, DSPs) execute feature computation such as RMS extraction, statistical summaries, or side-channel power event segmentation (Albaiz et al., 28 Mar 2026).
• Model Training/Estimation: Autonomous online (or initial offline) training routines estimate baseline statistics (mean, variance, trend) or model parameters (VAR matrices, thresholds) using incremental, memory-efficient algorithms (e.g., Welford’s method, moving windows) (Albaiz et al., 28 Mar 2026, Li et al., 2020).
• Anomaly Inference: Real-time evaluation of statistical metrics (Z-scores, Mahalanobis distances, composite outlier scores) against application-calibrated thresholds, yielding anomaly flags or scores (Albaiz et al., 28 Mar 2026, Park et al., 2024).
• Decision Logic and Logging: Watchdog timers, debounce rules, and composite scoring rules further vet anomaly candidates, while microSDs or cloud endpoints log events, timestamps, and feature vectors for operator review or fleet-based coordination (Albaiz et al., 28 Mar 2026, Sadi et al., 3 Apr 2026).

A defining characteristic is the integration of lightweight, interpretable, low-latency statistical detection with workflows and memory footprints suitable for resource-constrained MCUs or edge devices.

2. Data Preprocessing and Feature Engineering

Power anomaly detection architectures rely on robust, signal-agnostic preprocessors to ensure the reliability and discriminative power of downstream models:

• Sampling Fidelity: Precise ADC sampling strategies capture the power system waveform with appropriate resolution (typically several kHz), ensuring faithful reconstruction of load and event signatures (Albaiz et al., 28 Mar 2026).
• Feature Buffering and Aggregation: Circular or sliding buffers accumulate blocks of N samples for computation of block features (e.g., RMS load, ON/OFF cycles), minimizing per-sample processing overhead (Albaiz et al., 28 Mar 2026).
• Domain-Specific Feature Design: In domain-adaptive architectures, feature vectors reflect instantaneous RMS, block mean, RMS deviation, trend slopes, or dwell durations tailored to the physical appliance or energy asset (Albaiz et al., 28 Mar 2026).
• Signal Denoising and Outlier Filtering: Optionally, digital filters or discrete wavelet transforms suppress high-frequency noise, and statistical rejection is applied to readings beyond pre-learned limits (Albaiz et al., 28 Mar 2026).

This preprocessing pipeline maximizes detection sensitivity for both incipient, subtle faults (e.g., compressor cycle anomalies) and abrupt, catastrophic events (e.g., power loss).

3. Detection Algorithms: Z-Score and Statistical Thresholding

The canonical core of many MCUs and lightweight power anomaly detectors is an interpretable Z-score model:

• Online Statistical Parameter Estimation: The mean ($\mu$) and standard deviation ($\sigma$) of each feature are estimated incrementally during a fixed-duration training phase, employing Welford-style streaming updates to avoid memory penalties and ensure numerical stability (Albaiz et al., 28 Mar 2026).
• Multi-Feature Anomaly Scoring: For a per-cycle feature vector $x$, the outlier score is $Z_i = (x_i - \mu_i)/\sigma_i$ for each feature $i$, with a composite anomaly score set as the average $score = (1/d) \sum_{i=1}^d |Z_i|$ (Albaiz et al., 28 Mar 2026).
• Empirical Thresholding: A detection threshold (e.g., $Z_{thresh}=2.5$) is determined empirically to separate benign operation from tested anomalies. For specific classes of events (e.g., OFF-state outages), domain rules (e.g., dwell > 60 minutes) supplement the statistical test (Albaiz et al., 28 Mar 2026).
• Latency and Efficiency: Architectures achieve per-vector inference latency in the 20–40 µs range, orders of magnitude below the sampling interval, ensuring no event goes undetected in real time (Albaiz et al., 28 Mar 2026).

This approach yields interpretable, deterministic detection performance suitable for deployment on $<$4 KB SRAM platforms (Albaiz et al., 28 Mar 2026), facilitating debugging, certification, and field troubleshooting.

4. Implementation, Optimization, and Embedded Constraints

Real-world deployments enforce rigorous design constraints on both computation and memory footprint:

• Memory Management: The full implementation comprises approximately 63 KB of Flash (program + constants + I/O stack) and ~3.3 KB SRAM (feature buffer, statistics, stack), fitting easily on low-cost MCUs (e.g., STM32F446RE, 128 KB SRAM/512 KB Flash) (Albaiz et al., 28 Mar 2026).
• Compute/Power Consumption: The embedded loop is predominantly interrupt-driven for sampling, with arithmetic routines implemented via 32-bit integer sums and a single floating-point $\sqrt{}$ operation per window. The energy impact is negligible ($\sim$100 mW device power) (Albaiz et al., 28 Mar 2026).
• Asynchronous Logging: Decoupled logging routines ensure asynchronous data flush to nonvolatile storage (e.g., microSD via SPI), precluding impact on the real-time detection path (Albaiz et al., 28 Mar 2026).
• Extensibility: Although the system is tailored for a particular appliance, the architecture is modular—minor code adaptations suffice to monitor pumps, motors, or HVAC units with distinct cycle patterns (Albaiz et al., 28 Mar 2026).

These optimizations realize fully autonomous TinyML anomaly detection under extreme cost, memory, and energy budgets.

5. Empirical Evaluation and Performance Benchmarks

Comprehensive experimental validation demonstrates the robustness, accuracy, and practical viability of these architectures:

• Field Dataset Acquisition: Continuous, granular appliance monitoring over two weeks, with ON/OFF cycles and synthetic anomalies (thermostat override, door left open, power disconnect) introduced as ground truth benchmarks (Albaiz et al., 28 Mar 2026).
• Detection Metrics: The architecture achieves perfect discrimination—Precision = 1.00, Recall = 1.00, F1 = 1.00—with all induced anomalies flagged, and zero false positives or negatives (Albaiz et al., 28 Mar 2026).
• Detection Delay: Time to alarm is bounded by the next ON cycle or timer expiration for persistent OFF states, yielding near-real-time response (Albaiz et al., 28 Mar 2026).
• Resource Use: RMS and anomaly scoring computation completes within a fraction of the 30 s sampling window, with overall memory and power use well within embedded limits (Albaiz et al., 28 Mar 2026).
• Trade-Offs: Simplicity of the statistical model offers transparency and fixed-latency at the expense of adaptivity to long-term drift, which is suggested for future work (Albaiz et al., 28 Mar 2026).

The empirical profile establishes a reference for embedded anomaly detection in resource-constrained and mission-critical domains.

6. Adaptation, Limitations, and Extensions

Power anomaly detection architectures exhibit several strengths and explicitly documented limitations:

• Transparency and Explainability: Feature-level Z-scores and simple compositional scoring rules yield easily auditable models, in contrast to opaque autoencoders or deep neural networks (Albaiz et al., 28 Mar 2026).
• Lack of Adaptivity: Current implementations use fixed, static statistics; future designs require online updating or drift compensation to accommodate changing operating environments (e.g., temperature shifts, component aging) (Albaiz et al., 28 Mar 2026).
• Scalability and Fleet Learning: Extension to federated or gossip-based learning, where a cohort of appliances contributes to global model refinement, is proposed as a near-term direction (Albaiz et al., 28 Mar 2026).
• Model Upgrades: Integrating additional lightweight models such as isolation forests, or simple One-Class SVMs, could improve sensitivity to complex or nonlinear anomaly patterns, still within embedded resource budgets (Albaiz et al., 28 Mar 2026).

These avenues provide a roadmap for advancing the state-of-the-art, balancing explainability, autonomy, operational stability, and adaptivity in power anomaly detection systems.

---

References:

(Albaiz et al., 28 Mar 2026) Fully Autonomous Z-Score-Based TinyML Anomaly Detection on Resource-Constrained MCUs Using Power Side-Channel Data