What Energy Anomaly Detection Actually Does

What energy anomaly detection actually does

Energy anomaly detection is software that learns what normal energy behaviour looks like for a building or piece of equipment, then flags the readings that don't fit — a chiller drawing more power than its load justifies, a system running when it should be off, a slow upward drift that a monthly bill would hide. It catches the waste that's invisible until it shows up as cost, and it does it continuously, not once a year when someone reviews the numbers.

That sounds like an alarm. It isn't, and the difference is the whole point.

Why a fixed-threshold alarm isn't enough

Every BMS already has alarms. You set a limit — "alert if the chilled-water temperature goes above 9°C" — and it fires when the limit is crossed. Threshold alarms are essential for safety and hard faults, but they're blind to the most expensive problems in a building, for three reasons:

- They only catch values, not patterns. A chiller using 15% more energy than the same conditions needed last month is wasting real money, but no single reading breaches a limit, so no alarm fires.
- Normal isn't a fixed number. The right power draw at 3pm on a hot Tuesday is different from 3am on a cool Sunday. A static threshold can't tell the difference, so it's either too loose to catch drift or so tight it floods the operator with false alarms.
- Slow drift never trips them. Fouling cooling towers, failing sensors, and creeping inefficiency move gradually. By the time they cross a fixed limit, you've been paying for the waste for months.

Anomaly detection works on the pattern, not the limit. It asks "is this reading normal given everything else?" rather than "did this reading cross a line?"

How anomaly detection works, in plain terms

The mechanism is more grounded than the word "AI" suggests:

1. Learn the baseline. The platform builds a model of normal from history — how this equipment behaves across time of day, day of week, load, and weather. In Malaysia's climate, weather correlation matters: cooling load tracks temperature and humidity, so "normal" is defined relative to conditions, not as a flat figure.
2. Compare live data to the expectation. Every new reading is measured against what the model expected for those exact conditions.
3. Flag the deviation. When actual departs from expected by enough, it's an anomaly — surfaced to the operator with the context needed to act, not buried in a log.

This is the same family of methods the buildings research community calls fault detection and diagnostics (FDD). The savings are well documented: LBNL research found organisations using FDD across hundreds of buildings achieved median whole-building savings of around 8%, with individual measures saving 5–30%. The reason is simple — a large share of energy waste in real buildings comes from equipment quietly running wrong, not from equipment being switched on.

What it catches that you'd otherwise pay for

Concretely, on a Malaysian site, anomaly detection surfaces things like:

- Equipment running out of schedule — an air handler or chiller left on overnight or through a weekend.
- Efficiency drift — a chiller plant's kW/RT creeping up as condensers foul or staging goes wrong, long before it would trip any alarm. See chiller plant efficiency.
- Demand spikes that set your bill — overlapping equipment starts pushing your monthly peak up under the TNB RP4 tariff, where each kW of maximum demand costs roughly RM89–97 per month.
- Power quality events — surges and sag/swell that stress equipment, routed as alerts to the right person.
- Simple faults wearing money — a stuck valve, a failed sensor feeding a control loop a wrong number, a leak in a compressed-air line.

Each of these is invisible on a monthly bill and invisible to a fixed threshold. It takes a model of normal to see them.

From anomaly to action

Detection is only useful if it reaches someone in time. A capable platform routes anomalies as prioritised alerts — by WhatsApp or email — to the person who can act, with enough context to know what and where. The goal is the opposite of alarm flooding: fewer, more meaningful flags, each worth responding to.

Where the response can be automated, the loop closes without a human. Through the automation layer, a detected pattern can trigger a control action — staging plant differently, resetting a setpoint, shifting load. We trace that full path from reading to response in how energy data becomes decisions.

In CobiNeural, anomaly detection runs across energy, equipment and power quality, and the same data that raises an alert also feeds the EECA reporting workflows — so a flagged-and-fixed anomaly becomes documented evidence of an energy-saving measure, not just a one-off save.

Does anomaly detection mean more false alarms?

Done badly, any detection system can be noisy. Done well, anomaly detection produces fewer nuisance alerts than crude thresholds, because it understands context — it won't flag high power draw on the hottest afternoon of the year as a fault, because the model expected it. The engineering work is in tuning sensitivity so genuine deviations surface and normal variation stays quiet. That tuning, and a baseline built on enough good data, is what separates a useful system from one operators learn to ignore.

The payoff is a building that tells you when it starts wasting energy, the week it starts — not the month you finally read the bill. To see what anomaly detection would surface on your own site, book a walkthrough.