Unsupervised, Semi-Supervised and Anomaly Learning

Introduction

Electrical power systems, industrial drives, renewable-energy plants, buildings, and manufacturing processes generate large volumes of measurements. Voltage, current, frequency, vibration, temperature, pressure, harmonic distortion, switching status, and protection events may be recorded continuously. Yet useful labels—such as “bearing fault,” “incipient insulation failure,” or “normal operating state”—are often scarce, expensive, delayed, or inconsistent.

Unsupervised, semi-supervised, and anomaly-learning methods address this limitation. Unsupervised learning discovers structure without target labels. Semi-supervised learning combines a small labelled set with a much larger unlabelled set. Anomaly learning models normal or common behaviour and identifies observations that differ significantly from it. These approaches are valuable for operating-state discovery, event detection, rare-fault analysis, condition monitoring, and exploratory engineering analysis.

The central engineering principle is that an algorithm should not merely produce clusters or alarms. It should produce evidence that can be interpreted in relation to physical behaviour, measurement quality, operating conditions, and safety requirements.

Learning Objectives

After studying this chapter, a student should be able to:

1. Distinguish supervised, unsupervised, semi-supervised, and anomaly-learning tasks.
2. Prepare and scale electrical-engineering data for structure discovery.
3. Apply and interpret k-means, hierarchical clustering, density estimation, PCA, and representation-learning methods.
4. Design anomaly-detection workflows for rare faults and operating events.
5. Explain the assumptions, strengths, and limitations of major algorithms.
6. Evaluate models using engineering-relevant metrics and validation procedures.
7. Recognize safety, privacy, cybersecurity, and governance issues in automated monitoring.

1. Learning Without Complete Labels

In supervised learning, a model receives input vectors and known targets. In unsupervised learning, only the input data are available. Let an observation be represented by

where x_i is the ith observation and p is the number of measured features. A dataset containing n observations is commonly written as X = {x₁, x₂, …, x_n}. The features may be instantaneous samples, windowed statistics, phasor quantities, spectral amplitudes, or operating metadata.

Unsupervised learning seeks a useful structure in X. Examples include:

• groups of similar load or generation conditions;
• a low-dimensional representation of correlated sensor measurements;
• high-density regions representing common operation;
• isolated observations representing possible events or faults.

Semi-supervised learning uses a labelled subset L = {(x_i,y_i)} and an unlabelled subset U = {x_j}. Its usefulness depends on a reasonable relationship between the unlabelled data and the task. If unlabelled data come from a different plant, season, or sensor configuration, they may degrade rather than improve performance.

Anomaly detection is not identical to classification. Classification asks which known class an observation belongs to. Anomaly detection asks whether the observation is sufficiently inconsistent with a reference population or model. A rare but legitimate operating condition may therefore be anomalous statistically while being acceptable operationally.

2. Preparing Electrical-Engineering Data

2.1 Measurement windows and features

Raw electrical signals are usually converted into windows. For a voltage waveform, useful features may include RMS value, frequency, crest factor, total harmonic distortion, negative-sequence magnitude, and spectral energy. For a motor, features may include current imbalance, vibration-band energy, temperature slope, and load estimate.

For a discrete signal with N samples in a window, RMS is

where x_i is the ith sample and all samples must have the same physical unit. RMS is meaningful for periodic or varying signals, but the window length and sampling process should be documented.

Feature engineering must preserve the time context. A mean value may hide a short switching transient; a frequency-domain feature may be more informative for rotating machinery; and a derivative may amplify noise. Timestamp alignment, missing values, sensor calibration, and sampling-rate differences must be addressed before learning.

2.2 Scaling and transformations

Distance-based methods are sensitive to feature scale. A common standardization is

where x_ij is feature j of observation i, μ_j is the training-set mean, and σ_j is the training-set standard deviation. The resulting value is dimensionless. Means and standard deviations must be calculated using training data only and then reused during deployment.

If a feature is heavily skewed, a logarithmic transformation may be appropriate, but only for positive values and with a documented treatment of zeros. Robust scaling based on the median and interquartile range can reduce the influence of extreme measurements. Scaling does not remove physical meaning; it changes how features contribute numerically to a method.

2.3 Leakage and temporal dependence

Randomly mixing data from the same event into training and testing can produce unrealistically high performance. For time-series applications, validation should usually be chronological, event-based, plant-based, or operating-regime-based. A model trained on post-fault measurements must not be evaluated as though it predicted that same fault in advance.

3. Clustering for Operating-State Discovery

Clustering partitions or organizes observations according to similarity. In electrical engineering, clusters may correspond to light, medium, and heavy loading; combinations of photovoltaic output and battery state; motor operating regimes; or recurring power-quality conditions.

3.1 k-means clustering

Given a selected number of clusters k, k-means assigns each observation to the nearest centroid and updates each centroid to the mean of its assigned observations. Its objective is

where C_k is cluster k, μ_k is its centroid, and the norm is usually Euclidean. The objective has squared units of the standardized feature space. It is appropriate when clusters are reasonably compact and approximately spherical under the selected distance metric.

The algorithm alternates between assignment and centroid update until assignments stabilize or improvement becomes small. Because initialization affects the result, several starts should be used. The choice of k should combine engineering interpretation with diagnostics such as the silhouette coefficient, stability across runs, and changes in within-cluster dispersion. No single numerical criterion proves that a cluster is physically real.

3.2 Hierarchical and density-based clustering

Hierarchical clustering builds a tree of nested groups. It is useful when a multiscale view is desired—for example, distinguishing broad load regimes and then sub-regimes. The result depends on the linkage rule and distance definition.

Density-based methods, such as DBSCAN, identify dense regions separated by sparse regions and can label isolated points as noise. They can discover non-spherical clusters and need not specify the number of clusters in advance. However, one global density scale may be unsuitable when operating states have very different variability or population sizes.

3.3 Interpreting clusters

A cluster is not automatically a fault class. After clustering, engineers should inspect centroid values, feature distributions, time-of-day and weather relationships, equipment states, and representative waveforms. A cluster that appears to indicate a fault may instead represent a sensor range change, maintenance activity, or an unrecorded change in control settings.

Figure: A practical workflow from measurements to engineering decisions.

4. Density Estimation and Probability-Based Detection

Density estimation models where observations are common or rare. A Gaussian model for a feature vector uses mean vector μ and covariance matrix Σ. Its density is

Here p is the feature dimension, |Σ| is the determinant, and Σ⁻¹ is the inverse covariance matrix. The covariance matrix must be positive definite for the ordinary nonsingular formula. Correlated features should not be treated as independent unless that assumption is justified.

A useful distance from the Gaussian centre is the squared Mahalanobis distance:

Unlike Euclidean distance, it accounts for feature variance and correlation. With approximately Gaussian data and known parameters, d_M² has an approximate chi-square distribution with p degrees of freedom. In practice, parameters are estimated, distributions may be non-Gaussian, and thresholds should be selected using validation data and operational consequences—not blindly from theory.

Gaussian mixture models represent density as a weighted combination of components:

The components can represent different operating states. The expectation-maximization procedure alternates between estimating component responsibilities and updating mixture parameters. Mixtures are flexible but can be unstable with too many components, poorly scaled variables, or insufficient data.

5. Principal Component Analysis

PCA finds orthogonal directions that successively explain maximum variance. Let centred data be represented by matrix Z, with rows as observations. Its sample covariance matrix is

where n > 1 and each column of Z has zero sample mean. Eigenvectors v_j and eigenvalues λ_j satisfy

with eigenvalues ordered from largest to smallest. For a unit eigenvector, λ_j is the variance along component j. The proportion of variance explained by the first r components is

PCA is often applied after centring and, when units differ substantially, standardization. A reduced representation is t_i = V_rᵀ(x_i − μ), where V_r contains the selected eigenvectors. Reconstruction is x̂_i = μ + V_r t_i. The reconstruction residual e_i = x_i − x̂_i can support anomaly detection.

PCA maximizes variance, not fault relevance. A small-variance fault signal may be discarded. Conversely, a large principal component may represent normal changes in load or weather rather than an abnormality. PCA components should therefore be interpreted through loadings, physical variables, and time plots.

Worked example: PCA variance interpretation

Suppose standardized measurements have eigenvalues 4.2, 1.1, 0.5, and 0.2. The total variance is 6.0. The first two components explain

Thus two components summarize most variance, but this does not prove that they preserve every fault signature. The decision should also consider reconstruction error and validation on known events.

6. Representation Learning

Representation learning transforms raw or high-dimensional data into features that make useful structure more accessible. Examples include autoencoders, convolutional networks for waveform or spectrogram data, and recurrent or temporal models for sequences.

An autoencoder contains an encoder and decoder:

where x is the input, z is a latent representation, f_θ is the encoder, and g_ϕ is the decoder. A common training objective is mean squared reconstruction error:

This loss has squared units of the input if raw, unscaled variables are used; it is dimensionless if standardized features are used. An autoencoder trained mostly on normal data may produce high reconstruction error for abnormal inputs. However, a highly expressive model may also reconstruct faults well, reducing detection sensitivity. Bottleneck size, regularization, training population, and threshold selection are consequential design choices.

Self-supervised learning can exploit unlabelled data by creating a predictive task, such as reconstructing masked waveform segments or predicting the next feature window. The learned representation may then be used with a small labelled set. This is useful where labels are limited but historical measurements are abundant.

7. Anomaly Detection in Engineering Systems

7.1 Types of anomalies

Point anomalies are individual unusual observations. Contextual anomalies are unusual only in a context, such as high current during low load or high temperature at a particular ambient condition. Collective anomalies are unusual sequences, such as a gradual drift followed by a trip. Electrical systems often require all three perspectives.

Common methods include:

7.2 Thresholds and alarm logic

A continuous anomaly score must be converted into an operational action. Thresholds may be selected from normal validation data, labelled event data, quantiles, costs, or safety requirements. A single threshold is not always sufficient. Persistence rules, hysteresis, alarm suppression, and multi-sensor confirmation can reduce nuisance alarms.

For a binary event detector, recall is

and precision is

where TP, TN, FP, and FN denote true positives, true negatives, false positives, and false negatives. In rare-fault settings, accuracy can be misleading: a detector that never alarms may achieve high accuracy when faults are extremely uncommon. Precision-recall curves, detection delay, false alarms per operating hour, and missed-event severity are often more meaningful.

The threshold should reflect consequences. A protective interlock may require a conservative, independently validated design, whereas a maintenance recommendation may tolerate more false alarms. Machine-learning output should not silently replace certified protection functions.

8. Semi-Supervised Learning with Limited Labels

A practical workflow begins with a large unlabelled archive and a smaller set of reviewed events. Clustering can organize the archive; experts can label representative samples; and a supervised classifier can then be trained on the expanded set. This is active learning when the system selects uncertain or informative samples for human labelling.

Pseudo-labelling assigns model predictions to unlabelled observations, but errors can reinforce themselves. Confidence thresholds, class-balance checks, temporal separation, and expert review are important. Consistency regularization encourages similar predictions under realistic perturbations, but perturbations must preserve the engineering meaning of the signal.

Semi-supervised methods are especially useful when labels are expensive—for example, when fault confirmation requires inspection or laboratory testing. They are less reliable when the labelled subset is biased toward dramatic failures and excludes early-stage or benign conditions.

9. Illustrative Case: Condition Monitoring of an Induction Motor

Background

Consider an illustrative three-phase induction motor in a manufacturing line. A historian records phase currents at 2 kHz, vibration at 10 kHz, bearing temperature every second, speed, estimated load, and maintenance events. Only six confirmed bearing-fault episodes exist, while several months of mostly normal operation are unlabelled.

Problem

The plant wants to discover operating regimes, identify unusual behaviour early, and avoid excessive maintenance alarms. Current magnitude varies substantially with production load, so a simple current threshold is unsuitable.

Analysis and approach

Signals are divided into 10-second windows. Features include current RMS and negative-sequence current, vibration-band energies, temperature, temperature slope, speed, and load. Measurements are aligned by timestamp. Missing windows are flagged rather than silently filled, and training statistics are computed from an initial normal period.

PCA is used to inspect correlations and reduce visualization dimension. Clustering identifies low-, medium-, and high-load regimes. Within each regime, a robust anomaly model combines vibration features, temperature trend, and current imbalance. A reconstruction score and a density score are monitored separately. An alarm requires an elevated score in two consecutive windows and confirmation that the motor is running under a comparable load.

The six confirmed episodes are held out by event, not by randomly sampling individual windows. The plant engineers review high-scoring windows and discover that some are caused by a loose vibration sensor. After sensor maintenance, the model is retrained. A later bearing event produces a sustained rise in vibration-band energy and temperature trend before the maintenance record confirms the fault.

Outcome

The system does not claim to diagnose every bearing defect. Instead, it provides regime-aware early warnings and ranked evidence for inspection. Evaluation includes false alarms per operating day, warning time before confirmed maintenance, missed events, and performance separately by load regime.

Learning points

1. Operating context is essential for interpreting anomalies.
2. Unsupervised structure can reduce nuisance alarms but does not replace engineering labels.
3. Sensor faults must be considered as alternative explanations.
4. Event-based validation is more realistic than random window splitting.
5. Human review remains part of a safe condition-monitoring workflow.

10. Limitations, Governance, and Best Practice

Unsupervised models can find structure caused by data-collection practices rather than physics. Concept drift occurs when equipment ages, control logic changes, or the plant adds new loads. A model trained on one season may not represent another. Missing-not-at-random data, sensor saturation, communication failures, and cyber-manipulated measurements can all create misleading anomalies.

Important governance practices include versioning data and models, recording feature definitions, preserving timestamps, documenting thresholds, monitoring drift, and maintaining an audit trail for alarms and operator actions. Privacy may arise when energy data reveal production schedules or occupancy. Cybersecurity requires protection of both data pipelines and model services; an attacker may attempt to create false alarms or conceal a real event.

For safety-critical applications, machine learning should normally support—not replace—validated protection, interlocking, and emergency procedures. Alarm explanations should identify influential features, comparison periods, operating regime, and uncertainty. A model that cannot be meaningfully challenged by an engineer is unsuitable for unsupervised autonomous action.

A robust implementation sequence is:

1. Define the engineering decision and consequence of error.
2. Establish sensor quality and a trusted reference period.
3. Create physically meaningful, time-aware features.
4. Scale using training data and prevent leakage.
5. Compare simple statistical baselines with more complex models.
6. Validate by time, event, equipment, and operating regime.
7. Select thresholds with operators and maintenance personnel.
8. Monitor drift, false alarms, missed events, and feedback.
9. Reassess after maintenance, redesign, or sensor replacement.

Contemporary Developments

Current practice increasingly combines physics-informed features with representation learning, edge computing, and digital twins. Lightweight models can execute near sensors, reducing latency and communication requirements. Federated learning may permit multiple facilities to improve a model without centralizing raw operational data, although heterogeneity and security remain challenges. Multimodal models can combine waveforms, images, maintenance text, and control logs, but their additional complexity increases requirements for traceability and validation.

The most promising direction is not unrestricted automation. It is a layered architecture in which physical constraints, statistical monitoring, learned representations, and expert review provide complementary evidence.

Chapter Summary

Unsupervised learning discovers structure in unlabelled electrical-engineering data. Clustering can reveal operating regimes, while density estimation identifies regions of common or rare behaviour. PCA provides an orthogonal low-dimensional representation and can support reconstruction-based detection, but maximum variance is not equivalent to fault relevance. Representation learning, especially autoencoders and self-supervised methods, can extract useful features from large archives, although expressive models may reconstruct abnormal data too well.

Anomaly detection requires a reference population, an interpretable score, an appropriate threshold, and validation that reflects time, operating regime, and event rarity. Semi-supervised learning combines limited expert labels with abundant unlabelled data, but pseudo-label errors and sampling bias must be controlled. Engineering deployment requires sensor-quality checks, leakage prevention, drift monitoring, cybersecurity, privacy protection, and human oversight. In safety-critical systems, learned alarms should complement rather than replace certified protection functions.

Key Terms

Unsupervised learning: Learning structure from data without target labels.

Semi-supervised learning: Learning from a combination of labelled and unlabelled data.

Anomaly detection: Identifying observations or sequences that differ from a reference behaviour.

Operating state: A recurring condition of an engineered system defined by measurements and context.

Feature: A measured or computed variable used by a learning method.

Standardization: Transforming a feature by subtracting its mean and dividing by its standard deviation.

Clustering: Grouping observations according to similarity.

Centroid: The mean vector representing a cluster in k-means.

Density estimation: Modelling how concentrated or probable observations are in feature space.

Mahalanobis distance: A covariance-adjusted distance from a reference mean.

Covariance matrix: A matrix describing feature variances and pairwise covariances.

Principal component: An orthogonal direction associated with a variance eigenvalue.

Eigenvalue: A quantity indicating variance captured by a PCA direction.

Reconstruction error: The discrepancy between an input and its model reconstruction.

Representation learning: Learning a transformed feature space from data.

Autoencoder: A neural encoder-decoder trained commonly to reconstruct its input.

Concept drift: Change over time in the data-generating process.

Precision: The fraction of positive alarms that are true positives.

Recall: The fraction of actual events detected by a system.

Data leakage: Use of information during training that would not be available at deployment.

Review Questions

Short Answer Questions

1. What distinguishes anomaly detection from ordinary multiclass classification?
2. Why should feature scaling be performed before k-means clustering?
3. What does an eigenvalue represent in PCA?
4. Give one example each of a point anomaly and a collective anomaly in an electrical system.
5. Why is random window-level splitting potentially misleading for time-series validation?

Long Answer Questions

1. Explain the complete workflow for using clustering to discover operating states in a distribution feeder.
2. Compare k-means, density-based clustering, and Gaussian mixture models in terms of assumptions and engineering applications.
3. Derive the interpretation of Mahalanobis distance and discuss why covariance matters.
4. Explain how PCA and an autoencoder can both support anomaly detection, including their limitations.
5. Discuss governance and safety requirements for deploying an anomaly detector in an industrial motor-monitoring system.

Analytical / Application Questions

1. A dataset contains voltage, current, temperature, and vibration measurements with very different units. Design a preprocessing and validation procedure before applying k-means and PCA.
2. A detector has high accuracy but misses nearly all rare transformer faults. Explain why this can occur and propose more suitable evaluation measures and alarm strategies.
3. A newly installed control system causes the anomaly score to increase across all operating conditions. Develop a diagnostic plan to distinguish concept drift, sensor error, feature leakage, and a genuine plant change.

Multiple Choice Questions with Answers

Question 1

Which task is most directly associated with unsupervised learning?

A. Predicting a known fault label from labelled examples

B. Discovering recurring operating states without target labels

C. Computing a protection relay setting from a standard

D. Selecting a resistor from a manufacturer catalogue

Correct Answer: B. Discovering recurring operating states without target labels

Question 2

In k-means clustering, what does the standard objective minimize?

A. The number of measured features

B. The total squared distance from observations to their assigned centroids

C. The number of missing sensor values

D. The classification accuracy on labelled faults

Correct Answer: B. The total squared distance from observations to their assigned centroids

Question 3

Why is feature scaling important for Euclidean-distance clustering?

A. It guarantees that the number of clusters is correct

B. It removes all sensor noise

C. It prevents a numerically large-unit feature from dominating distance

D. It converts unlabelled data into labelled data

Correct Answer: C. It prevents a numerically large-unit feature from dominating distance

Question 4

For PCA, what does the first principal component represent?

A. The direction of greatest variance in the centred data

B. The feature with the smallest physical unit

C. The most recent measurement in the dataset

D. The class with the largest number of labels

Correct Answer: A. The direction of greatest variance in the centred data

Question 5

If PCA eigenvalues are 4.2, 1.1, 0.5, and 0.2, what percentage of variance is explained by the first two components?

A. 53.3%

B. 70.0%

C. 83.3%

D. 88.3%

Correct Answer: D. 88.3%

Question 6

Which situation is a contextual anomaly?

A. A single corrupted timestamp in a database

B. High motor current during a documented high-load start

C. Unusually high temperature relative to ambient conditions and normal load

D. A repeated normal measurement during steady operation

Correct Answer: C. Unusually high temperature relative to ambient conditions and normal load

Question 7

What is a major risk of pseudo-labelling in semi-supervised learning?

A. It always reduces the amount of available data

B. Incorrect predictions can reinforce themselves as training labels

C. It requires every observation to be manually inspected first

D. It prevents the use of unlabelled data

Correct Answer: B. Incorrect predictions can reinforce themselves as training labels

Question 8

Which metric is often more informative than accuracy for a very rare fault?

A. Precision-recall performance

B. Number of input features only

C. Mean sensor sampling interval only

D. Cluster centroid magnitude only

Correct Answer: A. Precision-recall performance

Question 9

What is the main purpose of an autoencoder in reconstruction-based anomaly detection?

A. To replace all physical protection devices

B. To encode data and reconstruct patterns, often producing larger errors for unfamiliar inputs

C. To guarantee that every anomaly is a new fault type

D. To assign relay addresses automatically

Correct Answer: B. To encode data and reconstruct patterns, often producing larger errors for unfamiliar inputs

Question 10

Which validation practice best reduces leakage in a fault-detection time series?

A. Randomly mixing windows from the same event across training and testing

B. Using future post-fault measurements to train a predictor of that fault

C. Splitting data chronologically or by independent event

D. Removing all timestamps before evaluation

Correct Answer: C. Splitting data chronologically or by independent event