Mass balance with an unmetered demand
$$\Delta L_t \;=\; \sum_{k\in\mathcal{S}} \beta_k\,\bar Q_{k,t} \;+\; \gamma_{h(t)} \;+\; \varepsilon_t,\qquad \beta_k \ge 0$$
$$\mathcal{S} = \arg\min_{\mathcal{S}}\; n\ln\hat\sigma^2_{\mathcal{S}} + |\mathcal{S}|\ln n,\qquad \hat A = \frac{\Delta t}{\hat\beta}$$
Which flows fill a tank, by non-negative least squares grown one flow at a time while the information criterion improves; the town's demand, which nobody meters at the tank, is a level per hour of the day. The coefficient is the tank's cross-section, and the residual is an alarm with a physical reason.
C-Town, a simulated benchmark network, against its own hydraulic model: area T2 within 5% and T5 within 2% where one pump feeds one tank. 4 of 5 labelled attacks at 1.9 false alarm hours a week.
A power factor estimated from the whole window
$$S_t = \sqrt{3}\,V_t I_t, \qquad S_t^2 - P_t^2 = \tan^2\!\varphi\;P_t^2$$
$$\widehat{\tan^2\varphi} = \frac{\sum_t \left(S_t^2-P_t^2\right)P_t^2}{\sum_t P_t^4},\qquad (\hat\tau_V,\hat\tau_I,\hat\tau_P) = \arg\max_{\tau\in\{-1,0,1\}^3} R^2$$
A raw meter is a line, \(y = a x + b\). Solving the triangle sample by sample takes the root of a small difference of two large numbers; estimating one constant from every sample does not. Partners from two historians are aligned by the law itself, and a decode is used only if \(\operatorname{se}(\hat a)/|\hat a| \le 0.02\) and \(\cos\hat\varphi \in [0.5, 1]\).
Held out: 28 of 29 law decodes right to within 2% of full scale, among 488 raw meters.
A balance, and the test that a meter belongs to it
$$T_t = s\sum_{i\in\mathcal{P}} I_{i,t} \;+\; s\,(a x_t + b) \;+\; \varepsilon_t$$
$$\operatorname{CV}\!\left(\hat c_{\mathcal{P}}\right) \le 0.03, \qquad 1 - R^2_{\,x\in} \;\le\; 0.2\,\bigl(1 - R^2_{\,x\notin}\bigr)$$
Kirchhoff at a busbar, mass at a header, heat at a cooler: the parts of a real balance share one coefficient, which tells a law from a coincidence. A raw meter joins only if leaving it out breaks the balance; without that test the held out plants produced wrong decodes the development plants never showed.
Held out, against the method it replaced: 2 meters fixed, 0 broken.
Normal learned once, held against the fleet
$$z_{j,t} = \frac{x_{j,t}-\mu_{j,h(t)}}{\sigma_{j,h(t)}} \;-\; \operatorname{med}_{i\in\mathcal{F}(j)} z_{i,t}$$
$$r_{j,t} = x_{j,t} - f\!\left(x_{\mathcal{N}(j),t},\,x_{j,t-1},\,x_{j,t-2}\right)$$
$$\text{alarm} \iff |r_{j,t}| > 3\,q_{0.999}\ \text{for three samples in a row}$$
Two detectors. A drift: each reading against its normal at that hour, learned from the start of the history and never rolled forward, minus what its siblings of the same kind did. A jump: the residual of a prediction from the readings the compiler says it is wired to, which must persist before it counts.
Planted faults, held out: 25 of 30 faulty machines, 1.0 healthy ones flagged per plant. On the water attacks the graph caught 5 of 5 at 7.7 false hours a week, a deep autoencoder 5 at 69.
Placing a meter by what it moves with
$$w_{ij} = \max_{0\le\ell\le 3}\bigl|\rho_{ij}(\ell)\bigr|, \qquad \hat u(j) = \arg\max_{u}\sum_{i\in\operatorname{top}_k(j)} w_{ij}\,\mathbf{1}[u_i = u]$$
Every series standardised first, which erases a raw meter's unknown scale and offset, so a murky export is read on the same footing as a clean one. Compared against partial dependence, a neural net and a transformer with meters as tokens trained by masked modelling.
Tennessee Eastman, a chemical plant, made murky three times: 62% of meters placed on the right unit by correlation, 61% by the transformer, against about a quarter by chance.