An apparatus, including a plurality of devices, a network operations center (NOC), and a plurality of control nodes. Each device consumes a portion of the resource when turned on, and performs a corresponding function within an acceptable operational margin by cycling on and off. The NOC generates a plurality of run time schedules that coordinates run times for the each of the plurality of devices to control the peak demand of the resource. Each of the control nodes is coupled to a corresponding one of the devices. The plurality of control nodes transmits sensor data and device status to the NOC for generation of the plurality of run time schedules, and executes selected ones of the run time schedules to cycle the plurality of devices, and employs the sensor data and device status in a model to detect exceptions to normal operation of a facility.