Anomaly detection of steam turbine with hierarchical pre‐warning strategy

IET Generation, Transmission & DistributionEarly View ORIGINAL RESEARCH PAPEROpen Access Anomaly detection of steam turbine with hierarchical pre-warning strategy Kun Yao, Kun Yao School of Mechanical Engineering and Automation, Harbin Institute of Technology (Shenzhen), Shenzhen, ChinaSearch for more papers by this authorShuangshuang Fan, Shuangshuang Fan School of Electrical Engineering & Automation, Harbin Institute of Technology, Harbin, ChinaSearch for more papers by this authorYing Wang, Ying Wang College of Power and Energy Engineering, Harbin Engineering University, Harbin, ChinaSearch for more papers by this authorJie Wan, Corresponding Author Jie Wan wanjie@hit.edu.cn School of Electrical Engineering & Automation, Harbin Institute of Technology, Harbin, China Correspondence Jie Wan, School of Electrical Engineering and Automation, Harbin Institute of Technology, Harbin 518055, China. Email: wanjie@hit.edu.cn Donghui Yang, School of Economics and Management, Southeast University, Nanjing 211189, China. Email: dhyang@seu.edu.cnSearch for more papers by this authorDonghui Yang, Corresponding Author Donghui Yang dhyang@seu.edu.cn School of Economics and Management, Southeast University, Nanjing, China Correspondence Jie Wan, School of Electrical Engineering and Automation, Harbin Institute of Technology, Harbin 518055, China. Email: wanjie@hit.edu.cn Donghui Yang, School of Economics and Management, Southeast University, Nanjing 211189, China. Email: dhyang@seu.edu.cnSearch for more papers by this authorYong Cao, Yong Cao School of Mechanical Engineering and Automation, Harbin Institute of Technology (Shenzhen), Shenzhen, ChinaSearch for more papers by this author Kun Yao, Kun Yao School of Mechanical Engineering and Automation, Harbin Institute of Technology (Shenzhen), Shenzhen, ChinaSearch for more papers by this authorShuangshuang Fan, Shuangshuang Fan School of Electrical Engineering & Automation, Harbin Institute of Technology, Harbin, ChinaSearch for more papers by this authorYing Wang, Ying Wang College of Power and Energy Engineering, Harbin Engineering University, Harbin, ChinaSearch for more papers by this authorJie Wan, Corresponding Author Jie Wan wanjie@hit.edu.cn School of Electrical Engineering & Automation, Harbin Institute of Technology, Harbin, China Correspondence Jie Wan, School of Electrical Engineering and Automation, Harbin Institute of Technology, Harbin 518055, China. Email: wanjie@hit.edu.cn Donghui Yang, School of Economics and Management, Southeast University, Nanjing 211189, China. Email: dhyang@seu.edu.cnSearch for more papers by this authorDonghui Yang, Corresponding Author Donghui Yang dhyang@seu.edu.cn School of Economics and Management, Southeast University, Nanjing, China Correspondence Jie Wan, School of Electrical Engineering and Automation, Harbin Institute of Technology, Harbin 518055, China. Email: wanjie@hit.edu.cn Donghui Yang, School of Economics and Management, Southeast University, Nanjing 211189, China. Email: dhyang@seu.edu.cnSearch for more papers by this authorYong Cao, Yong Cao School of Mechanical Engineering and Automation, Harbin Institute of Technology (Shenzhen), Shenzhen, ChinaSearch for more papers by this author First published: 22 March 2022 https://doi.org/10.1049/gtd2.12452AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinked InRedditWechat Abstract Anomaly detection of steam turbines is to recognize infrequent instances within sensor data that plays a vital role in stable power supply. Machine learning models have been applied to diagnose the faults of turbine and verified useful for identifying engine problem. To detect anomalies of steam turbines with machine learning methods, here, an approach called hierarchical pre-warning strategy is proposed that combines clustering methods with classification methods. Three different clustering methods, K-means, Isolation Forest and Local Outlier Factor, are chosen to separate anomalies from normal data. Since clustering results cannot give unanimous decision, the clustering instances are labelled with three classes, real anomalies, suspected anomalies and normal data, according to their overlapping recognition. Subsequently, five classification algorithms, k-nearest neighbour, support vector machine, decision tree, random forest and gradient boosting decision tree, have been examined to train the labelled data set. The classification results illustrate that gradient boosting decision tree and random forest are much more precise to detect real anomalies of steam turbines. The real anomalies identified by clustering methods have been classified into suspected anomalies by this approach that is more practicable and consistent with ground truth. 1 INTRODUCTION The normal operation of steam turbines, important power producers of generators, is the basis for maintaining a stable power supply [1]. Numerous sensors arranged on the turbine are used to monitor the working status of various parts, and then judge the turbine status by monitoring its abnormal parameters [2]. In the production process, many faults, such as sensor failure and abnormal equipment parts operation, could cause the fluctuation of various monitoring parameters, which result in considerable difficulties for the research on fault diagnosis methods [3]. However, it is also a difficult problem to find the anomaly nodes of every sensor. The identification of anomaly nodes is the basis of fault diagnosis, which can accurately judge the unit fault and ensure the continuous supply of power generation. Timely detection of abnormal conditions can avoid machine fault, also can reduce maintenance costs that resulting in stable economic benefits [4]. In the era of big data, with massive monitor data of steam turbines, anomaly detection is more than important before diagnosing the fault. According to the actual operation data of steam turbine, the typical abnormal phenomenon is the sudden load change, which will affect the Automatic Generation Control (AGC) performance evaluation of high-power thermal power units in power grid [3]. Actually, there are two cases that can cause sudden change of turbine load: the first one is the hardware problem of regulating valve, which causes the abnormal output power of the unit, which is a real fault; the other one is the noise problem when measuring the changes of power signal. The abnormal noise is a software fault that is not a real problem of turbines. Whether it is true fault or abnormal noise, it will affect the normal operation of steam turbine, which should not be overlooked. The actual data of steam turbine has its own characteristic, each index of the sample is independent with each other. And their change trends are not the same in different scenarios, which leads the judgment of abnormal nodes to be more complex. For instance, in Figure 1, it shows the waving curves of three indicators (power, flow demand energy management and actual flow) for a steam turbine in 400 s. The flow demand energy management (FDEM) is a comprehensive steam flow demand for steam turbine. At a certain time, only when all indicators suddenly drop or rise at the same time, it is a real anomaly, otherwise it is the noise anomaly [5]. As shown in Figure 1, both in point 2 and point 3, three indicators suddenly fluctuate with large amplitude at the same time, which indicates that the sudden load changes are caused by the hardware problem of the control valve. While in the second of point 1, the first indicator is suddenly changed, the curves of last two indicators keep smooth tendency. That is the measurement noise or sensor shock caused by poor shielding and cannot be diagnosed as outliers. FIGURE 1Open in figure viewerPowerPoint A case of anomaly data diagnosis of steam turbine Scholars have contributed a lot of approaches to diagnose the real fault in practice. Supervised methods have been examined because of their powerful classification. The literature [6] uses support vector machine (SVM) to diagnose the faults with an application in the sheet metal stamping operations, and the success rate of the experiment is more than 96.5%. However, the label data required by supervised methods is too difficult to obtain. And it is necessary to select the relevant features. The existence of redundant features may reduce the speed and accuracy of the learning algorithm [7]. This problem has been solved in the work of [8]. Que applies XGBoost model to detect anomalies based on learning history data, but this method cannot rank the importance of features and has poor interpretability. Some scholars also study deep learning methods to detect abnormal data of steam turbine. Kumar [9] uses the artificial neural network to construct a classifier to operate vibration analysis for a large steam turbine. Convolutional neural network (CNN) and recurrent neural network (RNN) have been widely used to improve diagnostic rate of engine fault [10]. Ref. [1] proposed a novel method to improve CNN with extreme gradient boosting (XGBoost). They also remind us that deep learning methods are sensitive to the local feature. But, in reality, there are very few outliers among massive data and a series of features changing. So, some researchers resort to unsupervised approaches to detect anomalies in steam turbine field data. Facing time-series data generated by turbine sensor, scientists try to distinguish abnormal behaviours from normal patterns based on the similar features. Refs. [11, 12] projected unsupervised spatiotemporal graphical modelling approach to detect anomalies in distributed cyber-physical systems and energy prediction of complex dynamical systems. Hierarchical method was used to extract features of time-scale non-stationary data and found the developed algorithm enables unsupervised data analysis [13]. In the work of [14], the authors developed a comprehensive methodology for detection and integrated diagnostics of gas turbine sensors. Three different levels of analysis, physics-based thresholds, sensor voting and statistical filtering, are integrated to decide anomalies and consequently used in the anomaly classification algorithm. However, clustering approach has rarely adopted because of sparse fault data. Moreover, only one unsupervised method or supervised method is used to detect anomalies of steam turbine. Both of those two methods have drawbacks. The supervised learning methods have to use label data, but in practice, the cost of obtaining label data is too high [15]. For the performance of unsupervised learning models, there is no accurate measurement standard and the interpretability of model results is poor. Based on the existing research gap, this paper intends to develop a hybrid method that firstly takes unsupervised learning method to cluster normal data and anomaly data, then the results are assisting to give label for supervised learning and improve the prediction ability of supervised detection model [16]. K-means clustering, isolation forest algorithm [17] and local anomaly factor detection (LOF) model are applied because of their different clustering fundamentals. We integrate the results of these three methods to judge at three levels, normal data, suspected abnormal data, and anomalies by setting up different early warning mechanisms. In the part of supervised learning, the classification models, k-nearest neighbour (KNN) [18], multi class SVM [19], gradient lifting tree (gbdt) [20], random forest [21] and decision tree, are operated to learn the samples parameters and compare the classification performances. In this way, the model constructed by hybrid method has strong interpretability for detecting outliers and timely adjusting them into abnormal data set for future detection. 2 LITERATURE REVIEW 2.1 Anomaly detection Anomaly detection aims to identify behaviour patterns in data that do not conform to the expected, such as unknown attacks, lesions in health indicators, a surge in credit card consumption or machine fault, etc., which appear rarely compared with normal observation [22]. Anomalies in different scenarios will bring great harm to individuals, organizations, enterprises and even countries [23]. At present, the research on anomaly detection have touched many fields, such as banking, wireless sensor network, network intrusion, online social network, healthcare and so on. Illegal use of a credit card or its information with the aim of obtaining illegal benefits or causing illegal harm to the cardholder without the knowledge of the owner is referred to as credit card fraud [24]. Anomaly-based network intrusion detection refers to the discovery of abnormal patterns that do not conform to the expected normal behaviour in network traffic, which is the core problem of network security [23]. In order to detect the abuse of medical expenditure, the clustering method based on geographic location [25], decision tree method [26], and LOF algorithm [27] have all been applied to the anomaly detection of health care behaviour. Anomaly detection of online social networks has also aroused the interest of many scholars. Ref. [28] employs random forest, logistic regression and support vector machine to detect fake accounts in online social networks; J48 and Naive Bayes models were used to distinguish between real and fake images circulated on Twitter [29]. Although researches on anomaly detection in the above fields have been relatively mature, less attention has been paid to the steam turbine data detection. Due to the normal operation of the steam turbine has great significance to its economy and reliability, this paper tries to find a better performance prediction model to detect anomaly data of steam turbine. 2.2 Steam turbine fault diagnosis The literature on anomaly detection of steam turbine is insufficient because of difficulty in abnormal data acquisition. The related works are mainly about fault diagnosis and health prognostics. The fault tree [30] is applied in the field of turbine vibration fault diagnosis, and the minimum cut set is calculated by taking the qualitative analysis of turbine rotor misalignment fault tree as an example. The results prove that the method is feasible to diagnose turbine vibration fault. Ref. [31] proposed a support vector classifier (SVC) based on enhanced particle swarm optimization (EPSO), which extracted support vectors from the database to diagnose the vibration fault of the turbine generator set. Compared with the traditional neural network method, it was found that the model had higher diagnostic accuracy and shorter learning time. Shi [32] et al. proposed a steam turbine rotor fault diagnosis method based on permutation entropy and improved fruit fly algorithm (IFOA) optimized correlation vector machine (RVM), which improved the identification accuracy and efficiency of turbine rotor fault diagnosis. The decision tree C4.5 [33] was applied to marine steam turbine fault diagnosis, and its diagnostic accuracy was tested to be up to 90%. Anomaly detection methods are used in gas turbine by using one-class classification methods [34], deep learning network [35] and semi-supervised method [36], but most of the existing literature only consider fault diagnosis and health prognostics of gas turbine without focusing on steam turbine and its power plant. So, in this paper, we will try to detect anomalies including faults and machine vibration anomaly simultaneously for steam turbine based on a combined method. Firstly, several unsupervised clustering methods with good performance are selected for clustering unlabelled samples, and the results of various methods will be integrated to judge and label true anomalies, suspected anomalies and normal samples. Then the models constructed by supervised learning method are used to identify the anomalies. According to the characteristics of steam turbine data studied in this paper, true anomalies represent machine faults and suspected anomalies represent abnormal vibration of valves. 3 METHODOLOGY Two basic classifications of machine learning are supervised learning and unsupervised learning methods. Generally, supervised methods are preferred to use with training step and classification step. However, it is not quite adapted to the problem of hardly collecting a large number of labelled samples in practice because the cost of manual labelling is too high. The unsupervised learning methods can automatically learn the characteristics of numerous samples to cluster data into different categories without requiring labels. Nevertheless, there is no basis for judging whether the models are good or bad, and the interpretability is poor. The problem of how to effectively employ unlabelled data to assist supervised learning are drawing scholars' attention. To this end, in this paper, a data-driven semi-supervised learning method is proposed to detect steam turbine anomalies. By integrating the advantages of supervised learning and unsupervised learning, label samples can be automatically obtained and mature classification models can be used to obtain high precision. First of all, we preprocessed the original data and convert the initial indicators into the difference characteristics that can more intuitively measure the trend of change in each indicator. Then in the unsupervised learning section, isolation forest [37], K-means [16] and local outlier factor (LOF) [16] are respectively adopted to cluster the preprocessed characteristics. In real application scenarios, it is much more expensive to detect less anomalies than more anomalies, so we will set different levels of early warning mechanism to improve detection accuracy. The samples that appear in the anomaly detected by the three algorithms at the same time are regarded as true anomalies and labelled as class "0". The anomalies not detected by the three algorithms at the same time are regarded as suspected anomalies and marked as class "1". The remaining samples are normal data and labelled as class "2". Since there remain fewer faults during operation of the steam turbine, the gap between the number of anomaly and normal samples is too large, that is, the three classes are extremely imbalanced. If the class-imbalanced label data are directly used for classification model to train and learn, the model will have serious bias and the algorithm will not be able to accurately show the distribution of the data, so the precision of classification will also decrease [38]. In order to eliminate the class imbalance, the method of under-sampling [39] will be adopted for the normal samples with the largest data scale, from which the data size equal to the anomalies will be randomly selected to form a new sample set with all the anomaly samples to train different classification models. Finally, we under-sampled 100 times and integrated the results of 100 different sample sets to compare the performance of each classification model to find a better prediction model, so as to make the results more explanatory. In the supervised learning, we adopt random forest (RF) [40], gradient boosting decision tree (GBDT) [20], support vector machine (SVM) [19], K-nearest neighbour (KNN) [18] and decision tree (DT) to train and learn new samples. The process of hierarchical pre-warning strategy with three steps proposed in this paper is shown in Figure 2. Firstly, three different unsupervised methods are applied to cluster initial sample set without label in this approach. Leveraging three clustering tools to find all potential anomalies from distance-based, density-based and ensemble perspectives. Then we can label the set with the clustering results, such as three labels mentioned in the below. According to the overlaps of three clustering results, we give three hierarchical levels in this work. Finally, based on labelled data set, multi-class classification model was well trained from five classifiers and subsequently was utilized to detect new sample set by illustrating different hierarchical labels. FIGURE 2Open in figure viewerPowerPoint Anomaly detection process of steam turbine 3.1 Unsupervised learning methods Unsupervised anomaly detection models can be divided into a variety of methods based on different principles, such as statistical and probabilistic and models, linear models, proximity-based outlier detection [41]. Among them, the clustering-based method is to gather samples together according to similarity to identify data point that is significantly different from the remaining data [38, 42]. As a benchmark of clustering method, K-means is classic and effective algorithm based on distance similarity [16]. Some algorithms have been proposed and proved to be functional in detecting outliers. Isolation forest and local outlier factor have performed other methods in specific field. Therefore, to find proper algorithm in the domain of detecting anomalies for steam turbine, in this paper, we select and compare those two methods and benchmark clustering method. 3.1.1 Isolation forest (IF) Isolation forest [17] is an ensemble clustering algorithm that uses a binary tree to segment the data set. The depth of a sample point in the binary tree reflects the degree of alienation of the sample point. Therefore, those clusters with high density need to be cut many times before stopping cutting, resulting in longer paths. Conversely, points with sparse distribution have relatively shorter paths. IF has linear time complexity and high accuracy, which can improve the robustness of the model. The composition of the entire algorithm can be divided into two steps [43]: Training: Assuming that D = { x 1 , x 2 , … , x R } ${\rm{D\;}} = \{ {{x_1},{x_2}, \ldots ,{x_R}} \}\;$ represents a sample set, each sample has Q features, and a total of t isolation trees (iTree) are constructed. Each iTree is composed of n ( { x 1 , x 2 , … , x n } ∈ D ) $n( {\{ {{x_1},{x_2}, \ldots ,{x_n}} \} \in D} )$ samples which are selected randomly. For each iTree, firstly, the model will randomly select a feature q ( q ∈ Q ) $q( {q \in Q} )$ as a starting node, and randomly select a threshold v between the maximum and the minimum of the feature q $q$ . Those smaller than v in the samples are listed to the left branch and the others are drawn to the right branch. Then, repeat the above steps on the left and right branches until the termination condition is met; Predicting: When calculating the anomaly score of sample x i ${x_i}$ , it starts from the root node of an iTree and proceeds from top to bottom according to the value of each feature until it reaches a certain leaf node. Its path depth h ( x i ) ${\rm{h}}( {{x_i}} )$ in each iTree can be calculated by formula (1) h x i = e + C n \begin{equation}h{\rm{\;}}\left( {{x_i}} \right) = {\rm{\;}}e + C\left( n \right)\end{equation} (1) where e represents the number of edges passed by the data x i ( i = 1 , 2 , … , n ) ${x_i}( {i = 1,2, \ldots ,n} )$ from the root node to the leaf node. C ( n ) $C( n )$ represents the average path length of a binary tree constructed with n $n$ . samples. The calculation formula is C n = 2 H n − 1 − 2 n − 1 n . \begin{equation}C{\rm{\;}}\left( n \right) = {\rm{\;}}2H\left( {n - 1} \right) - \frac{{2\left( {n - 1} \right)}}{n}.\end{equation} (2)where H ( n − 1 ) $H( {n - 1} )$ . can be estimated with ln ( n − 1 ) + 0.5772156649 $\ln ( {n - 1} ) + 0.5772156649$ . The anomaly score of x i ${x_i}$ . can be calculated as follows: Score x i = 2 − E h x i C n \begin{equation}{\rm{Score\;}}\left( {{x_i}} \right) = {2^{ - \frac{{E\left( {h\left( {{x_i}} \right)} \right)}}{{C\left( n \right)}}}}\;\end{equation} (3)represents the mean value of tath length of x i ${x_i}$ in t iTrees. 3.1.2 Local outlier factor (LOF) The LOF algorithm is a typical density-based anomaly detection method [44]. This method assigns each data point an outlier factor that depends on the neighbourhoods' density to determine whether the data point is an anomaly. The process and some concepts in the algorithm are as follows [37]: d p , q ${d_{p,q}}$ : The distance between point p and point q Kth-distance: Assuming that d k ( o ) ${d_k}( o )$ is the kth-distance of point o, d k ( o ) = d ( o , p ) ${d_k}\;( o ) = \;d( {o,p} )$ and satisfy the following conditions: There remains at least k points p ′ ∈ D ∖ { O } $p^{\prime} \in D\backslash \{ O \}$ to make d ( o , p ′ ) ≤ d ( o , p ) ${\rm{d}}( {{\rm{o}},p^{\prime}} ) \le {\rm{d}}( {{\rm{o}},{\rm{p}}} )$ true. There remains at least k−1 points p ′ ∈ D ∖ { O } $p^{\prime} \in D\backslash \{ O \}$ to make d ( o , p ′ ) < d ( o , p ) ${\rm{d}}( {{\rm{o}},p^{\prime}} ) < {\rm{d}}( {{\rm{o}},{\rm{p}}} )$ true. K-distance neighbourhood: Let N k ( o ) ${N_k}( o )$ be the Kth-distance neighbourhood of point o, which satisfies, N k o = p ′ ∈ D ∖ o | d o , p ′ ≤ d k o \begin{equation}{N_k}\;\left( o \right) = \left\{ {p^{\prime} \in D\backslash \left\{ o \right\}{\rm{|d}}\left( {{\rm{o}},p^{\prime}} \right) \le {d_k}\left( o \right)} \right\}\;\end{equation} (4) Reachable distance: the Kth reachable distance from point p to point o is defined as d k o , p = max d k o , d o , p \begin{equation}{d_k}\;\left( {o,p} \right) = \;{\rm{max}}\left( {{d_k}\left( o \right),{\rm{d}}\left( {{\rm{o}},{\rm{p}}} \right)} \right)\end{equation} (5) Local reachable density: the reciprocal of the mean value of all k neighbourhood distances of point o, defined as, ρ k o = 1 ∑ P ∈ N k o d k o , p / k = k ∑ P ∈ N k o d k o , p \begin{equation}{\rho _k}\;\left( o \right) = \frac{1}{{\mathop \sum \nolimits_{P \in {N_k}\left( o \right)} {d_k}\left( {o,p} \right)/k}} = \frac{k}{{\mathop \sum \nolimits_{P \in {N_k}\left( o \right)} {d_k}\left( {o,p} \right)}}\;\end{equation} (6) Local outlier factor: The average ratio of the local reachable density of other points in the neighbourhood N k ( o ) ${N_k}( o )$ of point o to the local reachable density of point o, L O F K o = ∑ P ∈ N k o ρ K O ρ K P k \begin{equation}LO{F_K}\;\left( o \right) = \frac{{\mathop \sum \nolimits_{P \in {N_k}\left( o \right)} \frac{{{\rho _K}\left( O \right)}}{{{\rho _K}\left( P \right)}}}}{k}\;\end{equation} (7) With these definitions in mind, the procedure for the LOF method is obvious: For each data point, calculate the distance between it and all other points, and sort them from near to far. For each data point, find its k nearest neighbours and calculate the LOF score. 3.2 Supervised learning methods Supervised learning can be generally divided into classification, regression and dimensionality reduction. Classification algorithms are the most commonly used method in practice and literature of machine learning and data mining [45]. They are aimed at build optimum model from training data set and testing set [46]. The tuned modes can then apply to predict discrete random variables with labels. Researches on classification have been relatively mature that can be applied for anomaly detection if the training set is adequately assembled. In recent decades, support vector machine (SVM) and its novel improvement have been dramatically used to tackle the problems of classification [47]. While, some ensemble learning methods, bagging and boosting, are also spreading their superiorities [48]. Consequently, two representative algorithms for two ensemble methods, random forest and gradient boosting decision tree, are adopted with K nearest neighbour (KNN), decision tree and SVM to find out the optimal classification method in the process of detecting anomalies for steam turbine data. 3.2.1 Random forest Random forest [40] is built by a group of decision trees based on bagging ensemble learning. The main idea of bagging [49] is that each base learner is trained based on different sub-training sets, and the predicted value of all base learners is integrated to get the final prediction result. Based on bagging, the generation process of RF is as follows (Figure 3). Suppose that there is an original sample set N, and each sample contains K features. Each decision tree selects n (n ≤ N) sub-samples from the sample set N by sampling with replacement; Randomly select a (a ≤ K) features from n samples, and the optimal split point is the same as the determination rule in the decision tree; Repeat m $m$ times to obtain m $m$ decision trees; Each subtree produces a result and the majority voting mechanism is used to output the decision when predicting the new sample. FIGURE 3Open in figure viewerPowerPoint Algorithm generation process of random forest It is not difficult to see from the generation process that the randomness of random forest is mainly reflected in two aspects: the random selection of the data set and the features used by each