Expert Systems With Applications 189 (2022) 116094

Contents lists available at ScienceDirect

Expert Systems With Applications

journal homepage: [Link]/locate/eswa

A new auto-encoder-based dynamic threshold to reduce false alarm rate for

anomaly detection of steam turbines
Jin Uk Ko a, Kyumin Na a, Joon-Seok Oh b, Jaedong Kim b, Byeng D. Youn a, c, d, *
a
Department of Mechanical and Aerospace Engineering, Seoul National University, Seoul 08826, Republic of Korea
b
Power Generation Laboratory, Korea Electric Power Corporation Research Institute, Daejeon 34056, Republic of Korea
c
Institute of Advanced Machines and Design, Seoul National University, Seoul 08826, Republic of Korea
d
OnePredict Inc., Seoul 06160, Republic of Korea

A R T I C L E I N F O A B S T R A C T

Keywords: This study proposes an ensemble denoising auto-encoder-based dynamic threshold (EDAE-DT) to overcome the
Anomaly detection false alarm issue in anomaly detection. The proposed ensemble denoising auto-encoder can model the normal
Deep learning condition well through a denoising task and an ensemble technique. The dynamic threshold sets a time-varying
Ensemble denoising auto-encoder
threshold that considers the variation of normal data. Performance metrics for anomaly detection are newly
Dynamic threshold
Steam turbine
proposed to quantitatively verify the performance. A new sensitivity is defined from the dynamic threshold to
identify which signal is related to the change that arises due to an anomaly. The diagnostic performance of the
proposed approach is compared using metrics for classification and a confusion matrix. Validation results, which
examined thermal power plant datasets, show that the proposed modeling method outperforms both the auto-
encoder and denoising auto-encoder approaches. Additionally, the proposed method can significantly reduce
the false alarm rate, as compared to conventional methods, while detecting anomalies faster than experts. The
anomaly-related signals are identified successfully through the newly defined sensitivity. Finally, the diagnositc
results demonstrate that the proposed approach is more accurate than conventional methods.

1. Introduction respect to the amount of fault data available.

When at least fault data has been obtained, supervised-learning-
A steam turbine is a major component of a thermal power plant. Its based methods can be used for fault classification or predicting the
major role is to transfer fluid energy to a generator, which converts the future condition. A survey of fault diagnosis and prognosis approaches
energy to electricity (Bloch, Singh, & Singh, 2008; Chaibakhsh & was performed by Kordestani et al. (2019). According to the authors,
Ghaffari, 2008; Que & Xu, 2019). A steam turbine usually rotates at high fault diagnosis was a task that detected, isolated and identified a fault;
speed by being subjected to high-pressure and high-temperature steam prognosis was to predict the future condition and estimate the remaining
produced by a boiler. Therefore, the operating conditions of a turbine useful lifetime (RUL) of a component. Among various types of prognosis
are considerably harsh (Friswell, Penny, Garvey, & Lees, 2010; Guo, Liu, methods, data-driven-based schemes had two advantages: 1) they
& Li, 2016). These harsh conditions can be the main reason for a system required less domain knowledge and 2) they offered a dimensionality
failure, which can lead to a catastrophic disaster due to a turbine’s reduction from high-dimensional data. Zhang et al. (Y. Zhang, Li, Gao,
enormous rotational energy. Consequently, fast and accurate anomaly Chen, & Li, 2020) developed an ensemble of a sparsed denoising auto-
detection, necessary for effective fault diagnosis and prognosis (FDP) encoder, a denoising auto-encoder, and a contractive auto-encoder to
(Kordestani, Saif, Orchard, Razavi-Far, & Khorasani, 2019), is required extract discriminative features. This ensemble technique could treat
to detect anomalies in advance in order to prevent anomalies from redundant information and deal with the noise issue. A convolutional
progressing to the point of causing catastrophic failure (Arranz, Cruz, auto-encoder (CAE) was proposed to extract meaningful features from
Sanz-Bobi, Ruíz, & Coutiño, 2008; T.-L. Chen, 2009). Among various vibration signals (Qian, Qin, Wang, & Liu, 2021). After extracting fea­
approaches for anomaly detection of a turbine, unsupervised or tures using CAE, a fault classifier and a domain classifier categorized the
supervised-learning-based methods have been widely studied with condition and the domain label, respectively. Correlation alignment loss

* Corresponding author at: Department of Mechanical and Aerospace Engineering, Seoul National University, Seoul 08826, Republic of Korea.
E-mail address: bdyoun@[Link] (B.D. Youn).

[Link]
Received 14 June 2021; Received in revised form 6 September 2021; Accepted 13 October 2021
Available online 22 October 2021
0957-4174/© 2021 Elsevier Ltd. All rights reserved.
J.U. Ko et al. Expert Systems With Applications 189 (2022) 116094

was applied to generate domain-invariant features in the fault classifier. threshold is determined inaccurately. If the threshold is determined too
Lv. et al (Lv, Chen, Pan, & Zhou, 2020) proposed a conditional adver­ sensitively, false alarms can occur frequently; if it is set too conserva­
sarial denoising auto-encoder (CADAE), which employed a semantic tively, few alarms might be generated, even when an anomaly occurs. A
attribute and a non-semantic attribute together; those attributes were few prior studies have concentrated on developing an accurate threshold
obtained by prior knowledge and by a convolutional neural network, in the field of deep-learning-based anomaly detection. In early work, an
respectively. An auto-encoder with a residual connection and wide- intuitive threshold, called the N-sigma rule, was defined by using the
kernel at the first convolutional layer was developed by Yang et al. mean and standard deviation of a health index (Nelson, 1984; Shewhart,
(Yang, Karimi, & Sun, 2021). The residual connection relieved the 1931). When the health index was assumed to follow a Gaussian dis­
overfitting issue when a model became deeper and a wide-kernel at the tribution, it was considered to be normal when an index existed within 3
first layer reduced the effect of high frequency noise (Zhang, Peng, Li, times the standard deviation from the mean. Chen et al. (2020) proposed
Chen, & Zhang, 2017). Then, the proposed auto-encoder generated a stacked denoising auto-encoder to detect anomalies in a wind turbine.
important features from raw vibration signals. In addition, some studies A health indicator was defined as a Mahalanobis-distance (MD) of the
have examined failure prognosis in an engineered system. Kordestani, residual and the threshold was determined as the point where the upper
Samadi, and Saif (2020) proposed a recursive Bayesian algorithm to tail of the indicator’s cumulative distribution function became the
estimate the RUL of multifunctional spoiler (MFS) systems in an aircraft. confidence level. Zeng, Yang, and Bo (2020) proposed a new method
Three parallel networks were trained to learn the failure parameters; the that combined a sparse Bayesian learning and hypothesis testing. Hy­
recursive algorithm was able to model the RUL, considering uncertainty. pothesis testing was done to determine whether or not a sample falls into
An ensemble-based fault detection approach for a gas turbine was a confidence interval.
studied by Mousavi, Moradi, Chaibakhsh, Kordestani, and Saif (2020). When detecting anomalies using a deep learning method, it is crucial
Four Wiener models were used to output a residual and a threshold, to reduce false alarms to prevent a tremendous waste of human and
respectively. Then, several classifiers were combined to identify the material resources (Fujiyama, et al., 2004). Although steam turbines are
condition of the MFS system. Due to the effect of ensemble, the prog­ mainly operated at a constant speed, local fluctuations can occur even
nostic performance was improved. Although these FDP-related studies when a turbine is working normally. These fluctuations occur for several
showed high performance, label information or signals of high sampling reasons, such as the control of the turbine to meet the electrical power
frequency over 5000 [Hz] were needed to apply the developed needs (López, Flores, & Garcı́a, 2003). Accurately detecting abnormal­
algorithms. ities can become challenging, since the change due to an anomaly and
As an alternative, unsupervised learning algorithms can be used if the change caused by local fluctuations in the normal signals can be
labeled fault samples are scarce. Anomaly detection based on unsuper­ confused. As a result, to avoid false alarms, it is critical to consider
vised learning consists of two major steps: 1) modeling of normal data variations in the normal condition when determining a proper
and 2) setting a threshold that becomes a criterion to judge whether or threshold. However, previous studies have a false alarm issue because
not the target system is operating normally (Chen, Li, Chen, Wang, & they have paid little attention to the consideration of local variations in
Jiang, 2020). The first step is to learn the characteristics of the normal the normal signals. These prior approaches usually set a constant
data using an unsupervised algorithm, like an auto-encoder. By training threshold, rather than considering the local variations (Chen, et al.,
an auto-encoder with a bottleneck layer to reconstruct the input, the 2020; Nelson, 1984; Shewhart, 1931). Though this kind of constant
auto-encoder can learn the essential information of the input signals threshold is simple and intuitive, false alarms can be triggered repeat­
(Arranz, et al., 2008; Chen, et al., 2020). If a model is well-trained with edly if this approach is used. Therefore, false alarms should be mini­
normal data, the output has little error with normal input data; however, mized adequately to enable accurate anomaly detection.
there will be significant error in the output if the input is abnormal data. To overcome the false alarm issue, an ensemble denoising auto-
Some prior studies related to deep-learning-based anomaly detection for encoder-based dynamic threshold (EDAE-DT) is newly proposed in
turbines have focused on the modeling performance by developing a this work. An unsupervised learning approach is chosen because fault
deep learning model. Arranz et al. (2008) proposed a neural network of data is very hard to obtain from a steam turbine. Fault data is difficult to
a single-layer with a sigmoid function to characterize the normal data of obtain for two reasons; 1) the turbine is monitored closely during
a combined-cycle gas turbine plant. Several models have been trained to operation and 2) the turbine is stopped immediately if a problem occurs,
detect the condition. For example, Dhini, Kusumoputro, and Surjandari no matter how small the problem is. In this work, an ensemble denoising
(2017) developed a multilayer perceptron of a sigmoid function for auto-encoder (EDAE) is trained to model the normal condition of a
anomaly detection of a steam turbine. The objective function was mean steam turbine. A deep neural network is selected as the base model of the
squared error (MSE) and the weights were trained by a back- auto-encoder (AE) because it is most widely used in the field of anomaly
propagation method. Liu et al. (Liu, Lu, Ren, & Wu, 2020) developed detection of engineered systems (Arranz, et al., 2008; Dhini, et al., 2017;
a flowchart for wind turbine anomaly detection by using k-means Lu, et al., 2017; Zhao, et al., 2019). The denoising task can improve the
clustering (Likas, Vlassis, & Verbeek, 2003), t-distributed stochastic reconstruction performance of the AE by learning to remove noise in the
neighborhood estimation (t-SNE) (Van der Maaten & Hinton, 2008), and input (Goodfellow, Bengio, Courville, & Bengio, 2016). The ensemble
a deep neural network. Specifically, k-means clustering and t-SNE were technique can reduce the generalization error by averaging the output of
used to extract meaningful features from wind turbine data. Lu, Wang, several models (Nisbet, Elder, & Miner, 2009). After training the EDAE,
Qin, and Ma (2017) proposed a stacked denoising auto-encoder to the dynamic threshold (DT) calculates a variable threshold according to
consider the noise in the input signals. The auto-encoder was trained the output of the EDAE by computing the upper confidence limit from
with a greedy approach and sparsity was constrained to the hidden the joint distribution of the output and the residual. Given an output of
layers. In other work, a convolutional auto-encoder approach was the EDAE, a threshold value is determined dynamically with respect to
developed by Lee, Jung, Song, and Choo (2020) for anomaly detection of the output. Finally, to give more meaningful information to the opera­
a gas turbine. When training the model, computational cost was tors after an anomaly is detected, condition parameters that are sensitive
decreased using the sparse connectivity in the convolutional layer and to the anomaly are identified through a newly defined sensitivity, which
through the reduction of a feature map through use of a max-pooling is calculated by using the maximum values of the residual and the
layer. threshold. Through this enhancement, the operators are able to inves­
The second step is to set a threshold and raise alarms by checking tigate the specific parts related to the sensitive parameters, which can
whether or not the health index exceeds a threshold; a residual is usually reduce the maintenance cost. In this research, two datasets from a
used as the health index. Even when an algorithm learns normal data thermal power plant are used to validate the proposed EDAE-DT. Each
well, the performance of the anomaly detection can be poor if the dataset consists of several operating parameters and has a sampling

2
J.U. Ko et al. Expert Systems With Applications 189 (2022) 116094

Fig. 1. Conventional procedure of deep-learning-based anomaly detection.

Fig. 2. Architecture of an auto-encoder.

frequency of 1 [sample/min]. To confirm the effect of the ensemble and method detects anomalies with significantly fewer false alarms, as
denoising in the modeling process, the proposed EDAE approach is compared with conventional methods, while also detecting anomalies
compared with AE and DAE methods; AE is used in (Dhini, et al., 2017; faster than experts.
Lutz, et al., 2020) and DAE is used in (Chen, et al., 2020; Lu, et al., The rest of this paper is structured as follows. Section 2 presents the
2017). Since the performance of a deep learning algorithm varies ac­ methodology of deep-learning-based anomaly detection and the concept
cording to its architecture, the modeling performances of AE, DAE, and of an auto-encoder. Section 3 explains the proposed anomaly detection
EDAE are compared with various numbers of hidden layers. Then, the method and explores the concept of sensitivity and quantitative per­
anomaly detection performance of EDAE-DT is compared with previous formance metrics. The validation of the proposed idea with power plant
anomaly detection methods; specifically, the N-sigma method (Nelson, datasets is illustrated in Section 4. Finally, Section 5 offers a summary of
1984; Shewhart, 1931) and the MD-based method (Chen et al., 2020). N- the conclusion of this paper.
sigma is chosen for comparison because it is simple and intuitive; MD is
selected since a threshold is determined statistically from a single health 2. Theoretical background
index extracted from multi-variate signals. For quantitative validation,
several metrics are newly defined for evaluation of anomaly detection 2.1. Deep-learning-based anomaly detection
performance. In addition, to validate the performance of the fault
diagnosis, a confusion matrix is used by labeling the detected status as Deep learning has been widely used in anomaly detection of engi­
normal or anomaly. The validation results indicate that the proposed neered systems. The general procedure of deep-learning-based anomaly

3
J.U. Ko et al. Expert Systems With Applications 189 (2022) 116094

Fig. 3. Procedure of EDAE-DT.

detection is illustrated in Fig. 1. It consists of a training step and a testing from either a normal or anomaly condition. Those signals are pre­
step. In the training step, multi-variate operating signals of the normal processed using the same methods as in the training step. Then, a re­
condition are measured first. Preprocessing is needed because raw sig­ sidual is calculated using the trained auto-encoder. Finally, the
nals cannot be directly used for a deep learning algorithm. Preprocessing condition of the system is monitored by comparing the residual and the
includes filling in missing values, removing outliers, treating noise, etc. threshold.
Next, the hyper-parameters of an auto-encoder are selected, either
heuristically or by grid search (Montavon, Orr, & Müller, 2012), random
search (Bergstra & Bengio, 2012), or Bayesian optimization (Snoek, 2.2. Concept of an auto-encoder
Larochelle, & Adams, 2012). Critical hyper-parameters, such as the
learning rate, should be chosen carefully to ensure the maximal per­ An auto-encoder (AE) is an unsupervised learning algorithm that is
formance of an algorithm. Then, by using the preprocessed normal data trained to reconstruct its input. The basic architecture of an AE is
and the chosen hyper-parameters, an auto-encoder is trained by mini­ illustrated in Fig. 2. Given multi-variate signals, including vibration,
mizing the objective function, such as mean squared error or mean ab­ temperature, and pressure, they are entered into an encoder and are
solute error. A trained auto-encoder can model the characteristics of a reconstructed in the decoder part; the architectures of both parts are
normal condition. Finally, a threshold is determined using the residual, usually symmetric. The representation of the (l + 1)-th layer becomes as
which is calculated as the L1 norm or L2 norm of the output and true follows:
data. For example, given a confidence level (p), a threshold can be set as ( )
al+1 = f W l al + bl (1)
the value where the cumulative distribution function of a residual be­
comes (1 − p) In the testing step, new signals are measured; they can be where f(⋅) is the activation function; al is the output of the l-th layer; W l

4
J.U. Ko et al. Expert Systems With Applications 189 (2022) 116094

Fig. 4. Architecture of EDAE.

absolute error (MAE). In this study, MAE is used because MAE is more
sensitive to local variations of input data (Willmott & Matsuura, 2005).
The mathematical expression of MAE is as follows:

1 ∑M
L= xi|
|xi − ̂ (2)
M i=1

where xi is the sample at time index i, and M is the number of samples.

When an AE is successfully trained with normal data of a steam turbine,
it can be said that the AE models the normal condition of the turbine.

3. Ensemble denoising auto-encoder-based dynamic threshold

(EDAE-DT)

Fig. 5. Calculation of DT.

3.1. Overall procedure of EDAE-DT

and bl are the weight and bias between the l-th layer and the (l + 1)-th To detect anomalies of a steam turbine with fewer false alarms, an
layer. To induce the non-linear dimensionality reduction of the input, ensemble denoising auto-encoder-based dynamic threshold (EDAE-DT)
the final layer of the encoder has smaller hidden nodes than those of the is newly proposed. The overall procedure of EDAE-DT is described in
input layer (Gehring, Miao, Metze, & Waibel, 2013). In this way, the Fig. 3. Similar to the conventional anomaly detection procedure, the
encoder extracts the essential information from the input data. Then, a proposed method consists of training and testing steps. In the training
decoder reconstructs the input from the encoded information. The AE is procedure, operating signals of the normal condition are measured from
trained by minimizing the mean squared error (MSE) or the mean the steam turbine. In the preprocessing step, the missing values are filled

Table 1
Defined performance metrics.
Performance type Notation Definition Formulation Unit
√̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅
Modeling performance RMSE Root mean squared error 1 ∑T ∑N ( )2 –
yj (ti ) − xj (ti )
TN i=1 j=1
Anomaly detection performance α # of false alarms per hour N(F) times / hour
Ttr + Tval
β # of valid alarms per hour N(V) times / hour
Tte
δ How much faster than experts’ detection Te − V0 days

5
J.U. Ko et al. Expert Systems With Applications 189 (2022) 116094

Fig. 6. Concept of false alarms and valid alarms.

signals, the reconstructing performance can be enhanced. Also, the

Table 2
ensemble technique can improve the performance by reducing the un­
Condition parameters and units of A1 and A2.
certainty in the outputs.
No. Parameter Unit Notation [ ]T
xi = xi1 , x2i , ..., xin
1 Vibration in the x-direction at bearing #1 mm x1 (3)
2 Vibration in the y-direction at bearing #1 mm x2 xj = x + εj
̃
3 Vibration in the x-direction at bearing #2 mm x3
4 Vibration in the y-direction at bearing #2 mm x4 B ⃒ ( i) ⃒
1∑ ⃒ ⃒
5 Vibration in the x-direction at bearing #3 mm x5 Lj = x − xi ⃒
⃒Qj ̃
6 Vibration in the y-direction at bearing #3 mm x6 B i=1 j

7 Vibration in the x-direction at bearing #4 mm x7

8 Vibration in the y-direction at bearing #4 mm x8 1 ∑M
( i)
yi = Qj ̃
x
9 Vibration in the x-direction at bearing #5 mm x9 M j=1
10 Vibration in the y-direction at bearing #5 mm x10 ⃒ ⃒
⃒ ⃒
11 Vibration in the x-direction at bearing #6 mm x11 rji = ⃒yij − xij ⃒ (4)
12 Vibration in the y-direction at bearing #6 mm x12
13 Vibration in the x-direction at bearing #7 mm x13 After training the EDAE, the dynamic threshold (DT) is calculated as
14 Vibration in the y-direction at bearing #7 mm x14
shown in Fig. 3b; each step is described graphically in Fig. 5. For each
15 Vibration in the x-direction at bearing #8 mm x15
16 Vibration in the y-direction at bearing #8 mm x16 parameter, let the output of EDAE be y = [ytr ; yval ]T and the corre­
17 Vibration in the x-direction at bearing #9 mm x17 sponding residual be r = [rtr ; rval ]T . Both variables are obtained by Eq.
18 Vibration in the y direction at bearing #9 mm x18
(4); index i and j are ignored for convenience. The joint probability
19 Metal temperature of the crossover pipe ◦
C x19
20 Steam temperature of the crossover pipe ◦
C x20 distribution f(y, r) is obtained by kernel density estimation using a
21 Pressure of the crossover pipe psi x21 Gaussian kernel. The bandwidth is estimated by Scott’s rule (Scott,
22 Steam pressure of the hot reheater line kg/ x22 2015). Then, for each yk (black dotted line) of the regular grid size, the
cm2g marginal distribution h(⋅) is obtained by
23 Pressure of upstream of the low-pressure bypass kg/ x23
valve cm2g f (yk , r)
24 Pressure of the hot reheater outlet line kg/ x24 h(r; y = yk ) = ∫ ∞ (5)
f (yk , r)dr
cm2g − ∞

The denominator plays the role of normalization to make the integral

of h(⋅) be 1. Next, using a pre-defined confidence level (p), the critical
by linear interpolation of nearby values, outliers are removed by the 6-
point (qk ) for each yk is calculated so that qk satisfies Eq. (6).
MAD (median absolute deviation) method, and moving average filtering
∫ qk
is applied for smoothing. Finally, the signals are min–max scaled.
h(r; y = yk )dr = 1 − p (6)
Next, EDAE is trained as shown in Fig. 3a. The learning rate and the − ∞
number of latent nodes are selected by Bayesian optimization. Fig. 4
Those critical points are linearly interpolated and the upper and
illustrates the architecture of EDAE. The denoising auto-encoder (DAE)
lower tails are flattened as follows:
has a symmetric architecture around the latent layer. Dropout is applied
{ ( )
to the intermediate hidden layers (orange circle), except the latent layer; g(y) = g yupper if y⩾yupper
(7)
the dropout rate is set as 0.1. Each model is trained with noisy input g(y) = g(ylower ) if y⩽ylower
signals; they are added using different white-gaussian noise (ε) with the
same signal-to-noise ratio for each model. That is, if xin denotes the n-th here ylower and yupper are chosen as 0.8 times of minimum of y and 1.2
parameter value at time index i, all clean signals (x) and corrupted times of the maximum of y, respectively. The reason for flattening is
( )
signals ̃ xj for the j-th model become like Eq. (3). Then, the loss function because interpolation is usually inaccurate in those regions. Then, a
( ) ( )
of the j-th model Lj , the ensembled-output yi , and the residual of j-th critical function (g(y) ) can be defined with respect to each parameter,
( ) which is the blue line in Fig. 5. When ym is the EDAE’s output for unseen
tag at i-th index rji become like Eq. (4). In Eq. (4), B is the mini-batch data, g(ym ) becomes the threshold value. If the residual is greater than
size, Qj (⋅) is the learned representation of model j, and M is the number g(ym ), the system is considered to have an anomaly, since the residual
of models; M is set as five in this work. rji is non-negative since it is the L1 exceeds the confidence limit.
norm of the output and the target value. By learning to denoise the input After detecting an anomaly by EDAE-DT, to find the condition pa

6
J.U. Ko et al. Expert Systems With Applications 189 (2022) 116094

Fig. 7. Sensor locations of the steam turbine.

3.2. Proposed performance metrics

Table 3
Data descriptions of both datasets A1 and A2. As described in Section 2.1, deep-learning-based anomaly detection
Dataset A1 A2 methods consist of two main steps: modeling of normal data and
Sampling rate [sample/min] 1
anomaly detection. Accordingly, two kinds of metrics are newly defined
Number of raw condition parameters 24 for quantitative validation; metrics for modeling performance and those
Data configuration Training data 06/30/11 to 10/ 02/12/13 for anomaly detection performance. The proposed metrics are summa­
23/11 to 07/12/ rized in Table 1. RMSE (root mean squared error) of validation data is
13
defined to quantify the modeling performance because it is the most-
Validation data 10/23/11 to 10/ 08/01/13
30/11 to 08/08/ widely used metric for regression (Neill & Hashemi, 2018; Stetco,
13 et al., 2019). In the formulation, T is the time length of the validation
Test data 10/30/11 to 10/ 12/18/13 data, N is the number of condition parameters; xij and yij are j-th
31/11 to 12/19/
13 parameter at time index i and the ensembled-output of it, respectively.
Anomaly detection 10/31/11 12:20:00 12/18/13 RMSE indicates how well an algorithm reconstructs the input data,
time by experts (Te) 20:40:00 which means modeling the normal data. The smaller this metric, the
Start time of 10/31/11 13:30:00 12/19/13 better the algorithm learns the normal data.
shutdown 02:00:00
Definitions of false alarms and valid alarms are needed to define
Restart time after 11/10/11 03:20:00 12/19/13
maintenance 19:40:00 metrics for anomaly detection performance. Fig. 6 describes the mean­
Cause of anomaly High vibration in the x- Leakage at ing of both alarms. In Fig. 6, Ttr, Tval, and Tte are time lengths of the
direction at bearing #4 crossover pipe training, validation, and test data, respectively; the black line is the
Anomaly-related Vibration in the x- Pressure of
residual and the dotted blue line is the threshold. Training, validation,
parameter by direction at bearing #4 crossover pipe
experts (x7) (x21)
and test data might be continuous or not; however, they should be in
order of time, not overlapped. An alarm occurs when the residual ex­
ceeds the threshold. False alarms are alarms that arise in the training and
rameters related to the anomaly, a sensitivity is newly defined as fol­ validation periods; these are expressed in the orange regions. Valid
lows: alarms, expressed in the gray region, are alarms that occur in the test
( ( )) ( ( )) period, since a change due to an anomaly will occur in the test period. In
max r yj,te − max g yj,total
sj = ( ( )) (8) this context, three metrics – α, β, and δ – are newly proposed to quantify
max r yj,te
the anomaly detection performance. α and β are the numbers of false
( ) alarms and valid alarms per hour, respectively. In the formulation of
where sj is the sensitivity of the j-th parameter, r yj is the residual of yj , Table 1, F and V, mathematically defined in Eq. (9), are sets of false
( )
alarms and valid alarms; in the equation, fs is the sampling frequency. A
yj,total is the union of yj,tr ; yj,val ; yj,te , and g(⋅) is the critical function. If sj
small α means that anomaly detection is reliable; a large α denotes that
is positive, an alarm is produced for the parameter; it can be said that no anomaly detection is so sensitive that the operator might be confused by
alarm occurs if sj is negative. Also, a greater value of sj indicates a more too many false alarms. In contrast, the larger the value of β, the better an
sensitive parameter. This sensitivity value can give a clue to the plant algorithm is sensitive to the change of the system due to an anomaly. α is
operators about which parameters are relevant to the abnormality. more crucial than β from the viewpoint of reliability only if β is greater

7
J.U. Ko et al. Expert Systems With Applications 189 (2022) 116094

(a) Signal trend of vibration in the x-direction at bearing #4 (x7) for case A1

(b) Signal trend of pressure of the crossover pipe (x21) for case A2
Fig. 8. Trends of preprocessed anomaly-related parameters.

(a) 3 layers (b) 5 layers

(c) 7 layers (d) 9 layers

Fig. 9. Architecture of four auto-encoders with different depths of hidden layers.

8
J.U. Ko et al. Expert Systems With Applications 189 (2022) 116094

Table 4 usually stopped after any anomaly is detected. For dataset A1, training,
Bayesian optimization results of AE, DAE, and EDAE for four different hidden validation, and test data are successively constituted; however, the
layers. configuration is not successive for dataset A2. The number of training
# of hidden layers Hyper-parameters AE DAE EDAE samples is around 170,000 for both datasets. For case A1, the shutdown
3 layers # of latent nodes 11 25 15
began at 13:30:00 on 10/31/11 and the turbine was re-operated at
Learning rate 0.004466 0.010000 0.000674 03:20:00 on 11/10/11. Here, and throughout, the date format is month/
5 layers # of latent nodes 25 18 10 day/year; for instance, 10/31/11 is October 31, 2011. In case A2, the
Learning rate 0.000873 0.001267 0.000120 turbine started to stop at 02:00:00 on 12/19/13; it was restarted at
7 layers # of latent nodes 11 14 9
19:40:00 on 12/19/13 after maintenance. The anomaly cause of A1 is a
Learning rate 0.000744 0.006773 0.000594
9 layers # of latent nodes 2 4 7 high vibration in the x-direction at the 4th turbine bearing, detected by
Learning rate 0.004984 0.001319 0.000120 the operator at 12:20:00 on 10/31/11; the anomaly-related parameter is
also analyzed as vibration in the x-direction at bearing #4 by experts.
The anomaly reason of A2 is leakage at the crossover pipe; this was
than 0. δ is defined as the difference between the detection time of ex­ discovered by the operator at 20:40:00 on 12/18/13. For A2, among
perts (Te) and the first detection of a valid alarm (V0). It is desirable for δ pressure and temperature of crossover pipe signals, experts determined
to be positive; otherwise, there is no reason to use that anomaly detec­ that the pressure of the crossover pipe is significantly related to the
tion algorithm. As for the units of the metrics, RMSE has no dimension anomaly; on the other hand, temperature is relatively slow to change
because input signals are normalized and α, β are times per hour; the due to the anomaly. Fig. 8 illustrates preprocessed-signal trends of
unit of δ is days. anomaly-related parameters determined by experts; units are not
expressed since they are normalized. The vertical black-dotted line is the

{ ⃒ }
{ ( ) ( ) } ⃒ 1
F = ti |g yj (ti ) ⩽r yj (ti ) and ti ∈ P where P = ti ⃒⃒{T0 ⩽ti ⩽T1 } ∪ {T2 ⩽ti ⩽T3 }, ti+1 − ti =
fs
{ ⃒ } (9)
{ ( ) ( ) } ⃒ 1
V = ti |g yj (ti ) ⩽r yj (ti ) and ti ∈ Q where Q = ti ⃒⃒T4 ⩽ti ⩽T5 , ti+1 − ti =
fs

anomaly detection time by the experts. For case A1, the variation scale of
the training and validation periods are similar to each other. However,
4. Validation with power plant datasets vibration increased significantly in the test period near 14:00:00 on 10/
30/11. That is, the change due to the anomaly is valid in the test period
The proposed EDAE-DT approach is validated by examining two of A1. The variations of training and validation data for case A2 are also
datasets from a steam turbine of a domestic thermal power plant. EDAE similar. However, the variation in the test period is not valid, as
is compared with AE and DAE, focusing on the modeling performance. compared to case A1; this means that for A2 it will be harder to detect the
Those three models of various architectures are compared to each other. anomaly than it was for A1.
Then, to confirm the anomaly detection performance of EDAE-DT, the N-
sigma method (Nelson, 1984; Shewhart, 1931) and the Mahalanobis-
distance-based method (MD, (J. Chen, et al., 2020)) are compared to 4.2. Comparative anomaly detection studies
the proposed approach. After modeling the normal data with EDAE, the
anomaly detection performances of the three methods – N-sigma, MD, Nelson’s N-sigma method and the Mahalanobis-distance-based
and DT – are validated by employing the metrics in Table 1. Addition­ method (MD) are chosen as the comparative studies. Both methods set
ally, the diagnostic performances of those methods are compared using a constant threshold; the N-sigma method is intuitive, and MD extracts a
classification metrics and a confusion matrix; a sample is labeled 1 if the single health indicator from multi-variate signals. In the N-sigma
residual exceeds the threshold; otherwise, it is labeled 0. method, mean (μk ) and standard deviation (σ k ) are calculated from the
L1 residual of the k-th parameter. Then, μk +n × σk becomes the
4.1. Descriptions of datasets from the steam turbine threshold, where n is selected by two methods; it can be determined
manually or calculated as the value that satisfies the confidence level
Two datasets were collected from a steam turbine of domestic ther­ (p). Finally, the metrics shown in Table 1 are calculated for each
mal power plant A. The power capacity of each generator of plant A is parameter and are averaged for all parameters. The MD method is
500 [MW]. Operating signals of the steam turbine were measured by an different from the N-sigma method. The residual of the k-th parameter is
Osisoft PI system. The PI system organizes various signals from the calculated as the difference between the true and predicted output as
entire power plant. 24 parameters related to the steam turbine were follows:
measured for this dataset; the meaning and the unit of each parameter is
rk = yk,true − yk,pred (10)
provided in Table 2 and the sensor locations are illustrated in Fig. 7.
Also, the sampling rate, data configuration, and several types of anom­ Then, a monitoring indicator at the l-th sample is calculated as
aly information for the two datasets are summarized in Table 3. The follows:
sampling rate is 1 [sample/min] and the number of parameters is 24 for √̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅
the two datasets. Since EDAE should be designed to learn the charac­ tl = (rl − r)T S− 1 (rl − r) (11)
teristics of the normal condition well, the length of the training data is
set as around 4–5 months, to be long enough to allow accurate modeling where r and S are the mean vector and covariance matrix of the residual,
of the normal condition. The validation data is set to a length of 1 week, respectively. After that, the probability distribution function of the in­
and the length of test data is around 1 day, including the experts’ dicator t is calculated by kernel density estimation. Finally, the
detection time Te. The test period is inevitably short, since a turbine is threshold is set as a point such that the cumulative distribution function

9
J.U. Ko et al. Expert Systems With Applications 189 (2022) 116094

Fig. 10. Training loss and validation loss of auto-encoders for dataset A1; (a) AEs; (b) DAEs; (c) EDAEs.

of t becomes (1 − p). When calculating the metrics of anomaly detection ensembled with five DAEs. The confidence level of each threshold
shown in Table 1, the residual is substituted by the indicator t. method is set as 1e-3.

4.3.1. Modeling performance

4.3. Results for dataset A1 For the four different architectures in Fig. 9, modeling performances
of AE, DAE, and EDAE are compared to each other. The critical hyper-
For dataset A1, EDAE, AE, and DAE are trained with four different parameters – the number of latent nodes and learning rate – are cho­
depths of hidden layers, as described in Fig. 9; specifically, 3 layers, 5 sen by Bayesian optimization. The number of iterations is 12 and the
layers, 7 layers, and 9 layers. The gray circles show the input or output acquisition function is chosen as expected improvement (EI). The
nodes, the green circles represent the latent nodes, and the orange cir­ convergence results of the optimization are summarized in Figs. S1–S3
cles are the intermediate hidden nodes. For DAE and EDAE, noise with a (Supplementary material); the y-axis denotes the minimum validation
signal-to-noise-ratio of 5 [dB] is added to the input signals. Training loss until the iteration. The MAE of the validation data is converged in
epochs and batch size are set as 60 and 64, respectively. EDAE is

10
J.U. Ko et al. Expert Systems With Applications 189 (2022) 116094

Fig. 11. RMSE of AE, DAE, and EDAE with respect to four different architectures.

Fig. 12. Averaged anomaly detection metrics of three thresholds; N-sigma, MD, and DT.

and validation losses per epoch of the AEs, DAEs, and EDAEs are orga­
Table 5 nized in Fig. 10. The red circles, blue triangles, green squares, and purple
Anomaly detection performance of the top three parameters of A1; sorted by plus-shaped lines represent the results for 3 layers, 5 layers, 7 layers, and
sensitivity s. 9 layers, respectively. For each EDAE, the averaged losses of five DAEs
Condition parameters s α [times/ β [times/ δ are illustrated. The training losses are converged during the training
hour] hour] [days] procedure and the validation loss is usually greater than the training
Vibration in the x-direction 0.921821 0.051934 55.390734 0.9174 loss. The difference between the converged training loss and the vali­
at bearing #4 (x7) dation loss decreases in order for AE, DAE, and EDAE, respectively. This
Vibration in the x-direction 0.871573 0.036558 55.192050 0.9139
means that EDAE suffers the least from the overfitting issue.
at bearing #3 (x5)
Vibration in the y-direction 0.839537 0.044075 55.350991 0.9167
RMSE values for trained AE, DAE, and EDAE are summarized in
at bearing #5 (x10) Fig. 11. DAE shows a smaller RMSE value than AE, due to the denoising
task. The RMSE values of EDAE are smaller than those of AE and DAE in
every case. In particular, the RMSE value for an EDAE of 3 layers is the
every case, which means a local optimum has been reached. Table 4 smallest. This means that the EDAE of 3 layers learns the normal con­
shows the Bayesian optimization results with respect to the different dition better than other approaches. This is because a light neural
depths of the hidden layers. To make a bottleneck layer, the number of network is enough to model the training data, whose input dimension is
latent nodes is constrained to be less than the number of nodes in the just 24. In case of light data, a neural network with many hidden layers
layer that is before the latent layer. The optimal learning rate decreases may have a severe overfitting problem. Consequently, the anomaly
as a model becomes deeper because a small learning rate has the performance of the 3-layer EDAE is selected for further study.
advantage of optimizing a complex neural network. Using the optimized
critical hyper-parameters, the three algorithms are trained. The training

11
J.U. Ko et al. Expert Systems With Applications 189 (2022) 116094

(a) Output and residual results of EDAE

(b) Critical function of DT

Fig. 13. Results of EDAE-DT for x7: (a) output and residual results; (b) critical function of DT.

alarms (α) shows that DT generates far fewer false alarms than either N-
Table 6 sigma or MD. Specifically, the α value of DT is about 32.92% of that of N-
Averaged diagnostic performance of 10 trials for dataset A1. sigma, which produces the most false alarms. In summary, the results
Metrics Precision Recall Accuracy F1 score show that EDAE-DT can detect an anomaly faster than experts, while
generating the fewest false alarms, as compared to the conventional
N-sigma 0.919 0.992 0.993 0.958
MD 0.003 0.006 0.987 0.004 methods.
DT 0.918 1.000 0.999 0.957 Based on the newly proposed sensitivity in Eq. (8), the top three
anomaly-sensitive parameters were selected; these are presented in
Table 5. As you can see, vibration in the x-direction at bearing #4 (x7) is
4.3.2. Anomaly detection performance
the most sensitive parameter. This coincides with the sensitive param­
After training the EDAE of 3 layers using the training data, N-sigma,
eter that is analyzed by the experts. The α value of that parameter is
MD, and DT are obtained. Fig. 12 represents the averaged anomaly
0.0519 times per hour, which means that there is one false alarm every
detection metrics of those thresholds. When seeing the metric β, N-sigma
20 hours, on average. On the other hand, the β value is 55.3907 times
produces 42.2934 valid alarms per hour, while DT generates slightly
per hour, which shows that the most sensitive parameter can generate
fewer valid alarms; the β value of MD is too small, as compared to the
frequent valid alarms.
other two methods. Also, DT generates the first valid alarm faster than
Fig. 13 illustrates the output, residual, and critical function of x7. In
the experts by 0.78 days. While MD triggers the first valid alarm slower
Fig. 13a, the first column shows the results of the training data, the
than experts, N-sigma triggers the alarm earlier than experts by 0.84
second column shows those of validation, and the third column shows
days, which is slightly faster than DT. However, the metric for false

12
J.U. Ko et al. Expert Systems With Applications 189 (2022) 116094

(a) N-sigma

(b) MD

(c) DT
Fig. 14. Predicted label for x7, as determined by the diagnostic methods; (a) N-sigma; (b) MD; (c) DT.

those of the test period. The blue line is the true data, the yellow line is 4.3.3. Fault diagnosis performance
the output, in the first row of Fig. 13a. In the second row of Fig. 13a, the The diagnostic performances of N-sigma, MD, and DT are compared
blue line is the residual and the yellow plot is the dynamic threshold. using classification metrics – precision, recall, accuracy, and F1 score –
The vertical black-dotted line denotes the time required for detection by and a confusion matrix. The true labels of samples are annotated as bi­
experts. Since the residual is the L1 norm of the output and true data, the nary; the samples during training and validation periods are labeled as
residual is not negative. Because a critical function produces a threshold normal, and the ones in test period are labeled as anomaly. The pre­
for the EDAE’s output, it is good for training and validation samples to dicted label is obtained for each parameter as follows:
be located under the critical function to mitigate the false alarm issue; {
this can be seen in Fig. 13b. Unlike the training and validation samples, 0 if rni < hin
i
yn = (12)
test samples cross the function; this means that alarms occur during the 1 otherwise
test period. Thus, it is confirmed that DT can effectively reduce false
alarms, while generating valid alarms. where yin is a predicted label, rni denotes a residual and hin is a threshold
of the n-th parameter at time index i. Then, a single label at time index i

13
J.U. Ko et al. Expert Systems With Applications 189 (2022) 116094

(a) N-sigma (b) MD (c) DT

Fig. 15. Confusion matrices of the diagnostic methods for dataset A1; (a) N-sigma; (b) MD; (c) DT.

4.4. Results for dataset A2

Table 7
Bayesian optimization results of AE, DAE, and EDAE for four different 4.4.1. Modeling performance
architectures. As in the case A1, the modeling performances of AE, DAE, and EDAE
# of hidden layers Hyper-parameters AE DAE EDAE with respect to the different numbers of hidden layers are compared to
3 layers # of latent nodes 5 18 13 each other. For AE, DAE, and EDAE, the critical hyper-parameters are
Learning rate 0.009310 0.007051 0.000651 selected by Bayesian optimization. The optimization settings are the
5 layers # of latent nodes 15 11 15 same as in the case of A1. The convergence plots are organized in
Learning rate 0.000565 0.001846 0.000257
Figs. S4, S5, and S6. The minimum objective function is converged
7 layers # of latent nodes 12 16 7
Learning rate 0.000079 0.001746 0.000196
during the optimization, which denotes that a local optimum has been
9 layers # of latent nodes 6 7 6 found. Bayesian optimization results of AE, DAE, and EDAE are sum­
Learning rate 0.000031 0.002122 0.000201 marized in Table 7. In the same manner as that used for A1, the number
of latent nodes is upper-bounded with the number of nodes of the pre­
( i) vious layer to build a bottleneck architecture. As can be seen, the
y is calculated by averaging the predicted outputs of all parameters as learning rate is generally decreased when the number of hidden layers
follows: increases. This is because a small learning rate is suitable to find an
⎧ 1∑ i optimal point in a more complex network. The three algorithms are
⎪
⎨ 0 if y < 0.5
n n n trained with the optimized hyper-parameters. The training and valida­
i
y = (13)
⎪
⎩ tion MAEs per epoch are summarized in Fig. 16; the legend is the same as
1 otherwise Fig. 10. The losses of five DAEs of each EDAE are averaged. The training
and validation losses are converged in most cases. In addition, the dif­
Table 6 shows the averaged diagnostic performance metrics over 10
ference between the training loss and validation loss of EDAE is smaller
independent trials for dataset A1. As you can see, MD has inaccurate
than those of AE and DAE.
results, as compared to N-sigma and DT. The recall and accuracy of DT
Fig. 17 illustrates the RMSE values of trained AE, DAE, and EDAE for
are slightly greater than those of N-sigma, but the precision and F1 score
four different architectures. As shown in the figure, for each architec­
of DT are slightly smaller than those of N-sigma. That is, the diagnostic
ture, RMSE values decrease in the order of AE, DAE, and EDAE. The
performances of DT and N-sigma are similar to each other. This is
RMSE value of EDAE for the 3-layer scenario is smaller than that of the
because 1) the labeling might be wrong due to the lack of exact label
others. This illustrates that an EDAE of three layers can model the
information and 2) the number of faulty samples is far smaller than that
normal data remarkably well, better than the other approaches. Deeper
of normal samples. The predicted labels for x7 are described in Fig. 14. A
EDAEs show worse modeling performance than the EDAE of 3 layers.
blue lines denotes a residual, a yellow line is a threshold, a black dotted
The reason for this is that the deeper models suffer an overfitting
line denotes Te, and a red circle is the predicted label of a sample. For
problem. Therefore, the EDAE of 3 layers is analyzed in detail.
MD, a health index is illustrated instead of the residual. Though MD
classifies most of the samples during training and validation periods as
4.4.2. Anomaly detection performance
normal, it also misclassifies the test samples as normal. This is consistent
Three thresholds – N-sigma, MD, and DT – are calculated using the
with the results of Fig. 12, which denotes that the valid alarm rate of MD
EDAE’s output. Averaged anomaly detection metrics of those methods
is smallest. DT and N-sigma seem to have similar prediction results. The
are described in Fig. 18. First, the α value of N-sigma is highest among
confusion matrices of the model used in Fig. 12 are illustrated in Fig. 15.
the thresholds; this implies that the false alarm problem is the most
The label of normal samples is 0 and that of the faulty ones is 1. The float
severe when using N-sigma. MD falls in second place, and DT shows the
value is the number of predicted samples over that of total samples and
smallest α. This indicates that the false alarm issue is not severe for DT,
the value in parentheses is that of predicted samples. From the confusion
as compared to N-sigma and DT. The valid alarm rate β value of DT is
matrices, it can also be found that MD misclassifies the fault samples as
43.5976; this means DT triggers valid alarms about 43 times per hour.
normal. Also, DT and N-sigma have similar classification performance,
MD’s β is 0.0423, which represents that MD triggers fewer valid alarms
which is also shown in Table 6 and Fig. 14.
than N-sigma and DT; that is, MD is least sensitive to the change of multi-

14
J.U. Ko et al. Expert Systems With Applications 189 (2022) 116094

Fig. 16. Training loss and validation loss of auto-encoders for dataset A2; (a) AEs; (b) DAEs; (c) EDAEs.

variate time-series data that arises due to an anomaly. Finally, δ values rate of the parameter is around 0.052 times per hour, which is quite
of DT and N-sigma are 0.5765; this describes that those methods detect small. The valid alarm rate value is 57.9296 times per hour, which also
an anomaly faster than experts by around 13 hours. In contrast, the δ describes that the parameter is sensitive to the change of input data that
value of MD is negative, which means that MD’s detection is slower than happens due to an anomaly. Although there are temperature-related
experts. In summary, EDAE-DT produces the fewest false alarms, while parameters at the crossover pipe (e.g., the metal temperature of the
triggering valid alarms faster than experts. Thus, DT is superior to the N- crossover pipe), these parameters are not selected as anomaly-sensitive
sigma and MD methods. parameters. The reason for this is that change of temperature is slower
After validating the superior anomaly detection performance of than that of pressure when there is a sudden change in a system. Thus,
EDAE-DT, parameters that are sensitive to the change of input due to the pressure is a better choice for anomaly detection.
anomaly are selected, as outlined in Table 8. Those parameters are Fig. 19 illustrates the output, residual, and critical function of EDAE-
sorted in descending order based on the sensitivity. It turns out that the DT for x21. The legends are the same as those shown in Fig. 13. In the
pressure of the crossover pipe has the largest sensitivity value, which training and validation periods, the output of EDAE is similar to the true
matches the true anomaly cause shown in Table 3. Also, the false alarm data; this indicates that EDAE can model the normal condition

15
J.U. Ko et al. Expert Systems With Applications 189 (2022) 116094

Fig. 17. RMSE of AE, DAE, and EDAE with respect to four different architectures.

Fig. 18. Averaged anomaly detection metrics of three thresholds; N-sigma, MD, and DT.

4.4.3. Fault diagnosis performance

Table 8 The performance of fault diagnosis of the N-sigma, MD and DT ap­
Anomaly detection performance of the top three parameters of A2; sorted by proaches are compared through the use of classification metrics and a
sensitivity s.
confusion matrix. The labeling method is same as that used in the case of
Condition parameters s α [times/ β [times/ δ dataset A1. The averaged performance metrics over 10 independent
hour] hour] [days]
trials are summarized in Table 9. DT has greatest recall, accuracy, and F1
Pressure of the crossover 0.927301 0.052017 57.929581 0.7639 score, as compared to other methods; the precision of DT is almost same
pipe (x21) as that of N-sigma. Therefore, it can be said that DT has more accurate
Pressure of upstream of the 0.821639 0.061042 59.154932 0.7639
low-pressure bypass (x23)
diagnostic performance, as compared to the other methods. This
Pressure of the hot reheater 0.818417 0.050691 59.112680 0.7639 matches with the facts found in Fig. 18. However, the gaps of the
outlet line (x24) diagnostic metrics between DT and N-sigma are not dramatic, as
compared to the results in Fig. 18. This is because 1) some samples might
be wrongly labeled due to the absence of exact label information and 2)
successfully. Furthermore, greater error lies in the output of the test
the number of normal samples is much greater than that of faulty ones.
period. In Fig. 19b, the black line is the critical function. As you can see,
Fig. 20 describes the predicted labels for x21; in the case of MD, a health
the critical function exists over the training and validation points; this
index is plotted in place of the residual. MD mainly misclassifies the test
illustrates that false alarms can be diminished. Specifically, the residual
samples as normal. Though DT and N-sigma have similar prediction
of the test data increases gradually, crossing the critical function.
results, the false alarm rate of DT is smaller than N-sigma when
Therefore, it can be validated that the dynamic threshold determined by
considering the training and validation samples. From the model
the critical function can trigger valid alarms.
employed in Fig. 18, confusion matrices of those three methods are
calculated in Fig. 21. Likewise, for the results of case A1, the

16
J.U. Ko et al. Expert Systems With Applications 189 (2022) 116094

(a) Output and residual results of EDAE

(b) Critical function of DT

Fig. 19. Results of EDAE-DT for x21: (a) output and residual results; (b) critical function of DT.

joint probability distribution of the residual and EDAE’s output. By

Table 9 doing so, false alarms are significantly minimized, as compared to the
Averaged diagnostic performance of 10 trials for dataset A2. comparative methods. From the two case studies, the following contri­
Metrics Precision Recall Accuracy F1 score butions are confirmed:
N-sigma 1.000 0.967 0.999 0.983
MD 0.006 0.003 0.984 0.004 1) The proposed ensemble denoising auto-encoder (EDAE) approach
DT 0.997 1.000 1.000 0.999 can model the normal data successfully through its denoising task
and its ensemble technique. The denoising task makes EDAE robust
against noise, and the ensemble technique can improve the recon­
classification performances of DT and N-sigma are similar to each other. struction performance. Among different four architectures, EDAE of
Also, MD mainly predicts fault samples as normal, which denotes that its 3 layers has a superior modeling performance than other auto-
valid alarm rate is very small. encoders.
2) A novel threshold called dynamic threshold (DT) is developed to
5. Conclusion minimize false alarms in anomaly detection. By employing the joint
probability distribution between the output of a model and the re­
This paper proposes an ensemble denoising auto-encoder-based dy­ sidual, a variable threshold is set that satisfies the confidence limit
namic threshold (EDAE-DT) for anomaly detection of a steam turbine according to the input variation. The validation results show that the
system. EDAE can model the characteristics of the normal condition
well, and DT can calculate a time-varying threshold by considering the

17
J.U. Ko et al. Expert Systems With Applications 189 (2022) 116094

(a) N-sigma

(b) MD

(c) DT
Fig. 20. Predicted label for x21, as determined by the diagnostic methods; (a) N-sigma; (b) MD; (c) DT.

proposed threshold generates much fewer false alarms, as compared In future research, the proposed method will be validated with other
to conventional methods, and alerts valid alarms faster than experts. power plant data. Also, to broaden the applicability of the proposed
3) A sensitivity is newly defined from DT to find the condition param­ method, this method will be applied to other systems, like wind turbines.
eters related to an anomaly. As a result, after an anomaly is detected,
sensitive parameters can be identified. It is discovered that the most CRediT authorship contribution statement
sensitive parameter, determined by the proposed sensitivity,
matches with the true abnormal-related parameter. This can be Jin Uk Ko: Conceptualization, Methodology, Formal analysis,
helpful for the operators by localizing an area for inspection. Writing – original draft, Writing – review & editing. Kyumin Na:
4) To quantitatively validate the anomaly detection performance, three Conceptualization, Supervision, Writing – original draft. Joon-Seok Oh:
performance metrics are newly defined. By using those metrics, it is Investigation, Validation, Data curation. Jaedong Kim: Investigation,
possible to quantitatively express the false alarm rate, the valid alarm Validation, Data curation. Byeng D. Youn: Conceptualization, Project
rate, and the difference between the detection times by an anomaly administration, Funding acquisition, Supervision, Writing – review &
detection method and by experts. editing.

18
J.U. Ko et al. Expert Systems With Applications 189 (2022) 116094

(a) N-sigma (b) MD (c) DT

Fig. 21. Confusion matrices of the diagnostic methods for dataset A2; (a) N-sigma; (b) MD; (c) DT.

Declaration of Competing Interest Lee, G., Jung, M., Song, M., & Choo, J. (2020). Unsupervised anomaly detection of the
gas turbine operation via convolutional auto-encoder. In IEEE International
Conference on Prognostics and Health Management (ICPHM) (pp. 1–6). IEEE.
The authors declare that they have no known competing financial Likas, A., Vlassis, N., & Verbeek, J. J. (2003). The global k-means clustering algorithm.
interests or personal relationships that could have appeared to influence Pattern Recognition, 36(2), 451–461.
the work reported in this paper. Liu, X., Lu, S., Ren, Y., & Wu, Z. (2020). Wind turbine anomaly detection based on
SCADA data mining. Electronics, 9(5), 751. [Link]
electronics9050751
Acknowledgement López, M. A. A., Flores, C. H., & Garcı́a, E. G. (2003). An intelligent tutoring system for
turbine startup training of electrical power plant operators. Expert Systems with
Applications, 24, 95–101.
This work was supported by the R&D project ‘Intelligent Digital Lu, C., Wang, Z.-Y., Qin, W.-L., & Ma, J. (2017). Fault diagnosis of rotary machinery
Power Plant (IDPP)’ of Korea Electric Power Corporation (KEPCO) (No. components using a stacked denoising autoencoder-based health state identification.
R17GA08). Signal Processing, 130, 377–388.
Lutz, M.-A., Vogt, S., Berkhout, V., Faulstich, S., Dienst, S., Steinmetz, U., … Ortega, A.
(2020). Evaluation of anomaly detection of an autoencoder based on maintenace
Appendix A. Supplementary data information and scada-data. Energies, 13(5), 1063.
Lv, H., Chen, J., Pan, T., & Zhou, Z. (2020). Hybrid attribute conditional adversarial
denoising autoencoder for zero-shot classification of mechanical intelligent fault
Supplementary data to this article can be found online at [Link] diagnosis. Applied Soft Computing, 95, 106577. [Link]
org/10.1016/[Link].2021.116094. asoc.2020.106577
Montavon, G., Orr, G., & Müller, K.-R. (2012). Neural networks: tricks of the trade (Vol.
7700): Springer.
References
Mousavi, M., Moradi, M., Chaibakhsh, A., Kordestani, M., & Saif, M. (2020). Ensemble-
based fault detection and isolation of an industrial Gas turbine. In 2020 IEEE
Arranz, A., Cruz, A., Sanzbobi, M., Ruiz, P., & Coutino, J. (2008). DADICC: Intelligent International Conference on Systems, Man, and Cybernetics (SMC) (pp. 2351–2358).
system for anomaly detection in a combined cycle gas turbine plant. Expert Systems IEEE.
with Applications, 34(4), 2267–2277. Neill, S. P., & Hashemi, M. R. (2018). Fundamentals of ocean renewable energy: Generating
Bergstra, J., & Bengio, Y. (2012). Random search for hyper-parameter optimization. electricity from the sea. Academic Press.
Journal of Machine Learning Research, 13. Nelson, L. S. (1984). The Shewhart control chart—tests for special causes. Journal of
Bloch, H. P., Singh, M., & Singh, M. P. (2008). Steam turbines. McGraw-Hill Professional Quality Technology, 16(4), 237–239.
Publishing. Nisbet, R., Elder, J., & Miner, G. (2009). Handbook of statistical analysis and data mining
Chaibakhsh, A., & Ghaffari, A. (2008). Steam turbine model. Simulation Modelling Practice applications. Academic Press.
and Theory, 16(9), 1145–1162. Qian, Q., Qin, Y., Wang, Y., & Liu, F. (2021). A new deep transfer learning network based
Chen, J., Li, J., Chen, W., Wang, Y., & Jiang, T. (2020). Anomaly detection for wind on convolutional auto-encoder for mechanical fault diagnosis. Measurement, 178,
turbines based on the reconstruction of condition parameters using stacked 109352. [Link]
denoising autoencoders. Renewable Energy, 147, 1469–1480. Que, Z., & Xu, Z. (2019). A data-driven health prognostics approach for steam turbines
Chen, T.-L. (2009). Real-time turbine maintenance system. Expert Systems with based on xgboost and dtw. IEEE Access, 7, 93131–93138.
Applications, 36(4), 8676–8681. Scott, D. W. (2015). Multivariate density estimation: Theory, practice, and visualization.
Dhini, A., Kusumoputro, B., & Surjandari, I. (2017). Neural network based system for John Wiley & Sons.
detecting and diagnosing faults in steam turbine of thermal power plant. In 2017 Shewhart, W. A. (1931). Economic control of quality of manufactured product: Macmillan
IEEE 8th International Conference on Awareness Science and Technology (iCAST) (pp. And Co Ltd, London.
149–154). IEEE. Snoek, J., Larochelle, H., & Adams, R. P. (2012). Practical bayesian optimization of
Friswell, M. I., Penny, J. E., Garvey, S. D., & Lees, A. W. (2010). Dynamics of rotating machine learning algorithms. arXiv preprint arXiv:1206.2944.
machines. Cambridge University Press. Stetco, A., Dinmohammadi, F., Zhao, X., Robu, V., Flynn, D., Barnes, M., … Nenadic, G.
Fujiyama, K., Nagai, S., Akikuni, Y., Fujiwara, T., Furuya, K., Matsumoto, S., … (2019). Machine learning methods for wind turbine condition monitoring: A review.
Kawabata, T. (2004). Risk-based inspection and maintenance systems for steam Renewable Energy, 133, 620–635.
turbines. International Journal of Pressure Vessels and Piping, 81(10-11), 825–835. Van der Maaten, L., & Hinton, G. (2008). Visualizing data using t-SNE. Journal of machine
Gehring, J., Miao, Y., Metze, F., & Waibel, A. (2013). Extracting deep bottleneck features learning research, 9.
using stacked auto-encoders. In IEEE international conference on acoustics, speech and Willmott, C. J., & Matsuura, K. (2005). Advantages of the mean absolute error (MAE)
signal processing (pp. 3377–3381). IEEE. over the root mean square error (RMSE) in assessing average model performance.
Goodfellow, I., Bengio, Y., Courville, A., & Bengio, Y. (2016). Deep learning (Vol. 1). MIT Climate Research, 30, 79–82.
press Cambridge. Yang, D., Karimi, H. R., & Sun, K. (2021). Residual wide-kernel deep convolutional auto-
Guo, S., Liu, P., & Li, Z. (2016). Inequality constrained nonlinear data reconciliation of a encoder for intelligent rotating machinery fault diagnosis with limited samples.
steam turbine power plant for enhanced parameter estimation. Energy, 103, Neural Networks, 141, 133–144.
215–230. Zeng, X. J., Yang, M., & Bo, Y. F. (2020). Gearbox oil temperature anomaly detection for
Kordestani, M., Saif, M., Orchard, M. E., Razavi-Far, R., & Khorasani, K. (2019). Failure wind turbine based on sparse Bayesian probability estimation. International Journal
prognosis and applications—A survey of recent literature. IEEE transactions on of Electrical Power & Energy Systems, 123, 106233. [Link]
reliability. ijepes.2020.106233
Kordestani, M., Samadi, M. F., & Saif, M. (2020). A new hybrid fault prognosis method
for MFS systems based on distributed neural networks and recursive bayesian
algorithm. IEEE Systems Journal, 14(4), 5407–5416.

19
J.U. Ko et al. Expert Systems With Applications 189 (2022) 116094

Zhang, W., Peng, G., Li, C., Chen, Y., & Zhang, Z. (2017). A new deep learning model for Zhao, R., Yan, R., Chen, Z., Mao, K., Wang, P., & Gao, R. X. (2019). Deep learning and its
fault diagnosis with good anti-noise and domain adaptation ability on raw vibration applications to machine health monitoring. Mechanical Systems and Signal Processing,
signals. Sensors, 17(2), 425. [Link] 115, 213–237.
Zhang, Y., Li, X., Gao, L., Chen, W., & Li, P. (2020). Intelligent fault diagnosis of rotating
machinery using a new ensemble deep auto-encoder method. Measurement, 151,
107232. [Link]

20