Anomaly Detection in Gas Turbines Using Outlet Energy Analysis with Cluster-Based Matrix Profile

Abstract

Gas turbines play a key role in generating power. It is really important that they work efficiently, safely, and reliably. However, their performance can be adversely affected by factors such as component wear, vibrations, and temperature fluctuations, often leading to abnormal patterns indicative of potential failures. As a result, anomaly detection has become an area of active research. Matrix Profile (MP) methods have emerged as a promising solution for identifying significant deviations in time series data from normal operational patterns. While most existing MP methods focus on vibration analysis of gas turbines, this paper introduces a novel approach using the outlet power signal. This modified approach, termed Cluster-based Matrix Profile (CMP) analysis, facilitates the identification of abnormal patterns and subsequent anomaly detection within the gas turbine engine system. Significantly, CMP analysis not only accelerates processing speed, but also provides user-friendly support information for operators. The experimental results on real-world gas turbines demonstrate the effectiveness of our approach in the early detection of anomalies and potential system failures.

1. Introduction

One of the main features of Industry $4.0$ [1] is its capacity of gathering real-time operational data. These data can be mined to extract normal or abnormal operation patterns, which can be used to undertake condition monitoring of any industrial process. Therefore, maintenance is a basic task deeply related to the machines’ status, which can be determined by a continuous condition-monitoring process [2]. Predictive maintenance tries to prevent machine failures in advance, usually through the diagnostic analysis of operational data. The diagnosis process commonly involves anomaly detection, which leads to the performance optimization of the machine operation.

Industrial gas turbines are used in several industrial sectors as mechanical power engines, such as in power plants, aerospace, transportation, or off-shore platforms [3]. In this context, gas turbines’ maintenance and performance improvement are key components in industries.

In real-world pattern-recognition applications, the ability to detect and report novel or abnormal events in data are of paramount importance. Due to the broad nature of this task, several other terms with similar meanings have been employed across a range of disciplines, including anomaly detection, intrusion detection, fault detection, condition monitoring, and outlier detection [4,5]. While the specific terminology may vary, the underlying goal remains consistent: to identify and isolate patterns that deviate from the norm and that may indicate a potential threat, fault, or anomaly. Diagnostic process can be performed by a data-driven approach or a model-based approach. In this article, we follow a data-driven approach.

Data-mining techniques have been widely employed across a range of domains to extract relevant knowledge from large datasets, in order to support informed decision-making processes [6]. In particular, increasing attention has been directed towards the application of data-mining techniques for knowledge extraction from time series data—i.e., an ordered set of observations recorded over time pertaining to a particular phenomenon and measured across a defined time span [7,8].

Machine learning is a rapidly evolving research area that provides a suite of algorithms and methods for use in data mining. However, many of these algorithms struggle to effectively analyze temporal and sequential data. In contrast to the natural ordering of time series data, where the likelihood of an observation occurring at a given point in time is influenced by past observations, machine learning algorithms often assume independent and identically distributed data [9]. This can limit their ability to effectively model and interpret time series data. Furthermore, data labeling represents a significant challenge in real-world time series projects, which often require extensive retroactive analysis. In many cases, these tasks are unsupervised, meaning that the data are unlabeled, and the algorithm must identify meaningful patterns and relationships on its own.

The Matrix Profile (MP) technique is a powerful tool for identifying patterns and anomalies in large, complex datasets, particularly in time series data. Compared to other techniques, MP methods offer several unique advantages. For example, the MP is highly scalable, making it ideal for analyzing massive datasets. It is also domain-agnostic, with the length of a subsequence being the only parameter specified by the application programmer. Furthermore, the MP procedure allows for parallel computing and gradual updating, among other advantages [9,10].

In addition to its remarkable efficiency and scalability, the MP possesses numerous other outstanding qualities, making it an extremely versatile technique. One of its most-important features is its extraordinary generality. It is also robust, scalable, simple, and parameter-free [11,12,13,14,15]. Additionally, the MP is space-efficient, an anytime algorithm, and incrementally maintainable [16,17]. The MP algorithm eliminates the need for a similarity threshold or distance to be set by the user, as it achieves constant time complexity in the subsequence distance [18,19]. Moreover, the MP is deterministic in its execution and can be efficiently executed on hardware.

Usually, the MP technique is applied to vibration data gathered from gas turbines [20,21,22,23]. In our proposed approach, we used only the outlet energy signal for the anomaly detection, aiming to simplify the interpretation of the possible discords, i.e., a possible anomalous subsequence or pattern, by the end-user. On the other side, we introduce a Cluster-based Matrix Profile (CMP) algorithm to improve the computational time of MP execution. The use of just one prototype for each cluster of points instead of all the points, at each possible discord, substantially reduces the computational cost spent by the algorithm.

This study aims to discover motifs and discords in time series data collected from a gas turbine [24] using the proposed CMP technique. The remainder of this article is structured in the following manner: Section 2 will outline the definition of the MP method for time series, and specifically for anomaly detection, both mathematically and conceptually, to provide the basis for the new proposed CMP method. Furthermore, other time series discord detection methods are reviewed. In Section 3, a detailed description of our proposed CMP is presented. Section 4 comprises the experimental setup of our gas turbine case study and the results of the work, while Section 5 summarizes the key findings of the study and highlights their significance.

2. Background

In this section, the use of the MP technique in time series, and especially for times series anomaly detection, will be analyzed. Furthermore, the MP method will be detailed and its algorithmic formulation will be introduced. Finally, other time series discord-detection methods will be reviewed, as those techniques have become the most-used methods in time anomaly detection.

2.1. Matrix Profile

In this subsection, we will explore how the MP is applied to time series. We will first discuss its use within time series, followed by a deeper examination of its significance for detecting anomalies within them. In addition, the intricacies of the MP method and its algorithmic underpinnings will be analyzed, providing a comprehensive understanding before moving on to other commonly used time series discord-detection methods.

2.1.1. Matrix Profile in Time Series

A time series motif refers to a repeated pattern within an unlabeled time series and is critical in many data-mining tasks [24]. Conversely, a discord is a subsequence in a time series that differs significantly from other subsequences and is often an indicator of anomalous behavior [25]. The MP is a recently developed data-driven time series pattern-discovery method that records and annotates the location (index) and distance to the nearest neighbor of each subsequence of a time series [26]. This information can be used to identify time series motifs and anomalies, or time series discords, which are frequently used in time series data mining [27,28,29,30].

While the Fourier transform, wavelet transform, and ARIMA models are also used for time series analysis, these techniques may not be as effective or versatile as MP methods when handling complex, large-scale datasets.

The versatility and scalability of the MP technique make it a valuable tool for a wide range of time series data-mining tasks [14,15,27,31,32]. Its applications span diverse domains, such as website user data analysis [33], medical diagnostics [34], music analysis [35,36], and critical business applications [37,38]. In particular, the technique has found extensive use in domains such as finance, healthcare, weather, and sensor data analysis. Thanks to their scalability and efficiency, MP algorithms are well-suited for analyzing large-scale datasets, including streaming data and big data.

2.1.2. Matrix Profile for Time Series Anomaly Detection

Time series discord detection aims to identify anomalies over time. The MP technique can detect unusual patterns in time series, enabling the identification of unexpected events or deviations from the norm in diverse applications such as sensor data analysis, network intrusion detection, and financial time series analysis [26,27].

Moreover, motif discovery is an important task that provides valuable insight into the underlying structure and behavior of time series. This approach has been successfully applied to many problems in various domains, including medicine, motion-capture, robotics, and video surveillance. MP methods are highly effective at analyzing more-complex time series primitives, such as semantic segmentation [39], time series chain discovery [40], and snippet extraction [41], and finding predictive patterns in weakly labeled data [42]. This area of research is active and continues to evolve.

While there are alternative methods for discovering these primitives, the MP is highly efficient regardless of subsequence length or dimensionality, making it a valuable attribute in comparison to other algorithms, which often suffer from the curse of dimensionality [28,29,43].

In time series analysis, the tasks of discord detection and motif discovery are crucial, and the MP is a highly effective technique, which has been extensively reviewed and demonstrated to be effective in identifying anomalies (discords) and recurring patterns (motifs) in time series data. It offers an efficient and effective means of identifying unusual patterns and behaviors in time series data [30,42,44].

2.1.3. Matrix Profile Method

Throughout this section, the terminology and definitions for the MP technique are introduced [26,42].

 Definition 1 

(Time series). A sequence of real-valued numbers called a time series $T\in {\mathbb{R}}^n$ is defined as the equation $T=\left[t_1,t_2,\cdots ,t_n\right]$, where n is the length of the time series T.

In our research, focus is put on similarities between local regions of a time series. A local region of a time series is called a subsequence.

 Definition 2 

(Subsequence). The term $T_{i,m}\in {\mathbb{R}}^m$ refers to a subsequence of length m in time series T, which is a sequence of m contiguous elements beginning at position i and ending at position $i+m-1$ in time series T.

Sliding a window of size m across a time series allows us to extract all its subsequences. It is called the all-subsequence set.

 Definition 3 

(All-subsequence set). The all-subsequence set $\mathit{A}$ of a time series T consists of the subsequences of T ordered in the following way:

$$\mathit{A}=\left\{T_{1,m},T_{2,m},\cdots ,T_{n-m+1,m}\right\}$$

where $T_{i,m}$ is represented by ${\mathit{A}}_i$.

In this definition, the all-subsequence set is just notational. Since this would require a significant amount of time and memory, we do not extract subsequences in this form in our implementation. It is possible to compute the distance between any subsequence from a time series and the rest of the sequences in an all-subsequence set. These distance data are stored in a vector called a distance profile (see Figure 1):

 Definition 4 

(Distance profile). A distance profile $D\in {\mathbb{R}}^{n-m+1}$ is a vector that represents the distances between a given query $Q=T_{i,m}$ and every other subsequence in the all-subsequence set:

$$D_i^T={dist(T_{i,m},T_{j,m})}_{j=1}^{n-m+1}$$

where $dist(·,·)$ denotes the Euclidean distance between the z-scores of two subsequences.

It is important to note that the query sequence and all-subsequence set are not required to come from the same time series. By definition, when both the query subsequence and the all-subsequence set belong to the same time series T, their distance profiles must be zero at the query location and near zero before and after. The literature refers to these matches as trivial matches [29], which are avoided by ignoring an exclusion zone (shown as a grey region in Figure 1) of length $m/2$ before and after the query location. As a general rule, the distance values in the exclusion zone are set to infinity. A time series distance profile aims to identify a subsequence’s nearest neighbor, except for trivial neighbors.

As a result, a subsequence $T_{j,m}$ is the nearest neighbor of a subsequence $T_{i,m}$ if $dist(T_{i,m},T_{j,m})=min\left(D_i^T\right)$ and a subsequence $T_{j,m}$ is a trivial nearest neighbor of $T_{i,m}$ if $dist(T_{i,m},T_{j,m})=min\left(D_i^T\right)$ and $|i-j|\le m/2$. Now, it is possible to formalize the Matrix Profile as follows.

 Definition 5 

(Matrix Profile). A Matrix Profile ${\mathit{P}}^T\in {\mathbb{R}}^{n-m+1}$ of a time series T is composed of a vector of distances between each subsequence $T_{i,m}$ and its nearest nontrivial neighbors:

$${\mathit{P}}^T={n{n}_{nt}\left(D_i^T\right)}_{i=1}^{n-m+1}$$

where $n{n}_{nt}\left(D_i^T\right)$ represents the minimal distance between $T_{i,m}$ and its nontrivial neighbors.

Time series analysis uses the term nontrivial neighbors to refer to subsequences in the Matrix Profile that are not identical to the target subsequence. The concept of nontrivial neighbors refers to identifying patterns in a time series that are similar, but not identical, as they have some minor variations.

 Definition 6 

(Matrix Profile index). A Matrix Profile index ${\mathit{I}}^T$ is a vector that stores the index of the nearest nontrivial neighbors of each subsequence of a time series T:

$${\mathit{I}}^T={{\mathit{I}}_i^T}_{i=1}^{n-m+1},where{\mathit{I}}_i^T=jwithn{n}_{nt}\left(D_i^T\right)=dist(T_{i,m},T_{j,m}).$$

In the same way as distance profiles, Matrix Profiles can also be considered as metadata for annotating time series. Several interesting and exploitable properties exist in the profile. For example, the maximum value or the highest point of the profile corresponds to a possible anomalous subsequence (a discord) [31,45], whereas the minimal values or the lowest point correspond to the best motif subsequence pair in the series [29], and the variance can be viewed as a measure of T’s complexity. Additionally, the time series density is exactly estimated by the histogram of the values in the Matrix Profile [46]. If the query subsequence and the all-subsequence set come from different time series, the Matrix Profile and Matrix Profile index can be generalized to two time series. In this case, we refer to ${\mathit{P}}^{T_1,T_2}$ and ${\mathit{I}}^{T_1,T_2}$ as the joint Matrix Profile and Matrix Profile Index, respectively. Typically, ${\mathit{P}}^{T_1,T_2}\ne {\mathit{P}}^{T_2,T_1}$, and ${\mathit{I}}^{T_1,T_2}\ne {\mathit{I}}^{T_2,T_1}$. Figure 2 shows the Matrix Profile of time series T.

Summarizing, the MP method can be described algorithmically as follows (Algorithm 1).

Algorithm 1 Matrix Profile.

Input: T, a time series of length n             m, the length of the subsequence/pattern Output: $P^T$, the Matrix Profile begin $\hspace{1em}{D}^T\leftarrow ⌀$                   ▹ Initialize the distance matrix  for $i\in 1,\cdots ,n-m+1$ do      for $j\in 1,\cdots ,n-m+1$ do          $D_i^T(i,j)\leftarrow Euclidean\_Distance(T_{i,m},T_{j,m})$    ▹ Distance profile for $T_{i,m}$      end for      $D^T\leftarrow D^T+D_i^T$                ▹ Update the distance matrix  end for $\hspace{1em}{P}^T\leftarrow ⌀$                      ▹ Initialize the Matrix Profile  for $i\in 1,\cdots ,n-m+1$ do      $P_i^T\leftarrow Min\_Distance\_n{n}_{nt}\left(D_i^T\right)$          ▹ Find nearest neighbor  end for  $P^T\leftarrow P^T+P_i^T$                         ▹ Matrix Profile  return $\left(P^T\right)$  end

Based on the Matrix Profile algorithm, the usual K discord computation is as follows (Algorithm 2).

Algorithm 2 K discords’ computation.

Input: T, a time series of length n            m, the length of the subsequence/pattern            K, the number of discords Output: $Discords\left(K\right)$ in the time series T for a given subsequence of length m begin  $P^T\leftarrow MatrixProfile($T,m)                ▹ Compute the Matrix Profile  $Ord{P}^T\leftarrow DescendantSorting\left(P^T\right)$  $Discords\left(K\right)\leftarrow K\_Max\left(Ord{P}^T\right)$  return $\left(Discords\right(K\left)\right)$ end

2.2. Other Time Series Discord Methods

In the area of anomaly detection, time series discords have become some of the most-effective and -competitive methods. Discords in time series are the most-unusual time series subsequences that are maximally different from any other subsequence in the same series. This term was introduced by [25]. The primary purpose of time series discords is to detect anomalies over time. Time series discords can be identified using several algorithms, each of which uses different techniques for measuring the distance or dissimilarity between subsequences and for identifying the most-anomalous subsequences [47,48]. In addition to the MP method, here are a few examples:

• HotSAX is an algorithm that detects discords in time series data. By using Symbolic Aggregate Approximation (SAX), each subsequence is converted into a sequence of symbols, which are then compared to determine where the discord lies [25,49,50,51].
• iSAX uses a hierarchical approach to symbolization, allowing for faster and more-efficient detection of discords than HotSAX [51,52].
• Data discords can also be detected using deep learning techniques such as Convolutional Neural Networks (CNNs) and Long Short-Term Memory (LSTM) networks [53]. An anomalous pattern can be flagged as a discord by these models, which are trained to detect patterns in the data [54,55,56].
• Weighted Anomaly Thresholding (WAT) is another algorithm that uses weighted moving averages to detect anomalies in time series data. Data points that fall outside of a certain threshold are identified by computing a moving average of the time series [57,58,59,60].

Time series discords can be detected using MP and iSAX, but their approaches and performances differ. As for time complexity, iSAX has an $O(nlogn)$ complexity, whereas MP has an $O\left(n\right)$ complexity. Additionally, MP is more robust to noise compared to iSAX because it uses a sliding window approach, while iSAX relies on a symbolization technique, which can be sensitive to small fluctuations in the data. The MP is also scalable, as it can handle datasets of varying lengths and resolutions, versus iSAX’s fixed-length subsequence requirements. Furthermore, the MP has fewer parameters and a simpler output format than iSAX, making it generally easier to use. Due to its symbolization technique, iSAX can be difficult to interpret, whereas the MP provides a clear and understandable output. The MP algorithm has a time complexity of $O\left(n\right)$ and is suitable for larger datasets, whereas the HotSAX algorithm has a time complexity of $O(nwlogn)$, where n is the length of the time series and w is the length of the subsequences being compared. The iSAX algorithm has a time complexity of $O(nlogn)$.

Concerning the approach, the MP is a statistical and mathematical approach to detecting discords in time series data. To accomplish this, it uses a sliding window and distance measures. While Artificial Neural Networks (ANNs) employ a model-driven approach, using a trained model to predict discords, WAT is a statistical approach that uses a weighted moving average to discover anomalies. When compared to WAT and ANNs, the MP emphasizes data-driven discord identification and makes use of a sliding window and distance measures.

Furthermore, the MP algorithm is more robust to noise than other algorithms like HotSAX, iSAX, and WAT. This is because the MP utilizes a sliding window approach to compute distance measures that are less influenced by noise. On the other hand, HotSAX and iSAX both rely on symbolization techniques, which can be sensitive to small fluctuations in the data, making them more prone to noise. WAT uses a weighted moving average, which is easily affected by outliers and fluctuations in the data, making it more sensitive to noise than MP.

As far as scalability is concerned, the MP algorithm can be applied to datasets with various lengths and resolutions, making it more appropriate for data that may be irregular or sparse in real-world applications. In terms of scalability, the MP algorithm is a scalable approach that can be applied to datasets with varying lengths and resolutions, making it more suitable for real-world applications where the data may be irregular or sparse. However, HotSAX and iSAX require fixed-length subsequences and may not be so scalable in these cases. Additionally, ANNs are computationally expensive and require many data to train, even though they can detect anomalies accurately. Meanwhile, WAT is applicable to datasets of varying lengths and resolutions, but requires several parameters to be tuned for optimal results. As a result, the MP is more scalable and requires fewer parameters to be tuned, making it an effective approach for detecting discords in time series.

As for interpretability, the MP algorithm is known for providing an interpretable output, which can be used to understand the structures and patterns in data. By using an MP plot, the discords and their locations are clearly displayed. In contrast, iSAX is based on a symbolization technique, which can be difficult to interpret. Moreover, Neural Networks are black box models, so understanding their predictions can be challenging. Nevertheless, WAT provides clear and interpretable output in the form of anomalies, but MP’s plot is highly useful for identifying discords and locating them in time series data.

Given the advantages mentioned above, the present study employed the MP approach as a basis for our new proposed method to detect discordance in time series data as a result of simplicity, robustness to noise, scalability, and interpretability.

3. Cluster-Based Matrix Profile Methodology

The Matrix Profile has two primary components: a distance profile $D_i^T$ and a Matrix Profile index ${\mathit{I}}^T$. The distance profile is a vector that represents the minimum z-normalized Euclidean distances between any subsequence within a time series and its nearest neighbors. In practice, the Matrix Profile will only store the smallest non-trivial distance from each distance profile, thereby significantly reducing the spatial complexity to $O\left(n\right)$. Its first nearest neighbor index appears in the profile index where the most-similar subsequence resides. Matrix Profiles are calculated with sliding windows. With m as the window size, the algorithm is as follows: A windowed subsequence is compared with the entire time series to calculate its distance. The distance profile is updated with minimal values, and the first nearest neighbor index is set. A distance calculation occurs $n-m+1$ times, where n shows the length of the time series and m shows the window size [26].

In real-world datasets, not all anomalies are of equal importance. Despite some anomalies being indicative of critical issues or deviations from expected behavior, others might be relatively benign minor fluctuations. By focusing on identifying the most-relevant and -impactful anomalies, instead of overwhelming analysts with hundreds, it is possible to improve the quality of the analysis.

Detecting anomalies in various domains is an essential task, and one critical variant of the problem is the top K discord detection. An algorithm aims to identify those anomalies within datasets that are most significant or impactful. The parameter K denotes this, where K is a user-defined parameter. These anomalies are often those that deviate the most from the expected or normal patterns within the dataset. The challenge lies in efficiently selecting and presenting these K anomalies to provide actionable insights to users. In this paper, we introduce an innovative approach to Optimal Discord Detection, which diverges from the conventional pursuit of simply identifying the top K discords. Our method revolves around a refined emphasis on optimizing the selection and presentation of these paramount anomalies. Our method employs clustering techniques to identify closely related anomalies, reducing redundancy, and subsequently, employs nearest neighbor methods to pinpoint the exact data points within the Matrix Profile that correspond to these highly impactful anomalies. The core objective of our approach is to provide more-meaningful and -interpretable results.

At the heart of our methodology lies a crucial insight: as the user-defined parameter, denoted as K, is increased, the Matrix Profile often yields a growing number of closely located index points. These points exhibit remarkably similar patterns, occasionally differing by only a single data point within the original dataset sub-series. The conventional Matrix Profile approach typically treats each of these closely related points as individual discord candidates, potentially overwhelming users with a multitude of closely related anomalies.

To overcome this challenge, we introduce a systematic process that commences by grouping these closely located points in Matrix Profile into clusters. This clustering step effectively consolidates related anomalies, resulting in a more-coherent representation of the underlying data characteristics. Subsequently, we deploy a center-based clustering algorithm to identify representative cluster centers, which serve as proxies for the remaining Matrix Profile’s index points within each cluster.

What distinguishes our innovation is the utilization of these cluster centers as foundational elements for discord detection. Leveraging nearest neighbor methods, we precisely pinpoint the exact data points within the Matrix Profile that correspond to these centers, introducing them as our discerning discord index points. Significantly, our approach grants users the flexibility to choose K by their preference, as the clustering process inherently determines the optimal number of discord candidates. This alleviates the need for users to specify K in advance.

This novel approach empowers users to efficiently detect anomalies in time series data, providing them with a refined, intuitive, and efficient tool. Notably, our “optimal discord detection” method not only delivers the option to choose K, but also ensures that the selected K represents the most-representative discord points within the Matrix Profile.

Our proposed approach can be described by the following algorithm (Algorithm 3).

Algorithm 3 Optimal Discord Detection method.

Input: T, a time series of length n             m, the length of the subsequence/pattern Output: $P^T$, the Matrix Profile                 $TopKDiscords$, The Matrix Profile top K discords begin  $60<K_0<200$  $Threshold\leftarrow 110$  $n\leftarrow 10$  $P^T\leftarrow MatrixProfile($T,m)               ▹ Compute the Matrix Profile  for $i\in 1$ to $K_0$ do      $M_i\leftarrow \mathrm{Max}(P^T,i)$                  ▹ Find the K discords in $P^T$  end for  $M\leftarrow M+M_i$                       ▹ Update the cluster centers  $C^n\leftarrow \mathrm{Clustering}\left(M\right)$                      ▹ Apply clustering  $Ord{C}^n\leftarrow DescendantSorting\left(C^n\right)$  $OptimalDiscords\leftarrow C^0$  for $i\in 1,\cdots ,n$ do      if $C^i-C^{i-1}>Threshold$ then          $OptimalDiscords\leftarrow \mathrm{FindNearestNeighbor}(P^T,C^i)$      end if  end for  return $\left(OptimalDiscords\right)$ end

4. Experimentation and Results

This section covers our experiments and their outcomes. First, we describe the dataset we used and the tools we employed in Section 4.1 “Experimental Setup”. Then, in Section 4.2 “Results”, we present our findings.

4.1. Experimental Setup

In this section, we will go over the specifics of our experimental setup. We will detail the datasets we used and the software and hardware configurations we set up. This provides clarity for our results.

4.1.1. Dataset

The proposed methodology was tested on a dataset acquired from a medium-sized power gas turbine owned by Siemens Industrial Turbomachinery (SIT). Due to confidentiality constraints, this dataset is not available for disclosure. To monitor the gas turbine’s behavior, sensors were strategically placed at various locations to gather the data. Given the importance of detecting transient effects in operational modes, it is essential that datasets have a minimum duration of one minute. In the context of an industrial gas turbine, numerous valuable signals are present. In this study, a dataset with a one-minute sample time, denoted as $\mathit{X}\in {\mathbb{R}}^{n\times d}$, was examined. This dataset comprises n = 23,000 data points, equivalent to nearly 16 days, and includes the Turbine Outlet Energy (TOE) signal—the energy emitted from the turbine, with $d=1$. These data were incorporated into the system as a time series T.

A gas turbine generates mechanical power by initially compressing air (or another fluid) in a compressor, followed by fuel combustion in the combustor. This process elevates the temperature, facilitating the expansion of the fluid through a turbine, which, in turn, produces energy. The respective components are illustrated in Figure 3. Toward the conclusion of the process, both temperature and pressure are concurrently diminished, culminating in the transfer of mechanical power to the intended application [61].

4.1.2. Software and Hardware

In order to implement this method, Python 3 [63] was used along with libraries like numpy [64], pandas [65], scikit-learn [66], matplotlib [67], seaborn [68], and scipy [69] for data analysis. Additional libraries called stumpy [70] and matrixprofile [71] were used for motif discovery and anomaly recording. The hardware used to run the software was the SageMaker by Amazon Web Services (AWS), version $2.199.0$, (Frankfurt, Germany), with 16 CPUs and 64 GiB.

4.2. Results

In addition to finding the motif in the TOE’s time series data, the MP construction also helps with finding the anomaly present in the TOE. Operation patterns that are similar and have low values in the MP are termed motifs, whereas those exhibiting high values and being dissimilar are termed anomalies. We will, therefore, be able to detect anomalies accurately and efficiently using the proposed method. The proposed method is simple and easy to implement. Below, the procedure for detecting anomalies in the proposed method is described.

On the above-mentioned dataset, which is also displayed in Figure 4, experiments with different motif lengths (m) were conducted. As shown in Figure 5, Figure 6, Figure 7 and Figure 8, firstly, we have a sample dataset with red and green shades showing the motifs detected for the indicated window size, and then, we have an MP in which the dots indicate where the patterns started. The third plot illustrates the zoomed-in patterns detected, and the fourth plot illustrates the density of the data at that point by a violin plot. For instance, Figure 5 and Figure 6 both depict processes transitioning from high to low values during operation. The detailed view in the zoomed-in plot, along with the violin plot, clearly shows how these two patterns align. In contrast, the operational mode in Figure 7 shifts from a low to a high value. Furthermore, the mode of operation in Figure 8 progresses beyond the patterns observed in Figure 5 and Figure 6, eventually reaching higher values. Additionally,

Table 1. Summary of using motif discovery for different time window sizes.

Window Size	Motif Index	Nearest Neighbor	Operation Pattern
1440	4555	8870	High_Low
2880	7872	3557	High_Low
4320	0	9765	Low/Middle_High
5760	7614	3312	High_Low_High

displays the motif discoveries for different window sizes and the corresponding indexes of similar patterns, as well as their behavior according to the operation mode.

In order to obtain a better idea of what we are dealing with, the raw data is provided in Figure 4. It may be possible to see some patterns in the data visually, but let us imagine what would happen if there were more than 16 days’ worth of data or if we looked at the values for the whole year. Without some type of transformation, it would be pretty difficult to visualize what is happening. The MP method will be calculated over different window sizes in order to discover any interesting pattern.

Now, we will focus on the CMP within the 24 to 96 h windows, as there are some evident discords (peaks on the plots). First, to find discords, we utilized our CMP algorithm. In the CMP, the top K discords refer to the K most-anomalous or unusual sub-series within a time series. Thus, the top K discords represent the sub-series with the lowest similarity scores, indicating their distinct dissimilarity. These are particularly useful in time series analysis and anomaly detection, as they assist in identifying patterns and events that differ from the usual.

The plots in Figure 9, Figure 10, Figure 11 and Figure 12 show the top optimal discords through the Matrix Profile with red stars and the red pattern in the corresponding time series. Our analysis indicates that they are optimal because, as the parameter K is increased, the number of close index points in the Matrix Profile increases, but they are so close together that they show the patterns being so similar and perhaps just a one-point difference between their original points in the dataset sub-series. Figure 13 is provided for better understanding.

To avoid unnecessary discord index points in the Matrix Profiles, we propose a new algorithm, namely the CMP. This algorithm initially groups close points together and, then, separates unrelated points using a center-based clustering algorithm. Subsequently, the center of each cluster is used as a representative for the other points within that cluster. After identifying the cluster centers, we employed the nearest neighbor methods to precisely locate the exact points in the Matrix Profile, introducing them as discord index points. The number of clusters was also used to determine an optimal discord number. Consequently, regardless of the chosen value of K for detecting discords, the system will automatically select the optimal number. In our analysis, various values of K were evaluated, but we ultimately selected 101 for the system. This choice ensured a sufficiently large K to prevent potential discords in the dataset from being missed.

Table 2. Discord detection results for different window sizes.

Window Size	Number of Discords	Discord Index	Operation Pattern
1440	2	6698 9181	High Middle
2880	2	18,819 19,648	Low Low_Upper low
4320	2	18,094 18,213	Upper low_Low Low_Upper low
5760	1	12,384	High_Middle_High_Low

presents the results of an analysis conducted on the aforementioned time series data, employing various window sizes to identify discords. The table details the number of discords, their indexes, and their associated operational patterns for each window size. The columns represent the “window size” in minutes, the “number of discords” identified, the “discord index”, and the “operation pattern”. The latter describes the behavior of the time series data at each discord’s location. These operation patterns, or discords, were readily identifiable as anomalies due to their stark contrast to the operational mode labels of their vicinity. These operational modes represent the states of the gas turbine process. The operational mode labels were derived through an automatic data-driven approach based on an ensemble of clustering methods [72], further validated by gas turbine process experts. The results indicate that the number and characteristics of the detected discords are influenced by the window size used in the analysis. For instance, smaller window sizes (1440 to 4320 min) identified two discords each, exhibiting simpler operational patterns like “High”, “Middle”, “Low”, and variations of “Low”. In contrast, the largest window size (5760 min) detected only one discord, but with a more-complex pattern (“High_Middle_High_Low”). Smaller window sizes tend to identify more-discrete and less-complex anomalies, while a larger window size may consolidate multiple anomalies into a single, more-complex detection or indicate fewer anomalies. While the window size certainly affects the number and complexity of detected discords, each result can be meaningful and useful for different aspects of discord analysis. For example, a smaller window size may be useful in identifying more, short-term anomalous patterns, while a larger window size may be more appropriate for identifying longer-term trends and patterns. The choice of the window size ultimately depends on the goals and requirements of the specific analysis, and it is important to choose an appropriate window size to obtain meaningful results that meet the needs of the analysis. This information is crucial for understanding the operational dynamics of the system under study such as gas turbines.

5. Conclusions

This study introduced a novel methodology for anomaly detection in gas turbines, specifically targeting the Turbine Outlet Energy (TOE) signal. Our study utilized a one-minute sample time dataset from a medium-sized power gas turbine, demonstrating the proficiency of the Cluster-based Matrix Profile (CMP) method in detecting anomalies in the TOE’s time series data. The CMP approach demonstrated its ability to distinguish between normal operational patterns and anomalies, showcasing its effectiveness in accurate and efficient anomaly detection. By using Matrix Profile construction, the methodology can identify both motifs and anomalies, based on their similarities and value patterns in the time series data. This ability is important for the early detection of potential issues in turbine operation and operational settings, allowing for more-accurate predictions and maintenance scheduling, thereby enhancing the overall efficiency and safety of gas turbine operations. The method’s simplicity and straightforward implementation further contribute to its practical applicability in real-world settings. Moreover, the study’s exploration of discord detection using the CMP method and the top K discords algorithm illuminates the ability of the system to identify the most-significant anomalous sub-series within a dataset by optimizing detection through center-based clustering and nearest neighbor methods. Our experiments validated the CMP method’s efficacy in identifying anomalous patterns across various window sizes. These findings underline the method’s versatility and adaptability to different operational contexts and data scales. The anomaly detection results were corroborated by gas turbine process experts, further attesting to the practical applicability and reliability of the CMP method in real-world scenarios. The proposed CMP method stands out for its simplicity and ease of implementation, making it an accessible tool for practitioners in the field. This creates new opportunities for exploring more-complex datasets and operational scenarios, potentially extending its application beyond gas turbines to other industrial processes.