Formalize the anomaly detection problem in the feature evolution time series, [T ₀, T) represents the observation window of the observed event. In general, it can be assumed that T ₀ = 0. Each feature F uses a continuous time stamp sequence T _u = t ₁, …, t _n . X _t−T:t ∈ R ^M×(T+1) represents the observation sequence X _t−T , X _t−T+1, …, X _t . y ̂ and y represents the predicted value and the true value. L represents the loss function. In the problem of time series anomaly detection, past historical observations are very important for understanding and capturing the dynamic patterns in the current data stream. We use the observation sequence X _t−T:t to calculate the anomaly score of X _t . Given X = x ₁, …, x _N , where N is the length of the vector x. The observation x _t is the N-dimensional vector x t = [ x t 1 , … , x t N ] and X ∈ R ^M×N at time t(t ≤ N). According to the past historical observation data X _t−T:t , the problem of anomaly detection in vibration time series data of hydraulic turbine unit is formally defined as follows.

Problem: Given the historical observation sequence represented by the time series in the order given as X _t−T:t , where t is the current time point, report an anomaly score for a given current data point X _t instantly at any time.

LSTM is a kind of deep recurrent neural network. It is widely used in time series. LSTM realizes the memory function in time through the opening and closing of the door. It can effectively solve the problem of gradient disappearance and gradient explosion in general situations. The key is to introduce a gating unit system. The system stores historical information through the internal memory unit-cell state unit. Different gates can make the network know when to forget historical information, when to update cells status dynamically. Cells are cyclically connected to each other, instead of hidden units in the general cyclic network. If the input gate sigmoid allows new information input, its value can be added to the state. The state unit has linear self-circulation. Its weight is controlled by the forget gate. The output of the cell can be closed by the output gate. The status unit can also be used as an additional input for the gating unit. f t = σ w f ∗ C t − 1 , Z t , h t − 1 + b f (1) i t = σ w i ∗ C t − 1 , Z t , h t − 1 + b i (2) C t = f t ∗ C t − 1 + i t ∗ R E L U w c ∗ Z t , h t − 1 + b c (3) o t = σ w o ∗ C t , Z t , h t − 1 + b o (4) h t = o t ∗ R E L U C t (5)

Here f, i, o, h, C, c, w, Z, b, σ() respectively represents forget gate, input gate, output gate, hidden state vector, unit state vector, weight matrix, feature vector, bias vector and sigmoid function. In this paper, we select to use LSTM due to the following features: 1) it is able to support end to end modeling; 2) it is easy to incorporate exogenous; 3) it is powerful in feature extraction for vibration time series data of hydraulic turbine unit.

This paper propose to combine LSTM and conditional quantile regression to model explicitly temporal dependencies and stochasticity in vibration time series data of hydraulic turbine unit. The overall structure of QRNN consists of two parts: 1) offline training 2) online anomaly detection. As shown in Figure 2, the proposed neural network is composed of two recurrent neural networks, such as the LSTM encoder and predictor-detector network. It can be considered as f = pd(e(h _t , (x,y) _t )) where f is the predicted scores, x _t and y _t are the input variables, h _t is the encoder state, e(.) is an encoder and pd(.) is the predictor-detector network. The LSTM encoder is trained to extract useful temporal and non-linear patterns contained in vibration time series data, which can be used to guide the predictor-detector network of anomaly detection. If exogenous variables are available, they can get concatenated with extracted feature vectors from the LSTM encoder and used as input to the predictor-detector network. The predictor-detector network consists of an LSTM and dense layers for output prediction. The training process can be carried out daily training according to business needs, such as once a week or once a month. The offline part is composed of preprocessing sub-module (shared by online and offline modules) and start-up sub-module. The online part consists of real-time detection and update sub-modules. The data is preprocessed in the preprocessing module. The data is divided into sequences through a sliding window of length T. The startup module builds the model and deploys it to memory after training, testing, and verification. The fitted model can now perform real-time anomaly detection. In streaming or online settings, new observations after preprocessing (such as X _t at time t) can be sent to the detection module and provide anomaly scores. If the abnormal score of X _t is lower or higher than the abnormal threshold, X _t is marked as abnormal. The update of sub-module will update the parameters of each operation in QRNN db. The overall structure is shown in Figure 1.

QRNN is composed of LSTM encoder and prediction-detector network. The network can essentially be regarded as a large neural network, expressed as f = pd(e(h _t , (x,y) _t )), where f is the prediction score, x _t and y _t are input variables, h _t is the state of the encoder, e(.) is the ana encoder, and pd(.) is the prediction-detection network. The trained LSTM encoder can extract useful time and nonlinear dynamic patterns contained in the heterogeneous time series of feature evolution. These patterns can be used to guide the prediction-detection network to perform anomaly detection.

If exogenous variables are available, they can be connected with the feature vector extracted from the LSTM encoder and used as input to the predictor-detector network. This is because in reality, it is not necessary to observe all the content needed to predict the output through the input. After the LSTM encoder network is trained, the output from the last cell state is sent to the prediction-detection network. This is also the training prediction score evolution data stream y ̂ t + M : t = p d ( h t − T , X t + M : t ) , where h(.) is the hidden coding state, as shown in Figure 3. The proposed QRNN prediction-detection network consists of an LSTM layer and a fully connected output prediction layer. The last dense layer is modeled as three outputs and three loss functions. One for the desired fitting model. The other two are used to guide the upper and lower bounds of forecast uncertainty estimates. It is worth noting that the total loss is calculated as the sum of individual quantile losses. And the output is all quantile predictions of different quantile values defined by τ ∈ [0, 1].

QRNN is an anomaly detector based on prediction. The anomaly detection depends on the quality of the predicted value. When predicting normal data, the probability distribution of the error can be calculated, and then used to find the maximum posterior probability estimate of the normal behavior of the test data. In order to predict more accurately, it is necessary to set thresholds for the upper and lower bounds. Beyond this threshold, data points can be marked as abnormal, as shown in Figure 4. In the deep learning regression task setting, the mean square error function is the most commonly used loss function. ξ t = y t − y t ̂ (6)

Intuitively speaking, taking the negative power of the mean square error function approximates the Gaussian process whose mode corresponds to the mean parameter. Non-parametric distributions like conditional quantiles are very useful in quantifying uncertainty estimation in decision-making and minimizing risk.

The goal of Quantile regression (QR) is to estimate the conditional median or any other quantile of the distribution. It can be done by solving the following formula. min ξ ∈ R ∑ ρ r y i − ξ (7) Where the function ρ _r (.) is the tilted absolute value function that yields the τth sample quantiles. To obtain an estimate of the conditional median function, we replace the scalar ξ by the parametric function ξ(x _i , β), which can be formulated as a linear function of parameters. min β ∈ R ∑ ρ r y i − ξ x i , β (8)

Quantile regression learns to predict the conditional quantiles y ̂ τ t + 1 : M | ( X t − T : t , τ ) for the given target distribution via formula (9), in which y ̂ τ ( . ) is the predicted value at the given quantile. P y ̂ t + 1 : M ≤ y ̂ τ t + 1 : M = τ (9)

We focus on putting weights to the distances between points on the distribution function and the fitted regression line based on the selected quantile. We select to use QR due to it has the following key features: 1) It does not make any distribution assumption on the error; 2) QR can describe the outcome variable of the entire conditional distribution; 3) QR is more robust to outliers and setting errors of the error distribution; 4) QR can expand the flexibility of parametric and non-parametric regression methods.

We set τ ∈ [0, 1] to generate the predicted value y _t+1:M with the smallest reconstruction error ξ, as shown in the formula (6) in the predictive detector network. And calculate the quantile loss of a single data point by formula (10). Because we needed a complete conditional distribution rather than a point estimate of uncertainty estimation, the average loss function L(.) on a given data distribution can be defined by formula (11), where f ^W (x _t ) is the fitting model under the given quantile τ, y _t and x _t are true values. L ξ t | τ = τ ξ t i f ξ t ≥ 0 τ − 1 ξ t i f ξ t < 0 (10) L y t , f W x t τ = 1 L ∑ t = 1 L L y t , f W x t | τ (11)

In the case of a loss function, the prediction-detector network is modeled as three outputs and three loss functions, with the lower quantile, the median (fitting model) and the upper quantile. At τ = 0.5, the loss function will estimate the median value instead of the average value. With the upper quantile and the lower quantile, a reliable uncertainty estimate can be provided for forecasting.

It needs to be considered that during the operation of the turbine, the data update of each subsystem arrives in the form of a stream over time. This may include updates to existing features, or new features, as shown in Figure 1. Generally, a time series may have endogenous variables (for example, the output is a function of the previous output), or may not have exogenous variables that are not affected by other variables in the system. But the output depends on it. Most work ignores exogenous variables. But in order to improve quality and improve anomaly detection, this article introduces exogenous variables. When performing anomaly detection on the time series of various hydraulic turbines, sometimes there may be patterns that were not previously available. It deviates greatly from the training model. This may be a training data set observed in a specific mode. In general, it requires that each time a new data set is reached, the entire process of training the model must start from the beginning. For hydraulic turbine time series fault detection models, training the entire model requires a large amount of data sets and a large amount of time. In actual situations, it is impractical to keep training the model with the arrival of new data. In order to solve this problem, an online incremental update scheme is needed to provide threshold and model updates. QRNN can receive previously unavailable characteristics or evolved data points for learning, without starting from scratch, so as to mark abnormal data points and update model parameters in real time, as shown in formula (12) and (13), where th _up and th _lo are the upper and lower thresholds of the abnormal score calculated by the selected quantile, α1 and α2 are the higher and lower bounds, respectively, and f ̂ ( . ) is the fitted model at the corresponding quantile (τ = 0.5 corresponds to the median). t h u p = f ̂ x t τ = α 2 (12) t h l o = f ̂ x t τ = α 1 (13)

Based on the conditional quantile regression, with the emergence of a new data set, the confidence of the model parameter distribution will be automatically updated. The threshold value will be incrementally updated, as described in the loss function above. With this setting, QRNN can perform anomaly detection in vibration time series data of hydraulic turbine unit.

Figure 5 shows the overall algorithm of QRNN. For preprocessing, offline training, evaluation, testing and detection is performed. The fitted model f ̂ ( . ) is loaded into memory ready for anomaly detection which is performed in formula (12) and (13). After the traversal is completed, the fitted model is saved to QRNNdb. QRNN is design to operate with multiple settings depending on whether exogenous features are present. During fitting, different processing needs to be performed according to whether the exogenous feature (XF) is existed. During this procedure, LSTM encoder can be used as feature extractor. Upon the arrival of vibration time series data of hydraulic turbine unit, the proposed QRNN will predict its value and seamlessly flag its anomaly score. At the same time, the model parameters will be updated. The prediction, model updates and abnormal scoring can be completed in a single pass at O(1) time complexity.