2.1. KDD process

KDD process was exposed by ^{Fayyad, Piatetsky-Shapiro, Smyth, and Uthurusamy (1996)}. This procedure is developed on 5 steps that allow the discovery of knowledge, starting with raw data and ending with practical knowledge (^{Ristoski & Paulheim, 2016}). The process is shown in Figure 1.

Figure 1 Overview of the KDD process. 

2.2. Description of data types supplied by the protection system of a hydroelectric power plant

Currently, HPP have a digital protection system that monitors the operation of the mechanical and electrical components of the system to react to anomalous situations or failures. In case of eventuality, these protection systems activate some protection functions, which have a logic implemented that allows them to determine whether they should enter an alarm state or issue a trip order that initiates a stop sequence of the generation unit (^{Carreño-Pérez, Morales-Rivera, & Rivas-Trujillo, 2019}).

As shown in Figure 2, the mechanical protection system monitors and protects mechanical equipment using electronic devices called PLC’s (Program Logic Control), the actions and records of these devices are displayed through SCADA (Supervisory Control and Data Acquisition). On the other hand, the electrical components are monitored and protected by digital relays, which in case of a fault, activate specific protection functions for the type of fault, these actions are registered in the SOE (Sequence Of Events), which is a binary register that gives information on the electrical and mechanical protection functions that were activated during the fault (^{Penin, 2007}).

Figure 2 General architecture of the protection system from the Amaime Colombia HPP. 

In this way, the information provided by a hydroelectric protection system for the identification of faults is divided into the records presented by the SCADA (mechanical components) and the relay (electrical components) that contain both the analog variables records and the binary variables contained in the SOE.

Therefore, the records from the SCADA and the relay provide categorical data (binary) and quantitative data (analog) which are divided as follows:

Alarms: categorical data, indicates that the component associated to the sensed variable is in a state that represents a potential danger to the operation of the plant (this does not generate a system stop sequence).

Trips: categorical data, are states where the measured variables exceed a set value, this set value is critical and represents a danger to the operation of the system, for this reason, a stop sequence of the generation system is performed.

Analog records: quantitative data measured by the different sensors installed in the system elements (Temperature, pressure, vibration, current, voltage, etc.), which are stored in the SCADA and the relay.

3.1. Data selection

A brief description is made about the hydroelectric power plant, in such a way that it allows us to understand the structure of the available data and, therefore, facilitate its selection.

The Amaime HPP is listed as a small hydroelectric power station since its operating range is below 20 MVA, it has two turbo generator groups, each consisting of a Francis type turbine and a salient pole synchronous generator with a power of 11.56 MVA.

Each turbo generator group consists of subsystems with specific functions. Figure 3 shows the mechanical elements associated to the generation process and the subsystems that support its operation.

Figure 3 Subgroups of mechanical components of the generation system, image taken from the SCADA System. 

The subsystems presented in Figure 3 have a series of sensors installed, which allow monitoring and recording the state and behavior of the different components associated to the mechanical system.

The mechanical variables associated to the bearings, lubrication and pressure system are presented in Table 1, as well as the abbreviation that will be used to refer to these variables in this article.

Once all the analog variables that make up the turbo generator group have been identified, the historical records of these variables are selected.

With this, the selection of the data set is completed and the data mining technique to be used will be selected, which should allow the records to be separated into groups with similar behaviors.

Having defined the data group, the next step is the preprocessing of the available information.

3.2. Data set preprocessing

The preprocessing begins with the search of the records of variables that present anomalous or missing data, as observed in Table 2. where 3 randomly chosen records are shown, among which one presents a missing data. After locating this data, the interpolation function shown in (1) is used to replace the anomalous value or complete the missing value.

The use of this equation in this process is valid since the sampling rate of data are 5 seconds and during this time interval there are no significant changes in the variables of the mechanical process, because the changes in the variables of these systems are too slow and occurs in minute intervals. From the above, a linear behavior of the variables between nearby records can be assumed (^{Devore, 2016}).

Dataset records were adjusted by searching and deleting records when the system is out of service to avoid having fault records that do not exist, for this, histograms such as the one presented in Figure 4 were used, in which it is evidenced that the monitored variable “Accumulator oil pressure” (AOP) indicates a value of pressure zero when the system is out of operation, this could be interpreted by the protection system as a failure.

Figure 4 Histogram of the Accumulator Oil Pressure (AOP) variable. 

In Figure 5 the histogram of the filtered variable (AOP) is shown. This procedure was repeated with each of the variables that make up the data set.

Figure 5 Histogram of the Accumulator Oil Pressure (AOP) variable without records of the system out of service. 

3.3. Data transformation

In this step the adjusted data is transformed to a format that can be processed by some data mining algorithm. For this, it was decided to transform the numerical data of the records into categorical data containing information on the status (ok, alarm, trip) of each component.

In this first transformation, the setting parameters of the protection functions presented in Table 3 were used, which allow to determine the state of an element of the system.

With the settings presented in Table 3, the numerical values of the variables are compared with the set values. Depending on this comparison, each record assumes a state, i.e. When the value of a variable reaches the alarm set value (value T1 in Figure 6) its status changes to "alarm".

Figure 6 Example of protection function of temperature. 

Thus, the data set like that presented in Table 4, which provides information on the state of the system variables is obtained.

Now, the information of interest is focused on the records of the variables in a failure situation, therefore, a filter is done to eliminate the rows that exhibit the normal system behavior (rows without tripping), For this reason, the applied filter removes all rows without presence of trip states.

After filtering, a data set which exclusively contains categorical records in fault states (rows with tripping), e.g. the fragment of records shown in Table 5. The examples shown are only a fraction of the total records, because the volume of records obtained is high and it is not possible to show it in the document.

At this point, the registers have an easy to understand structure, where the state of each variable in the evaluated failures is known., however, it still does not have the format required to apply the selected data mining technique, since the clustering requires that the data be numerical to calculate the distances between the records.

To achieve that, a new table was constructed where each variable is divided into the states that it can assume (ok, alarm, trip), creating for each variable in table 5 at least three new variables in Table 6. After this new classification, for each state of the variables it must be specified whether it is active or not, in this way, the value “1” indicates that the variables are active in that state and the value “0” indicates that the variables are not active in that state. thus obtaining, the data set presented in Table 6, in which it is observed that variables such as “AOP” can assume 5 different states, but only one at a time.

At this point, the data transformation process is completed.

3.4. Data mining implementation

In the data mining process, it was decided to use hierarchical clustering with the distance function based on the Jaccard index and the "Ward.D" clustering method.

The Jaccard index is a method used in agronomy to determine the similarity between two ecosystems based on the species they present in common (^{Soler, Berroterán, Gil, & Acosta, 2012}). This method measures the similarity between two groups, regardless of the type of variable that governs them (^{Real & Vargas, 1996}), since it calculates the cardinality of the intersection of the two sets and then divides it by the cardinality of the union of both groups as shown in (2).

Next, the number of clusters is specified using the elbow method (^{Garcia et al., 2018}), which allows determining a point where the increase in the number of groups does not generate a significant change in cohesion or relationship between the centroids of each group and on the elements within each group. In the present case study, the estimate of the optimal cluster number is presented in Figure 7.

Figure 7 Relation between distance and numbers of clusters. 

In it is observed that after cluster number 8 the cohesion between the elements of each group stop increasing, and the cohesion between the centroids of each group ceases to decrease significantly, this indicates that the optimal cluster number is 8.

Once the optimal cluster number is determined, the hierarchical clustering is carried out, implementing a pruning of the dendrogram at K = 8, this results in the distribution presented in Figure 8.

In Figure 8 each division between nodes represents the groups that are formed according to the relationship between the data, in addition, the length of the vertical axis represents the cohesion between the clusters of the same node.

The dendrogram presented in Figure 8 allows to verify that the number of clusters supported by the elbow method is correct, since the distances in the branches after pruning are small compared to the distances before pruning.

Figure 8 Hierarchical cluster distribution (Distance function Jaccard, grouping method Ward D2). 

After performing the Clustering, the group label is assigned to each of the records presented in Table 5, thus obtaining Table 7 in which the sampled data set for training is presented.

3.5. Evaluation and interpretation of failure cases.

In the evaluation and interpretation process, the clusters obtained after the data mining process are analyzed, with the aim of verifying if the correct clustering was performed.

Next, in Table 8 a fragment of the registers that make up cluster 3 is presented, in which a pattern in the behavior of the signals is observed, composed of a high pressure trigger in the AOP variable and alarm signals in some other variables, however, one record has a different behavior (record in yellow, table 8), since it presents a low pressure trip, which is a significantly different behavior from the real fault. This means that the record must be removed from this group and subsequently reassigned to the cluster that best represents it.

The behavior verification process must be carried out on each of the generated clusters, with the aim of correcting the records that could be poorly classified.

After analyzing each of the clusters and adjusting the classification of the records, the interpretation of each of the obtained patterns were made, thus the Table 9 is generated, in which a characteristic pattern of each cluster is presented.

The characteristic pattern of the types of failure presented in Table 9, was determined by extracting the state with the highest frequency of each of the variables contained in the records of each cluster.

To carry out the interpretation of each of the clusters present in Table 9, it is necessary to correlate the knowledge about the configuration of the plant and the types of failure that may occur, it is recommended at this point to consult a specialist in fault identification in HPP that corroborate the type of failure that each cluster represents.

At as a result of this process, Table 10 is obtained, in which each of the type of failure (cluster) showed in the Table 9 is presented with their corresponding interpretation. The information given in the interpretation of Table 10 should be as detailed as possible.

Therefore, the type of failure that each cluster represents and the variations in the signals for each cluster (example in Table 8) define the behavior that the protection system of the HPP can show these failures are presented. This information is called a training data set.