Blended Filter-Based Detection for Thruster Valve Failure and Control Recovery Evaluation for RLV

Abstract

Security enhancement and cost reduction have become crucial goals for second-generation reusable launch vehicles (RLV). The thruster is an important actuator for an RLV, and its control normally requires a valve capable of high-frequency operation, which may lead to excessive wear or failure of the thruster valve. This paper aims at developing a thruster fault detection method that can deal with the thruster fault caused by the failure of the thruster valve and play an emergency role in the cases of hardware sensor failure. Firstly, the failure mechanism of the thruster was analyzed and modeled. Then, thruster fault detection was employed by introducing an angular velocity signal, using a blended filter, and determining an isolation threshold. In addition, to support the redundancy management of the thruster, an evaluation method of the nonlinear model-based numerical control prediction was proposed to evaluate whether the remaining fault-free thruster can track the attitude control response performance under the failure of the thruster valve. The simulation results showed that the method is stable and allowed for the effective detection of thruster faults and timely evaluation of recovery performance.

1. Introduction

The successful flight of Colombia in 1981, the first space shuttle of the United States, pioneered the partial reuse of a space launch vehicle [1]. However, it had high launch costs and a long preparation period. Applying the learning experience from this shuttle mission [2], NASA implemented the second-generation reusable launch vehicle (RLV) research program. At present, X-37B has been successfully launched several times, with the longest orbiting flight time of 718 days [3], demonstrating a breakthrough in RLV technology.

As a new type of aerospace flight vehicle, the effects of system failure caused by various actuators, sensors, or system components are of more concern to researchers. Statistics from the Federal Aviation Authority (FAA) and the National Transport Safety Board (NTSB) show that among the flight accidents over the past decade, hardware and system failure were the main cause of loss-of-control during flight [4]. Considering the harsh aerospace environment and the complexity of aerospace tasks, there is a call for intelligent fault tolerance control that can handle component faults and does not increase hardware complexity, cost, and mass [5].

RLV reentry usually relies on the thruster to supplement the aerodynamic actuator for attitude control. Specifically, during orbit, deorbit, and initial reentry phase, the thruster is the main actuator for the attitude control of the RLV.

Currently, the pulse width modulation (PWM) method [6,7] is mainly used for thruster control in spacecraft. When a duty cycle of a thruster is modulated using this method, the thruster can be considered as a continuous actuator. Its advantage lies in the application of the continuous multivariable control method to the RLV’s attitude control. However, the PWM method requires a thruster that is capable of high-frequency operation, which may lead to excessive wear of the thruster valve. In addition, the PWM duty cycle of the thruster system is subject to a certain practical limit [8].

One common approach to detect and isolate spacecraft thruster faults is to install pressure, temperature, and electrical sensors on the thrusters. The use of these additional sensors makes the fault detection and isolation quite simple and robust, as these sensors can assist in the direct detection of thrust. However, the need for additional sensors adds to the complexity, mass, and volume requirements of the spacecraft. This type of system is used, for example, on NASA’s space shuttle orbiter [9]. When such extensive sensing is unavailable, an online fault diagnosis approach for thrusters can play an emergency role in the cases of hardware sensor failure or work as a supplementary reference for online monitoring [10].

A maximum-likelihood-based approach was proposed in the literature [11,12] to detect leaking thrusters for the space shuttle orbiter’s reactive control system jets; the soft failure was used to designate a fuel or oxidizer leak in a vehicle reactive control system jet. For the fuel leak, it only described the state in which one valve was open and the jet did not fire, but it did not consider the fuel leak after valve wear and other valve failure cases. In the literature [13,14], fault detection and isolation methods were developed based on the exponentially weighted recursive least squares estimation using an accelerometer and angular rate sensors. A neural network then provided adaptive control reconfiguration to multiple destabilizing hard and soft thruster faults. However they did not provide an analysis of the failure caused by thruster valves, or, more particularly, the impact of thruster failure caused by valve performance degradation on the RLV or spacecraft. A nonlinear fault detection observer was designed in literature [15] to realize active fault tolerance tracking and RLV attitude control, combined with adaptive sliding mode technology, by the actuator redundancy. However, the fault detection observer was assumed to be idealized and less affected by the sensor noise and disturbances. In the literature [16], a velocity-free nonlinear proportional-integral control allocation scheme was provided for the fault-tolerant attitude control of flexible spacecraft under thruster redundancy. A uniform actuator fault model was established, but the system states before and after the fault were not considered; moreover, the noise signals that approximate the control input were also not regarded, leading to an output error from the model. The literature [17] proposed a sliding mode observer with an equivalent output injection to reconstruct external disturbances and actuator faults and developed a sliding mode-based attitude controller using an exponential reaching law. The exponential reaching law relies on the state of the system and the corresponding formation of the estimated parameters, although in the theoretical design process, the authors described the partial failure of the thruster using the thruster fault modeling. However, it could not detect faults under low thrust conditions due to the thruster leakage in the simulation verification process. The simulation results also showed that the fault detection time frame of the designed sliding observer was more than 6 s. In literature [18], an observer-based fault-tolerant controller was constructed such that the states of the resulting closed-loop systems were uniformly and ultimately bounded in the presence of model parameter uncertainty, external disturbances, time-varying input delay, actuator faults, and actuator saturation. However, the controller gain matrix and observer gain matrix were required to be designed for satisfying the results of the uniformly and ultimately bounded system. This method helped in dealing with several problems at the expense of optimal control performance in different situations, and the fixed gain of the observer did not consider the requirements of specific fault detection such as false alarm rates, fault detection rates, and fault detection time.

Literature [19] showed that any motion-based fault detection and isolation is reliant on the accuracy of the measurement data used, thus, great care has been taken here to obtain highly accurate angular and translational acceleration estimates from the gyros and accelerometers. The motion-based method presented in this work was used and extended in this research.

Unlike previous studies, in this study, the failure of thruster valves, including valve wear and leakage failure in addition to valve jams and difficulty in closure, was investigated. We proposed a detection solution for the failures based on motion state estimation with particular consideration of the noise that affects the RLV operation in initial reentry, on-orbit, and de-orbit phase, which is caused by electromagnetic radiation in near-Earth space [20]. In this paper, a physical filter was used in combination with a Kalman filter to suppress the input interference of the approximate control of the thruster valve, enhance the consistency of physical input and algorithm model input, improve the accuracy of motion state estimation, and thereby improve the fault detection rate.

The paper aims at developing an online thruster fault detection method that can handle thruster valve failure and does not increase more hardware complexity or cost.

Firstly, the failure of thruster valves under different working conditions was analyzed, and the thruster model caused by valve failure was established.

Then, on the basis of the thruster model, a motion-based blending filter fault detection method is proposed. The blending filter was used to estimate the thruster state and suppress the noise signals that approximate the control signal. The fault detection was conducted by comparing the variance-based function of the observed output in a certain time window with the threshold.

Finally, based on the thruster redundancy, a nonlinear model-based numerical control prediction method is proposed to evaluate whether the remaining fault-free thruster can track the attitude control response performance under thruster valve failure, and conducted for longitudinal attitude control as an example.

2. Blending Filter-Based Thruster Fault Detection

2.1. Equations and Model

Ignoring the installation gap error of the thruster, the following can be assumed:

• The RLV can be treated as an ideal rigid body and any elastic vibration can be ignored;
• The dynamic characteristics of the navigation system can be ignored, and the feedback state of the vehicle can be regarded as the ideal state.

For longitudinal attitude control, it can be assumed that $\beta \approx 0,\varnothing \approx 0$, and, ignoring the earth’s rotation, the flight dynamics equations [21] can be written as follows:

$$\{\begin{array}{l}\dot{\mathit{h}}=V\sin (\theta -\alpha )\\ \dot{\mathit{V}}=-\frac{D}{m_b}-\frac{\mu \sin (\theta -\alpha )}{r^2}\\ \dot{\mathit{\alpha }}=q-\frac{L}{m_{b}V}+\frac{(\mu -V^{2}r)\cos (\theta -\alpha )}{V^{2}r}\\ \dot{\mathit{\theta }}=q\\ \dot{\mathit{q}}=\frac{\mathit{M}}{I_y}\end{array},$$

(1)

where $h$ is the altitude of the flight vehicle, $V$ is the velocity, $\alpha$ is the angle of attack (AoA), $\theta$ is the pitch angle, $q$ is the pitch rate, $m_b$ is the mass of the flight vehicle, L and D are the lift force and drag force, respectively, $\mu$ is the product of the gravitational constant and the mass of the Earth, $r$ is the distance from the flight vehicle to the center of gravity, $I_y$ is the moment of inertia, and M is the pitch moment that is the input and is induced by the thruster.

The thruster valve is normally used to control the thrust from the thruster. When the thruster valve is open, the thrust produced by the thruster is not adjustable, so according to the thruster valve switching state, the fault-free thruster has only two states: normal-rated thrust and no thrust. The mathematical description of this can be written as follows:

$$F_i=\{\begin{array}{l}0,U=0\\ F,U=1\end{array},$$

(2)

where F is the normal rated thrust of the thruster, U is the switch command of the thruster valve that represents the control input, 0 is the command to turn off the thruster valve, and 1 is the command to turn on the thruster valve. In this paper, the control signal refers to the physical signal corresponding to the switch command of the thruster valve (control input).

2.2. Thruster Model Based on Valve Failure

Figure 1 shows the basic principle of the thruster. By supplying power to the coil, the electromagnet generates a magnetic force that drives the thruster valve to either switch on or off, so the fuel combines with the catalyst and, after heating, generates injection gas to provide reaction thrust to the RLV.

For this study, the possible thruster faults caused by the failure conditions of the thruster valve are:

Fault A: The thruster valve is closed; a control signal is activated to turn on the valve, but the thruster valve does not open and a pipe jam fault occurs, that is:

$$F_i\equiv 0,when\{\begin{array}{l}U(k-1)=0\\ U(k)=1\end{array}.$$

(3)

Fault B: The thruster valve is open; a control signal is applied to turn off the valve, but the thruster valve does not close and the pipeline cannot be closed, that is:

$$F_i\equiv F,when\{\begin{array}{l}U(k-1)=1\\ U(k)=0\end{array}.$$

(4)

Fault C: The thruster valve is open; after a control signal is given, the valve-closing performance of the fuel pipe attenuates so that it is not completely executed in accordance with the control signal, and the valve only partially closes, that is:

$$\{\begin{array}{l}{F}_i(k-1)=F,U(k-1)=1\\ F_i(k)=\tau F,U(k)=0\end{array},$$

(5)

where $\tau$ refers to the ratio of the incomplete closing distance to the width of the nozzle after performance degradation.

2.3. Blending the Physical Filter and Kalman Filter for Fault Detection

The Kalman filter conducts timely calculations, has a small cache space, and estimates based on sensor feedback data. In this study, we used the aforementioned filter to estimate the attitude angular rate of the RLV.

The state variables $x\in {\mathbb{R}}^n$ of the discrete time process can be estimated by the Kalman filter and can be described by the following discrete random difference equations:

$$\begin{array}{l}{x}_k=A{x}_{k-1}+B{u}_{k-1}+w_{k-1}\\ z_k=H{x}_k+v_k\end{array},$$

(6)

where the random signals $w_{k-1}$ and $v_k$ represent the process noise and observation noise, respectively. They can be assumed to be white noises and are independent of each other. Their probability density obeys the normal distribution of expectation 0, variance Q and expectation 0, variance R, respectively.

The Kalman filter comprises the prediction part based on the time series, and the correction and updating part based on the measurement feedback, wherein the prediction part is given by the following formulae:

$$\begin{array}{l}{\hat{x}}_k^{-}=A{\hat{x}}_{k-1}+B{u}_{k-1}\\ P_k^{-}=A{P}_{k-1}{A}^T+Q\end{array},$$

(7)

where ${\hat{x}}_k^{-}$ represents the forward-calculation state variables, $P_k^{-}$ is the forward-calculation error covariance, and ${\hat{x}}_{k-1}$ and $P_{k-1}$ are the initial estimations.

The measurement feedback correction formulae are:

$$\begin{array}{l}{K}_k=P_k^{-}{H}^T{(H{P}_k^{-}{H}^T+R)}^{-1}\\ {\hat{x}}_k={\hat{x}}_k^{-}+K_k(z_k-H{\hat{x}}_k^{-})\\ P_k=(1-K_{k}H)P_k^{-}\end{array}$$

(8)

where $K_k$ is the Kalman filter’s gain, $z_k$ represents the observation variables, ${\hat{x}}_k$ is the updated estimate, and $P_k$ is the updated error covariance.

In the longitudinal attitude control of a thruster, the short-cycle mode manipulation moment has a greater influence on the pitch rate. In this study, the pitch rate was used as a variable state of the fault detection and the Kalman filter was designed for the state of estimation, and combined with Equation (1). The equation of the state of the thruster longitudinal attitude fault detection can be expressed as follows:

$$q_t=q_{t-1}+\frac{M\mathsf{\Delta }t}{I_y},$$

(9)

where $q_t$ is the pitch rate at the next moment, $q_{t-1}$ is the pitch rate at the current time. The approximate interval time of the thruster control command is $\mathsf{\Delta }t$. Equation (9) is obtained using the forward Euler method. The filter can be used for the estimation of one dimensional or multidimensional random process. In Equation (6) the pitch rate is the state variables, $A=1$, $B=1/I_y$, $H$ is considered an ideal sensor gain of 1, and $u_{k-1}$ refers to the pitch moment generated during the interval time of thruster control command. In the system design, the related allowable deviation range is given for the state variable and the observation owing to the uncertainty caused by noise. Therefore, the white noise variances Q and R can be set according to the deviation range of the state variable and the observation variable.

In this study, the state estimation of the Kalman filter is combined with the physical feedback and the prediction calculation. It is used as a software algorithm that predicts a follow-up state based on the model of a current state, and it is necessary to consider the consistency between the model input and the input of the physical system. If there is an approximate control signal noise in the input of the physical system, it may lead to the following: one is that the input of the physical system will deviate from the input of the model; the other is that the input of physical system has a great influence on the sensor data generated by the actual physical system, which is then introduced into the Kalman filter for state estimation. These challenges may result in the failure of the Kalman filter to estimate the state, as shown in Figure 2.

In the RLV flight, several thruster missions, including on-orbit, de-orbit, and initial reentry, are performed in the near-earth space environment. However, electromagnetic radiation in the near-earth space environment is very complex [22]. Furthermore, the noise caused by electromagnetic induction or charging effect of the vehicle can easily interfere with the control signal [23]. However, the vehicle control input usually works within a certain frequency band. For example, the flight attitude control command period is 20 ms, the guidance command period is 100 ms, and the no-command state still sends the reference pulse based on the command period. Therefore, in this study, a bandpass physical filter was introduced and applied before the control signal input in order to suppress the approximate control signal noise. The input position of the physical filter is shown in Figure 1. The approximate control signal noise outside the frequency band, which is caused by electromagnetic radiation in space, will be suppressed after passing through the physical filter. This ensures that the state estimation performed using the Kalman filter is more accurate. A sample circuit diagram of the physical filter is shown below in Figure 3.

The filter is designed using the FilterLab 2.0 software; the passband frequency is from 10 Hz to 50 Hz, which meets the control input period.

The introduction of the physical filter improved the input consistency between the model and the physical system as shown in the simulation results given in Figure 4. Blending the physical filter and Kalman filter results in a smaller state estimation bias in comparison to the Kalman filter.

In the attitude loop, the onboard calculation period is typically in the order of several tens of milliseconds. In this paper, the residual deviation between the predicted output of the blending filter (${\hat{z}}_k$) and the sensor measurement feedback ($z_k$) was used as the observation output in each period for three types of faults, that is:

$$\begin{array}{l}{r}_k=z_k-{\hat{z}}_k\\ r_k=H{x}_k+v_k-H{\hat{x}}_k\end{array}.$$

(10)

Fault-free condition: $E[r_k]=0$, their probability density obeys the normal distribution of expectation 0, variance R.

Fault condition: $E[r_k]\ne 0$

A variance test is used for the residual evaluation for a selected time frame, and analysis; see Section 4.1.

Establishing the binary hypothesis:

H0: fault-free

H1: fault

The designed fault detection function (weighted sum of squared residuals) was:

$${\lambda }_k=r_k^T{A}_k^{-1}{r}_k,$$

(11)

where $A_k=diag({\sigma }_k^2)$, ${\sigma }_k$ are the $r_k$ group standard deviation, then ${\lambda }_k\sim {\chi }^2(m)$, m equals the dimension of $z_k$.

The fault-free was determined by:

$${\lambda }_k\le T_D.$$

(12)

The fault was detected by:

$${\lambda }_k>T_D.$$

(13)

To determine the $T_D$ according to the requirement of the system false alarm rate $P_F$:

$$P_F={\alpha }_T,$$

(14)

then,

$$P_F={\displaystyle {\int }_{T_D}^{\infty }{\chi }^2(m)d\lambda }={\alpha }_T\to T_D,$$

(15)

where ${\alpha }_T$ is the expected value.

3. Thruster Control Recovery Evaluation Based on Proposed Fault Detection

An RLV is a highly maneuverable vehicle that can implement missions of on-orbit, de-orbit, and reentry in the atmosphere. For different missions, the attitude control response needs to achieve different performances according to guidance commands, but when the working thrusters fail, the attitude control response performance will be affected. As an important actuator for an RLV, the thruster is usually designed with redundancy to ensure a safe flight. Based on the redundancy of the thruster, stopping the thruster failure and quickly selecting the fault-free thruster to recover the attitude control response performance are very helpful to improve the fault-tolerant ability of the RLV.

This section describes the nonlinear model-based numerical prediction method that was used to evaluate whether the remaining fault-free thrusters can track the attitude control response performance under the failure of the thruster valve.

The attitude control response includes the following parts:

$$\mathrm{Overshoot}\le {\sigma }_{*}\%$$

$$\mathrm{Rise}\mathrm{time}\le t_{r^{*}}$$

$$\mathrm{Settling}\mathrm{time}\le t_{s^{*}}$$

$$\mathrm{Steady}\text{-}\mathrm{state}\mathrm{error}\le e_{*}.$$

In the RLV’s longitudinal attitude loop, it has a plurality of thrusters for pitch control; the force generated by a single thruster is F, the maximum thrust generated by the thrusters is F_max, and the fault boundary of the thruster is F_hold, as shown in Figure 5.

For RLV longitudinal attitude control, the thrusters provide directional impulses in the $\pm y$-axis.

Considering the RLV’s longitudinal attitude nonlinear model from Equation (1), M represents the operating pitch moment of thrusters,

$$M={\displaystyle \sum _{i=1}^m{F}_i}{L}_d{U}_i,$$

(16)

where $F_i$ corresponds to the output of the $i^{th}$ thruster, see Equation (2), $U_i$ is the switch command of the $i^{th}$ thruster valve for two states 0 and 1. The command to turn off the thruster valve is 0, and that to turn on the thruster valve is 1. $L_d$ is the distance from the acting force to the center of gravity of the RLV.

In this study, when the fault was detected, the working thrusters were isolated and the other thrusters were employed to track the attitude control response performance. It is important to note that multiple thruster control allocation schemes may satisfy the attitude control response performance; however, minimum consumption of energy is the foremost objective for control allocation strategy:

$$\begin{array}{l}J=\min {\{\mathrm{S}}_1{,\mathrm{S}}_2,\cdots {\mathrm{S}}_n\},\\ {\mathrm{S}}_j={\displaystyle \sum _{i=1}^k\left|{\nu }_i\right|},j=1,2\cdots n\end{array},$$

(17)

where ${\mathrm{S}}_j$ represents each thruster control allocation scheme of energy consumption in a selected time frame, ${\nu }_i$ is the number of working thrusters at each control period and $J$ is the priority objective for the control allocation strategy.

An allocation scheme for thruster control that can satisfy the attitude control response of performance was determined in three steps.

The first step was to calculate the gain $K_p$ according to the required rise time after the attitude angle control command was given. The specific algorithm is as follows:

Algorithm 1:$K_p$ gain numerical calculation for rise time requirement

where $q_{cmd}$ is the pitch rate reference command, ${\alpha }_{cmd}$ is then given command of the AoA, $e_q$ is the deviation between the pitch rate reference command and the feedback, $K_p$ is the adjustment gain in the limit range $[n_1{n}_2]$ of the RLV’s pitch acceleration, ${\dot{q}}_{cmd}$ is the reference pitch acceleration, and $M_{cmd}$ is the expected control moment. RK45 is the Runge–Kutta method including Equation (1).

The second step is to calculate the control moment and identify the thruster control allocation scheme satisfying the steady-state error requirement based on Algorithm 1. The specific algorithm is as follows:

Algorithm 2: Nonlinear model-based numerical control

where $e_{\alpha }$ is the deviation between the AoA command and the feedback, $Thrs{t}_{num}$ is the remaining fault-free thruster working number, $M_0$ is the control moment from a single thruster, $\hat{M}$ is the control moment for each control period, and ${\hat{M}}_1$ is an assumed control moment. The condition of $\left|e_{\alpha }\right|\le e_{*}$, the algorithm used a circular prediction calculation by the Runge-Kutta method (RK45) to match it with ${\hat{M}}_1$ input and the flight dynamics model; ${\hat{M}}_1$ was replaced in turn from rest fault-free thruster $[-nn]$ at each cycle to find the optimized control moment.

The third step is to evaluate whether the remaining fault-free thruster that can track the attitude control response performance under the failure of the thruster valve using the nonlinear model-based numerical control prediction. The prediction flow chart is as following Figure 6:

In conclusion, the multi-thruster, from a working equivalence point of view, can be regarded as a single thruster. The upper limit of the thruster can be set, and fault detection and isolation can be conducted based on the three types of faults, with the isolation state either turned on or off for all of the types. A numerical calculation method based on a nonlinear model was used to evaluate control recovery and determine if the fault-free thruster could track the attitude control response performance following failure of a thruster valve.

4. Results

In this study, the RLV flight numerical simulation from the deorbit to the initial reentry phase was used to verify the feasibility and performance of the proposed method. The state of the vehicle in the example was as follows: the Mach number $M_a$ = 25, AoA initial state was 0°, AoA command was $\alpha$ = 40°, thrust generated by a single thruster F_i = 3.87 kN [12], distance from the moment vector to the center of gravity L_d = 26.86 m, and moment of inertia I_v = 651,470 kg·m². The nonlinear flight dynamics model in Equation (1) was employed for verification. The 1796 U.S. standard atmosphere model [24] was used in this study and the example vehicle data were comparable to the space shuttle [25].

4.1. Thruster Fault Detection

⮚

State estimation

Considering the three fault types A, B, and C, the state estimation and fault-free status comparison were made among the three fault types using the blended Kalman filter, as shown in Figure 7, Figure 8 and Figure 9.

Figure 7 depicts the state estimation of the type A fault and the fault-free state using the blended Kalman filter. The thruster valve was closed in the previous time period, with an initial pitch rate of 0°/s, and, after a command to turn on the valve was given, the fault-free thruster generated a thrust to create an incremental pitch rate, as shown in Figure 7b. Figure 7a displays the type A fault state, that is, it was turned off in the previous moment, with a pitch rate of 0°/s; no response output occurred after a thrust command was given at the latter point as the valve was stuck. As shown in the above figures, the state estimation of the blended Kalman filter was consistent with the actual data trend in the fault and fault-free conditions, and the deviation was in the range of ±0.1°/s.

Figure 8 depicts the estimations of the type B fault and the fault-free state. On the premise that the RLV had a pitch rate at the initial moment of 2°/s, the thruster valve in the previous time period was turned on, and, after a command to turn off the valve was given, the thruster should close under the fault-free state and the pitch rate should have been maintained at around 2°/s. Figure 8a displays the type B fault state, that is, after a command to turn off the valve was given, the valve was stuck and did not close. Under the condition of the above-mentioned type B fault and the fault-free state, the state estimation of the blended Kalman filter agreed with the trend of the feedback data, with a deviation within the range of ±0.1°/s.

Figure 9 displays the estimation of the type C fault and the fault-free state. As shown above, when the vehicle had an initial pitch rate of 2°/s, the thruster valve at the previous time was turned on, and, after a command to turn the valve off was given, the thruster did not completely close, indicating a type C fault. Here, it was assumed that the ratio of the valves’ incomplete closing distance to the nozzle width was $\tau =0.2$ after the performance had been attenuated under the limit conditions. As the type C fault is a small thrust-related leakage problem, the pitch rate increment will be slowly generated, as shown in Figure 9a. The pitch rate should fluctuate around the initial pitch rate of 2°/s under the fault-free state, as shown in Figure 9b. The state estimation method adopted in this paper, as mentioned above, remained consistent with the trend of the observed data, with a deviation within the range of ±0.1°/s.

⮚

Variance test

In this study, based on the above-mentioned state estimation of the blended Kalman filter, the residual deviation between the state estimation of the pitch rate and the sensor feedback in each period was compared and considered as the fault detection condition. The variance in the 3 s time window was counted; a fault could be ascertained when it was outside of the given threshold. Figure 10 shows a comparison of the residual deviation between the type A, B, and C faults and the fault-free state, respectively, and its variance in the 3 s time window was counted. As shown in

Table 1. Thruster fault detection.

Fault Type	$\mathit{D}[{\mathit{r}}_{\mathit{k}\text{-}\mathbf{group}}]$	$\mathit{m}\mathit{e}\mathit{a}\mathit{n}[{\mathit{r}}_{\mathit{k}\text{-}\mathbf{group}}]$	Fault-Free
			$\mathit{D}[{\mathit{r}}_{\mathit{k}\text{-}\mathbf{group}}]$	$\mathit{m}\mathit{e}\mathit{a}\mathit{n}[{\mathit{r}}_{\mathit{k}\text{-}\mathbf{group}}]$
A	0.067100	−0.542500	0.000062	−0.000512
B	0.127900	−0.514600	0.000064	−0.000223
C	0.010700	−0.124600	0.000026	−0.000087

, the minimum variance of type A, B, and C faults was more than 0.01, however the maximum variance of the corresponding fault-free state was less than 0.00006, therefore, a threshold which was an order of magnitude larger was selected as the decision condition to obviously distinguish the fault state from the fault-free state. In addition, the mean test data in Table 1 further shows that a significant difference exists between the mean value of fault-free residual and that of fault residual within 3 s.

⮚

False alarm rates and fault detection rates test

In this study, the process noise was zero mean white noise with a standard deviation of $Q^{1/2}$, and the standard deviation of noise changed from $1\times {10}^{-8}$ to $1\times {10}^{-3}$. Each simulation took 1000 data points, chi-square degree of freedom $m=1$, false alarm rate ${\alpha }_T$ = 5%, look-up table $T_D=3.84$. The test results for the false alarm rates are given in Figure 11.

Figure 11a shows that the false alarm rate varies from 3.5 to 6.5, suggesting that the threshold determined by the formula did not meet the requirement (${\alpha }_T=5\%$) as shown in Figure 11a. Increase the correction coefficient ${\beta }_c$, $T_{Dn}={\beta }_c{T}_D$. ${\beta }_c$ was obtained through simulation and validation calculations, which increases with 0.01 per step from ${\beta }_c=1$. For each ${\beta }_c$ test, 10,000 data points were used to verify the false alarm rates ${\alpha }_T=5\%$ And from the test, ${\beta }_c=1.15$. After correction, Figure 11b shows the false alarm rates varied between 2.5 and 5.0 and met the requirements of the 5% false alarm rate. Due to the existence of approximate control signal noise in the system, the noise is not suppressed after the extended Kalman filter (EKF) based solution is employed. As shown in Figure 11c, the false alarm rates varied from 16 to 26, and these rates are much higher than that of the blending filter solution.

Several faults are presented in this paper for the fault detection rates test. The first group was 1000 A-type faults; the second group was 1000 B-type faults; the third group was 1000 C-type faults; the fourth group contained mixed faults i.e., 1000 B-type and C-type mixed faults. The $T_{Dn}$ was used in this test and the test results are given in

Table 2. Fault detection rates test.

Fault Type	Fault Number	Miss Ratio PM (%) EKF Solution/ Blending Filter Solution	Fault Detection Rates PD (%) EKF Solution/ Blending Filter Solution
A	1000	27.40/8.40	72.60/91.60
B	1000	18.00/6.30	82.00/93.70
C	1000	32.10/12.20	67.90/87.80
B&C	1000	10.60/3.80	89.40/96.20

.

Based on the classification of class A, B, and C faults, it was easy to distinguish the fault classed based on the state of the control input of class A faults which is different from that of class B and C faults. The class B and C faults produced different thrust so the ${\lambda }_k$ from fault detection functions were different and could be classified by comparing their values. All multiple thrusters received the same control command, and the results suggest that class B and C faults can be part of the same group of control thrusters at the same time. Hence, when class B and C failures occur at the same time, the thrust generated is greater making fault detection easier. The blending filter solution has a high detection rate of A-type, B-type, B and C mixed faults i.e., at than 90%, and a good detection rate of 87.8% was obtained for type C leakage faults as they are not easy to detect as shown in Table 2. However, owing to the lack of the suppression function of approximate control signal noise, the EKF based solution showed worse performance than the blending filter solution in the fault detection rates test. The test results are shown in Table 2.

4.2. Thruster Control Recovery Evaluation

This section describes the reference response curve employed to determine whether the remaining fault-free thruster can track the attitude control response performance under the failure of the thruster valve, as shown in Figure 12.

The thruster configuration refers to the space shuttle’s data [9]. The RLV includes 38 main thrusters and 6 moving thrusters. The thruster evaluation was studied with reference only to the main thrusters. In accordance with the RLV redundancy configuration, the RLV longitudinal attitude control was configured as $\left\{-10,\dots ,-2,-1,0,1,2,\dots ,10\right\}$, where “$-$” indicates the +y-axis impulse generated.

Figure 12 shows an AoA reference response curve and the thruster operation input in the fault-free state. In the rise time period, in order to shorten the rise time and the settling time, more thrusters were needed to generate the expected thrust.

To conduct a simplified analysis of the number of operating thrusters and their operation time, as shown in Figure 12b, 1 s was taken as the unit time, assuming that a thruster was operating at full load for one second, i.e., two states including 1 s continuously turned on or 1 s continuously turned off.

Figure 13 displays the AoA step response output and thruster operation input under type A, B, and C faults and fault-free conditions. During the rise time period, as shown in Figure 13b, the thruster shows a type A fault in the period of 2–5 s and stopped operating. During this period, the blended Kalman filter was used to diagnose and isolate the faulty thruster and, based on the reference response curve, the remaining fault-free thruster was employed to evaluate the control recovery performance using Algorithm 1 and Algorithm 2. The red part in Figure 13b represents the number of thrusters and the working time for the type A fault. During adjustment of the working thruster, the AoA response was as shown in Figure 13a, and to improve the settling time after fault tolerance, both the given pitch rate and the overshoot were increased, while the pitch angle was adjusted by the controller to reach the steady-state requirement.

In the stage of the attitude angle feedback control, as shown in Figure 13d, the thruster showed a type B fault in the period of 35–39 s, the thruster was turned on at the previous time and did not close at the latter time when the command to turn off was given. The steady-state error then increased, and the controller isolated and switched over the thruster, as shown in Figure 13d. To rapidly reduce the steady-state error, the number of active thrusters was increased, and after the steady-state error was adjusted, the number of thrusters was reduced according to the principle of energy consumption optimization.

In the steady-state stage, as shown in Figure 13f, at 44 s, the two thrusters were in operation, then were closed after a command was given, but in the period of 45–48 s, the thruster was not fully closed due to a type C fault, hence, only one thruster closed. At this stage, the steady-state error increased, and a new demand for operating the thruster was given. After adjustment, the steady-state error stabilized, and the performance requirements were met, as shown in Figure 13e.

In the above cases, after the failure of a thruster valve, the remaining fault-free thrusters can satisfy the recovery control performance.

4.3. Running Time and Stability Testing of the Algorithm

This section describes the 1000 cases of random thruster valve failures and AoA command settings that were used to evaluate the running time and stability of the algorithm on the computer, as shown in Figure 14a,b.

The computer configuration is: Intel(R) Core(TM) i5-4200H CPU @ 2.80GHz, RAM 4.00GB, Windows 8 operating system.

Figure 14c shows that the algorithm has good stability in evaluating whether the remaining fault-free thruster can track the attitude control response performance under the failure of a thruster valve. At the same time, Figure 14d shows that the algorithm can complete a fault detection and performance recovery evaluation between 3.2 s and 4.8 s.

5. Discussion

The PWM method is a mature technology of thruster control and is widely used [6,7,8], but its high-frequency on/off thruster valve operation and valve lifetime are the main causes of the failure problems studied in this paper. Motion-based diagnosis has been proven to be effective [19], and Kalman filtering has been applied in engineering for a long time, however, some shortcomings existed in the proposed research of motion-based fault diagnosis. The approximate control signal noise has a serious impact on Kalman filter model-based state estimation. The frequency of the noise is different from that of the control signal. Therefore, a bandpass filter was introduced to suppress the approximate control signal noise. At the same time, Kalman filtering was used to estimate the motion state and to detect the failure of the thruster valves. The simulation shown in Figure 11 showed that the results met the criterion of the false alarm rates of 5% by blending the filter detection. In addition, to support the redundancy management of the thruster, a recovery evaluation method of employing the remaining fault-free thruster to track the command performance under the failure of a thruster valve was employed; Figure 14 demonstrates the effectiveness of this method. The algorithm running time and stability were tested in 1000 cases, as shown in Figure 14. The running time was between 3.2 s and 4.8 s, and the algorithm operated stably without a dead cycle.

In this study, several thruster missions, including on-orbit, de-orbit, and initial reentry, were assumed to be performed, in which the atmospheric density is close to vacuum. In the future, the extended application of this method, such as the aero-assisted orbital transfer mission, will be focused on, in which the atmospheric density is in the low-density state. In addition, the redundancy management of actuators will also be one of the key research directions in the future.

6. Conclusions

In this paper, the fault types of a thruster valve were analyzed, and three types of thruster valve failure states were examined. By adding a physical filter, the potential influence of the approximate control signal noise on the Kalman filter state estimation was reduced, meanwhile, the residual data was analyzed according to the effective detection and the fault threshold was given in combination with the statistics of the variance. For the three types of fault diagnosis, the threshold generated by the above method was clear and fault detection could be achieved in a short time window. In addition, a controlled recovery evaluation scheme was proposed, combining a nonlinear model-based numerical control prediction, to determine whether the remaining fault-free thrusters can meet the requirements of command performance tracking. Finally, the simulation demonstrated that this method can detect the thruster fault within a certain time window, quickly evaluate the recovery performance, and run stably.