Content uploaded by Robert Fonod

Author content

All content in this area was uploaded by Robert Fonod on Nov 26, 2019

Content may be subject to copyright.

IFAC PapersOnLine 52-12 (2019) 436–441

ScienceDirect

Available online at www.sciencedirect.com

2405-8963 Copyright © 2019. The Authors. Published by Elsevier Ltd. All rights reserved.

Peer review under responsibility of International Federation of Automatic Control.

10.1016/j.ifacol.2019.11.282

10.1016/j.ifacol.2019.11.282 2405-8963

Model-based FDI for Agile Spacecraft with

Multiple Actuators Working

Simultaneously

E. Lopez-Encarnacion ∗,R. Fonod ∗,P. Bergner ∗∗

∗Delft University of Technology, 2629 HS Delft, The Netherlands

(e-mail: ericlopen@gmail.com, r.fonod@tudelft.nl)

∗∗ Airbus Defence and Space, 88090 Immenstaad am Bodensee,

Germany (e-mail: patrick.bergner@airbus.com)

Abstract: Fast and large-angle attitude slew maneuvers often imply simultaneous use of

multiple actuators such as thrusters and reaction wheels (RWs). A fault in any of these actuators

might lead to partial or full damage of sensitive spacecraft instruments. In this paper, a model-

based Fault Detection and Isolation (FDI) strategy is proposed, which aims at detecting various

actuator faults, such as stuck-open/closed thruster, thruster leakage, loss of eﬀectiveness of

all thrusters, and change of RW friction torque due to change of Coulomb and/or viscosity

factor. The proposed FDI strategy is also able to detect and isolate faults aﬀecting the RWs

tachometer sensor. The FDI system design is based on a multiplicative extended Kalman ﬁlter

and a generalized likelihood ratio thresholding of the residual signals. The performance and

robustness of the proposed FDI strategy is evaluated using Monte Carlo simulations and carefully

deﬁned FDI performance indices. Preliminary results suggest promising performance in terms

of detection/isolation times, miss-detection/isolation rates, and false alarm rates.

Keywords: Fault Detection and Isolation; Agile Spacecraft; Reaction Wheels; Thrusters.

1. INTRODUCTION

Spacecraft agility, meaning the capability of the spacecraft

to change its attitude by performing fast attitude slew

maneuvers or to follow a given attitude proﬁle with high

precision, is becoming more and more important for future

space missions. These requirements demand the spacecraft

to be equipped with actuators, such as thrusters and

reaction wheels (RWs), capable of generating high reaction

torques and perform attitude maneuvers with high angular

rates. The control of the spacecraft attitude is achieved by

the Attitude and Orbit Control System (AOCS), which

includes sensors and actuators that are not exempt of

faults. An incorrect AOCS fault management may cause

severe degradation of the spacecraft performance and/or

cause damage to sensitive spacecraft instruments.

A quick Fault Detection and Isolation (FDI) system is cru-

cial for a successful fault recovery action (e.g., switching to

redundant hardware and/or employing a new controller).

Model-based FDI techniques, in general, gained a great

deal of attention in the past decades and, in particular,

they show great potential for aerospace applications, see

Marzat et al. (2012) for a recent survey. The majority of

published works on AOCS fault diagnosis focuses on faults

occurring in a particular type of actuator or a particular

type of sensor. For instance, sole thruster and RW faults

were studied in Fonod et al. (2015b) and in Meskin and

Khorasani (2007), respectively. Gyroscope sensor faults

were studied in Venkateswaran et al. (2002). Only very

few examples of model-based FDI systems dealing with

a combination of diﬀerent type of actuators or sensors

exist for agile spacecraft. Patton et al. (2008) considered

gyroscope and thruster faults, whereas Hou et al. (2008)

focused on gyroscope and RW faults combinations.

An example of agile spacecraft that makes use of multi-

ple actuators working simultaneously is the Athena (Ad-

vanced Telescope for High-ENergy Astrophysics) space-

craft, an L-class mission of the European Space Agency,

which aims at addressing the Hot and Energetic Universe

science theme. The Athena spacecraft is required to be

agile in order to rapidly re-point its instruments, while pro-

tecting its sensitive instruments from direct sun light. The

attitude re-pointing may imply realization of fast large-

angle attitude slews. To perform such slews, the Athena

spacecraft is equipped with a set of thrusters and RWs to

provide accurate control torques.

Torques generated by RWs and thrusters may have similar

impact on the spacecraft dynamics. Therefore, a fault in

any of these actuators might produce a similar eﬀect on the

spacecraft dynamics. Thus, the isolation part of an FDI

system design becomes challenging since no sensors can

directly measure the delivered torques by such actuators.

In this paper, we propose a standalone FDI strategy

capable of detecting and isolating certain faults occurring

in the thrusters, RWs, and RW tachometer sensors.

2. PROBLEM FORMULATION

In this paper, we assume the spacecraft (s/c) is equipped

with a set of NTthrusters and a set of NRRWs, which

may suﬀer from various faults detailed in the sequel.

21st IFAC Symposium on Automatic Control in Aerospace

August 27-30, 2019. Cranfield, UK

Copyright © 2019 IFAC 436

Model-based FDI for Agile Spacecraft with

Multiple Actuators Working

Simultaneously

E. Lopez-Encarnacion ∗,R. Fonod ∗,P. Bergner ∗∗

∗Delft University of Technology, 2629 HS Delft, The Netherlands

(e-mail: ericlopen@gmail.com, r.fonod@tudelft.nl)

∗∗ Airbus Defence and Space, 88090 Immenstaad am Bodensee,

Germany (e-mail: patrick.bergner@airbus.com)

Abstract: Fast and large-angle attitude slew maneuvers often imply simultaneous use of

multiple actuators such as thrusters and reaction wheels (RWs). A fault in any of these actuators

might lead to partial or full damage of sensitive spacecraft instruments. In this paper, a model-

based Fault Detection and Isolation (FDI) strategy is proposed, which aims at detecting various

actuator faults, such as stuck-open/closed thruster, thruster leakage, loss of eﬀectiveness of

all thrusters, and change of RW friction torque due to change of Coulomb and/or viscosity

factor. The proposed FDI strategy is also able to detect and isolate faults aﬀecting the RWs

tachometer sensor. The FDI system design is based on a multiplicative extended Kalman ﬁlter

and a generalized likelihood ratio thresholding of the residual signals. The performance and

robustness of the proposed FDI strategy is evaluated using Monte Carlo simulations and carefully

deﬁned FDI performance indices. Preliminary results suggest promising performance in terms

of detection/isolation times, miss-detection/isolation rates, and false alarm rates.

Keywords: Fault Detection and Isolation; Agile Spacecraft; Reaction Wheels; Thrusters.

1. INTRODUCTION

Spacecraft agility, meaning the capability of the spacecraft

to change its attitude by performing fast attitude slew

maneuvers or to follow a given attitude proﬁle with high

precision, is becoming more and more important for future

space missions. These requirements demand the spacecraft

to be equipped with actuators, such as thrusters and

reaction wheels (RWs), capable of generating high reaction

torques and perform attitude maneuvers with high angular

rates. The control of the spacecraft attitude is achieved by

the Attitude and Orbit Control System (AOCS), which

includes sensors and actuators that are not exempt of

faults. An incorrect AOCS fault management may cause

severe degradation of the spacecraft performance and/or

cause damage to sensitive spacecraft instruments.

A quick Fault Detection and Isolation (FDI) system is cru-

cial for a successful fault recovery action (e.g., switching to

redundant hardware and/or employing a new controller).

Model-based FDI techniques, in general, gained a great

deal of attention in the past decades and, in particular,

they show great potential for aerospace applications, see

Marzat et al. (2012) for a recent survey. The majority of

published works on AOCS fault diagnosis focuses on faults

occurring in a particular type of actuator or a particular

type of sensor. For instance, sole thruster and RW faults

were studied in Fonod et al. (2015b) and in Meskin and

Khorasani (2007), respectively. Gyroscope sensor faults

were studied in Venkateswaran et al. (2002). Only very

few examples of model-based FDI systems dealing with

a combination of diﬀerent type of actuators or sensors

exist for agile spacecraft. Patton et al. (2008) considered

gyroscope and thruster faults, whereas Hou et al. (2008)

focused on gyroscope and RW faults combinations.

An example of agile spacecraft that makes use of multi-

ple actuators working simultaneously is the Athena (Ad-

vanced Telescope for High-ENergy Astrophysics) space-

craft, an L-class mission of the European Space Agency,

which aims at addressing the Hot and Energetic Universe

science theme. The Athena spacecraft is required to be

agile in order to rapidly re-point its instruments, while pro-

tecting its sensitive instruments from direct sun light. The

attitude re-pointing may imply realization of fast large-

angle attitude slews. To perform such slews, the Athena

spacecraft is equipped with a set of thrusters and RWs to

provide accurate control torques.

Torques generated by RWs and thrusters may have similar

impact on the spacecraft dynamics. Therefore, a fault in

any of these actuators might produce a similar eﬀect on the

spacecraft dynamics. Thus, the isolation part of an FDI

system design becomes challenging since no sensors can

directly measure the delivered torques by such actuators.

In this paper, we propose a standalone FDI strategy

capable of detecting and isolating certain faults occurring

in the thrusters, RWs, and RW tachometer sensors.

2. PROBLEM FORMULATION

In this paper, we assume the spacecraft (s/c) is equipped

with a set of NTthrusters and a set of NRRWs, which

may suﬀer from various faults detailed in the sequel.

21st IFAC Symposium on Automatic Control in Aerospace

August 27-30, 2019. Cranfield, UK

Copyright © 2019 IFAC 436

Model-based FDI for Agile Spacecraft with

Multiple Actuators Working

Simultaneously

E. Lopez-Encarnacion ∗,R. Fonod ∗,P. Bergner ∗∗

∗Delft University of Technology, 2629 HS Delft, The Netherlands

(e-mail: ericlopen@gmail.com, r.fonod@tudelft.nl)

∗∗ Airbus Defence and Space, 88090 Immenstaad am Bodensee,

Germany (e-mail: patrick.bergner@airbus.com)

Abstract: Fast and large-angle attitude slew maneuvers often imply simultaneous use of

multiple actuators such as thrusters and reaction wheels (RWs). A fault in any of these actuators

might lead to partial or full damage of sensitive spacecraft instruments. In this paper, a model-

based Fault Detection and Isolation (FDI) strategy is proposed, which aims at detecting various

actuator faults, such as stuck-open/closed thruster, thruster leakage, loss of eﬀectiveness of

all thrusters, and change of RW friction torque due to change of Coulomb and/or viscosity

factor. The proposed FDI strategy is also able to detect and isolate faults aﬀecting the RWs

tachometer sensor. The FDI system design is based on a multiplicative extended Kalman ﬁlter

and a generalized likelihood ratio thresholding of the residual signals. The performance and

robustness of the proposed FDI strategy is evaluated using Monte Carlo simulations and carefully

deﬁned FDI performance indices. Preliminary results suggest promising performance in terms

of detection/isolation times, miss-detection/isolation rates, and false alarm rates.

Keywords: Fault Detection and Isolation; Agile Spacecraft; Reaction Wheels; Thrusters.

1. INTRODUCTION

Spacecraft agility, meaning the capability of the spacecraft

to change its attitude by performing fast attitude slew

maneuvers or to follow a given attitude proﬁle with high

precision, is becoming more and more important for future

space missions. These requirements demand the spacecraft

to be equipped with actuators, such as thrusters and

reaction wheels (RWs), capable of generating high reaction

torques and perform attitude maneuvers with high angular

rates. The control of the spacecraft attitude is achieved by

the Attitude and Orbit Control System (AOCS), which

includes sensors and actuators that are not exempt of

faults. An incorrect AOCS fault management may cause

severe degradation of the spacecraft performance and/or

cause damage to sensitive spacecraft instruments.

A quick Fault Detection and Isolation (FDI) system is cru-

cial for a successful fault recovery action (e.g., switching to

redundant hardware and/or employing a new controller).

Model-based FDI techniques, in general, gained a great

deal of attention in the past decades and, in particular,

they show great potential for aerospace applications, see

Marzat et al. (2012) for a recent survey. The majority of

published works on AOCS fault diagnosis focuses on faults

occurring in a particular type of actuator or a particular

type of sensor. For instance, sole thruster and RW faults

were studied in Fonod et al. (2015b) and in Meskin and

Khorasani (2007), respectively. Gyroscope sensor faults

were studied in Venkateswaran et al. (2002). Only very

few examples of model-based FDI systems dealing with

a combination of diﬀerent type of actuators or sensors

exist for agile spacecraft. Patton et al. (2008) considered

gyroscope and thruster faults, whereas Hou et al. (2008)

focused on gyroscope and RW faults combinations.

An example of agile spacecraft that makes use of multi-

ple actuators working simultaneously is the Athena (Ad-

vanced Telescope for High-ENergy Astrophysics) space-

craft, an L-class mission of the European Space Agency,

which aims at addressing the Hot and Energetic Universe

science theme. The Athena spacecraft is required to be

agile in order to rapidly re-point its instruments, while pro-

tecting its sensitive instruments from direct sun light. The

attitude re-pointing may imply realization of fast large-

angle attitude slews. To perform such slews, the Athena

spacecraft is equipped with a set of thrusters and RWs to

provide accurate control torques.

Torques generated by RWs and thrusters may have similar

impact on the spacecraft dynamics. Therefore, a fault in

any of these actuators might produce a similar eﬀect on the

spacecraft dynamics. Thus, the isolation part of an FDI

system design becomes challenging since no sensors can

directly measure the delivered torques by such actuators.

In this paper, we propose a standalone FDI strategy

capable of detecting and isolating certain faults occurring

in the thrusters, RWs, and RW tachometer sensors.

2. PROBLEM FORMULATION

In this paper, we assume the spacecraft (s/c) is equipped

with a set of NTthrusters and a set of NRRWs, which

may suﬀer from various faults detailed in the sequel.

21st IFAC Symposium on Automatic Control in Aerospace

August 27-30, 2019. Cranfield, UK

Copyright © 2019 IFAC 436

Model-based FDI for Agile Spacecraft with

Multiple Actuators Working

Simultaneously

E. Lopez-Encarnacion ∗,R. Fonod ∗,P. Bergner ∗∗

∗Delft University of Technology, 2629 HS Delft, The Netherlands

(e-mail: ericlopen@gmail.com, r.fonod@tudelft.nl)

∗∗ Airbus Defence and Space, 88090 Immenstaad am Bodensee,

Germany (e-mail: patrick.bergner@airbus.com)

Abstract: Fast and large-angle attitude slew maneuvers often imply simultaneous use of

multiple actuators such as thrusters and reaction wheels (RWs). A fault in any of these actuators

might lead to partial or full damage of sensitive spacecraft instruments. In this paper, a model-

based Fault Detection and Isolation (FDI) strategy is proposed, which aims at detecting various

actuator faults, such as stuck-open/closed thruster, thruster leakage, loss of eﬀectiveness of

all thrusters, and change of RW friction torque due to change of Coulomb and/or viscosity

factor. The proposed FDI strategy is also able to detect and isolate faults aﬀecting the RWs

tachometer sensor. The FDI system design is based on a multiplicative extended Kalman ﬁlter

and a generalized likelihood ratio thresholding of the residual signals. The performance and

robustness of the proposed FDI strategy is evaluated using Monte Carlo simulations and carefully

deﬁned FDI performance indices. Preliminary results suggest promising performance in terms

of detection/isolation times, miss-detection/isolation rates, and false alarm rates.

Keywords: Fault Detection and Isolation; Agile Spacecraft; Reaction Wheels; Thrusters.

1. INTRODUCTION

Spacecraft agility, meaning the capability of the spacecraft

to change its attitude by performing fast attitude slew

maneuvers or to follow a given attitude proﬁle with high

precision, is becoming more and more important for future

space missions. These requirements demand the spacecraft

to be equipped with actuators, such as thrusters and

reaction wheels (RWs), capable of generating high reaction

torques and perform attitude maneuvers with high angular

rates. The control of the spacecraft attitude is achieved by

the Attitude and Orbit Control System (AOCS), which

includes sensors and actuators that are not exempt of

faults. An incorrect AOCS fault management may cause

severe degradation of the spacecraft performance and/or

cause damage to sensitive spacecraft instruments.

A quick Fault Detection and Isolation (FDI) system is cru-

cial for a successful fault recovery action (e.g., switching to

redundant hardware and/or employing a new controller).

Model-based FDI techniques, in general, gained a great

deal of attention in the past decades and, in particular,

they show great potential for aerospace applications, see

Marzat et al. (2012) for a recent survey. The majority of

published works on AOCS fault diagnosis focuses on faults

occurring in a particular type of actuator or a particular

type of sensor. For instance, sole thruster and RW faults

were studied in Fonod et al. (2015b) and in Meskin and

Khorasani (2007), respectively. Gyroscope sensor faults

were studied in Venkateswaran et al. (2002). Only very

few examples of model-based FDI systems dealing with

a combination of diﬀerent type of actuators or sensors

exist for agile spacecraft. Patton et al. (2008) considered

gyroscope and thruster faults, whereas Hou et al. (2008)

focused on gyroscope and RW faults combinations.

An example of agile spacecraft that makes use of multi-

ple actuators working simultaneously is the Athena (Ad-

vanced Telescope for High-ENergy Astrophysics) space-

craft, an L-class mission of the European Space Agency,

which aims at addressing the Hot and Energetic Universe

science theme. The Athena spacecraft is required to be

agile in order to rapidly re-point its instruments, while pro-

tecting its sensitive instruments from direct sun light. The

attitude re-pointing may imply realization of fast large-

angle attitude slews. To perform such slews, the Athena

spacecraft is equipped with a set of thrusters and RWs to

provide accurate control torques.

Torques generated by RWs and thrusters may have similar

impact on the spacecraft dynamics. Therefore, a fault in

any of these actuators might produce a similar eﬀect on the

spacecraft dynamics. Thus, the isolation part of an FDI

system design becomes challenging since no sensors can

directly measure the delivered torques by such actuators.

In this paper, we propose a standalone FDI strategy

capable of detecting and isolating certain faults occurring

in the thrusters, RWs, and RW tachometer sensors.

2. PROBLEM FORMULATION

In this paper, we assume the spacecraft (s/c) is equipped

with a set of NTthrusters and a set of NRRWs, which

may suﬀer from various faults detailed in the sequel.

21st IFAC Symposium on Automatic Control in Aerospace

August 27-30, 2019. Cranfield, UK

Copyright © 2019 IFAC 436

Model-based FDI for Agile Spacecraft with

Multiple Actuators Working

Simultaneously

E. Lopez-Encarnacion ∗,R. Fonod ∗,P. Bergner ∗∗

∗Delft University of Technology, 2629 HS Delft, The Netherlands

(e-mail: ericlopen@gmail.com, r.fonod@tudelft.nl)

∗∗ Airbus Defence and Space, 88090 Immenstaad am Bodensee,

Germany (e-mail: patrick.bergner@airbus.com)

Abstract: Fast and large-angle attitude slew maneuvers often imply simultaneous use of

multiple actuators such as thrusters and reaction wheels (RWs). A fault in any of these actuators

might lead to partial or full damage of sensitive spacecraft instruments. In this paper, a model-

based Fault Detection and Isolation (FDI) strategy is proposed, which aims at detecting various

actuator faults, such as stuck-open/closed thruster, thruster leakage, loss of eﬀectiveness of

all thrusters, and change of RW friction torque due to change of Coulomb and/or viscosity

factor. The proposed FDI strategy is also able to detect and isolate faults aﬀecting the RWs

tachometer sensor. The FDI system design is based on a multiplicative extended Kalman ﬁlter

and a generalized likelihood ratio thresholding of the residual signals. The performance and

robustness of the proposed FDI strategy is evaluated using Monte Carlo simulations and carefully

deﬁned FDI performance indices. Preliminary results suggest promising performance in terms

of detection/isolation times, miss-detection/isolation rates, and false alarm rates.

Keywords: Fault Detection and Isolation; Agile Spacecraft; Reaction Wheels; Thrusters.

1. INTRODUCTION

Spacecraft agility, meaning the capability of the spacecraft

to change its attitude by performing fast attitude slew

maneuvers or to follow a given attitude proﬁle with high

precision, is becoming more and more important for future

space missions. These requirements demand the spacecraft

to be equipped with actuators, such as thrusters and

reaction wheels (RWs), capable of generating high reaction

torques and perform attitude maneuvers with high angular

rates. The control of the spacecraft attitude is achieved by

the Attitude and Orbit Control System (AOCS), which

includes sensors and actuators that are not exempt of

faults. An incorrect AOCS fault management may cause

severe degradation of the spacecraft performance and/or

cause damage to sensitive spacecraft instruments.

A quick Fault Detection and Isolation (FDI) system is cru-

cial for a successful fault recovery action (e.g., switching to

redundant hardware and/or employing a new controller).

Model-based FDI techniques, in general, gained a great

deal of attention in the past decades and, in particular,

they show great potential for aerospace applications, see

Marzat et al. (2012) for a recent survey. The majority of

published works on AOCS fault diagnosis focuses on faults

occurring in a particular type of actuator or a particular

type of sensor. For instance, sole thruster and RW faults

were studied in Fonod et al. (2015b) and in Meskin and

Khorasani (2007), respectively. Gyroscope sensor faults

were studied in Venkateswaran et al. (2002). Only very

few examples of model-based FDI systems dealing with

a combination of diﬀerent type of actuators or sensors

exist for agile spacecraft. Patton et al. (2008) considered

gyroscope and thruster faults, whereas Hou et al. (2008)

focused on gyroscope and RW faults combinations.

An example of agile spacecraft that makes use of multi-

ple actuators working simultaneously is the Athena (Ad-

vanced Telescope for High-ENergy Astrophysics) space-

craft, an L-class mission of the European Space Agency,

which aims at addressing the Hot and Energetic Universe

science theme. The Athena spacecraft is required to be

agile in order to rapidly re-point its instruments, while pro-

tecting its sensitive instruments from direct sun light. The

attitude re-pointing may imply realization of fast large-

angle attitude slews. To perform such slews, the Athena

spacecraft is equipped with a set of thrusters and RWs to

provide accurate control torques.

Torques generated by RWs and thrusters may have similar

impact on the spacecraft dynamics. Therefore, a fault in

any of these actuators might produce a similar eﬀect on the

spacecraft dynamics. Thus, the isolation part of an FDI

system design becomes challenging since no sensors can

directly measure the delivered torques by such actuators.

In this paper, we propose a standalone FDI strategy

capable of detecting and isolating certain faults occurring

in the thrusters, RWs, and RW tachometer sensors.

2. PROBLEM FORMULATION

In this paper, we assume the spacecraft (s/c) is equipped

with a set of NTthrusters and a set of NRRWs, which

may suﬀer from various faults detailed in the sequel.

21st IFAC Symposium on Automatic Control in Aerospace

August 27-30, 2019. Cranfield, UK

Copyright © 2019 IFAC 436

Model-based FDI for Agile Spacecraft with

Multiple Actuators Working

Simultaneously

E. Lopez-Encarnacion ∗,R. Fonod ∗,P. Bergner ∗∗

∗Delft University of Technology, 2629 HS Delft, The Netherlands

(e-mail: ericlopen@gmail.com, r.fonod@tudelft.nl)

∗∗ Airbus Defence and Space, 88090 Immenstaad am Bodensee,

Germany (e-mail: patrick.bergner@airbus.com)

Abstract: Fast and large-angle attitude slew maneuvers often imply simultaneous use of

multiple actuators such as thrusters and reaction wheels (RWs). A fault in any of these actuators

might lead to partial or full damage of sensitive spacecraft instruments. In this paper, a model-

based Fault Detection and Isolation (FDI) strategy is proposed, which aims at detecting various

actuator faults, such as stuck-open/closed thruster, thruster leakage, loss of eﬀectiveness of

all thrusters, and change of RW friction torque due to change of Coulomb and/or viscosity

factor. The proposed FDI strategy is also able to detect and isolate faults aﬀecting the RWs

tachometer sensor. The FDI system design is based on a multiplicative extended Kalman ﬁlter

and a generalized likelihood ratio thresholding of the residual signals. The performance and

robustness of the proposed FDI strategy is evaluated using Monte Carlo simulations and carefully

deﬁned FDI performance indices. Preliminary results suggest promising performance in terms

of detection/isolation times, miss-detection/isolation rates, and false alarm rates.

Keywords: Fault Detection and Isolation; Agile Spacecraft; Reaction Wheels; Thrusters.

1. INTRODUCTION

Spacecraft agility, meaning the capability of the spacecraft

to change its attitude by performing fast attitude slew

maneuvers or to follow a given attitude proﬁle with high

precision, is becoming more and more important for future

space missions. These requirements demand the spacecraft

to be equipped with actuators, such as thrusters and

reaction wheels (RWs), capable of generating high reaction

torques and perform attitude maneuvers with high angular

rates. The control of the spacecraft attitude is achieved by

the Attitude and Orbit Control System (AOCS), which

includes sensors and actuators that are not exempt of

faults. An incorrect AOCS fault management may cause

severe degradation of the spacecraft performance and/or

cause damage to sensitive spacecraft instruments.

A quick Fault Detection and Isolation (FDI) system is cru-

cial for a successful fault recovery action (e.g., switching to

redundant hardware and/or employing a new controller).

Model-based FDI techniques, in general, gained a great

deal of attention in the past decades and, in particular,

they show great potential for aerospace applications, see

Marzat et al. (2012) for a recent survey. The majority of

published works on AOCS fault diagnosis focuses on faults

occurring in a particular type of actuator or a particular

type of sensor. For instance, sole thruster and RW faults

were studied in Fonod et al. (2015b) and in Meskin and

Khorasani (2007), respectively. Gyroscope sensor faults

were studied in Venkateswaran et al. (2002). Only very

few examples of model-based FDI systems dealing with

a combination of diﬀerent type of actuators or sensors

exist for agile spacecraft. Patton et al. (2008) considered

gyroscope and thruster faults, whereas Hou et al. (2008)

focused on gyroscope and RW faults combinations.

An example of agile spacecraft that makes use of multi-

ple actuators working simultaneously is the Athena (Ad-

vanced Telescope for High-ENergy Astrophysics) space-

craft, an L-class mission of the European Space Agency,

which aims at addressing the Hot and Energetic Universe

science theme. The Athena spacecraft is required to be

agile in order to rapidly re-point its instruments, while pro-

tecting its sensitive instruments from direct sun light. The

attitude re-pointing may imply realization of fast large-

angle attitude slews. To perform such slews, the Athena

spacecraft is equipped with a set of thrusters and RWs to

provide accurate control torques.

Torques generated by RWs and thrusters may have similar

impact on the spacecraft dynamics. Therefore, a fault in

any of these actuators might produce a similar eﬀect on the

spacecraft dynamics. Thus, the isolation part of an FDI

system design becomes challenging since no sensors can

directly measure the delivered torques by such actuators.

In this paper, we propose a standalone FDI strategy

capable of detecting and isolating certain faults occurring

in the thrusters, RWs, and RW tachometer sensors.

2. PROBLEM FORMULATION

In this paper, we assume the spacecraft (s/c) is equipped

with a set of NTthrusters and a set of NRRWs, which

may suﬀer from various faults detailed in the sequel.

21st IFAC Symposium on Automatic Control in Aerospace

August 27-30, 2019. Cranfield, UK

Copyright © 2019 IFAC 436

2.1 Thruster Model

Deﬁning ST{1,2,...,N

T}as a set of all thrusters

indices, di∈R3×1as a ﬁxed direction of the ith thruster,

rMi∈R3×1as a vector position of the ith thruster in body-

ﬁxed reference frame, and FNi>0 as a maximum thrust

force of the ith thruster, then the maximum directional

torque of the ith thruster becomes

bTi=rMi×bFi,i∈S

T,(1)

where ’×’ denotes the cross product of two vectors and bFi

is the directional force of the ith thruster, i.e.,

bFi=−θ(di,

Ti)(FNi+ηFi),(2)

with θ(·,·) being a function that rotates the ith thruster

direction vector (di) for a given misalignment angle Tiand

ηFibeing a scalar zero-mean Gaussian white-noise aiming

at modeling variations on the eﬀective thruster force.

Finally, the total torque about the Center of Mass (CoM)

of the s/c generated by the thrusters is given by

TT=

NT

i=1

bTiuTi,(3)

where uTiis the commanded opening of the ith thruster.

2.2 Reaction Wheel Model

The torque generated by the ith RW is modelled as

cRi=uRi+TRfi+ηRai,i∈S

R,(4)

where SR{1,2,...N

R}is a set of all RW indices, uRi

is the commanded control torque, ηRaiis a zero-mean

Gaussian white-noise introduced to model torque eﬀects

caused, e.g., by variations of motor voltage frequency and

DC coil resistance, and TRfiis the friction torque in ball

bearings of the wheel. We model the friction torque as

TRfi=−µ1tanh (ωRi)−µ2sign(ωRi)|ωRi|1.25 ,(5)

where µ1>0 and µ2>0 are appropriate constants, and

ωRiis the angular speed of the ith RW satisfying

˙ωRi=J−1

RicRi,(6)

where JRiis the constant inertia of the ith RW. In (5),

the term associated with µ1and µ2aims at modelling

Coulomb and viscous friction of the ith RW, respectively.

Finally, the total torque about the CoM of the s/c gener-

ated by the RWs is given by

TR=

NR

i=1

θ(mRi,

Ri)cRi,(7)

where θ(·,·) is the same function as deﬁned for (2),

however now rotating the ith RW directional vector

mRi∈R3×1for a given RW misalignment angle Ri.

2.3 Spacecraft Model

The s/c is treated as a rigid body. Its rotational dynamics

about the CoM is given by

JS˙

ωS=TT−TR+TD−ωS×(JSωS−hR),(8)

where TD∈R3×1is the external disturbance torque,

JS∈R3×3is the s/c inertia, ωS∈R3×1is the s/c angular

velocity, and hR∈R3×1is the s/c angular momentum

vector associated with the RWs, i.e.,

hR=

NR

i=1

θ(mRi,

Ri)JRiωRi.(9)

The s/c motion is parametrized by a unit quaternion,

qT[qvec1qvec2qvec3qsca],qTq=1,

representing the s/c attitude with respect to an inertial

frame of reference. The s/c kinematics is given by

˙

q=1

2W(ωS)q,(10)

where

W(ωS)

0ωZ−ωYωX

−ωZ0ωXωY

ωY−ωX0ωZ

−ωX−ωY−ωZ0

,(11)

and ωX,ωY,ωZare the elements of ωSrepresenting the

s/c rotational rates around its body-ﬁxed X,Y,Zaxes.

2.4 Sensor Model

For FDI purposes, two high-precision star trackers (STRs),

angular rate measurement unit (RMU), and dedicated

tachometers for each RW are considered. STRs and RMU

are assumed to be fault-free as quick FDI strategies exist.

The sensor model for the ith STR, the RMU, and the RW

tachometers is, respectively, deﬁned as follows

qmeas

stri=(q⊗ϑ(stri)) ⊗ϕ(ηstri),(12)

ωmeas

S=θ(ωS,

rmu)+ηr mu,(13)

ωmeas

R=ωf

R+ηRm,(14)

where ωf

Rwill be deﬁned later, qmeas

stri,ωmeas

S,ωmeas

Rare

the measurements, and ηstri,ηrmu,ηRm are the measure-

ment noises, assumed to be independent zero-mean Gaus-

sian random variables. In (12), ’⊗’ denotes quaternion

multiplication, ϑ(·) is a function of the misalignment angle

stri, and ϕ(·) is a function of noise ηstrideﬁned in Euler

angles. These functions are used to manipulate (rotate) the

true quaternion qin order to mimic the STR misalignment

and noise, respectively, while preserving quaternion unity.

In (13), θ(·,·) rotates the measured s/c angular rate vector

(ωS) for a given RMU misalignment angle rmu.

2.5 Fault Model

Four distinct thruster fault types are considered: thruster

leakage, stuck-open/-closed thruster, and loss of eﬀective-

ness (LoE) of all thrusters simultaneously.

The ﬁrst three faults are modeled as (Fonod et al., 2015a)

uf

T=(INT×NT−Φ)uT,(15)

where Φdiag (φ1... φ

NT), uT

TuT1... u

TNT, and

the index fdenotes the faulty case. The scalar variable φi

models the fault for the ith thruster as

φi=0,if fault-free

1−χi/uTi,if faulty

Here, χiaims at modelling diﬀerent fault types, i.e.,

χi=1,stuck-open

0,stuck-closed

max{mleaki,u

Ti},propellant leakage

where mleakiis the ith thruster leakage magnitude.

The LoE fault represents a decrease in propellant supply

pressure feeding all the thrusters. Therefore, a LoE fault

will aﬀect all thrusters simultaneously, i.e.,

φi=mloe,∀i∈S

T,

where mloe is the LoE magnitude (0 ≤mloe ≤1).

2019 IFAC ACA

August 27-30, 2019. Cranfield, UK

437

Copyright © 2019. The Authors. Published by Elsevier Ltd. All rights reserved.

E. Lopez-Encarnacion et al. / IFAC PapersOnLine 52-12 (2019) 436–441 437

2.1 Thruster Model

Deﬁning ST{1,2,...,N

T}as a set of all thrusters

indices, di∈R3×1as a ﬁxed direction of the ith thruster,

rMi∈R3×1as a vector position of the ith thruster in body-

ﬁxed reference frame, and FNi>0 as a maximum thrust

force of the ith thruster, then the maximum directional

torque of the ith thruster becomes

bTi=rMi×bFi,i∈S

T,(1)

where ’×’ denotes the cross product of two vectors and bFi

is the directional force of the ith thruster, i.e.,

bFi=−θ(di,

Ti)(FNi+ηFi),(2)

with θ(·,·) being a function that rotates the ith thruster

direction vector (di) for a given misalignment angle Tiand

ηFibeing a scalar zero-mean Gaussian white-noise aiming

at modeling variations on the eﬀective thruster force.

Finally, the total torque about the Center of Mass (CoM)

of the s/c generated by the thrusters is given by

TT=

NT

i=1

bTiuTi,(3)

where uTiis the commanded opening of the ith thruster.

2.2 Reaction Wheel Model

The torque generated by the ith RW is modelled as

cRi=uRi+TRfi+ηRai,i∈S

R,(4)

where SR{1,2,...N

R}is a set of all RW indices, uRi

is the commanded control torque, ηRaiis a zero-mean

Gaussian white-noise introduced to model torque eﬀects

caused, e.g., by variations of motor voltage frequency and

DC coil resistance, and TRfiis the friction torque in ball

bearings of the wheel. We model the friction torque as

TRfi=−µ1tanh (ωRi)−µ2sign(ωRi)|ωRi|1.25 ,(5)

where µ1>0 and µ2>0 are appropriate constants, and

ωRiis the angular speed of the ith RW satisfying

˙ωRi=J−1

RicRi,(6)

where JRiis the constant inertia of the ith RW. In (5),

the term associated with µ1and µ2aims at modelling

Coulomb and viscous friction of the ith RW, respectively.

Finally, the total torque about the CoM of the s/c gener-

ated by the RWs is given by

TR=

NR

i=1

θ(mRi,

Ri)cRi,(7)

where θ(·,·) is the same function as deﬁned for (2),

however now rotating the ith RW directional vector

mRi∈R3×1for a given RW misalignment angle Ri.

2.3 Spacecraft Model

The s/c is treated as a rigid body. Its rotational dynamics

about the CoM is given by

JS˙

ωS=TT−TR+TD−ωS×(JSωS−hR),(8)

where TD∈R3×1is the external disturbance torque,

JS∈R3×3is the s/c inertia, ωS∈R3×1is the s/c angular

velocity, and hR∈R3×1is the s/c angular momentum

vector associated with the RWs, i.e.,

hR=

NR

i=1

θ(mRi,

Ri)JRiωRi.(9)

The s/c motion is parametrized by a unit quaternion,

qT[qvec1qvec2qvec3qsca],qTq=1,

representing the s/c attitude with respect to an inertial

frame of reference. The s/c kinematics is given by

˙

q=1

2W(ωS)q,(10)

where

W(ωS)

0ωZ−ωYωX

−ωZ0ωXωY

ωY−ωX0ωZ

−ωX−ωY−ωZ0

,(11)

and ωX,ωY,ωZare the elements of ωSrepresenting the

s/c rotational rates around its body-ﬁxed X,Y,Zaxes.

2.4 Sensor Model

For FDI purposes, two high-precision star trackers (STRs),

angular rate measurement unit (RMU), and dedicated

tachometers for each RW are considered. STRs and RMU

are assumed to be fault-free as quick FDI strategies exist.

The sensor model for the ith STR, the RMU, and the RW

tachometers is, respectively, deﬁned as follows

qmeas

stri=(q⊗ϑ(stri)) ⊗ϕ(ηstri),(12)

ωmeas

S=θ(ωS,

rmu)+ηr mu,(13)

ωmeas

R=ωf

R+ηRm,(14)

where ωf

Rwill be deﬁned later, qmeas

stri,ωmeas

S,ωmeas

Rare

the measurements, and ηstri,ηrmu,ηRm are the measure-

ment noises, assumed to be independent zero-mean Gaus-

sian random variables. In (12), ’⊗’ denotes quaternion

multiplication, ϑ(·) is a function of the misalignment angle

stri, and ϕ(·) is a function of noise ηstrideﬁned in Euler

angles. These functions are used to manipulate (rotate) the

true quaternion qin order to mimic the STR misalignment

and noise, respectively, while preserving quaternion unity.

In (13), θ(·,·) rotates the measured s/c angular rate vector

(ωS) for a given RMU misalignment angle rmu.

2.5 Fault Model

Four distinct thruster fault types are considered: thruster

leakage, stuck-open/-closed thruster, and loss of eﬀective-

ness (LoE) of all thrusters simultaneously.

The ﬁrst three faults are modeled as (Fonod et al., 2015a)

uf

T=(INT×NT−Φ)uT,(15)

where Φdiag (φ1... φ

NT), uT

TuT1... u

TNT, and

the index fdenotes the faulty case. The scalar variable φi

models the fault for the ith thruster as

φi=0,if fault-free

1−χi/uTi,if faulty

Here, χiaims at modelling diﬀerent fault types, i.e.,

χi=1,stuck-open

0,stuck-closed

max{mleaki,u

Ti},propellant leakage

where mleakiis the ith thruster leakage magnitude.

The LoE fault represents a decrease in propellant supply

pressure feeding all the thrusters. Therefore, a LoE fault

will aﬀect all thrusters simultaneously, i.e.,

φi=mloe,∀i∈S

T,

where mloe is the LoE magnitude (0 ≤mloe ≤1).

2019 IFAC ACA

August 27-30, 2019. Cranfield, UK

437

438 E. Lopez-Encarnacion et al. / IFAC PapersOnLine 52-12 (2019) 436–441

Two type of RW faults are considered. The ﬁrst considers

an increment of the measurement realized by the tachome-

ter sensor, i.e.,

ωf

R=ΨωR,(16)

where ωT

RωR1... ω

RNRis a vector of true RW

angular speeds and Ψdiag (ψ1... ψ

NR), with

ψi=1,if fault-free

mmeasi,if faulty

and mmeasi>1 representing tachometer scale increment.

The second considered RW fault is an increment of the RW

friction. Two friction types are considered, viscous friction

(fv) and Coulomb friction (fc). Both fvand fccan vary

diﬀerently in a faulty situations. Thus, the following fault

model for the ith RW friction torque TRfiis considered

Tf

Rfi=ξ1ifvi+ξ2ifci,i∈S

R,(17)

ξ1i=1,if fault-free

mv,if faulty ,ξ

2i=1,if fault-free

mc,if faulty

Here, mv>1 and mc>1 is the magnitude of the viscous

and Coulomb friction factor, respectively.

3. PROPOSED FDI STRATEGY

The proposed FDI strategy is based on a model-based

residual generation, statistical change detection, and sig-

nature matrix matching. A generalized likelihood ratio

(GLR) algorithm monitors each residual signal and com-

pares them with ﬁxed thresholds to determine fault pres-

ence. To decide whether the fault occurred in the thrusters

or in a particular RW, including the type of the RW fault,

the isolation logic matches the output of the thresholding

process with the columns of a predeﬁned signature matrix.

3.1 State Estimation

Before deﬁning the residual signal, we ﬁrst design a state

estimator to estimate the following state vector

xT=δgTωT

SωT

RTT

Rf ,(18)

where TT

Rf [TRf1... T

RfNR] and δg∈R3×1stands

for quaternion error. The ﬁlter employed here to estimate

xis a mix of an extended Kalman ﬁlter (EKF) and a

multiplicative EKF (MEKF). The EKF is used to estimate

ωS,ωR, and TRf , whereas MEKF is used to estimate δg.

Due to the quaternion unity constraint, qcannot be

directly estimated using EKF. Alternatively, additive EKF

or MEKF can be employed, see Markley (2004). Due to

large slews realized by the s/c, the MEKF is preferred as it

estimates the quaternion errors (δg), which are considered

to be small and easily linearized without loosing accuracy.

To proceed, we deﬁne the total control input vector uas

uTuT

TuT

R. To propagate the estimated state ˆ

x, the

following equation will be considered

˙

ˆ

x=f(ˆ

x,u),(19)

where f(ˆ

x,u) is a vector function deﬁned as

f(ˆ

x,u)

−ˆ

ωS×δˆ

g

J−1

S(ˆ

TT−ˆ

TR−ˆ

ωS×(JSˆ

ωS−ˆ

hR))

J−1

R(uR+ˆ

TRf )

0NR×1

,

where JRdiag(JR1...J

RNR); ˆ

hR=MRJRˆ

ωRwith

MRmR1...mRNRbeing the misalignment-free ma-

trix mapping the estimated RWs’ torque contributions into

the s/c body-ﬁxed frame; ˆ

TTand ˆ

TRbeing deﬁned as

ˆ

TT=−

NT

i=1

ˆ

bTiuTi,ˆ

TR=

NR

i=1

mRi(uRi+ˆ

TRfi),

where ˆ

bTi=FNi(rMi×di), and ˆ

TRfiis modelled as a

random walk driven by zero-mean white-noise ηRfi.

The ﬁlter’s time propagation step is done in a continuous

time. The estimated state (ˆ

xk−1) and covariance (Pk−1)

from the previous time step are propagated to the current

time step (ˆ

x−

kand P−

k), assuming constant control input

(uk−1), by integrating the following system of equations

˙

ˆ

x=f(ˆ

x,u)

˙

P=FP +PFT+Q(20)

where

F=∂f(x,u)

∂xx=ˆ

xk−1,u=uk−1

is the Jacobian matrix of the state and Qis the artiﬁcial

process noise covariance matrix

Q= diag εI3×3Q22 SRaJ−2

RSRf ,

with Q22 =J−1

SMRSRaMT

R−ˆ

BTSFˆ

BT

TJ−1

S,ˆ

BT=

[ˆ

bT1... ˆ

bTNT], εbeing a small constant, and SF,SRa,

and SRf being double sided power spectral densities of

ηF,ηRa, and ηRf , respectively.

All sensor measurements (12)-(14) are exploited for esti-

mation purposes. These measurements are only available

in discrete time and are, for convenience, lumped into

zT

k=(δgmeas

str1)T(δgmeas

str2)T(ωmeas

S)T(ωmeas

R)T,(21)

where the ith attitude error measurement, δgmeas

stri, is

expressed as a Gibbs vector

δgmeas

stri=qmeas

stri⊗(ˆ

q−

k)−1vec

qmeas

stri⊗(ˆ

q−

k)−1sca

(22)

where ·vec and ·sca, respectively, extracts the vector

and scalar part of the enclosed quaternion. In (22), ( ˆ

q−

k)−1

denotes the quaternion inverse of ˆ

q−

k.

In parallel to the propagation in time of (20), the esti-

mated full attitude ( ˆ

q) also needs to be propagated in

time from ˆ

qk−1to ˆ

q−

kby integrating ˙

ˆ

q=1

2W(ˆ

ωS)ˆ

q, where

W(·) was deﬁned in (11).

Once zkbecomes available, the state and the covariance

matrix are updated as follows

ˆ

xk=ˆ

x−

k+Kk(zk−h(ˆ

x−

k)) (23)

Pk=I(6+2NR)×(6+2NR)−KkHP−

k(24)

where

Kk=ˆ

P−

kHT(Hˆ

P−

kHT+R)−1

hˆ

x−

k=01×301×3(ˆ

ω−

Sk)T(ˆ

ω−

Rk)TT

H=

I3×303×(NR+3) 03×NR

I3×303×(NR+3) 03×NR

0(NR+3)×3I(NR+3)×(NR+3) 0(NR+3)×NR

R= diag σ2

str1

4I3x3

σ2

str2

4I3x3σ2

rmuI3x3σ2

RmINR×NR

and σstr1,σstr2,σrmu, and σRm are the standard devi-

ations of ηstr1,ηstr2,ηrmu, and ηRm, respectively. Note

2019 IFAC ACA

August 27-30, 2019. Cranfield, UK

438

that in the measurement noise covariance matrix R, the

measurement noise variances of the STRs are divided by

4 to account for the Gibbs vector transformation.

The Gibbs vector δˆ

gis transformed into the global atti-

tude representation, while preserving the unity quaternion

constraints, using

ˆ

qk=1

1+δˆ

gk2δˆ

gk

1⊗ˆ

q−

k(25)

After each measurement update, δˆ

gneeds to be reset to

zero explicitly, i.e., δˆ

g=03×1.

In this paper, we modify the standard measurement up-

date step equation of the Kalman ﬁlter to account for

proper implementation of the friction torque estimate

ˆ

TRfi, i.e., the ith friction torque estimate is updated as

follows ˆ

TRfi;k=ˆ

Tsgn

Rfi;kˆ

Tmag

Rfi;k,(26)

where the sign of the friction torque estimate is determined

by

ˆ

Tsgn

Rfi;k=−sign ˆcRi;k−1if JRiˆωRi;k<γ

−sign ˆωRi;k−1otherwise (27)

where γ>0 is a ﬁxed threshold accounting for the

RW’s friction characteristics. Finally, the magnitude of the

friction torque is computed as

ˆ

Tmag

Rfi;k=ˆ

x−

kTRfi+ˆ

Tsgn

Rfi;kKkzk−h(ˆ

x−

k)TRfi

where ·TRfipulls out the element associated with TRfi

from the enclosed vector.

Remark 1. The sign of the estimated friction torque, see

(27), is assumed to be opposite to the sign of the estimated

angular rate. However, if the physical angular momentum

is close to zero, the sign of the physical friction torque is

not clear. Thus, if the magnitude of the estimated angular

momentum is close to zero, the opposite sign of the last

estimated torque is considered to reduce zero crossing time.

3.2 Residual Signal Generation

We deﬁne the residual signal r∈RNS×1as follows

rkH1ˆ

xk−H2zT

k˜

TT

Rf;kT,(28)

where H1=[

0NS×3INS×NS], H2=[

0NS×6INS×NS],

and NS= 3+2NR.˜

TT

Rf =[

˜

TRf1... ˜

TRfNR] in (28)

stands for the “pseudo-measured” friction torque vector,

with ˜

TRfibeing calculated using the RW friction torque

model (5), which depends on the estimated angular rate

of the RW, i.e.,

˜

TRfi=−µ1tanh (ˆωRi)−µ2sign( ˆωRi)|ˆωRi|1.25 .(29)

Remark 2. It can be see n from (28) that attitude-related

residuals are not generated. Such residuals could be used,

for instance, to detect and isolate faults aﬀecting STRs.

3.3 Fault Detection Algorithm

The residual signal deﬁned in (28) has in total NS=3+

2NRcomponents. To detect fault presence, we employ the

well-known GLR test to detect changes in the mean value

of each residual component ri,i∈S

S{1,2,...,N

S}.

The GLR algorithm evaluates the log-likelihood between

two hypotheses H0(fault-free case) and H1(faulty case).

It works at discrete time instances kand with a moving

time window M. If the ith residual signal sequence can

be assumed independent and Gaussian, then the decision

function for the ith residual signal is given as follows

Blanke et al. (2006)

gM

i(k)= 1

2σ2

0iMk

j=k−M−1

(ri(j)−µ0i)2

,(30)

where µ0iand σ0iis the mean and standard deviation of

the ith residual signal in fault-free case, respectively.

Finally, the decision test for the ith residual signal is

deﬁned as follows

λi(k)=1,if gM

i(k)≥Υi

0 if gM

i(k)<Υi(31)

where Υi>0 is a ﬁxed threshold selected by the designer.

3.4 Fault Isolation Algorithm

Once a fault is detected, the FDI system must identify

in which actuator or sensor the fault has occurred. The

isolation logic is achieved by comparing a decision vector

λ[λ1... λ

NS]T(32)

with the columns of a pre-deﬁned fault signature matrix

MS∈RNS×(1+2NR)represented in Table 1. The columns

of this table represent fault signatures, which unequivo-

cally link the faults to the symptoms detected during the

system monitoring. The decision vector corresponding to

the actual “correct” fault signature is denoted as λc.

Table 1. Fault signatures.

Thruster RW sensor fault RW friction fault

fault 1 ... NR1... NR

ωSX - - - - - -

ωR1- X - - - - -

.

.

....

ωRNR- - - X - - -

TRf1- X - - X - -

.

.

.......

TRfNR- - - X - - X

Remark 3. It is obvious from Table 1 that thruster fault

isolation was not considered. Thruster fault isolation was

extensively tackled in the literature, see for instance Fonod

et al. (2015b); Pittet et al. (2016) and references therein.

4. SIMULATION RESULTS

Realistic s/c parameters and assumptions are considered

for simulation purposes. We assume a set of NR=4

identical (JRi=JR,∀i∈S

R) RWs placed in a classical

pyramidal conﬁguration with a tilt angle α. Thus, the

nominal RW conﬁguration matrix is given by

MR=cos(α)0−cos(α)0

0 cos(α)0−cos(α)

sin(α) sin(α) sin(α) sin(α).

Furthermore, a set of NT= 12 identical (FNi=FN,∀i∈

ST) thrusters is considered, which can generate torques in

all three degrees of freedom.

The FDI strategy presented in the previous section is

implemented in the GAFE 1,aMatlab/Simulink based

simulator for early phase FDI and Recovery (FDIR) design

and veriﬁcation & validation. Some relevant s/c and FDI

related parameters are summarized in Table 2.

1See the GAFE framework: http://gafe.estec.esa.int/

2019 IFAC ACA

August 27-30, 2019. Cranfield, UK

439

E. Lopez-Encarnacion et al. / IFAC PapersOnLine 52-12 (2019) 436–441 439

that in the measurement noise covariance matrix R, the

measurement noise variances of the STRs are divided by

4 to account for the Gibbs vector transformation.

The Gibbs vector δˆ

gis transformed into the global atti-

tude representation, while preserving the unity quaternion

constraints, using

ˆ

qk=1

1+δˆ

gk2δˆ

gk

1⊗ˆ

q−

k(25)

After each measurement update, δˆ

gneeds to be reset to

zero explicitly, i.e., δˆ

g=03×1.

In this paper, we modify the standard measurement up-

date step equation of the Kalman ﬁlter to account for

proper implementation of the friction torque estimate

ˆ

TRfi, i.e., the ith friction torque estimate is updated as

follows ˆ

TRfi;k=ˆ

Tsgn

Rfi;kˆ

Tmag

Rfi;k,(26)

where the sign of the friction torque estimate is determined

by

ˆ

Tsgn

Rfi;k=−sign ˆcRi;k−1if JRiˆωRi;k<γ

−sign ˆωRi;k−1otherwise (27)

where γ>0 is a ﬁxed threshold accounting for the

RW’s friction characteristics. Finally, the magnitude of the

friction torque is computed as

ˆ

Tmag

Rfi;k=ˆ

x−

kTRfi+ˆ

Tsgn

Rfi;kKkzk−h(ˆ

x−

k)TRfi

where ·TRfipulls out the element associated with TRfi

from the enclosed vector.

Remark 1. The sign of the estimated friction torque, see

(27), is assumed to be opposite to the sign of the estimated

angular rate. However, if the physical angular momentum

is close to zero, the sign of the physical friction torque is

not clear. Thus, if the magnitude of the estimated angular

momentum is close to zero, the opposite sign of the last

estimated torque is considered to reduce zero crossing time.

3.2 Residual Signal Generation

We deﬁne the residual signal r∈RNS×1as follows

rkH1ˆ

xk−H2zT

k˜

TT

Rf;kT,(28)

where H1=[

0NS×3INS×NS], H2=[

0NS×6INS×NS],

and NS= 3+2NR.˜

TT

Rf =[

˜

TRf1... ˜

TRfNR] in (28)

stands for the “pseudo-measured” friction torque vector,

with ˜

TRfibeing calculated using the RW friction torque

model (5), which depends on the estimated angular rate

of the RW, i.e.,

˜

TRfi=−µ1tanh (ˆωRi)−µ2sign( ˆωRi)|ˆωRi|1.25 .(29)

Remark 2. It can be see n from (28) that attitude-related

residuals are not generated. Such residuals could be used,

for instance, to detect and isolate faults aﬀecting STRs.

3.3 Fault Detection Algorithm

The residual signal deﬁned in (28) has in total NS=3+

2NRcomponents. To detect fault presence, we employ the

well-known GLR test to detect changes in the mean value

of each residual component ri,i∈S

S{1,2,...,N

S}.

The GLR algorithm evaluates the log-likelihood between

two hypotheses H0(fault-free case) and H1(faulty case).

It works at discrete time instances kand with a moving

time window M. If the ith residual signal sequence can

be assumed independent and Gaussian, then the decision

function for the ith residual signal is given as follows

Blanke et al. (2006)

gM

i(k)= 1

2σ2

0iMk

j=k−M−1

(ri(j)−µ0i)2

,(30)

where µ0iand σ0iis the mean and standard deviation of

the ith residual signal in fault-free case, respectively.

Finally, the decision test for the ith residual signal is

deﬁned as follows

λi(k)=1,if gM

i(k)≥Υi

0 if gM

i(k)<Υi(31)

where Υi>0 is a ﬁxed threshold selected by the designer.

3.4 Fault Isolation Algorithm

Once a fault is detected, the FDI system must identify

in which actuator or sensor the fault has occurred. The

isolation logic is achieved by comparing a decision vector

λ[λ1... λ

NS]T(32)

with the columns of a pre-deﬁned fault signature matrix

MS∈RNS×(1+2NR)represented in Table 1. The columns

of this table represent fault signatures, which unequivo-

cally link the faults to the symptoms detected during the

system monitoring. The decision vector corresponding to

the actual “correct” fault signature is denoted as λc.

Table 1. Fault signatures.

Thruster RW sensor fault RW friction fault

fault 1 ... NR1... NR

ωSX - - - - - -

ωR1- X - - - - -

.

.

....

ωRNR- - - X - - -

TRf1- X - - X - -

.

.

.......

TRfNR- - - X - - X

Remark 3. It is obvious from Table 1 that thruster fault

isolation was not considered. Thruster fault isolation was

extensively tackled in the literature, see for instance Fonod

et al. (2015b); Pittet et al. (2016) and references therein.

4. SIMULATION RESULTS

Realistic s/c parameters and assumptions are considered

for simulation purposes. We assume a set of NR=4

identical (JRi=JR,∀i∈S

R) RWs placed in a classical

pyramidal conﬁguration with a tilt angle α. Thus, the

nominal RW conﬁguration matrix is given by

MR=cos(α)0−cos(α)0

0 cos(α)0−cos(α)

sin(α) sin(α) sin(α) sin(α).

Furthermore, a set of NT= 12 identical (FNi=FN,∀i∈

ST) thrusters is considered, which can generate torques in

all three degrees of freedom.

The FDI strategy presented in the previous section is

implemented in the GAFE 1,aMatlab/Simulink based

simulator for early phase FDI and Recovery (FDIR) design

and veriﬁcation & validation. Some relevant s/c and FDI

related parameters are summarized in Table 2.

1See the GAFE framework: http://gafe.estec.esa.int/

2019 IFAC ACA

August 27-30, 2019. Cranfield, UK

439

440 E. Lopez-Encarnacion et al. / IFAC PapersOnLine 52-12 (2019) 436–441

Table 2. Spacecraft and FDI parameters.

Param. Value Unit Param. Value Unit

FN1 N απ/12 rad

JR0.108 kgm2TD1.6·10−4Nm

µ10.005 - µ210−5-

ε10−9-γ0.001 kgm2s−1

M10 s σF5·10−5N

σRa 0.003 Nm σRf 4·10−6Nm

σstr diag(3.43.49.2) ·10−7rad σRm 0.21 rad/s

σrmu 5.7·10−7rad/s

In the simulated scenario, the s/c is placed in a halo

orbit around L2, the second Lagrange point of the Sun-

Earth system. In this orbit, the main disturbance torque

(TDTD) aﬀecting the s/c is the solar radiation

pressure, which is assumed to be constant. The simulated

scenario comprises four (shorten) inertially-ﬁxed observa-

tion phases connected by three attitude slews, see Fig. 1.

The total duration of the scenario is approx. 9000 s.

0 1000 2000 3000 4000 5000 6000 7000 8000 9000

Time [s]

-80

-60

-40

-20

0

20

Attitude Euler Angle [°]

X

Y

Z

Fig. 1. Time evolution of the spacecraft’s attitude.

4.1 FDI Performance Indices

The performance of the proposed FDI strategy is evaluated

in terms of the following indices:

Correct detection: a fault is correctly detected if λ=λc.

False alarm: a false alarm occurs if λc=0NS×1and

λi= 1 for any i∈S

S.

Miss detection: a fault is miss-detected if a detectable

fault 2occurs, i.e., λc=0NS×1, and λ=0NS×1through-

out the entire simulation.

Correct/Miss isolation at

•equipment level: a fault is correctly/miss identiﬁed

to be either in the thrusters or in the RWs.

•component level: if fault is correctly/miss identiﬁed

to be due to a particular faulty tachometer or due to

an increase of the RW friction torque (only for RWs).

Detection time for

•thrusters (leakage and stuck-open) and RWs:

time between fault occurrence and its detection.

•thrusters (LoE and stuck-closed): time between

the faulty thruster is activated for the ﬁrst time after

fault occurrence and time of fault detection.

4.2 Sample Run Simulation Example

A sample test case scenario, where a friction torque fault

is introduced at tf= 2090.9 s for the 2nd RW with

mv= 17.98 and mc=5.05, is considered here. Figure 2

depicts the resulting residuals for nominal s/c values. It

can be observed from this ﬁgure that around t= 2100 s,

the residual corresponding to the 2nd RW friction torque

increases considerably. The eﬀect is even more clear when

examining Fig. 3, which shows the associated GLR signals

together with the ﬁxed thresholds (constant horizontal

lines matching the GLR signals’ color code).

2A fault is detectable if it has an actual eﬀect on the spacecraft.

-2

0

2

4

610

-6

[rad/s]

X Y Z

-50

0

50

100

150

[rpm]

R1 R2 R3 R4

0 1000 2000 3000 4000 5000 6000 7000 8000 9000

Time [s]

-0.1

0

0.1

[Nm]

Tfr1 Tfr2 Tfr3 Tfr4

Fig. 2. Time evolution of the residual signals.

0

50 X Y Z

0

50

100

150

R1 R2 R3 R4

0 1000 2000 3000 4000 5000 6000 7000 8000 9000

Time [s]

10

0

Tfr1 Tfr2 Tfr3 Tfr4

Fig. 3. Time evolution of the GLR signals vs. thresholds.

The proposed FDI strategy correctly reports the fault

presence at t= 2091.8 s (0.9 s detection delay) and

also correctly identiﬁes the aﬀected equipment (RWs) and

component (increased friction in the 2nd RW).

4.3 Monte Carlo Analysis

Two Monte Carlo (MC) campaigns are presented next.

The ﬁrst (second) campaign aims at demonstrating the

FDI performance without (with) considering model un-

certainties. Both campaigns assume measurement noises

and consist of 150 simulation runs per fault type. In

each run, the time of fault occurrence (tf) and the fault

magnitudes (mi,i∈{leak , loe, meas, v, c}) vary uniformly

in the deﬁned interval, see Table 3.

Table 3. MC-related parameters.

Parameter Value Unit Parameter Value Unit

tf(0,7500] s mleak (0,0.5] N/A

mloe (0,0.5] N/A mmeas (1,3] N/A

mv(1,20] N/A mc(1,9] N/A

σJ5 % σ

R0.1◦

σ

str 0.001 ◦σ

rmu 0.01 ◦

σ

T0.5◦

The model uncertainties follow a normal distribution with

standard deviations given in Table 3. Here, σJand σ

str,

σ

rmu,σ

T,σ

Ris the standard deviation of the s/c principal

moments of inertia and of the misalignment angles () for

the two STRs, RMU, thrusters, and RWs, respectively. It

should be noted that the implemented FDI strategy was

tuned for the uncertainty-free scenario.

The results for the MC campaign without and with uncer-

tainties is summarized in Table 4 and Table 5, respectively.

Selected fault scenarios are visualized in Figs. 4-5. Clearly,

the introduction of uncertainties increases the amount of

false alarm cases, thus decreases the correct detection

and isolation ratios. It is interesting to notice that stuck-

closed/open thruster faults present similar behaviour in

terms of correct detection and equipment isolation ratios,

but they diverge in the mean detection time. This is likely

because some thrusters, for certain attitude slews, are re-

quired to be open 95% of the time. Thus, a stuck-open fault

2019 IFAC ACA

August 27-30, 2019. Cranfield, UK

440

(open 100% of the time) does not produce a signiﬁcant

diﬀerence with respect to the fault-free behaviour. Similar

phenomenon occurs when a stuck-closed thruster is not

commanded. However, the eﬀect of this is not present

in the reported tables thanks to the careful deﬁnition of

the ”detection time” for stuck-closed fault, see Sec. 4.1.

Thruster leakage shows relatively high ratio of correct

detections, but also quite high detection time and low ratio

of correct equipment isolations. This is due to the fact

that some cases were run with mleak close to zero, which

produced very small amount of torque, see Fig. 4. Similar

reasoning holds for LoE fault type when mloe is very small

and its eﬀect on the s/c is negligible. Regarding RW faults,

in general, very good results can be observed for correct

detection/isolation ratios and for mean detection times.

The large variance associated with the detection time of

the friction fault is caused by a single simulation case,

where the Coulomb factor was increased only by 1.4% and

its time to detection was 100 times greater than the rest

of the simulation cases. The detection time of the RW

tachometer fault does not show any correlation with the

magnitude of the fault, see Fig. 5. It can be also seen

that the fault type (friction or tachometer fault) is not

correctly isolated when a slew in X-axis is performed, but

this only occurs for ﬁve cases. More tests would be required

to conﬁrm any clear correlation.

Table 4. MC campaign without uncertainties.

Thruster faults RW faults

Leak. LoE Closed Open Frict. Meas.

Correct detection [%] 99.33 87.33 100 100 100 100

Detection time [s]

(mean/std. deviation)

451.06/

1444

16.38/

47.43

1.63/

5.05

7.93/

51.63

3.59/

21.01

0.155/

0.0489

Corr. equip. isol. [%] 71.33 87.33 100 100 100 100

Corr. comp. isol. [%] N/A N/A N/A N/A 100 96.67

Miss detection [%] 0.67 12.67 0 0 0 0

Equip. miss isol. [%] 28.66 0 0 0 0 0

Comp. miss isol. [%] N/A N/A N/A N/A 0 3.33

False alarm [%] 0 0 0 0 0 0

Table 5. MC campaign with uncertainties.

Fault Thruster faults RW faults

free Leak. LoE Closed Op en Frict. Meas.

Correct detection [%] N/A 66 67.33 76.47 79.33 80 89.26

Detection time [s]

(mean/std. deviation) N/A 685.83/

2.37e3

26.06/

484.34

1.93/

17.89

4.50/

29.93

1.41/

0.73

0.16/

0.054

Corr. equip. isol. [%] N/A 44.67 67.33 76.47 79.33 80 84.56

Corr. comp. isol. [%] N/A N/A N/A N/A N/A 76.67 82.55

Miss detection [%] N/A 5.33 12.67 0 0 0 0

Equip. miss isol. [%] N/A 21.33 0 0 0 0 4.69

Comp. miss isol. [%] N/A N/A N/A N/A N/A 3.33 2.01

False alarm [%] 25.3 28.67 20 25.53 20.67 20 10.74

0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 0.5

mleak

100

101

102

103

Time to Detection [s]

Not isolated

Isolated

Fig. 4. MC results for thruster leakage faults.

5. CONCLUSIONS

An FDI strategy to detect and isolate a class of AOCS

faults for an agile spacecraft is presented. The strategy

diﬀers from usual schemes by being able to handle mul-

tiple actuators working simultaneously and to distinguish

diﬀerent types of faults of the same equipment. The per-

formance of the proposed FDI scheme is evaluated with

1 1.2 1.4 1.6 1.8 2 2.2 2.4 2.6 2.8 3

mmeas

0.1

0.2

0.3

0.4

0.5

0.6

Time to Detection [s]

Fault Type Isolated

Fault Type not-Isolated

Fig. 5. MC results for the RW tachometer faults.

respect to various noise sources and uncertainties. MC

simulation results revealed promising results in terms of

good detection/isolation rates and short detection times.

REFERENCES

Blanke, M., Kinnaert, M., Lunze, J., and Staroswiecki, M.

(2006). Fault diagnosis of continuous-variable systems,

189–298. Springer Berlin Heidelberg, Berlin, Heidelberg.

Fonod, R., Henry, D., Charbonnel, C., and Bornschlegl, E.

(2015a). Position and Attitude Model-Based Thruster

Fault Diagnosis: A Comparison Study. Journal of

Guidance, Control, and Dynamics, 38(6), 1012–1026.

Fonod, R., Henry, D., Charbonnel, C., Bornschlegl, E.,

Losa, D., and Bennani, S. (2015b). Robust FDI for fault-

tolerant thrust allocation with application to spacecraft

rendezvous. Control Engineering Practice, 42, 12–27.

Hou, Q., Cheng, Y., Lu, N., and Jiang, B. (2008). Study on

FDD and FTC of satellite attitude control system based

on the eﬀectiveness factor. In Proc. 2nd Int. Symp. on

Syst. and Contr. in Aerosp. and Astron., 1096–1101.

Markley, F.L. (2004). Multiplicative vs. additive ﬁltering

for spacecraft attitude determination. Dynamics and

Control of Systems and Structures in Space, (467-474).

Marzat, J., Piet-Lahanier, H., Damongeot, F., and Walter,

E. (2012). Model-based fault diagnosis for aerospace

systems: a survey. Proc. of the Institution of Mechanical

Engineers, Part G, 226(10), 1329–1360.

Meskin, N. and Khorasani, K. (2007). Fault detection and

isolation in a redundant reaction wheels conﬁguration

of a satellite. In IEEE International Conference on

Systems, Man and Cybernetics, 3153–3158.

Patton, R., Uppal, F., Simani, S., and Polle, B. (2008).

Reliable fault diagnosis scheme for a spacecraft attitude

control system. Proc. of the Institution of Mechanical

Engineers, Part O, 222(2), 139–152.

Pittet, C., Falcoz, A., and Henry, D. (2016). A Model-

based diagnosis method for transient and multiple faults

of AOCS thrusters. IFAC-PapersOnLine, 49(17), 82–87.

Venkateswaran, N., Siva, M., and Goel, P. (2002). Analyt-

ical redundancy based fault detection of gyroscopes in

spacecraft applications. Acta Astronautica, 50(9).

2019 IFAC ACA

August 27-30, 2019. Cranfield, UK

441

E. Lopez-Encarnacion et al. / IFAC PapersOnLine 52-12 (2019) 436–441 441

(open 100% of the time) does not produce a signiﬁcant

diﬀerence with respect to the fault-free behaviour. Similar

phenomenon occurs when a stuck-closed thruster is not

commanded. However, the eﬀect of this is not present

in the reported tables thanks to the careful deﬁnition of

the ”detection time” for stuck-closed fault, see Sec. 4.1.

Thruster leakage shows relatively high ratio of correct

detections, but also quite high detection time and low ratio

of correct equipment isolations. This is due to the fact

that some cases were run with mleak close to zero, which

produced very small amount of torque, see Fig. 4. Similar

reasoning holds for LoE fault type when mloe is very small

and its eﬀect on the s/c is negligible. Regarding RW faults,

in general, very good results can be observed for correct

detection/isolation ratios and for mean detection times.

The large variance associated with the detection time of

the friction fault is caused by a single simulation case,

where the Coulomb factor was increased only by 1.4% and

its time to detection was 100 times greater than the rest

of the simulation cases. The detection time of the RW

tachometer fault does not show any correlation with the

magnitude of the fault, see Fig. 5. It can be also seen

that the fault type (friction or tachometer fault) is not

correctly isolated when a slew in X-axis is performed, but

this only occurs for ﬁve cases. More tests would be required

to conﬁrm any clear correlation.

Table 4. MC campaign without uncertainties.

Thruster faults RW faults

Leak. LoE Closed Open Frict. Meas.

Correct detection [%] 99.33 87.33 100 100 100 100

Detection time [s]

(mean/std. deviation)

451.06/

1444

16.38/

47.43

1.63/

5.05

7.93/

51.63

3.59/

21.01

0.155/

0.0489

Corr. equip. isol. [%] 71.33 87.33 100 100 100 100

Corr. comp. isol. [%] N/A N/A N/A N/A 100 96.67

Miss detection [%] 0.67 12.67 0 0 0 0

Equip. miss isol. [%] 28.66 0 0 0 0 0

Comp. miss isol. [%] N/A N/A N/A N/A 0 3.33

False alarm [%] 0 0 0 0 0 0

Table 5. MC campaign with uncertainties.

Fault Thruster faults RW faults

free Leak. LoE Closed Op en Frict. Meas.

Correct detection [%] N/A 66 67.33 76.47 79.33 80 89.26

Detection time [s]

(mean/std. deviation) N/A 685.83/

2.37e3

26.06/

484.34

1.93/

17.89

4.50/

29.93

1.41/

0.73

0.16/

0.054

Corr. equip. isol. [%] N/A 44.67 67.33 76.47 79.33 80 84.56

Corr. comp. isol. [%] N/A N/A N/A N/A N/A 76.67 82.55

Miss detection [%] N/A 5.33 12.67 0 0 0 0

Equip. miss isol. [%] N/A 21.33 0 0 0 0 4.69

Comp. miss isol. [%] N/A N/A N/A N/A N/A 3.33 2.01

False alarm [%] 25.3 28.67 20 25.53 20.67 20 10.74

0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 0.5

m

leak

100

101

102

103

Time to Detection [s]

Not isolated

Isolated

Fig. 4. MC results for thruster leakage faults.

5. CONCLUSIONS

An FDI strategy to detect and isolate a class of AOCS

faults for an agile spacecraft is presented. The strategy

diﬀers from usual schemes by being able to handle mul-

tiple actuators working simultaneously and to distinguish

diﬀerent types of faults of the same equipment. The per-

formance of the proposed FDI scheme is evaluated with

1 1.2 1.4 1.6 1.8 2 2.2 2.4 2.6 2.8 3

m

meas

0.1

0.2

0.3

0.4

0.5

0.6

Time to Detection [s]

Fault Type Isolated

Fault Type not-Isolated

Fig. 5. MC results for the RW tachometer faults.

respect to various noise sources and uncertainties. MC

simulation results revealed promising results in terms of

good detection/isolation rates and short detection times.

REFERENCES

Blanke, M., Kinnaert, M., Lunze, J., and Staroswiecki, M.

(2006). Fault diagnosis of continuous-variable systems,

189–298. Springer Berlin Heidelberg, Berlin, Heidelberg.

Fonod, R., Henry, D., Charbonnel, C., and Bornschlegl, E.

(2015a). Position and Attitude Model-Based Thruster

Fault Diagnosis: A Comparison Study. Journal of

Guidance, Control, and Dynamics, 38(6), 1012–1026.

Fonod, R., Henry, D., Charbonnel, C., Bornschlegl, E.,

Losa, D., and Bennani, S. (2015b). Robust FDI for fault-

tolerant thrust allocation with application to spacecraft

rendezvous. Control Engineering Practice, 42, 12–27.

Hou, Q., Cheng, Y., Lu, N., and Jiang, B. (2008). Study on

FDD and FTC of satellite attitude control system based

on the eﬀectiveness factor. In Proc. 2nd Int. Symp. on

Syst. and Contr. in Aerosp. and Astron., 1096–1101.

Markley, F.L. (2004). Multiplicative vs. additive ﬁltering

for spacecraft attitude determination. Dynamics and

Control of Systems and Structures in Space, (467-474).

Marzat, J., Piet-Lahanier, H., Damongeot, F., and Walter,

E. (2012). Model-based fault diagnosis for aerospace

systems: a survey. Proc. of the Institution of Mechanical

Engineers, Part G, 226(10), 1329–1360.

Meskin, N. and Khorasani, K. (2007). Fault detection and

isolation in a redundant reaction wheels conﬁguration

of a satellite. In IEEE International Conference on

Systems, Man and Cybernetics, 3153–3158.

Patton, R., Uppal, F., Simani, S., and Polle, B. (2008).

Reliable fault diagnosis scheme for a spacecraft attitude

control system. Proc. of the Institution of Mechanical

Engineers, Part O, 222(2), 139–152.

Pittet, C., Falcoz, A., and Henry, D. (2016). A Model-

based diagnosis method for transient and multiple faults

of AOCS thrusters. IFAC-PapersOnLine, 49(17), 82–87.

Venkateswaran, N., Siva, M., and Goel, P. (2002). Analyt-

ical redundancy based fault detection of gyroscopes in

spacecraft applications. Acta Astronautica, 50(9).

2019 IFAC ACA

August 27-30, 2019. Cranfield, UK

441