Model-based FDI for Agile Spacecraft with Multiple Actuators Working Simultaneously

Abstract

Fast and large-angle attitude slew maneuvers often imply simultaneous use of multiple actuators such as thrusters and reaction wheels (RWs). A fault in any of these actuators might lead to partial or full damage of sensitive spacecraft instruments. In this paper, a model-based Fault Detection and Isolation (FDI) strategy is proposed, which aims at detecting various actuator faults, such as stuck-open/closed thruster, thruster leakage, loss of effectiveness of all thrusters, and change of RW friction torque due to change of Coulomb and/or viscosity factor. The proposed FDI strategy is also able to detect and isolate faults affecting the RWs tachometer sensor. The FDI system design is based on a multiplicative extended Kalman filter and a generalized likelihood ratio thresholding of the residual signals. The performance and robustness of the proposed FDI strategy is evaluated using Monte Carlo simulations and carefully defined FDI performance indices. Preliminary results suggest promising performance in terms of detection/isolation times, miss-detection/isolation rates, and false alarm rates.

Full text

IFAC PapersOnLine 52-12 (2019) 436–441
ScienceDirect
Available online at www.sciencedirect.com
2405-8963 Copyright © 2019. The Authors. Published by Elsevier Ltd. All rights reserved.
Peer review under responsibility of International Federation of Automatic Control.
10.1016/j.ifacol.2019.11.282
10.1016/j.ifacol.2019.11.282 2405-8963
Model-based FDI for Agile Spacecraft with
Multiple Actuators Working
Simultaneously
E. Lopez-Encarnacion ∗,R. Fonod ∗,P. Bergner ∗∗
∗Delft University of Technology, 2629 HS Delft, The Netherlands
(e-mail: ericlopen@gmail.com, r.fonod@tudelft.nl)
∗∗ Airbus Defence and Space, 88090 Immenstaad am Bodensee,
Germany (e-mail: patrick.bergner@airbus.com)
Abstract: Fast and large-angle attitude slew maneuvers often imply simultaneous use of
multiple actuators such as thrusters and reaction wheels (RWs). A fault in any of these actuators
might lead to partial or full damage of sensitive spacecraft instruments. In this paper, a model-
based Fault Detection and Isolation (FDI) strategy is proposed, which aims at detecting various
actuator faults, such as stuck-open/closed thruster, thruster leakage, loss of effectiveness of
all thrusters, and change of RW friction torque due to change of Coulomb and/or viscosity
factor. The proposed FDI strategy is also able to detect and isolate faults affecting the RWs
tachometer sensor. The FDI system design is based on a multiplicative extended Kalman filter
and a generalized likelihood ratio thresholding of the residual signals. The performance and
robustness of the proposed FDI strategy is evaluated using Monte Carlo simulations and carefully
defined FDI performance indices. Preliminary results suggest promising performance in terms
of detection/isolation times, miss-detection/isolation rates, and false alarm rates.
Keywords: Fault Detection and Isolation; Agile Spacecraft; Reaction Wheels; Thrusters.
1. INTRODUCTION
Spacecraft agility, meaning the capability of the spacecraft
to change its attitude by performing fast attitude slew
maneuvers or to follow a given attitude profile with high
precision, is becoming more and more important for future
space missions. These requirements demand the spacecraft
to be equipped with actuators, such as thrusters and
reaction wheels (RWs), capable of generating high reaction
torques and perform attitude maneuvers with high angular
rates. The control of the spacecraft attitude is achieved by
the Attitude and Orbit Control System (AOCS), which
includes sensors and actuators that are not exempt of
faults. An incorrect AOCS fault management may cause
severe degradation of the spacecraft performance and/or
cause damage to sensitive spacecraft instruments.
A quick Fault Detection and Isolation (FDI) system is cru-
cial for a successful fault recovery action (e.g., switching to
redundant hardware and/or employing a new controller).
Model-based FDI techniques, in general, gained a great
deal of attention in the past decades and, in particular,
they show great potential for aerospace applications, see
Marzat et al. (2012) for a recent survey. The majority of
published works on AOCS fault diagnosis focuses on faults
occurring in a particular type of actuator or a particular
type of sensor. For instance, sole thruster and RW faults
were studied in Fonod et al. (2015b) and in Meskin and
Khorasani (2007), respectively. Gyroscope sensor faults
were studied in Venkateswaran et al. (2002). Only very
few examples of model-based FDI systems dealing with
a combination of different type of actuators or sensors
exist for agile spacecraft. Patton et al. (2008) considered
gyroscope and thruster faults, whereas Hou et al. (2008)
focused on gyroscope and RW faults combinations.
An example of agile spacecraft that makes use of multi-
ple actuators working simultaneously is the Athena (Ad-
vanced Telescope for High-ENergy Astrophysics) space-
craft, an L-class mission of the European Space Agency,
which aims at addressing the Hot and Energetic Universe
science theme. The Athena spacecraft is required to be
agile in order to rapidly re-point its instruments, while pro-
tecting its sensitive instruments from direct sun light. The
attitude re-pointing may imply realization of fast large-
angle attitude slews. To perform such slews, the Athena
spacecraft is equipped with a set of thrusters and RWs to
provide accurate control torques.
Torques generated by RWs and thrusters may have similar
impact on the spacecraft dynamics. Therefore, a fault in
any of these actuators might produce a similar effect on the
spacecraft dynamics. Thus, the isolation part of an FDI
system design becomes challenging since no sensors can
directly measure the delivered torques by such actuators.
In this paper, we propose a standalone FDI strategy
capable of detecting and isolating certain faults occurring
in the thrusters, RWs, and RW tachometer sensors.
2. PROBLEM FORMULATION
In this paper, we assume the spacecraft (s/c) is equipped
with a set of NTthrusters and a set of NRRWs, which
may suffer from various faults detailed in the sequel.
21st IFAC Symposium on Automatic Control in Aerospace
August 27-30, 2019. Cranfield, UK
Copyright © 2019 IFAC 436
Model-based FDI for Agile Spacecraft with
Multiple Actuators Working
Simultaneously
E. Lopez-Encarnacion ∗,R. Fonod ∗,P. Bergner ∗∗
∗Delft University of Technology, 2629 HS Delft, The Netherlands
(e-mail: ericlopen@gmail.com, r.fonod@tudelft.nl)
∗∗ Airbus Defence and Space, 88090 Immenstaad am Bodensee,
Germany (e-mail: patrick.bergner@airbus.com)
Abstract: Fast and large-angle attitude slew maneuvers often imply simultaneous use of
multiple actuators such as thrusters and reaction wheels (RWs). A fault in any of these actuators
might lead to partial or full damage of sensitive spacecraft instruments. In this paper, a model-
based Fault Detection and Isolation (FDI) strategy is proposed, which aims at detecting various
actuator faults, such as stuck-open/closed thruster, thruster leakage, loss of effectiveness of
all thrusters, and change of RW friction torque due to change of Coulomb and/or viscosity
factor. The proposed FDI strategy is also able to detect and isolate faults affecting the RWs
tachometer sensor. The FDI system design is based on a multiplicative extended Kalman filter
and a generalized likelihood ratio thresholding of the residual signals. The performance and
robustness of the proposed FDI strategy is evaluated using Monte Carlo simulations and carefully
defined FDI performance indices. Preliminary results suggest promising performance in terms
of detection/isolation times, miss-detection/isolation rates, and false alarm rates.
Keywords: Fault Detection and Isolation; Agile Spacecraft; Reaction Wheels; Thrusters.
1. INTRODUCTION
Spacecraft agility, meaning the capability of the spacecraft
to change its attitude by performing fast attitude slew
maneuvers or to follow a given attitude profile with high
precision, is becoming more and more important for future
space missions. These requirements demand the spacecraft
to be equipped with actuators, such as thrusters and
reaction wheels (RWs), capable of generating high reaction
torques and perform attitude maneuvers with high angular
rates. The control of the spacecraft attitude is achieved by
the Attitude and Orbit Control System (AOCS), which
includes sensors and actuators that are not exempt of
faults. An incorrect AOCS fault management may cause
severe degradation of the spacecraft performance and/or
cause damage to sensitive spacecraft instruments.
A quick Fault Detection and Isolation (FDI) system is cru-
cial for a successful fault recovery action (e.g., switching to
redundant hardware and/or employing a new controller).
Model-based FDI techniques, in general, gained a great
deal of attention in the past decades and, in particular,
they show great potential for aerospace applications, see
Marzat et al. (2012) for a recent survey. The majority of
published works on AOCS fault diagnosis focuses on faults
occurring in a particular type of actuator or a particular
type of sensor. For instance, sole thruster and RW faults
were studied in Fonod et al. (2015b) and in Meskin and
Khorasani (2007), respectively. Gyroscope sensor faults
were studied in Venkateswaran et al. (2002). Only very
few examples of model-based FDI systems dealing with
a combination of different type of actuators or sensors
exist for agile spacecraft. Patton et al. (2008) considered
gyroscope and thruster faults, whereas Hou et al. (2008)
focused on gyroscope and RW faults combinations.
An example of agile spacecraft that makes use of multi-
ple actuators working simultaneously is the Athena (Ad-
vanced Telescope for High-ENergy Astrophysics) space-
craft, an L-class mission of the European Space Agency,
which aims at addressing the Hot and Energetic Universe
science theme. The Athena spacecraft is required to be
agile in order to rapidly re-point its instruments, while pro-
tecting its sensitive instruments from direct sun light. The
attitude re-pointing may imply realization of fast large-
angle attitude slews. To perform such slews, the Athena
spacecraft is equipped with a set of thrusters and RWs to
provide accurate control torques.
Torques generated by RWs and thrusters may have similar
impact on the spacecraft dynamics. Therefore, a fault in
any of these actuators might produce a similar effect on the
spacecraft dynamics. Thus, the isolation part of an FDI
system design becomes challenging since no sensors can
directly measure the delivered torques by such actuators.
In this paper, we propose a standalone FDI strategy
capable of detecting and isolating certain faults occurring
in the thrusters, RWs, and RW tachometer sensors.
2. PROBLEM FORMULATION
In this paper, we assume the spacecraft (s/c) is equipped
with a set of NTthrusters and a set of NRRWs, which
may suffer from various faults detailed in the sequel.
21st IFAC Symposium on Automatic Control in Aerospace
August 27-30, 2019. Cranfield, UK
Copyright © 2019 IFAC 436
Model-based FDI for Agile Spacecraft with
Multiple Actuators Working
Simultaneously
E. Lopez-Encarnacion ∗,R. Fonod ∗,P. Bergner ∗∗
∗Delft University of Technology, 2629 HS Delft, The Netherlands
(e-mail: ericlopen@gmail.com, r.fonod@tudelft.nl)
∗∗ Airbus Defence and Space, 88090 Immenstaad am Bodensee,
Germany (e-mail: patrick.bergner@airbus.com)
Abstract: Fast and large-angle attitude slew maneuvers often imply simultaneous use of
multiple actuators such as thrusters and reaction wheels (RWs). A fault in any of these actuators
might lead to partial or full damage of sensitive spacecraft instruments. In this paper, a model-
based Fault Detection and Isolation (FDI) strategy is proposed, which aims at detecting various
actuator faults, such as stuck-open/closed thruster, thruster leakage, loss of effectiveness of
all thrusters, and change of RW friction torque due to change of Coulomb and/or viscosity
factor. The proposed FDI strategy is also able to detect and isolate faults affecting the RWs
tachometer sensor. The FDI system design is based on a multiplicative extended Kalman filter
and a generalized likelihood ratio thresholding of the residual signals. The performance and
robustness of the proposed FDI strategy is evaluated using Monte Carlo simulations and carefully
defined FDI performance indices. Preliminary results suggest promising performance in terms
of detection/isolation times, miss-detection/isolation rates, and false alarm rates.
Keywords: Fault Detection and Isolation; Agile Spacecraft; Reaction Wheels; Thrusters.
1. INTRODUCTION
Spacecraft agility, meaning the capability of the spacecraft
to change its attitude by performing fast attitude slew
maneuvers or to follow a given attitude profile with high
precision, is becoming more and more important for future
space missions. These requirements demand the spacecraft
to be equipped with actuators, such as thrusters and
reaction wheels (RWs), capable of generating high reaction
torques and perform attitude maneuvers with high angular
rates. The control of the spacecraft attitude is achieved by
the Attitude and Orbit Control System (AOCS), which
includes sensors and actuators that are not exempt of
faults. An incorrect AOCS fault management may cause
severe degradation of the spacecraft performance and/or
cause damage to sensitive spacecraft instruments.
A quick Fault Detection and Isolation (FDI) system is cru-
cial for a successful fault recovery action (e.g., switching to
redundant hardware and/or employing a new controller).
Model-based FDI techniques, in general, gained a great
deal of attention in the past decades and, in particular,
they show great potential for aerospace applications, see
Marzat et al. (2012) for a recent survey. The majority of
published works on AOCS fault diagnosis focuses on faults
occurring in a particular type of actuator or a particular
type of sensor. For instance, sole thruster and RW faults
were studied in Fonod et al. (2015b) and in Meskin and
Khorasani (2007), respectively. Gyroscope sensor faults
were studied in Venkateswaran et al. (2002). Only very
few examples of model-based FDI systems dealing with
a combination of different type of actuators or sensors
exist for agile spacecraft. Patton et al. (2008) considered
gyroscope and thruster faults, whereas Hou et al. (2008)
focused on gyroscope and RW faults combinations.
An example of agile spacecraft that makes use of multi-
ple actuators working simultaneously is the Athena (Ad-
vanced Telescope for High-ENergy Astrophysics) space-
craft, an L-class mission of the European Space Agency,
which aims at addressing the Hot and Energetic Universe
science theme. The Athena spacecraft is required to be
agile in order to rapidly re-point its instruments, while pro-
tecting its sensitive instruments from direct sun light. The
attitude re-pointing may imply realization of fast large-
angle attitude slews. To perform such slews, the Athena
spacecraft is equipped with a set of thrusters and RWs to
provide accurate control torques.
Torques generated by RWs and thrusters may have similar
impact on the spacecraft dynamics. Therefore, a fault in
any of these actuators might produce a similar effect on the
spacecraft dynamics. Thus, the isolation part of an FDI
system design becomes challenging since no sensors can
directly measure the delivered torques by such actuators.
In this paper, we propose a standalone FDI strategy
capable of detecting and isolating certain faults occurring
in the thrusters, RWs, and RW tachometer sensors.
2. PROBLEM FORMULATION
In this paper, we assume the spacecraft (s/c) is equipped
with a set of NTthrusters and a set of NRRWs, which
may suffer from various faults detailed in the sequel.
21st IFAC Symposium on Automatic Control in Aerospace
August 27-30, 2019. Cranfield, UK
Copyright © 2019 IFAC 436
Model-based FDI for Agile Spacecraft with
Multiple Actuators Working
Simultaneously
E. Lopez-Encarnacion ∗,R. Fonod ∗,P. Bergner ∗∗
∗Delft University of Technology, 2629 HS Delft, The Netherlands
(e-mail: ericlopen@gmail.com, r.fonod@tudelft.nl)
∗∗ Airbus Defence and Space, 88090 Immenstaad am Bodensee,
Germany (e-mail: patrick.bergner@airbus.com)
Abstract: Fast and large-angle attitude slew maneuvers often imply simultaneous use of
multiple actuators such as thrusters and reaction wheels (RWs). A fault in any of these actuators
might lead to partial or full damage of sensitive spacecraft instruments. In this paper, a model-
based Fault Detection and Isolation (FDI) strategy is proposed, which aims at detecting various
actuator faults, such as stuck-open/closed thruster, thruster leakage, loss of effectiveness of
all thrusters, and change of RW friction torque due to change of Coulomb and/or viscosity
factor. The proposed FDI strategy is also able to detect and isolate faults affecting the RWs
tachometer sensor. The FDI system design is based on a multiplicative extended Kalman filter
and a generalized likelihood ratio thresholding of the residual signals. The performance and
robustness of the proposed FDI strategy is evaluated using Monte Carlo simulations and carefully
defined FDI performance indices. Preliminary results suggest promising performance in terms
of detection/isolation times, miss-detection/isolation rates, and false alarm rates.
Keywords: Fault Detection and Isolation; Agile Spacecraft; Reaction Wheels; Thrusters.
1. INTRODUCTION
Spacecraft agility, meaning the capability of the spacecraft
to change its attitude by performing fast attitude slew
maneuvers or to follow a given attitude profile with high
precision, is becoming more and more important for future
space missions. These requirements demand the spacecraft
to be equipped with actuators, such as thrusters and
reaction wheels (RWs), capable of generating high reaction
torques and perform attitude maneuvers with high angular
rates. The control of the spacecraft attitude is achieved by
the Attitude and Orbit Control System (AOCS), which
includes sensors and actuators that are not exempt of
faults. An incorrect AOCS fault management may cause
severe degradation of the spacecraft performance and/or
cause damage to sensitive spacecraft instruments.
A quick Fault Detection and Isolation (FDI) system is cru-
cial for a successful fault recovery action (e.g., switching to
redundant hardware and/or employing a new controller).
Model-based FDI techniques, in general, gained a great
deal of attention in the past decades and, in particular,
they show great potential for aerospace applications, see
Marzat et al. (2012) for a recent survey. The majority of
published works on AOCS fault diagnosis focuses on faults
occurring in a particular type of actuator or a particular
type of sensor. For instance, sole thruster and RW faults
were studied in Fonod et al. (2015b) and in Meskin and
Khorasani (2007), respectively. Gyroscope sensor faults
were studied in Venkateswaran et al. (2002). Only very
few examples of model-based FDI systems dealing with
a combination of different type of actuators or sensors
exist for agile spacecraft. Patton et al. (2008) considered
gyroscope and thruster faults, whereas Hou et al. (2008)
focused on gyroscope and RW faults combinations.
An example of agile spacecraft that makes use of multi-
ple actuators working simultaneously is the Athena (Ad-
vanced Telescope for High-ENergy Astrophysics) space-
craft, an L-class mission of the European Space Agency,
which aims at addressing the Hot and Energetic Universe
science theme. The Athena spacecraft is required to be
agile in order to rapidly re-point its instruments, while pro-
tecting its sensitive instruments from direct sun light. The
attitude re-pointing may imply realization of fast large-
angle attitude slews. To perform such slews, the Athena
spacecraft is equipped with a set of thrusters and RWs to
provide accurate control torques.
Torques generated by RWs and thrusters may have similar
impact on the spacecraft dynamics. Therefore, a fault in
any of these actuators might produce a similar effect on the
spacecraft dynamics. Thus, the isolation part of an FDI
system design becomes challenging since no sensors can
directly measure the delivered torques by such actuators.
In this paper, we propose a standalone FDI strategy
capable of detecting and isolating certain faults occurring
in the thrusters, RWs, and RW tachometer sensors.
2. PROBLEM FORMULATION
In this paper, we assume the spacecraft (s/c) is equipped
with a set of NTthrusters and a set of NRRWs, which
may suffer from various faults detailed in the sequel.
21st IFAC Symposium on Automatic Control in Aerospace
August 27-30, 2019. Cranfield, UK
Copyright © 2019 IFAC 436
Model-based FDI for Agile Spacecraft with
Multiple Actuators Working
Simultaneously
E. Lopez-Encarnacion ∗,R. Fonod ∗,P. Bergner ∗∗
∗Delft University of Technology, 2629 HS Delft, The Netherlands
(e-mail: ericlopen@gmail.com, r.fonod@tudelft.nl)
∗∗ Airbus Defence and Space, 88090 Immenstaad am Bodensee,
Germany (e-mail: patrick.bergner@airbus.com)
Abstract: Fast and large-angle attitude slew maneuvers often imply simultaneous use of
multiple actuators such as thrusters and reaction wheels (RWs). A fault in any of these actuators
might lead to partial or full damage of sensitive spacecraft instruments. In this paper, a model-
based Fault Detection and Isolation (FDI) strategy is proposed, which aims at detecting various
actuator faults, such as stuck-open/closed thruster, thruster leakage, loss of effectiveness of
all thrusters, and change of RW friction torque due to change of Coulomb and/or viscosity
factor. The proposed FDI strategy is also able to detect and isolate faults affecting the RWs
tachometer sensor. The FDI system design is based on a multiplicative extended Kalman filter
and a generalized likelihood ratio thresholding of the residual signals. The performance and
robustness of the proposed FDI strategy is evaluated using Monte Carlo simulations and carefully
defined FDI performance indices. Preliminary results suggest promising performance in terms
of detection/isolation times, miss-detection/isolation rates, and false alarm rates.
Keywords: Fault Detection and Isolation; Agile Spacecraft; Reaction Wheels; Thrusters.
1. INTRODUCTION
Spacecraft agility, meaning the capability of the spacecraft
to change its attitude by performing fast attitude slew
maneuvers or to follow a given attitude profile with high
precision, is becoming more and more important for future
space missions. These requirements demand the spacecraft
to be equipped with actuators, such as thrusters and
reaction wheels (RWs), capable of generating high reaction
torques and perform attitude maneuvers with high angular
rates. The control of the spacecraft attitude is achieved by
the Attitude and Orbit Control System (AOCS), which
includes sensors and actuators that are not exempt of
faults. An incorrect AOCS fault management may cause
severe degradation of the spacecraft performance and/or
cause damage to sensitive spacecraft instruments.
A quick Fault Detection and Isolation (FDI) system is cru-
cial for a successful fault recovery action (e.g., switching to
redundant hardware and/or employing a new controller).
Model-based FDI techniques, in general, gained a great
deal of attention in the past decades and, in particular,
they show great potential for aerospace applications, see
Marzat et al. (2012) for a recent survey. The majority of
published works on AOCS fault diagnosis focuses on faults
occurring in a particular type of actuator or a particular
type of sensor. For instance, sole thruster and RW faults
were studied in Fonod et al. (2015b) and in Meskin and
Khorasani (2007), respectively. Gyroscope sensor faults
were studied in Venkateswaran et al. (2002). Only very
few examples of model-based FDI systems dealing with
a combination of different type of actuators or sensors
exist for agile spacecraft. Patton et al. (2008) considered
gyroscope and thruster faults, whereas Hou et al. (2008)
focused on gyroscope and RW faults combinations.
An example of agile spacecraft that makes use of multi-
ple actuators working simultaneously is the Athena (Ad-
vanced Telescope for High-ENergy Astrophysics) space-
craft, an L-class mission of the European Space Agency,
which aims at addressing the Hot and Energetic Universe
science theme. The Athena spacecraft is required to be
agile in order to rapidly re-point its instruments, while pro-
tecting its sensitive instruments from direct sun light. The
attitude re-pointing may imply realization of fast large-
angle attitude slews. To perform such slews, the Athena
spacecraft is equipped with a set of thrusters and RWs to
provide accurate control torques.
Torques generated by RWs and thrusters may have similar
impact on the spacecraft dynamics. Therefore, a fault in
any of these actuators might produce a similar effect on the
spacecraft dynamics. Thus, the isolation part of an FDI
system design becomes challenging since no sensors can
directly measure the delivered torques by such actuators.
In this paper, we propose a standalone FDI strategy
capable of detecting and isolating certain faults occurring
in the thrusters, RWs, and RW tachometer sensors.
2. PROBLEM FORMULATION
In this paper, we assume the spacecraft (s/c) is equipped
with a set of NTthrusters and a set of NRRWs, which
may suffer from various faults detailed in the sequel.
21st IFAC Symposium on Automatic Control in Aerospace
August 27-30, 2019. Cranfield, UK
Copyright © 2019 IFAC 436
Model-based FDI for Agile Spacecraft with
Multiple Actuators Working
Simultaneously
E. Lopez-Encarnacion ∗,R. Fonod ∗,P. Bergner ∗∗
∗Delft University of Technology, 2629 HS Delft, The Netherlands
(e-mail: ericlopen@gmail.com, r.fonod@tudelft.nl)
∗∗ Airbus Defence and Space, 88090 Immenstaad am Bodensee,
Germany (e-mail: patrick.bergner@airbus.com)
Abstract: Fast and large-angle attitude slew maneuvers often imply simultaneous use of
multiple actuators such as thrusters and reaction wheels (RWs). A fault in any of these actuators
might lead to partial or full damage of sensitive spacecraft instruments. In this paper, a model-
based Fault Detection and Isolation (FDI) strategy is proposed, which aims at detecting various
actuator faults, such as stuck-open/closed thruster, thruster leakage, loss of effectiveness of
all thrusters, and change of RW friction torque due to change of Coulomb and/or viscosity
factor. The proposed FDI strategy is also able to detect and isolate faults affecting the RWs
tachometer sensor. The FDI system design is based on a multiplicative extended Kalman filter
and a generalized likelihood ratio thresholding of the residual signals. The performance and
robustness of the proposed FDI strategy is evaluated using Monte Carlo simulations and carefully
defined FDI performance indices. Preliminary results suggest promising performance in terms
of detection/isolation times, miss-detection/isolation rates, and false alarm rates.
Keywords: Fault Detection and Isolation; Agile Spacecraft; Reaction Wheels; Thrusters.
1. INTRODUCTION
Spacecraft agility, meaning the capability of the spacecraft
to change its attitude by performing fast attitude slew
maneuvers or to follow a given attitude profile with high
precision, is becoming more and more important for future
space missions. These requirements demand the spacecraft
to be equipped with actuators, such as thrusters and
reaction wheels (RWs), capable of generating high reaction
torques and perform attitude maneuvers with high angular
rates. The control of the spacecraft attitude is achieved by
the Attitude and Orbit Control System (AOCS), which
includes sensors and actuators that are not exempt of
faults. An incorrect AOCS fault management may cause
severe degradation of the spacecraft performance and/or
cause damage to sensitive spacecraft instruments.
A quick Fault Detection and Isolation (FDI) system is cru-
cial for a successful fault recovery action (e.g., switching to
redundant hardware and/or employing a new controller).
Model-based FDI techniques, in general, gained a great
deal of attention in the past decades and, in particular,
they show great potential for aerospace applications, see
Marzat et al. (2012) for a recent survey. The majority of
published works on AOCS fault diagnosis focuses on faults
occurring in a particular type of actuator or a particular
type of sensor. For instance, sole thruster and RW faults
were studied in Fonod et al. (2015b) and in Meskin and
Khorasani (2007), respectively. Gyroscope sensor faults
were studied in Venkateswaran et al. (2002). Only very
few examples of model-based FDI systems dealing with
a combination of different type of actuators or sensors
exist for agile spacecraft. Patton et al. (2008) considered
gyroscope and thruster faults, whereas Hou et al. (2008)
focused on gyroscope and RW faults combinations.
An example of agile spacecraft that makes use of multi-
ple actuators working simultaneously is the Athena (Ad-
vanced Telescope for High-ENergy Astrophysics) space-
craft, an L-class mission of the European Space Agency,
which aims at addressing the Hot and Energetic Universe
science theme. The Athena spacecraft is required to be
agile in order to rapidly re-point its instruments, while pro-
tecting its sensitive instruments from direct sun light. The
attitude re-pointing may imply realization of fast large-
angle attitude slews. To perform such slews, the Athena
spacecraft is equipped with a set of thrusters and RWs to
provide accurate control torques.
Torques generated by RWs and thrusters may have similar
impact on the spacecraft dynamics. Therefore, a fault in
any of these actuators might produce a similar effect on the
spacecraft dynamics. Thus, the isolation part of an FDI
system design becomes challenging since no sensors can
directly measure the delivered torques by such actuators.
In this paper, we propose a standalone FDI strategy
capable of detecting and isolating certain faults occurring
in the thrusters, RWs, and RW tachometer sensors.
2. PROBLEM FORMULATION
In this paper, we assume the spacecraft (s/c) is equipped
with a set of NTthrusters and a set of NRRWs, which
may suffer from various faults detailed in the sequel.
21st IFAC Symposium on Automatic Control in Aerospace
August 27-30, 2019. Cranfield, UK
Copyright © 2019 IFAC 436
2.1 Thruster Model
Defining ST{1,2,...,N
T}as a set of all thrusters
indices, di∈R3×1as a fixed direction of the ith thruster,
rMi∈R3×1as a vector position of the ith thruster in body-
fixed reference frame, and FNi>0 as a maximum thrust
force of the ith thruster, then the maximum directional
torque of the ith thruster becomes
bTi=rMi×bFi,i∈S
T,(1)
where ’×’ denotes the cross product of two vectors and bFi
is the directional force of the ith thruster, i.e.,
bFi=−θ(di,
Ti)(FNi+ηFi),(2)
with θ(·,·) being a function that rotates the ith thruster
direction vector (di) for a given misalignment angle Tiand
ηFibeing a scalar zero-mean Gaussian white-noise aiming
at modeling variations on the effective thruster force.
Finally, the total torque about the Center of Mass (CoM)
of the s/c generated by the thrusters is given by
TT=
NT

i=1
bTiuTi,(3)
where uTiis the commanded opening of the ith thruster.
2.2 Reaction Wheel Model
The torque generated by the ith RW is modelled as
cRi=uRi+TRfi+ηRai,i∈S
R,(4)
where SR{1,2,...N
R}is a set of all RW indices, uRi
is the commanded control torque, ηRaiis a zero-mean
Gaussian white-noise introduced to model torque effects
caused, e.g., by variations of motor voltage frequency and
DC coil resistance, and TRfiis the friction torque in ball
bearings of the wheel. We model the friction torque as
TRfi=−µ1tanh (ωRi)−µ2sign(ωRi)|ωRi|1.25 ,(5)
where µ1>0 and µ2>0 are appropriate constants, and
ωRiis the angular speed of the ith RW satisfying
˙ωRi=J−1
RicRi,(6)
where JRiis the constant inertia of the ith RW. In (5),
the term associated with µ1and µ2aims at modelling
Coulomb and viscous friction of the ith RW, respectively.
Finally, the total torque about the CoM of the s/c gener-
ated by the RWs is given by
TR=
NR

i=1
θ(mRi,
Ri)cRi,(7)
where θ(·,·) is the same function as defined for (2),
however now rotating the ith RW directional vector
mRi∈R3×1for a given RW misalignment angle Ri.
2.3 Spacecraft Model
The s/c is treated as a rigid body. Its rotational dynamics
about the CoM is given by
JS˙
ωS=TT−TR+TD−ωS×(JSωS−hR),(8)
where TD∈R3×1is the external disturbance torque,
JS∈R3×3is the s/c inertia, ωS∈R3×1is the s/c angular
velocity, and hR∈R3×1is the s/c angular momentum
vector associated with the RWs, i.e.,
hR=
NR

i=1
θ(mRi,
Ri)JRiωRi.(9)
The s/c motion is parametrized by a unit quaternion,
qT[qvec1qvec2qvec3qsca],qTq=1,
representing the s/c attitude with respect to an inertial
frame of reference. The s/c kinematics is given by
˙
q=1
2W(ωS)q,(10)
where
W(ωS)

0ωZ−ωYωX
−ωZ0ωXωY
ωY−ωX0ωZ
−ωX−ωY−ωZ0
,(11)
and ωX,ωY,ωZare the elements of ωSrepresenting the
s/c rotational rates around its body-fixed X,Y,Zaxes.
2.4 Sensor Model
For FDI purposes, two high-precision star trackers (STRs),
angular rate measurement unit (RMU), and dedicated
tachometers for each RW are considered. STRs and RMU
are assumed to be fault-free as quick FDI strategies exist.
The sensor model for the ith STR, the RMU, and the RW
tachometers is, respectively, defined as follows
qmeas
stri=(q⊗ϑ(stri)) ⊗ϕ(ηstri),(12)
ωmeas
S=θ(ωS,
rmu)+ηr mu,(13)
ωmeas
R=ωf
R+ηRm,(14)
where ωf
Rwill be defined later, qmeas
stri,ωmeas
S,ωmeas
Rare
the measurements, and ηstri,ηrmu,ηRm are the measure-
ment noises, assumed to be independent zero-mean Gaus-
sian random variables. In (12), ’⊗’ denotes quaternion
multiplication, ϑ(·) is a function of the misalignment angle
stri, and ϕ(·) is a function of noise ηstridefined in Euler
angles. These functions are used to manipulate (rotate) the
true quaternion qin order to mimic the STR misalignment
and noise, respectively, while preserving quaternion unity.
In (13), θ(·,·) rotates the measured s/c angular rate vector
(ωS) for a given RMU misalignment angle rmu.
2.5 Fault Model
Four distinct thruster fault types are considered: thruster
leakage, stuck-open/-closed thruster, and loss of effective-
ness (LoE) of all thrusters simultaneously.
The first three faults are modeled as (Fonod et al., 2015a)
uf
T=(INT×NT−Φ)uT,(15)
where Φdiag (φ1... φ
NT), uT
TuT1... u
TNT, and
the index fdenotes the faulty case. The scalar variable φi
models the fault for the ith thruster as
φi=0,if fault-free
1−χi/uTi,if faulty
Here, χiaims at modelling different fault types, i.e.,
χi=1,stuck-open
0,stuck-closed
max{mleaki,u
Ti},propellant leakage
where mleakiis the ith thruster leakage magnitude.
The LoE fault represents a decrease in propellant supply
pressure feeding all the thrusters. Therefore, a LoE fault
will affect all thrusters simultaneously, i.e.,
φi=mloe,∀i∈S
T,
where mloe is the LoE magnitude (0 ≤mloe ≤1).
2019 IFAC ACA
August 27-30, 2019. Cranfield, UK
437
Copyright © 2019. The Authors. Published by Elsevier Ltd. All rights reserved.

E. Lopez-Encarnacion et al. / IFAC PapersOnLine 52-12 (2019) 436–441 437
2.1 Thruster Model
Defining ST{1,2,...,N
T}as a set of all thrusters
indices, di∈R3×1as a fixed direction of the ith thruster,
rMi∈R3×1as a vector position of the ith thruster in body-
fixed reference frame, and FNi>0 as a maximum thrust
force of the ith thruster, then the maximum directional
torque of the ith thruster becomes
bTi=rMi×bFi,i∈S
T,(1)
where ’×’ denotes the cross product of two vectors and bFi
is the directional force of the ith thruster, i.e.,
bFi=−θ(di,
Ti)(FNi+ηFi),(2)
with θ(·,·) being a function that rotates the ith thruster
direction vector (di) for a given misalignment angle Tiand
ηFibeing a scalar zero-mean Gaussian white-noise aiming
at modeling variations on the effective thruster force.
Finally, the total torque about the Center of Mass (CoM)
of the s/c generated by the thrusters is given by
TT=
NT

i=1
bTiuTi,(3)
where uTiis the commanded opening of the ith thruster.
2.2 Reaction Wheel Model
The torque generated by the ith RW is modelled as
cRi=uRi+TRfi+ηRai,i∈S
R,(4)
where SR{1,2,...N
R}is a set of all RW indices, uRi
is the commanded control torque, ηRaiis a zero-mean
Gaussian white-noise introduced to model torque effects
caused, e.g., by variations of motor voltage frequency and
DC coil resistance, and TRfiis the friction torque in ball
bearings of the wheel. We model the friction torque as
TRfi=−µ1tanh (ωRi)−µ2sign(ωRi)|ωRi|1.25 ,(5)
where µ1>0 and µ2>0 are appropriate constants, and
ωRiis the angular speed of the ith RW satisfying
˙ωRi=J−1
RicRi,(6)
where JRiis the constant inertia of the ith RW. In (5),
the term associated with µ1and µ2aims at modelling
Coulomb and viscous friction of the ith RW, respectively.
Finally, the total torque about the CoM of the s/c gener-
ated by the RWs is given by
TR=
NR

i=1
θ(mRi,
Ri)cRi,(7)
where θ(·,·) is the same function as defined for (2),
however now rotating the ith RW directional vector
mRi∈R3×1for a given RW misalignment angle Ri.
2.3 Spacecraft Model
The s/c is treated as a rigid body. Its rotational dynamics
about the CoM is given by
JS˙
ωS=TT−TR+TD−ωS×(JSωS−hR),(8)
where TD∈R3×1is the external disturbance torque,
JS∈R3×3is the s/c inertia, ωS∈R3×1is the s/c angular
velocity, and hR∈R3×1is the s/c angular momentum
vector associated with the RWs, i.e.,
hR=
NR

i=1
θ(mRi,
Ri)JRiωRi.(9)
The s/c motion is parametrized by a unit quaternion,
qT[qvec1qvec2qvec3qsca],qTq=1,
representing the s/c attitude with respect to an inertial
frame of reference. The s/c kinematics is given by
˙
q=1
2W(ωS)q,(10)
where
W(ωS)

0ωZ−ωYωX
−ωZ0ωXωY
ωY−ωX0ωZ
−ωX−ωY−ωZ0
,(11)
and ωX,ωY,ωZare the elements of ωSrepresenting the
s/c rotational rates around its body-fixed X,Y,Zaxes.
2.4 Sensor Model
For FDI purposes, two high-precision star trackers (STRs),
angular rate measurement unit (RMU), and dedicated
tachometers for each RW are considered. STRs and RMU
are assumed to be fault-free as quick FDI strategies exist.
The sensor model for the ith STR, the RMU, and the RW
tachometers is, respectively, defined as follows
qmeas
stri=(q⊗ϑ(stri)) ⊗ϕ(ηstri),(12)
ωmeas
S=θ(ωS,
rmu)+ηr mu,(13)
ωmeas
R=ωf
R+ηRm,(14)
where ωf
Rwill be defined later, qmeas
stri,ωmeas
S,ωmeas
Rare
the measurements, and ηstri,ηrmu,ηRm are the measure-
ment noises, assumed to be independent zero-mean Gaus-
sian random variables. In (12), ’⊗’ denotes quaternion
multiplication, ϑ(·) is a function of the misalignment angle
stri, and ϕ(·) is a function of noise ηstridefined in Euler
angles. These functions are used to manipulate (rotate) the
true quaternion qin order to mimic the STR misalignment
and noise, respectively, while preserving quaternion unity.
In (13), θ(·,·) rotates the measured s/c angular rate vector
(ωS) for a given RMU misalignment angle rmu.
2.5 Fault Model
Four distinct thruster fault types are considered: thruster
leakage, stuck-open/-closed thruster, and loss of effective-
ness (LoE) of all thrusters simultaneously.
The first three faults are modeled as (Fonod et al., 2015a)
uf
T=(INT×NT−Φ)uT,(15)
where Φdiag (φ1... φ
NT), uT
TuT1... u
TNT, and
the index fdenotes the faulty case. The scalar variable φi
models the fault for the ith thruster as
φi=0,if fault-free
1−χi/uTi,if faulty
Here, χiaims at modelling different fault types, i.e.,
χi=1,stuck-open
0,stuck-closed
max{mleaki,u
Ti},propellant leakage
where mleakiis the ith thruster leakage magnitude.
The LoE fault represents a decrease in propellant supply
pressure feeding all the thrusters. Therefore, a LoE fault
will affect all thrusters simultaneously, i.e.,
φi=mloe,∀i∈S
T,
where mloe is the LoE magnitude (0 ≤mloe ≤1).
2019 IFAC ACA
August 27-30, 2019. Cranfield, UK
437

438 E. Lopez-Encarnacion et al. / IFAC PapersOnLine 52-12 (2019) 436–441
Two type of RW faults are considered. The first considers
an increment of the measurement realized by the tachome-
ter sensor, i.e.,
ωf
R=ΨωR,(16)
where ωT
RωR1... ω
RNRis a vector of true RW
angular speeds and Ψdiag (ψ1... ψ
NR), with
ψi=1,if fault-free
mmeasi,if faulty
and mmeasi>1 representing tachometer scale increment.
The second considered RW fault is an increment of the RW
friction. Two friction types are considered, viscous friction
(fv) and Coulomb friction (fc). Both fvand fccan vary
differently in a faulty situations. Thus, the following fault
model for the ith RW friction torque TRfiis considered
Tf
Rfi=ξ1ifvi+ξ2ifci,i∈S
R,(17)
ξ1i=1,if fault-free
mv,if faulty ,ξ
2i=1,if fault-free
mc,if faulty
Here, mv>1 and mc>1 is the magnitude of the viscous
and Coulomb friction factor, respectively.
3. PROPOSED FDI STRATEGY
The proposed FDI strategy is based on a model-based
residual generation, statistical change detection, and sig-
nature matrix matching. A generalized likelihood ratio
(GLR) algorithm monitors each residual signal and com-
pares them with fixed thresholds to determine fault pres-
ence. To decide whether the fault occurred in the thrusters
or in a particular RW, including the type of the RW fault,
the isolation logic matches the output of the thresholding
process with the columns of a predefined signature matrix.
3.1 State Estimation
Before defining the residual signal, we first design a state
estimator to estimate the following state vector
xT=δgTωT
SωT
RTT
Rf ,(18)
where TT
Rf [TRf1... T
RfNR] and δg∈R3×1stands
for quaternion error. The filter employed here to estimate
xis a mix of an extended Kalman filter (EKF) and a
multiplicative EKF (MEKF). The EKF is used to estimate
ωS,ωR, and TRf , whereas MEKF is used to estimate δg.
Due to the quaternion unity constraint, qcannot be
directly estimated using EKF. Alternatively, additive EKF
or MEKF can be employed, see Markley (2004). Due to
large slews realized by the s/c, the MEKF is preferred as it
estimates the quaternion errors (δg), which are considered
to be small and easily linearized without loosing accuracy.
To proceed, we define the total control input vector uas
uTuT
TuT
R. To propagate the estimated state ˆ
x, the
following equation will be considered
˙
ˆ
x=f(ˆ
x,u),(19)
where f(ˆ
x,u) is a vector function defined as
f(ˆ
x,u)



−ˆ
ωS×δˆ
g
J−1
S(ˆ
TT−ˆ
TR−ˆ
ωS×(JSˆ
ωS−ˆ
hR))
J−1
R(uR+ˆ
TRf )
0NR×1




,
where JRdiag(JR1...J
RNR); ˆ
hR=MRJRˆ
ωRwith
MRmR1...mRNRbeing the misalignment-free ma-
trix mapping the estimated RWs’ torque contributions into
the s/c body-fixed frame; ˆ
TTand ˆ
TRbeing defined as
ˆ
TT=−
NT

i=1
ˆ
bTiuTi,ˆ
TR=
NR

i=1
mRi(uRi+ˆ
TRfi),
where ˆ
bTi=FNi(rMi×di), and ˆ
TRfiis modelled as a
random walk driven by zero-mean white-noise ηRfi.
The filter’s time propagation step is done in a continuous
time. The estimated state (ˆ
xk−1) and covariance (Pk−1)
from the previous time step are propagated to the current
time step (ˆ
x−
kand P−
k), assuming constant control input
(uk−1), by integrating the following system of equations
˙
ˆ
x=f(ˆ
x,u)
˙
P=FP +PFT+Q(20)
where
F=∂f(x,u)
∂xx=ˆ
xk−1,u=uk−1
is the Jacobian matrix of the state and Qis the artificial
process noise covariance matrix
Q= diag εI3×3Q22 SRaJ−2
RSRf ,
with Q22 =J−1
SMRSRaMT
R−ˆ
BTSFˆ
BT
TJ−1
S,ˆ
BT=
[ˆ
bT1... ˆ
bTNT], εbeing a small constant, and SF,SRa,
and SRf being double sided power spectral densities of
ηF,ηRa, and ηRf , respectively.
All sensor measurements (12)-(14) are exploited for esti-
mation purposes. These measurements are only available
in discrete time and are, for convenience, lumped into
zT
k=(δgmeas
str1)T(δgmeas
str2)T(ωmeas
S)T(ωmeas
R)T,(21)
where the ith attitude error measurement, δgmeas
stri, is
expressed as a Gibbs vector
δgmeas
stri=qmeas
stri⊗(ˆ
q−
k)−1vec
qmeas
stri⊗(ˆ
q−
k)−1sca
(22)
where ·vec and ·sca, respectively, extracts the vector
and scalar part of the enclosed quaternion. In (22), ( ˆ
q−
k)−1
denotes the quaternion inverse of ˆ
q−
k.
In parallel to the propagation in time of (20), the esti-
mated full attitude ( ˆ
q) also needs to be propagated in
time from ˆ
qk−1to ˆ
q−
kby integrating ˙
ˆ
q=1
2W(ˆ
ωS)ˆ
q, where
W(·) was defined in (11).
Once zkbecomes available, the state and the covariance
matrix are updated as follows
ˆ
xk=ˆ
x−
k+Kk(zk−h(ˆ
x−
k)) (23)
Pk=I(6+2NR)×(6+2NR)−KkHP−
k(24)
where
Kk=ˆ
P−
kHT(Hˆ
P−
kHT+R)−1
hˆ
x−
k=01×301×3(ˆ
ω−
Sk)T(ˆ
ω−
Rk)TT
H=

I3×303×(NR+3) 03×NR
I3×303×(NR+3) 03×NR
0(NR+3)×3I(NR+3)×(NR+3) 0(NR+3)×NR


R= diag σ2
str1
4I3x3
σ2
str2
4I3x3σ2
rmuI3x3σ2
RmINR×NR
and σstr1,σstr2,σrmu, and σRm are the standard devi-
ations of ηstr1,ηstr2,ηrmu, and ηRm, respectively. Note
2019 IFAC ACA
August 27-30, 2019. Cranfield, UK
438
that in the measurement noise covariance matrix R, the
measurement noise variances of the STRs are divided by
4 to account for the Gibbs vector transformation.
The Gibbs vector δˆ
gis transformed into the global atti-
tude representation, while preserving the unity quaternion
constraints, using
ˆ
qk=1
1+δˆ
gk2δˆ
gk
1⊗ˆ
q−
k(25)
After each measurement update, δˆ
gneeds to be reset to
zero explicitly, i.e., δˆ
g=03×1.
In this paper, we modify the standard measurement up-
date step equation of the Kalman filter to account for
proper implementation of the friction torque estimate
ˆ
TRfi, i.e., the ith friction torque estimate is updated as
follows ˆ
TRfi;k=ˆ
Tsgn
Rfi;kˆ
Tmag
Rfi;k,(26)
where the sign of the friction torque estimate is determined
by
ˆ
Tsgn
Rfi;k=−sign ˆcRi;k−1if JRiˆωRi;k<γ
−sign ˆωRi;k−1otherwise (27)
where γ>0 is a fixed threshold accounting for the
RW’s friction characteristics. Finally, the magnitude of the
friction torque is computed as
ˆ
Tmag
Rfi;k=ˆ
x−
kTRfi+ˆ
Tsgn
Rfi;kKkzk−h(ˆ
x−
k)TRfi
where ·TRfipulls out the element associated with TRfi
from the enclosed vector.
Remark 1. The sign of the estimated friction torque, see
(27), is assumed to be opposite to the sign of the estimated
angular rate. However, if the physical angular momentum
is close to zero, the sign of the physical friction torque is
not clear. Thus, if the magnitude of the estimated angular
momentum is close to zero, the opposite sign of the last
estimated torque is considered to reduce zero crossing time.
3.2 Residual Signal Generation
We define the residual signal r∈RNS×1as follows
rkH1ˆ
xk−H2zT
k˜
TT
Rf;kT,(28)
where H1=[
0NS×3INS×NS], H2=[
0NS×6INS×NS],
and NS= 3+2NR.˜
TT
Rf =[
˜
TRf1... ˜
TRfNR] in (28)
stands for the “pseudo-measured” friction torque vector,
with ˜
TRfibeing calculated using the RW friction torque
model (5), which depends on the estimated angular rate
of the RW, i.e.,
˜
TRfi=−µ1tanh (ˆωRi)−µ2sign( ˆωRi)|ˆωRi|1.25 .(29)
Remark 2. It can be see n from (28) that attitude-related
residuals are not generated. Such residuals could be used,
for instance, to detect and isolate faults affecting STRs.
3.3 Fault Detection Algorithm
The residual signal defined in (28) has in total NS=3+
2NRcomponents. To detect fault presence, we employ the
well-known GLR test to detect changes in the mean value
of each residual component ri,i∈S
S{1,2,...,N
S}.
The GLR algorithm evaluates the log-likelihood between
two hypotheses H0(fault-free case) and H1(faulty case).
It works at discrete time instances kand with a moving
time window M. If the ith residual signal sequence can
be assumed independent and Gaussian, then the decision
function for the ith residual signal is given as follows
Blanke et al. (2006)
gM
i(k)= 1
2σ2
0iMk

j=k−M−1
(ri(j)−µ0i)2
,(30)
where µ0iand σ0iis the mean and standard deviation of
the ith residual signal in fault-free case, respectively.
Finally, the decision test for the ith residual signal is
defined as follows
λi(k)=1,if gM
i(k)≥Υi
0 if gM
i(k)<Υi(31)
where Υi>0 is a fixed threshold selected by the designer.
3.4 Fault Isolation Algorithm
Once a fault is detected, the FDI system must identify
in which actuator or sensor the fault has occurred. The
isolation logic is achieved by comparing a decision vector
λ[λ1... λ
NS]T(32)
with the columns of a pre-defined fault signature matrix
MS∈RNS×(1+2NR)represented in Table 1. The columns
of this table represent fault signatures, which unequivo-
cally link the faults to the symptoms detected during the
system monitoring. The decision vector corresponding to
the actual “correct” fault signature is denoted as λc.
Table 1. Fault signatures.
Thruster RW sensor fault RW friction fault
fault 1 ... NR1... NR
ωSX - - - - - -
ωR1- X - - - - -
.
.
....
ωRNR- - - X - - -
TRf1- X - - X - -
.
.
.......
TRfNR- - - X - - X
Remark 3. It is obvious from Table 1 that thruster fault
isolation was not considered. Thruster fault isolation was
extensively tackled in the literature, see for instance Fonod
et al. (2015b); Pittet et al. (2016) and references therein.
4. SIMULATION RESULTS
Realistic s/c parameters and assumptions are considered
for simulation purposes. We assume a set of NR=4
identical (JRi=JR,∀i∈S
R) RWs placed in a classical
pyramidal configuration with a tilt angle α. Thus, the
nominal RW configuration matrix is given by
MR=cos(α)0−cos(α)0
0 cos(α)0−cos(α)
sin(α) sin(α) sin(α) sin(α).
Furthermore, a set of NT= 12 identical (FNi=FN,∀i∈
ST) thrusters is considered, which can generate torques in
all three degrees of freedom.
The FDI strategy presented in the previous section is
implemented in the GAFE 1,aMatlab/Simulink based
simulator for early phase FDI and Recovery (FDIR) design
and verification & validation. Some relevant s/c and FDI
related parameters are summarized in Table 2.
1See the GAFE framework: http://gafe.estec.esa.int/
2019 IFAC ACA
August 27-30, 2019. Cranfield, UK
439

E. Lopez-Encarnacion et al. / IFAC PapersOnLine 52-12 (2019) 436–441 439
that in the measurement noise covariance matrix R, the
measurement noise variances of the STRs are divided by
4 to account for the Gibbs vector transformation.
The Gibbs vector δˆ
gis transformed into the global atti-
tude representation, while preserving the unity quaternion
constraints, using
ˆ
qk=1
1+δˆ
gk2δˆ
gk
1⊗ˆ
q−
k(25)
After each measurement update, δˆ
gneeds to be reset to
zero explicitly, i.e., δˆ
g=03×1.
In this paper, we modify the standard measurement up-
date step equation of the Kalman filter to account for
proper implementation of the friction torque estimate
ˆ
TRfi, i.e., the ith friction torque estimate is updated as
follows ˆ
TRfi;k=ˆ
Tsgn
Rfi;kˆ
Tmag
Rfi;k,(26)
where the sign of the friction torque estimate is determined
by
ˆ
Tsgn
Rfi;k=−sign ˆcRi;k−1if JRiˆωRi;k<γ
−sign ˆωRi;k−1otherwise (27)
where γ>0 is a fixed threshold accounting for the
RW’s friction characteristics. Finally, the magnitude of the
friction torque is computed as
ˆ
Tmag
Rfi;k=ˆ
x−
kTRfi+ˆ
Tsgn
Rfi;kKkzk−h(ˆ
x−
k)TRfi
where ·TRfipulls out the element associated with TRfi
from the enclosed vector.
Remark 1. The sign of the estimated friction torque, see
(27), is assumed to be opposite to the sign of the estimated
angular rate. However, if the physical angular momentum
is close to zero, the sign of the physical friction torque is
not clear. Thus, if the magnitude of the estimated angular
momentum is close to zero, the opposite sign of the last
estimated torque is considered to reduce zero crossing time.
3.2 Residual Signal Generation
We define the residual signal r∈RNS×1as follows
rkH1ˆ
xk−H2zT
k˜
TT
Rf;kT,(28)
where H1=[
0NS×3INS×NS], H2=[
0NS×6INS×NS],
and NS= 3+2NR.˜
TT
Rf =[
˜
TRf1... ˜
TRfNR] in (28)
stands for the “pseudo-measured” friction torque vector,
with ˜
TRfibeing calculated using the RW friction torque
model (5), which depends on the estimated angular rate
of the RW, i.e.,
˜
TRfi=−µ1tanh (ˆωRi)−µ2sign( ˆωRi)|ˆωRi|1.25 .(29)
Remark 2. It can be see n from (28) that attitude-related
residuals are not generated. Such residuals could be used,
for instance, to detect and isolate faults affecting STRs.
3.3 Fault Detection Algorithm
The residual signal defined in (28) has in total NS=3+
2NRcomponents. To detect fault presence, we employ the
well-known GLR test to detect changes in the mean value
of each residual component ri,i∈S
S{1,2,...,N
S}.
The GLR algorithm evaluates the log-likelihood between
two hypotheses H0(fault-free case) and H1(faulty case).
It works at discrete time instances kand with a moving
time window M. If the ith residual signal sequence can
be assumed independent and Gaussian, then the decision
function for the ith residual signal is given as follows
Blanke et al. (2006)
gM
i(k)= 1
2σ2
0iMk

j=k−M−1
(ri(j)−µ0i)2
,(30)
where µ0iand σ0iis the mean and standard deviation of
the ith residual signal in fault-free case, respectively.
Finally, the decision test for the ith residual signal is
defined as follows
λi(k)=1,if gM
i(k)≥Υi
0 if gM
i(k)<Υi(31)
where Υi>0 is a fixed threshold selected by the designer.
3.4 Fault Isolation Algorithm
Once a fault is detected, the FDI system must identify
in which actuator or sensor the fault has occurred. The
isolation logic is achieved by comparing a decision vector
λ[λ1... λ
NS]T(32)
with the columns of a pre-defined fault signature matrix
MS∈RNS×(1+2NR)represented in Table 1. The columns
of this table represent fault signatures, which unequivo-
cally link the faults to the symptoms detected during the
system monitoring. The decision vector corresponding to
the actual “correct” fault signature is denoted as λc.
Table 1. Fault signatures.
Thruster RW sensor fault RW friction fault
fault 1 ... NR1... NR
ωSX - - - - - -
ωR1- X - - - - -
.
.
....
ωRNR- - - X - - -
TRf1- X - - X - -
.
.
.......
TRfNR- - - X - - X
Remark 3. It is obvious from Table 1 that thruster fault
isolation was not considered. Thruster fault isolation was
extensively tackled in the literature, see for instance Fonod
et al. (2015b); Pittet et al. (2016) and references therein.
4. SIMULATION RESULTS
Realistic s/c parameters and assumptions are considered
for simulation purposes. We assume a set of NR=4
identical (JRi=JR,∀i∈S
R) RWs placed in a classical
pyramidal configuration with a tilt angle α. Thus, the
nominal RW configuration matrix is given by
MR=cos(α)0−cos(α)0
0 cos(α)0−cos(α)
sin(α) sin(α) sin(α) sin(α).
Furthermore, a set of NT= 12 identical (FNi=FN,∀i∈
ST) thrusters is considered, which can generate torques in
all three degrees of freedom.
The FDI strategy presented in the previous section is
implemented in the GAFE 1,aMatlab/Simulink based
simulator for early phase FDI and Recovery (FDIR) design
and verification & validation. Some relevant s/c and FDI
related parameters are summarized in Table 2.
1See the GAFE framework: http://gafe.estec.esa.int/
2019 IFAC ACA
August 27-30, 2019. Cranfield, UK
439

440 E. Lopez-Encarnacion et al. / IFAC PapersOnLine 52-12 (2019) 436–441
Table 2. Spacecraft and FDI parameters.
Param. Value Unit Param. Value Unit
FN1 N απ/12 rad
JR0.108 kgm2TD1.6·10−4Nm
µ10.005 - µ210−5-
ε10−9-γ0.001 kgm2s−1
M10 s σF5·10−5N
σRa 0.003 Nm σRf 4·10−6Nm
σstr diag(3.43.49.2) ·10−7rad σRm 0.21 rad/s
σrmu 5.7·10−7rad/s
In the simulated scenario, the s/c is placed in a halo
orbit around L2, the second Lagrange point of the Sun-
Earth system. In this orbit, the main disturbance torque
(TDTD) affecting the s/c is the solar radiation
pressure, which is assumed to be constant. The simulated
scenario comprises four (shorten) inertially-fixed observa-
tion phases connected by three attitude slews, see Fig. 1.
The total duration of the scenario is approx. 9000 s.
0 1000 2000 3000 4000 5000 6000 7000 8000 9000
Time [s]
-80
-60
-40
-20
0
20
Attitude Euler Angle [°]
X
Y
Z
Fig. 1. Time evolution of the spacecraft’s attitude.
4.1 FDI Performance Indices
The performance of the proposed FDI strategy is evaluated
in terms of the following indices:
Correct detection: a fault is correctly detected if λ=λc.
False alarm: a false alarm occurs if λc=0NS×1and
λi= 1 for any i∈S
S.
Miss detection: a fault is miss-detected if a detectable
fault 2occurs, i.e., λc=0NS×1, and λ=0NS×1through-
out the entire simulation.
Correct/Miss isolation at
•equipment level: a fault is correctly/miss identified
to be either in the thrusters or in the RWs.
•component level: if fault is correctly/miss identified
to be due to a particular faulty tachometer or due to
an increase of the RW friction torque (only for RWs).
Detection time for
•thrusters (leakage and stuck-open) and RWs:
time between fault occurrence and its detection.
•thrusters (LoE and stuck-closed): time between
the faulty thruster is activated for the first time after
fault occurrence and time of fault detection.
4.2 Sample Run Simulation Example
A sample test case scenario, where a friction torque fault
is introduced at tf= 2090.9 s for the 2nd RW with
mv= 17.98 and mc=5.05, is considered here. Figure 2
depicts the resulting residuals for nominal s/c values. It
can be observed from this figure that around t= 2100 s,
the residual corresponding to the 2nd RW friction torque
increases considerably. The effect is even more clear when
examining Fig. 3, which shows the associated GLR signals
together with the fixed thresholds (constant horizontal
lines matching the GLR signals’ color code).
2A fault is detectable if it has an actual effect on the spacecraft.
-2
0
2
4
610
-6
[rad/s]
X Y Z
-50
0
50
100
150
[rpm]
R1 R2 R3 R4
0 1000 2000 3000 4000 5000 6000 7000 8000 9000
Time [s]
-0.1
0
0.1
[Nm]
Tfr1 Tfr2 Tfr3 Tfr4
Fig. 2. Time evolution of the residual signals.
0
50 X Y Z
0
50
100
150
R1 R2 R3 R4
0 1000 2000 3000 4000 5000 6000 7000 8000 9000
Time [s]
10
0
Tfr1 Tfr2 Tfr3 Tfr4
Fig. 3. Time evolution of the GLR signals vs. thresholds.
The proposed FDI strategy correctly reports the fault
presence at t= 2091.8 s (0.9 s detection delay) and
also correctly identifies the affected equipment (RWs) and
component (increased friction in the 2nd RW).
4.3 Monte Carlo Analysis
Two Monte Carlo (MC) campaigns are presented next.
The first (second) campaign aims at demonstrating the
FDI performance without (with) considering model un-
certainties. Both campaigns assume measurement noises
and consist of 150 simulation runs per fault type. In
each run, the time of fault occurrence (tf) and the fault
magnitudes (mi,i∈{leak , loe, meas, v, c}) vary uniformly
in the defined interval, see Table 3.
Table 3. MC-related parameters.
Parameter Value Unit Parameter Value Unit
tf(0,7500] s mleak (0,0.5] N/A
mloe (0,0.5] N/A mmeas (1,3] N/A
mv(1,20] N/A mc(1,9] N/A
σJ5 % σ
R0.1◦
σ
str 0.001 ◦σ
rmu 0.01 ◦
σ
T0.5◦
The model uncertainties follow a normal distribution with
standard deviations given in Table 3. Here, σJand σ
str,
σ
rmu,σ
T,σ
Ris the standard deviation of the s/c principal
moments of inertia and of the misalignment angles () for
the two STRs, RMU, thrusters, and RWs, respectively. It
should be noted that the implemented FDI strategy was
tuned for the uncertainty-free scenario.
The results for the MC campaign without and with uncer-
tainties is summarized in Table 4 and Table 5, respectively.
Selected fault scenarios are visualized in Figs. 4-5. Clearly,
the introduction of uncertainties increases the amount of
false alarm cases, thus decreases the correct detection
and isolation ratios. It is interesting to notice that stuck-
closed/open thruster faults present similar behaviour in
terms of correct detection and equipment isolation ratios,
but they diverge in the mean detection time. This is likely
because some thrusters, for certain attitude slews, are re-
quired to be open 95% of the time. Thus, a stuck-open fault
2019 IFAC ACA
August 27-30, 2019. Cranfield, UK
440
(open 100% of the time) does not produce a significant
difference with respect to the fault-free behaviour. Similar
phenomenon occurs when a stuck-closed thruster is not
commanded. However, the effect of this is not present
in the reported tables thanks to the careful definition of
the ”detection time” for stuck-closed fault, see Sec. 4.1.
Thruster leakage shows relatively high ratio of correct
detections, but also quite high detection time and low ratio
of correct equipment isolations. This is due to the fact
that some cases were run with mleak close to zero, which
produced very small amount of torque, see Fig. 4. Similar
reasoning holds for LoE fault type when mloe is very small
and its effect on the s/c is negligible. Regarding RW faults,
in general, very good results can be observed for correct
detection/isolation ratios and for mean detection times.
The large variance associated with the detection time of
the friction fault is caused by a single simulation case,
where the Coulomb factor was increased only by 1.4% and
its time to detection was 100 times greater than the rest
of the simulation cases. The detection time of the RW
tachometer fault does not show any correlation with the
magnitude of the fault, see Fig. 5. It can be also seen
that the fault type (friction or tachometer fault) is not
correctly isolated when a slew in X-axis is performed, but
this only occurs for five cases. More tests would be required
to confirm any clear correlation.
Table 4. MC campaign without uncertainties.
Thruster faults RW faults
Leak. LoE Closed Open Frict. Meas.
Correct detection [%] 99.33 87.33 100 100 100 100
Detection time [s]
(mean/std. deviation)
451.06/
1444
16.38/
47.43
1.63/
5.05
7.93/
51.63
3.59/
21.01
0.155/
0.0489
Corr. equip. isol. [%] 71.33 87.33 100 100 100 100
Corr. comp. isol. [%] N/A N/A N/A N/A 100 96.67
Miss detection [%] 0.67 12.67 0 0 0 0
Equip. miss isol. [%] 28.66 0 0 0 0 0
Comp. miss isol. [%] N/A N/A N/A N/A 0 3.33
False alarm [%] 0 0 0 0 0 0
Table 5. MC campaign with uncertainties.
Fault Thruster faults RW faults
free Leak. LoE Closed Op en Frict. Meas.
Correct detection [%] N/A 66 67.33 76.47 79.33 80 89.26
Detection time [s]
(mean/std. deviation) N/A 685.83/
2.37e3
26.06/
484.34
1.93/
17.89
4.50/
29.93
1.41/
0.73
0.16/
0.054
Corr. equip. isol. [%] N/A 44.67 67.33 76.47 79.33 80 84.56
Corr. comp. isol. [%] N/A N/A N/A N/A N/A 76.67 82.55
Miss detection [%] N/A 5.33 12.67 0 0 0 0
Equip. miss isol. [%] N/A 21.33 0 0 0 0 4.69
Comp. miss isol. [%] N/A N/A N/A N/A N/A 3.33 2.01
False alarm [%] 25.3 28.67 20 25.53 20.67 20 10.74
0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 0.5
mleak
100
101
102
103
Time to Detection [s]
Not isolated
Isolated
Fig. 4. MC results for thruster leakage faults.
5. CONCLUSIONS
An FDI strategy to detect and isolate a class of AOCS
faults for an agile spacecraft is presented. The strategy
differs from usual schemes by being able to handle mul-
tiple actuators working simultaneously and to distinguish
different types of faults of the same equipment. The per-
formance of the proposed FDI scheme is evaluated with
1 1.2 1.4 1.6 1.8 2 2.2 2.4 2.6 2.8 3
mmeas
0.1
0.2
0.3
0.4
0.5
0.6
Time to Detection [s]
Fault Type Isolated
Fault Type not-Isolated
Fig. 5. MC results for the RW tachometer faults.
respect to various noise sources and uncertainties. MC
simulation results revealed promising results in terms of
good detection/isolation rates and short detection times.
REFERENCES
Blanke, M., Kinnaert, M., Lunze, J., and Staroswiecki, M.
(2006). Fault diagnosis of continuous-variable systems,
189–298. Springer Berlin Heidelberg, Berlin, Heidelberg.
Fonod, R., Henry, D., Charbonnel, C., and Bornschlegl, E.
(2015a). Position and Attitude Model-Based Thruster
Fault Diagnosis: A Comparison Study. Journal of
Guidance, Control, and Dynamics, 38(6), 1012–1026.
Fonod, R., Henry, D., Charbonnel, C., Bornschlegl, E.,
Losa, D., and Bennani, S. (2015b). Robust FDI for fault-
tolerant thrust allocation with application to spacecraft
rendezvous. Control Engineering Practice, 42, 12–27.
Hou, Q., Cheng, Y., Lu, N., and Jiang, B. (2008). Study on
FDD and FTC of satellite attitude control system based
on the effectiveness factor. In Proc. 2nd Int. Symp. on
Syst. and Contr. in Aerosp. and Astron., 1096–1101.
Markley, F.L. (2004). Multiplicative vs. additive filtering
for spacecraft attitude determination. Dynamics and
Control of Systems and Structures in Space, (467-474).
Marzat, J., Piet-Lahanier, H., Damongeot, F., and Walter,
E. (2012). Model-based fault diagnosis for aerospace
systems: a survey. Proc. of the Institution of Mechanical
Engineers, Part G, 226(10), 1329–1360.
Meskin, N. and Khorasani, K. (2007). Fault detection and
isolation in a redundant reaction wheels configuration
of a satellite. In IEEE International Conference on
Systems, Man and Cybernetics, 3153–3158.
Patton, R., Uppal, F., Simani, S., and Polle, B. (2008).
Reliable fault diagnosis scheme for a spacecraft attitude
control system. Proc. of the Institution of Mechanical
Engineers, Part O, 222(2), 139–152.
Pittet, C., Falcoz, A., and Henry, D. (2016). A Model-
based diagnosis method for transient and multiple faults
of AOCS thrusters. IFAC-PapersOnLine, 49(17), 82–87.
Venkateswaran, N., Siva, M., and Goel, P. (2002). Analyt-
ical redundancy based fault detection of gyroscopes in
spacecraft applications. Acta Astronautica, 50(9).
2019 IFAC ACA
August 27-30, 2019. Cranfield, UK
441

E. Lopez-Encarnacion et al. / IFAC PapersOnLine 52-12 (2019) 436–441 441
(open 100% of the time) does not produce a significant
difference with respect to the fault-free behaviour. Similar
phenomenon occurs when a stuck-closed thruster is not
commanded. However, the effect of this is not present
in the reported tables thanks to the careful definition of
the ”detection time” for stuck-closed fault, see Sec. 4.1.
Thruster leakage shows relatively high ratio of correct
detections, but also quite high detection time and low ratio
of correct equipment isolations. This is due to the fact
that some cases were run with mleak close to zero, which
produced very small amount of torque, see Fig. 4. Similar
reasoning holds for LoE fault type when mloe is very small
and its effect on the s/c is negligible. Regarding RW faults,
in general, very good results can be observed for correct
detection/isolation ratios and for mean detection times.
The large variance associated with the detection time of
the friction fault is caused by a single simulation case,
where the Coulomb factor was increased only by 1.4% and
its time to detection was 100 times greater than the rest
of the simulation cases. The detection time of the RW
tachometer fault does not show any correlation with the
magnitude of the fault, see Fig. 5. It can be also seen
that the fault type (friction or tachometer fault) is not
correctly isolated when a slew in X-axis is performed, but
this only occurs for five cases. More tests would be required
to confirm any clear correlation.
Table 4. MC campaign without uncertainties.
Thruster faults RW faults
Leak. LoE Closed Open Frict. Meas.
Correct detection [%] 99.33 87.33 100 100 100 100
Detection time [s]
(mean/std. deviation)
451.06/
1444
16.38/
47.43
1.63/
5.05
7.93/
51.63
3.59/
21.01
0.155/
0.0489
Corr. equip. isol. [%] 71.33 87.33 100 100 100 100
Corr. comp. isol. [%] N/A N/A N/A N/A 100 96.67
Miss detection [%] 0.67 12.67 0 0 0 0
Equip. miss isol. [%] 28.66 0 0 0 0 0
Comp. miss isol. [%] N/A N/A N/A N/A 0 3.33
False alarm [%] 0 0 0 0 0 0
Table 5. MC campaign with uncertainties.
Fault Thruster faults RW faults
free Leak. LoE Closed Op en Frict. Meas.
Correct detection [%] N/A 66 67.33 76.47 79.33 80 89.26
Detection time [s]
(mean/std. deviation) N/A 685.83/
2.37e3
26.06/
484.34
1.93/
17.89
4.50/
29.93
1.41/
0.73
0.16/
0.054
Corr. equip. isol. [%] N/A 44.67 67.33 76.47 79.33 80 84.56
Corr. comp. isol. [%] N/A N/A N/A N/A N/A 76.67 82.55
Miss detection [%] N/A 5.33 12.67 0 0 0 0
Equip. miss isol. [%] N/A 21.33 0 0 0 0 4.69
Comp. miss isol. [%] N/A N/A N/A N/A N/A 3.33 2.01
False alarm [%] 25.3 28.67 20 25.53 20.67 20 10.74
0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 0.5
m
leak
100
101
102
103
Time to Detection [s]
Not isolated
Isolated
Fig. 4. MC results for thruster leakage faults.
5. CONCLUSIONS
An FDI strategy to detect and isolate a class of AOCS
faults for an agile spacecraft is presented. The strategy
differs from usual schemes by being able to handle mul-
tiple actuators working simultaneously and to distinguish
different types of faults of the same equipment. The per-
formance of the proposed FDI scheme is evaluated with
1 1.2 1.4 1.6 1.8 2 2.2 2.4 2.6 2.8 3
m
meas
0.1
0.2
0.3
0.4
0.5
0.6
Time to Detection [s]
Fault Type Isolated
Fault Type not-Isolated
Fig. 5. MC results for the RW tachometer faults.
respect to various noise sources and uncertainties. MC
simulation results revealed promising results in terms of
good detection/isolation rates and short detection times.
REFERENCES
Blanke, M., Kinnaert, M., Lunze, J., and Staroswiecki, M.
(2006). Fault diagnosis of continuous-variable systems,
189–298. Springer Berlin Heidelberg, Berlin, Heidelberg.
Fonod, R., Henry, D., Charbonnel, C., and Bornschlegl, E.
(2015a). Position and Attitude Model-Based Thruster
Fault Diagnosis: A Comparison Study. Journal of
Guidance, Control, and Dynamics, 38(6), 1012–1026.
Fonod, R., Henry, D., Charbonnel, C., Bornschlegl, E.,
Losa, D., and Bennani, S. (2015b). Robust FDI for fault-
tolerant thrust allocation with application to spacecraft
rendezvous. Control Engineering Practice, 42, 12–27.
Hou, Q., Cheng, Y., Lu, N., and Jiang, B. (2008). Study on
FDD and FTC of satellite attitude control system based
on the effectiveness factor. In Proc. 2nd Int. Symp. on
Syst. and Contr. in Aerosp. and Astron., 1096–1101.
Markley, F.L. (2004). Multiplicative vs. additive filtering
for spacecraft attitude determination. Dynamics and
Control of Systems and Structures in Space, (467-474).
Marzat, J., Piet-Lahanier, H., Damongeot, F., and Walter,
E. (2012). Model-based fault diagnosis for aerospace
systems: a survey. Proc. of the Institution of Mechanical
Engineers, Part G, 226(10), 1329–1360.
Meskin, N. and Khorasani, K. (2007). Fault detection and
isolation in a redundant reaction wheels configuration
of a satellite. In IEEE International Conference on
Systems, Man and Cybernetics, 3153–3158.
Patton, R., Uppal, F., Simani, S., and Polle, B. (2008).
Reliable fault diagnosis scheme for a spacecraft attitude
control system. Proc. of the Institution of Mechanical
Engineers, Part O, 222(2), 139–152.
Pittet, C., Falcoz, A., and Henry, D. (2016). A Model-
based diagnosis method for transient and multiple faults
of AOCS thrusters. IFAC-PapersOnLine, 49(17), 82–87.
Venkateswaran, N., Siva, M., and Goel, P. (2002). Analyt-
ical redundancy based fault detection of gyroscopes in
spacecraft applications. Acta Astronautica, 50(9).
2019 IFAC ACA
August 27-30, 2019. Cranfield, UK
441