Fault Detection and Isolation in the Non-Toxic Orbital Maneuvering System and the Reaction Control System
Total Page:16
File Type:pdf, Size:1020Kb
Fault Detection and Isolation in the Non-Toxic Orbital Maneuvering System and the Reaction Control System ∗Mohammad Azam, ∗David Pham, §Fang Tu, ∗Krishna Pattipati, †Ann Patterson-Hine, and ‡Lui Wang ∗Dept. of ECE, University of Connecticut, Storrs, CT 06269-1157 †NASA Ames Research Center, MS 269-4, Moffett Filed, CA 94035-1000 ‡NASA Johnson Space Center, JSC-ER2, Houston, TX 77058 §Qualtech Systems Inc., 100 Meadow Road, Wethersfield, CT 06109 Abstract— In this paper, we consider the problem of test design 2. The system is reasonably complex with 160 faults and for real-time fault detection and diagnosis in the space shuttle’s 128 sensors. non-toxic orbital maneuvering system and reaction control sys- 3. The system response under normal and faulty conditions tem (NT-OMS/RCS). For demonstration purposes, we restrict our attention to the aft section of the NT-OMS/RCS, which consists is a function of initial conditions of the system (e.g., of 160 faults (each fault being either a leakage, blockage, igniter helium tank pressure, amount of liquid oxygen and fuel in fault, or regulator fault) and 128 sensors. Using the proposed the tanks, etc.). This complicates the test design process tests, we are able to uniquely isolate a large number of the faults because the tests should be insensitive to random initial of interest in the NT-OMS/RCS. Those that cannot be uniquely conditions. isolated can generally be resolved into small ambiguity groups and then uniquely isolated via manual/automated commands. 4. The possible combinations of commanded valves, cross- Simulation of the NT-OMS/RCS under various fault conditions feeds, and active engines causes the number of operating was conducted using the TRICKR modeling software. modes of the NT-OMS/RCS to be extremely large (> 226). The design of tests that are (nearly) invariant to I. INTRODUCTION operating modes is an engineering challenge. For safety-critical systems (e.g., aerospace, nuclear, auto- The lack of a complete mathematical model of the NT- motive, etc), fast and efficient fault detection and isolation OMS/RCS automatically rules out the possibility of an an- (FDI) techniques are necessary in order to attain a high alytic model-based FDI approach [9]-[15]. However, the NT- degree of availability, reliability, and operational safety [2]. OMS/RCS is sensor-rich, providing information on such pa- The permissible time window for the detection and diagnosis rameters as temperature, pressure, engine thrust, and fluid flow of faults in these systems can be quite narrow, which makes the at many locations in the NT-OMS/RCS network. As a result, problem of online detection and isolation all the more difficult. a large amount of monitored data is available to the crew The space shuttle is a prime example of a safety-critical members and mission control in real-time. In this situation, a system. For orbital maneuvering, orbital attitude control, and data-driven approach towards fault detection and diagnosis is a atmospheric re-entry, the space shuttle employs an orbital feasible solution (given that real-time estimates of the system maneuvering system and reaction control system (OMS/RCS). response variables, under nominal operating conditions, are Due to the hazards and difficulty involved in maintaining the available; these estimates can often be inexpensively obtained current OMS/RCS, a new design is currently under develop- using a simulator) [3]. ment that employs non-toxic propellants. This new system, In data-driven approaches, where failure modes are explic- which we will refer to as the NT-OMS/RCS, is the system of itly known a priori, a decision matrix (D-matrix) relating the interest in this paper. faults as rows and test results on the features of the residuals as FDI in the NT-OMS/RCS poses the following four chal- columns is developed off-line. These residuals are computed lenges: from simulations of nominal scenarios and scenarios simulated 1. A real-time simulation model of the NT-OMS/RCS, with single faults. Decision fusion (inference) algorithms, called TRICKR [4], is available. However, a complete using the test results (obtained by performing the same set of mathematical model is not available for use. This sit- tests that was used to develop the D-Matrix on the observed uation also arises frequently when a subsystem vendor data) and the D-matrix as inputs, provide the FDI solutions. protects the intellectual property of the system details. Since a reasonably accurate simulator is available for the NT- In this case, the subsystem vendor may provide an OMS/RCS, that uses the commands, fault universe and initial executable simulator to the system integrator. conditions as input parameters and that provides the estimated sensor readings in real-time, it is an ideal candidate system • valve blockages for the application of data-driven FDI methods. • igniter faults For data-driven FDI schemes, the design of robust diag- • regulator faults nostic tests represents a challenging task. The nature of the In the aft section of the NT-OMS/RCS, there are a total of observed data (e.g., sampling interval, noise), the number and 160 failure modes which are decomposed as 36 leakage, 26 distribution of sensors, weigh heavily into the effectiveness of igniter, 92 blockage, and 6 regulator faults. Of the four fault the tests. In multi-mode systems, test outcomes for a given classes, leakage and blockage represent the most difficult to fault may vary from one mode of operation to another. When detect and isolate, since they can occur in various degrees of the number of modes is small, separate sets of tests can severity. In addition, many of their characteristics (especially be designed for each mode. Since the NT-OMS/RCS has an for blockage) are sensitive to the initial conditions and system extremely large number of modes (where the number of modes modes. is equal to the number of possible combinations of active RCS and OMS engines), designing a separate set of tests for each C. Sensors mode is impractical. Consequently, the search for tests that The aft section of the NT-OMS/RCS contains the following are invariant (or nearly so) to the mode of operations is key. sensors: Also, the order in which the various tests are considered in • 2 valve position sensors diagnostic decisions is another issue that must be addressed. • 64 pressure sensors In this paper, a data-driven FDI scheme for the NT- • 28 temperature sensors OMS/RCS is devised. For proof of concept, we focus on the • 26 thrust sensors aft section of the NT-OMS/RCS, which contains 160 fault • 4 propellant mass sensors modes with 128 distributed sensors for monitoring tempera- • 4 propellant volume sensors ture, pressure, and thrust-output. Using the proposed tests, we are able to uniquely isolate a large number of the faults of D. Characteristics of the NT-OMS/RCS Fault Universe interest in the NT-OMS/RCS. Those that cannot be uniquely With the exception of leakages and certain types of regulator isolated can generally be resolved into small ambiguity groups faults (specifically the “stuck open” fault mode) , all faults in and then uniquely isolated via manual/automated commands. the NT-OMS/RCS are dormant, that is, they will produce no A benefit of the proposed FDI scheme is that it may serve anomalous sensor readings until an engine or a set of engines as a template for addressing other FDI problems for which a have been fired. Let Fi be the set of dormant faults that complete mathematical model of the system is not available. produce error signals when engine i has been fired. Given The rest of the paper is organized as follows. The FDI that the set of engines E have fired, the set of dormant faults problem for the NT-OMS/RCS is formulated in section 2. F˜ that will produce anomalous sensor readings is given by 1 An overview of the complete diagnostics process is given in ˜ section 3. In section 4, we give detailed descriptions of the F = Fi (1) diagnostic tests. In sections 5 and 6, we address the problems i∈E of sensor faults and fault severity estimation. Test cases and Finally, let us define FA as the set of leakage faults and “stuck simulation results are presented in section 6 to demonstrate open” regulator faults and S as the set of sensors displaying the viability of the idea, and the paper concludes in section 7 anomalous readings. The problem then is to determine the fault ˆ ˜ with a brief summary. set F ⊆ (FA ∪F ) that best accounts for the readings produced II. PROBLEM FORMULATION by the sensors in S. From further observations of the NT-OMS/RCS, the set S A. System Description is approximately given by As shown in Figure 1, the new OMS/RCS consists of 14 forward thrusters, 24 aft thrusters (12 jets on both the left and S = Sk|E (2) right sides), 2 orbital maneuvering engines located near the tail k∈Fˆ of the shuttle, 4 propellant storage tanks (2 ethanol tanks and where Sk|E are the set of sensors producing anomalous 2 liquid oxygen tanks), and a large distribution network [1]. readings when fault k has occurred and the set of engines Other components in the system include pressure regulators, E are firing. The set Sk|E, in turn, is approximately given as relief systems, igniters, and an assortment of valves. The propellants are delivered to the engines under high pressure Sk|E = Sk|i (3) from 4 helium storage tanks where they combine to produce i∈E the thrust used for attitude control, rotational maneuvers, and where Sk|i are the set of sensors producing anomalous read- small velocity adjustments.