Autonomous Attitude Reconstruction Analysis for Propulsion System with Typical Thrust Drop Fault

Abstract

The propulsion system is one of the important and vulnerable sub-systems in a strap-on launch vehicle. Among different failure modes, the thrust drop fault is the most common and remediable one. It degrades vehicle attitude tracking ability directly. To this end, this paper focuses on the design and application of attitude reconstruction problems with a thrust loss fault during the ascending flight phase. We firstly analyze the special failure modes and impacts on the propulsion system through a Failure Modes and Effects Analysis (FMEA). Then, six degrees of freedom dynamic and kinematic models are formulated, which are integrated into the Matlab/Simulink environment afterward. The above models’ validation is realized through numerical simulations with different fault severity. Simulation results show that the max attitude deviation is only 0.67° approximately in the pitch angle channel under normal conditions, and the flight attitude angle deviation is directly proportional to the thrust loss percentage when the thrust drop fault occurs. Based on the validated models, a practical reconfigurable ideal through adjusting the control allocation matrix is analyzed. Then, an automation redistribution mechanism based on the moment equivalent principle before and after the thrust drop is proposed to realize proportional allocation of virtual control command among the actuators. The effectiveness of the designed attitude reconstruction method is demonstrated through numerical simulations and comparison analysis under various fault scenarios. The results show that the rocket attitude can be quickly adjusted to the predetermined program angle within about 2.5 s after the shutdown failure of a single engine, and the flight speed and altitude can also reach the required value with another 17 s engine operation. Therefore, the designed control reconfiguration strategy can deal with the thrust loss fault with high practicability and can be applied to real-time FTC systems. Last but not least, conclusions and prospects are presented to inspire researchers with further exploration in this field.

1. Introduction

With the great progress of human science and technology development, more and more nations and research institutions have been focusing on space exploration. At present, heavy launch vehicles are still an indispensable tool and prerequisite for space development and utilization, which is also an important flag of the comprehensive strength and technological strength of one nation. With the advent of key and major aerospace programs such as deep space exploration, manned space programs, lunar probes, and space station construction, the reliability and safety of launch vehicles are drawing more and more attention.

Due to the complicated structure and harsh working environment, the propulsion system of a launch vehicle has become one of the most common fault sources, which will lead to launch failure or mission failure directly. In May 1986, a Delta vehicle loaded with a meteorological satellite worth 57 million dollars blew up within seconds after lift-off because the main engine closed down prematurely [1]. Due to the first-stage engine fault, the H-2 launch vehicle did not send the MTSAT satellite into the predefined orbit in November 1999 [2]. An M5 rocket, carrying the Astra-E satellite, failed to reach its expected orbit 550 km above the Earth in February 2000 in Japan [3], and India’s GSLV-F06 launch vehicle loaded with a GSAT-5P satellite exploded when lifting off [4]. The failure of an upgraded version of Europe’s Ariane 5 launcher in December 2002 was caused by an upper-stage engine fault [5]. In recent years, most launch failures have occurred in their propulsion systems. In 2017, the Chinese Long March 5 failed to complete the launch mission owing to one of the two core engines failing to operate normally [6]. In July 2019, Japan’s MOMO-4 vehicle crashed into the sea just because the engines were shut down in advance. In 2020 and 2021, SN8 and SN9 experienced two mission failures successively as a result of a Raptor engine fault. The tragedies caused by propulsion system faults drive global scholars to study fault mechanisms, reliability design methodology, preventive maintenance, etc., to eliminate faults thoroughly. However, due to the uncertainty of fault occurrence and the complexity of the fault mechanism, a fault is an unavoidable element from the birth of a vehicle to its disposal. Even for vehicles with the highest reliability and perfect maintenance, there is still a chance of a failure occurring according to Murphy’s Law. Thus, it is wise to admit the fact that a flight control system without any fault tolerance capability may suffer mission performance degradation or even vehicle attitude instability from an abrupt fault occurrence. Therefore, it is necessary to try to study effective Fault-Tolerant Control (FTC) methods to improve the reliability, safety, and mission success probability of launch vehicles as much as possible.

2. State-of-the-Art FTC

In recent years, great efforts have been made and research conducted on FTC, which has been widely applied to some safety-critical systems, especially in the field of aerospace engineering. From the application goal perspective, FTC can be roughly categorized into Mission Reconstruction (MRC) and Attitude Reconstruction (ARC).

For the MRC problem, Xiao He et al. proposed a deep-neural-network-based adaptive collocation method to solve MRC problems [7]. Changzhu Wei et al. presented a novel MRC method based on accelerated Landweber iteration and a redistribution mechanism for a horizontal takeoff and horizontal landing reusable launch vehicle [8]. Zhengyu Song et al. proposed an autonomous mission reconstruction algorithm for geostationary transfer orbit launch missions [6]. Yawei Wu et al. used a nonlinear observer based on a radial basis function neural network to estimate the fault information and then presented an adaptive back-stepping sliding mode trajectory controller [9]. When a fault occurs in a propulsion system, the flight control ability will degrade, and the launch vehicle will deviate from the normal trajectory, impacting the mission. Therefore, ARC should be first satisfied to maintain vehicle stability, and the most common reconstruction actions are usually achieved through Control Allocation (CA) [10]. Tong Li et al. maintained the system stability by reconfiguring the actual control command based on a fault detection and diagnosis method [11]. Cheng Tangming et al. realized launch vehicle attitude reconstruction based on the moment compensation ideal [12]. Liming Fan et al. proposed a simple composition consisting of a nominal controller and a robust compensator for a satellite attitude control system subject to parametric perturbations, external disturbances, and actuator faults [13]. Yaokun Zhang et al. proposed a two-stage control reconfiguration strategy based on the cascaded pseudoinverse allocation method and the neuron adaptive gain scheduling method for faults with different severity [14]. Argha A et al. described a novel scheme for FTC using a robust optimal control design method which can also be employed as actuator redundancy management for over-actuated linear systems [15]. Ariful Mashud et al. proposed a CA technique to redistribute the control effort to the healthy actuators taking the advantage of actuator redundancy of the uncertain descriptor system [16]. Binwen Lu et al. discussed the adaptive control allocation-based fault-tolerant flight control problem for an over-actuated aircraft in the presence of unknown uncertainties and actuator faults [17]. Tohidi S. S. et al. introduced an adaptive control allocation method based on the pseudoinverse along the null space of the control matrix in order to adaptively tolerate actuator faults [18]. There are many successful CA cases in launch history, such as SpaceX Falcon 9 and the Delta 4 rocket in 2012 [19].

The reviewed works have been proved to be effective in launch vehicle FTC, but the granularity of the modeling used in FTC is not enough for practical scenarios of propulsion systems. In addition, a lot of modeling work is needed based on the ad hoc scenario requirements in different applications. The main contribution of this paper is that a full scheme of fault response methodology to alleviate losses due to typical propulsion system failure for a specific strap-on launch vehicle is presented based on the aforementioned excellent studies, which mainly includes fault analysis, fault modeling, model validation, and fault tolerance. The remainder of this paper is organized as follows: In Section 3, a fault analysis for the propulsion system is conducted using FMEA. In Section 4, the mathematical models of a strap-on launch vehicle with a thrust drop fault are formulated. In Section 5, a simulation model is realized in Matlab/Simulink, and a number of numerical simulations under different fault scenarios are presented. In Section 6, an effective control reconfiguration strategy is designed and formulated. Finally, a brief conclusion and future work are provided in Section 7.

3. Propulsion System Fault Analysis

A fault analysis based on Failure Mode and Effects Analysis (FMEA) is closely related to the system’s structural hierarchy. To get a good understanding of the failure modes and failure causes, the construction architecture and its indenture levels of China’s Long March launch vehicle are set up, which serves as a reference system for the fault analysis, as shown in Figure 1. According to the paper’s research goal, we divide the launch vehicle into four top-down tiers, i.e., equipment level, system level, sub-system level, and component level successively. It is possible to have simpler or more detailed division results depending on one’s requirements. We define the whole launch vehicle equipment level, which is the highest level and is also the initial indenture level in FMEA. Generally speaking, the launch vehicle is usually composed of a propulsion system, control system, stage separation system, and electrical system. We define the hierarchy of the four systems as the system level, which is the second level and also the indenture level in FMEA. Similarly, we can define the sub-system level and component level. It is worth noting that the component level is also the lowest indenture level in FMEA.

From the great number of past launches, the faults that occurred in the launch vehicles were mainly focused on the propulsion system, control system, stage separation system, and electrical system. The propulsion system serves as the central power unit and core component of the launch vehicle and usually works in a harsh working environment with high pressure and temperature, intense vibration, strong corrosion, etc. Furthermore, the number of engines in the propulsion system increases sharply to satisfy heavy thrust requirements, which also complicates its structure. Therefore, the propulsion system is very prone to failure and becomes one of the most frequent fault sources, which will affect the overall mission success of launch vehicles eventually [20]. It is reported that from 1980 to 2004, 16 of the 31 launch failures in the United States and 37 of the 65 launch failures in Russia were caused by a propulsion system fault [21].

The propulsion system fault is analyzed through FMEA. Typical failure modes categorized according to the effects of these failed sub-systems on the propulsion system include thrust drop, explosion, inability to start up, and accidental shutdown. The FMEA results of the propulsion system are shown in

Table 1. The propulsion system FMEA.

Identifier	Failure Mode	Failure Cause
f1	thrust drop	propellant duct blockage, engine fault, actuator failure
f2	explosion	propellant leakage
f3	inability to start up	engine fault
f4	accidental shutdown	engine fault

.

Different failure modes have different criticality and severity on the propulsion system. According to thrust loss degree and launch mission success probability, the propulsion system fault severity can be classified into four tiers [22,23].

• Slight fault: thrust loses slightly, which will not impact the launch mission.
• Middle fault: thrust loses with a middle degree, and the energy loss of launch vehicles is small.
• Severe fault: thrust loses with great percentage, which results in mission failure.
• Fatal fault: collapse fault or severe leakage occurs in the propulsion system, and launch vehicles are out of control, even explode.

When a fatal fault occurs, there are almost no effective remedy methods at present; therefore, the paper mainly considers thrust drop with a middle or severe degree. If no explosion or catastrophic failure occurs, thrust drop fault impacts vehicle motion by two factors, namely, fault time $t_f$ and the actual thrust $T_a$ after fault occurrence; the variation of $T_a$ with working time t is described as follows:

$$T_a=\left\{\begin{array}{l}T\begin{array}{ccc}& & t<t_f\end{array}\\ \left(1-k\right)T\begin{array}{cc}t\ge t_f& \end{array}\end{array}\right.$$

(1)

where T is the standard thrust value of the normal engine, and $k\in [0,1]$ is the thrust loss coefficient.

4. Motion Models with Thrust Drop Fault

The propulsion system of a strap-on launch vehicle is transferred into core-stage-booster joint control mode from the only core-stage control method in order to improve the control ability. Thus, when a fault occurs in an engine, the rest of the normal engines can be used to compensate for the faulty effects caused by the faulty engine. The first-stage engine layout of some strap-on launch vehicles is shown in Figure 2 from the bottom view.

$O_1-X_1{Y}_1{Z}_1$ is the launch vehicle body coordinate system. $x{j}_1,x{j}_2$ denote the two core engines, which are diagonally allocated in the second and the third quadrants and can swing bidirectionally in the $O_1-Y_1{Z}_1$ plane. $z{t}_1,z{t}_2,z{t}_3,z{t}_4$ denote the four strap-on booster engines, which are symmetrically distributed around the vehicle on the $Y_1$ and $Z_1$ axes in the $O_1-Y_1{Z}_1$ plane and can swing tangentially. The corresponding actual swing angles are denoted by $U={[{\delta }_{xj1},{\delta }_{xj2},{\delta }_{xj3},{\delta }_{xj4},{\delta }_{zt1},{\delta }_{zt2},{\delta }_{zt3},{\delta }_{zt4}]}^T$, and the positive direction is indicated by the arrows in Figure 2.

Generally, launch vehicle motion models consist of dynamic equations, kinematic equations, and geometrical relation equations. Taking the launch vehicle as an equivalent particle, the launch vehicle’s motion can be divided into centroid translational motion and centroid rotational motion. The former is usually used in flight trajectory law research, and the latter is mainly used in attitude control design.

The forces and torques imposed on the launch vehicle are shown in

Table 2. The main forces and their corresponding torques.

Name	Force	Torque
Gravity	$mg$
Thrust	$P$	$M_P$
Control force	$F_c$	$M_c$
Gimbaled force	$F_l$	$M_l$
Aerodynamic force	$R^{\prime }$	$M_R^{\prime }$
Interference force	$F_B$	$M_B$

.

The vehicle translational dynamic and kinematic models can be presented in the earth-centered inertial coordinate system (ground coordinate system) as follows [24,25,26]:

$$\left\{\begin{array}{l}m\frac{d^{2}r}{d{t}^2}=P+F_c+F_l+mg+R^{\prime }+F_B\\ \left[\begin{array}{c}\dot{x}\\ \dot{y}\\ \dot{z}\end{array}\right]=\left[\begin{array}{c}Vcos\theta cos\sigma \\ Vsin\theta cos\sigma \\ -Vsin\sigma \end{array}\right]\end{array}\right.$$

(2)

where $r={[x,y,z]}^T$ denotes the real-time position vector, m denotes vehicle mass, $g$ denotes gravity acceleration, and $V$ denotes launch vehicle velocity.

In the body coordinate system, the rotational dynamic and kinematic models can be described as

$$\left\{\begin{array}{l}J\times \frac{d{\omega }_T}{dt}+{\omega }_T\times \left(J\times {\omega }_T\right)=M_p+M_c+M_l+{M^{\prime }}_R+M_B\\ {\omega }_T=\left[\begin{array}{c}{\omega }_{X_1}\\ {\omega }_{Y_1}\\ {\omega }_{Z_1}\end{array}\right]=\left[\begin{array}{c}-\dot{\phi }sin\psi +\dot{\gamma }\\ \dot{\phi }cos\psi sin\gamma +\dot{\psi }cos\gamma \\ \dot{\phi }cos\psi cos\gamma -\dot{\psi }sin\gamma \end{array}\right]\end{array}\right.$$

(3)

where ${\mathbf{\omega }}_{\mathit{T}}$ is the angular velocity in the body coordinate system, and $J$ is the constant inertial matrix with respect to the center of mass of the body.

Based on Equations (2) and (3), the attitude kinematic model can be described as

$$\left\{\begin{array}{l}\hspace{1em}\dot{\phi }=\frac{1}{cos\phi }\left({\omega }_{Y_1}sin\gamma +{\omega }_{Z_1}cos\gamma \right)\\ \hspace{1em}\dot{\psi }={\omega }_{Y_1}cos\gamma -{\omega }_{Z_1}sin\gamma \\ \dot{\gamma }={\omega }_{X_1}+tan\psi \left({\omega }_{Y_1}sin\gamma +{\omega }_{Z_1}cos\gamma \right)\end{array}\right.$$

(4)

The eight Euler angles are not independent of each other, and the relationships among them are:

$$\left\{\begin{array}{l}sin\sigma =cos\alpha cos\beta sin\psi +sin\alpha cos\beta \sin \gamma cos\psi -sin\beta cos\gamma cos\psi \\ sin\nu cos\sigma =-sin\alpha sin\psi +cos\alpha \sin \gamma cos\psi \\ cos\sigma cos\theta =cos\alpha cos\beta cos\phi cos\psi -sin\alpha cos\beta \left(\sin \gamma sin\psi cos\phi -cos\gamma sin\phi \right)\\ +sin\beta \left(cos\gamma sin\psi cos\phi +\sin \gamma sin\phi \right)\end{array}\right.$$

(5)

Utilizing the small deviation hypothesis to simplify the above dynamical models, the linearization dynamic model for launch vehicles can be deduced as:

$$\left\{\begin{array}{cc}\hfill & \Delta \stackrel{\dot{}\dot{}}{\phi }+b_1^{\phi }\Delta \dot{\phi }+b_2^{\phi }\Delta \phi -b_{3xj2}^{\phi }\Delta {\delta }_{xj2}+b_{3xj1}^{\phi }\Delta {\delta }_{xj4}-b_{3zt2}^{\phi }\Delta {\delta }_{zt2}+b_{3zt4}^{\phi }\Delta {\delta }_{zt4}\hfill \\ \hfill & ={\overline{M}}_{B{Z}_1}-b_2^{\phi }\left({\alpha }_{wp}+{\alpha }_{wq}\right)\hfill \\ \hfill & \stackrel{\dot{}\dot{}}{\psi }+b_1^{\psi }\dot{\psi }+b_2^{\psi }\beta -b_{3xj1}^{\psi }\Delta {\delta }_{xj1}+b_{3xj2}^{\psi }\Delta {\delta }_{xj3}-b_{3zt1}^{\psi }\Delta {\delta }_{zt1}+b_{3zt3}^{\psi }\Delta {\delta }_{zt3}\hfill \\ \hfill & ={\overline{M}}_{B{Y}_1}-b_2^{\psi }\left({\beta }_{wp}+{\beta }_{wq}\right)\hfill \\ \hfill & \stackrel{\dot{}\dot{}}{\gamma }+d_1\dot{\gamma }+d_{3xj1}{\delta }_{xj1}+d_{3xj2}{\delta }_{xj2}+d_{3xj3}{\delta }_{xj3}+d_{3xj4}{\delta }_{xj4}\hfill \\ \hfill & +d_{3zt1}{\delta }_{zt1}+d_{3zt2}{\delta }_{zt2}+d_{3zt3}{\delta }_{zt3}+d_{3zt4}{\delta }_{zt1}={\overline{M}}_{B{X}_1}\hfill \end{array}\right.$$

(6)

where $b_1^{\phi }$, $b_2^{\phi }$, $b_{3xj1}^{\phi }$, $b_{3xj2}^{\phi }$, $b_{3zt2}^{\phi }$, $b_{3zt4}^{\phi }$; $b_1^{\psi }$, $b_2^{\psi }$, $b_{3xj1}^{\psi }$, $b_{3xj2}^{\psi }$, $b_{3zt1}^{\psi }$, $b_{3zt3}^{\psi }$; $d_1$, $d_{3xj1-4}$, $d_{3zt1-4}$ are the coefficients of rigid body motion equations, and the detailed meanings can be seen in Reference [26].

5. Model Validation through Simulations

A Long March 5 launch vehicle launched in Wenchang, China, where the longitude, latitude, and altitude were 110.95 E, 19.61 N, and 20 m, respectively, is taken as a validation example. The cross-sectional area of the launch vehicle is 19.62 m²; the length is 53.7 m. The diameters of the core-stage engine and booster engine are 5 m and 3.35 m, respectively. The total thrust approximates to 10,600 KN. The operation time of the core first-stage engines and booster engines during the launch vehicle’s boost phase is usually not more than 160 s. Taking some factors such as centroid bias and wind disturbance into account, the PD control parameters of the launch vehicle, which are obtained through aerodynamic coefficient analysis at different feature points, are shown in

Table 3. PD control parameters of launch vehicle.

Feature Point (s)	${\mathit{K}}_{\mathit{P}}^{\mathit{P}\mathit{i}\mathit{t}\mathit{c}\mathit{h}}$	${\mathit{K}}_{\mathit{D}}^{\mathit{P}\mathit{i}\mathit{t}\mathit{c}\mathit{h}}$	${\mathit{K}}_{\mathit{P}}^{\mathit{Y}\mathit{a}\mathit{w}}$	${\mathit{K}}_{\mathit{D}}^{\mathit{Y}\mathit{a}\mathit{w}}$	${\mathit{K}}_{\mathit{P}}^{\mathit{R}\mathit{o}\mathit{l}\mathit{l}}$	${\mathit{K}}_{\mathit{D}}^{\mathit{R}\mathit{o}\mathit{l}\mathit{l}}$
0	0.8	1.2	0.8	1.2	0.4	0.2
17	0.8	1.2	0.8	1.2	0.4	0.2
50	0.9	1.2	0.9	1.3	0.4	0.2
75	0.9	1.2	0.9	1.4	0.4	0.2
90	0.9	1.2	0.9	1.5	0.4	0.2
120	0.8	1.4	0.8	1.4	0.4	0.2
135	0.8	1.4	0.8	1.4	0.2	0.1
170	0.8	1.2	0.8	1.3	0.2	0.1

.

To verify the effectiveness of the proposed motion models, numerical simulations are carried out in different scenarios. Based on Equations (2)–(5) and the PD control parameters, the motion models with the thrust drop fault of the launch vehicle are simulated in Matlab/Simulink, which consist of a force and torque module, dynamic module, kinematic module, and parameter module, as shown in Figure 3.

Firstly, the simulation results of the launch vehicle’s flight attitude without fault occurrence are shown in Figure 4 and Figure 5. Figure 4 describes the variations in the height and velocity of the rocket during the whole boost phase (160 s). The total thrust fluctuation is small, and the distance between the rocket centroid and the launch inertial coordinate origin increases with the flight time. At the same time, the velocity increases gradually due to the reduction in the rocket’s total mass caused by the fuel consumption in tanks. From Figure 5, we can find that the deviation between the pitch angle and the predefined flight attitude command is very small, 0.67° approximately, with the same conclusions for the yaw angle and roll angle. The simulations prove the proposed models are very effective.

Furthermore, four typical failure cases at different fault times with different thrust loss percentages are simulated to test the motion models (shown in

Table 4. Typical simulation cases for some engines.

	Fault Time	Thrust Drop Percentage	Engine Type
Case 1	40 s, 60 s, 100 s	80%	Core-stage No.2 engine
Case 2	40 s	20%, 60%, 80%	Core-stage No.2 engine
Case 3	40 s, 60 s, 100 s	80%	Booster No.2 engine
Case 4	40 s	20%, 60%, 80%	Booster No.2 engine

).

Case 1 simulates faults that occur at different times (40 s, 60 s, 100 s) with the same thrust drop percentage (80%) of the core-stage No.2 engine; the vehicle flight attitude angle deviations increase sharply and clearly at fault time (shown in Figure 6). However, the accurate deviation time deviates from the preset fault time slightly, especially for the roll angle. From the point of deviation value, roll angle deviation is very small because the core-stage No.2 engine mainly controls the pitch and yaw channels and has little impact on the roll channel. The results also show that the formulated dynamic models are very effective in detecting core-stage engine faults.

Case 2 supposes that fault occurs at 40 s with different thrust loss percentages (fault severity). There is no doubt that flight attitude deviation is directly proportional to thrust loss percentage, as shown in Figure 7. At the same time, the angle deviations after fault time do not diverge, which lays a base for the fault-tolerant control design. The results also show that the presented models can detect different failure modes with higher sensitivity and accuracy.

Case 3 and case 4 simulation results are shown in Figure 8 and Figure 9, respectively. In the two cases, simulation sets are the same as in case 1 and case 2, except for different engines. Two main conclusions are drawn here: one is that vehicle flight attitude angle produces deviation at different fault times, and the other is that the flight attitude angle deviation is also directly proportional to thrust loss percentage.

6. Attitude Reconstruction Strategy with Thrust Drop Fault

6.1. Problem Formulation

A propulsion system with a thrust drop fault usually results in an increasing flight attitude error, degrading attracting ability, and even worse deviating from the predefined trajectory. Therefore, attitude control should be firstly maintained during the ascending flight of launch vehicles. According to the simulation results in Section 4, although attitude angle shows clear deviation when thrust drops, it does not diverge with time, which implies that the traditional attitude controller has robustness and reconfiguration capacity to some extent.

Generally speaking, thrust size regulation is very difficult in engineering applications. On the contrary, thrust direction regulation, i.e., engine swing angle is easy in comparison. The attitude control system based on angle adjusting is shown in Figure 10, which mainly includes basic control law and control allocation law. The whole attitude control process can be described as: The attitude angle ($\Delta \phi ,\psi ,\gamma$) and angle velocity ($\Delta \stackrel{·}{\phi },\stackrel{·}{\psi },\stackrel{·}{\gamma }$) are firstly obtained by the measurement unit. Then, the virtual swing angle commands ($\Delta {\delta }_{\phi }^s,{\delta }_{\psi }^s,{\delta }_{\gamma }^s$) of three channels can be obtained through basic control law (e.g., PD control). Next, the core-stage engine virtual swing angle command ($\Delta {\delta }_{\phi xj}^s,{\delta }_{\psi xj}^s,{\delta }_{\gamma xj}^s$) and the booster engine virtual swing angle command ($\Delta {\delta }_{\phi zt}^s,{\delta }_{\psi zt}^s,{\delta }_{\gamma zt}^s$) can be calculated by allocation coefficients ($k_{xj}$ and $k_{zt}$, respectively). At last, the control allocation law allocates the virtual commands to the corresponding actuator, which drives the engine nozzle to swing at proper angles (${\delta }_{zt1},{\delta }_{zt2},{\delta }_{zt3},{\delta }_{zt4}$, ${\delta }_{xj1},{\delta }_{xj2},{\delta }_{xj3},{\delta }_{xj4}$) in order to maintain attitude tracking ability. Engine swing angles are directly determined by the control allocation law, and under fault-free conditions, the engine’s actual swing angles are calculated by:

$$\left\{\begin{array}{cc}\hfill & {\delta }_{xj1}=-{\delta }_{\psi xj}^{{}^s}+{\delta }_{{}_{\gamma xj}}^{{}^s}\hfill \\ \hfill & {\delta }_{xj2}=-\Delta {\delta }_{{}_{\phi xj}}^{{}^s}+{\delta }_{{}_{\gamma xj}}^{{}^s}\hfill \\ \hfill & {\delta }_{xj3}={\delta }_{\psi xj}^{{}^{{}^s}}+{\delta }_{{}_{\gamma xj}}^{{}^{{}^s}}\hfill \\ \hfill & {\delta }_{xj4}=\Delta {\delta }_{{}_{\phi xj}}^{{}^s}+{\delta }_{{}_{\gamma xj}}^{{}^s}\hfill \end{array}\right.,\left\{\begin{array}{cc}\hfill & {\delta }_{zt1}=-{\delta }_{\psi zt}^{{}^s}+{\delta }_{{}_{\gamma zt}}^{{}^s}\hfill \\ \hfill & {\delta }_{zt2}=-\Delta {\delta }_{{}_{\phi zt}}^{{}^s}+{\delta }_{{}_{\gamma zt}}^{{}^s}\hfill \\ \hfill & {\delta }_{zt3}={\delta }_{\psi zt}^{{}^s}+{\delta }_{{}_{\gamma zt}}^{{}^s}\hfill \\ \hfill & {\delta }_{zt4}=\Delta {\delta }_{{}_{\phi zt}}^{{}^s}+{\delta }_{{}_{\gamma zt}}^{{}^s}\hfill \end{array}\right.$$

(7)

If a thrust drop fault occurs in an engine, a large external disturbance moment can be brought into the attitude control system due to the imbalance between different thrusts, which will cause a large attitude tracking error and degrade attitude tracking ability directly. Considering the strap-on launch vehicle’s engine, function redundancy can provide a feasible fault-tolerant control method. Therefore, an automation flight attitude reconstruction strategy can be implemented by adjusting the redundant swing angles among engines cooperatively in order to keep the total control moment applied to the launch vehicle unchanged before and after the fault. In other words, the attitude control system can reallocate the virtual control command of three channels among the actuators proportionally and then reset the swing angles among the fault engines and the normal working engines simultaneously until the control moment after fault occurrence is equal to the expected control moment (normal state). According to Equation (6), the control moment can be expressed by

$$M=BU$$

(8)

The expressions of M and B are as follows

$$\left\{\begin{array}{cc}\hfill & \mathrm{M}=\left[\begin{array}{cc}\hfill & b_{3x}^{\phi }\Delta {\delta }_{{}_{\phi xj}}^{{}^s}+b_{3z}^{\phi }\Delta {\delta }_{{}_{\phi zt}}^{{}^s}\hfill \\ \hfill & b_{3x}^{\psi }{\delta }_{{}_{\psi xj}}^{{}^s}+b_{3z}^{\psi }{\delta }_{{}_{\psi zt}}^{{}^s}\hfill \\ \hfill & d_{3x}{\delta }_{{}_{\gamma xj}}^{{}^s}+d_{3z}{\delta }_{{}_{\gamma zt}}^{{}^s}\hfill \end{array}\right]\hfill \\ & B=\left[\begin{array}{cc}\hfill & 0-b_{3xj2}^{\phi }0b_{3xj1}^{\phi }0-b_{3zt2}^{\phi }0b_{3zt4}^{\phi }\hfill \\ \hfill & -b_{3xj1}^{\psi }0b_{3xj2}^{\psi }0-b_{3zt1}^{\psi }0b_{3zt3}^{\psi }0\hfill \\ \hfill & d_{3x1}{d}_{3x2}{d}_{3x3}{d}_{3x4}{d}_{3z1}{d}_{3z2}{d}_{3z3}{d}_{3z4}\hfill \end{array}\right]\hfill \end{array}\right.$$

(9)

where M is the expected control moment, and B is the control allocation matrix. When a thrust drop fault occurs in some engines, the control allocation law can realize the distribution of virtual control command by only adjusting the control allocation matrix to reconstruct the moment.

Of course, the adjustment range of the engine swing angle should be constrained by saturation limits. If ${\overline{\delta }}_{xji}$ and ${\overline{\delta }}_{zti}$ denote the maximum swing angle range of the core-stage and booster engines, respectively, then, we can write the following inequalities:

$$\left\{\begin{array}{l}\left|{\delta }_{xji}\right|\le {\overline{\delta }}_{xji}\\ \left|{\delta }_{zti}\right|\le {\overline{\delta }}_{zti}\end{array}\right.\begin{array}{cc},& \end{array}i=1,2,3,4$$

(10)

The transformation of Equation (10) can be rewritten as

$$\left|U\right|\le \overline{U}$$

(11)

where $\hspace{0.33em}|U|=\left[\left|{\delta }_{xji}\right|,\left|{\delta }_{zti}\right|\right]$, $\left|\overline{U}\right|=\left[\left|{\overline{\delta }}_{xji}\right|,\left|{\overline{\delta }}_{zti}\right|\right]$.

Swing angle readjusted among six engines is an ill-posed problem; thus, the following optimization problem is considered:

$$\left\{\begin{array}{l}\min \hspace{0.33em}\hspace{0.33em}J=\hspace{0.33em}|U\hspace{0.33em}|\\ s.t.\hspace{0.33em}\hspace{0.33em}BU=M^{\ast }\\ \hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}|\hspace{0.33em}U|\hspace{0.33em}\le \hspace{0.33em}\left|\overline{U}\right|\end{array}\right.$$

(12)

The optimization objective of this paper is the sum of the absolute values of the swing angles after fault occurrence is minimal, which means the minimum energy consumption is needed to reconstruct the control moment. The optimal problem can be transferred into a standard linear programming model, which can be solved by the improved simplex method effectively [26].

6.2. Numerical Simulations and Full Discussion

In this section, numerical simulations are carried out to verify the effectiveness of the proposed attitude control law. The simulation scenarios are shown in

Table 5. Fault-tolerant control simulation cases.

	Fault Time	Thrust Drop Percentage	Engine Type
Case 5	40 s	80%	Booster No.2 engine
Case 6	40 s	100% (shutdown fault)	Booster No.2 engine

, and the simulation results are shown in Figure 11 and Figure 12.

The simulation results show that the reconstructed flight attitude angle based on the proposed improved simplex method is tracked well, even though the thrust drop percentage is 80% of total loss. Specifically, for the 80% thrust loss case, the reconstructed pitch angle matches the normal attitude variation curve very well, and the yaw angle deviation after reconstruction shows an abrupt increase at fault time 40 s, approximately 0.2, which recovers balance rapidly. Although the deviation in the roll channel shows a chattering phenomenon during a very short time span, it can also recover balance quickly. For the 100% thrust loss case, the maximum pitch angle deviation is reduced by 0.008° compared with normal conditions, and the yaw angle deviation increases abruptly at fault time 40 s, which recovers balance at 44 s approximately. The chattering phenomenon is also observed in the roll channel. To sum up, the distribution algorithm can effectively realize the reconstruction of the launch vehicle control system and compensate for the impact of the thrust decline on the rocket flight.

6.3. Real Fault Mode Validation

At present, China’s Long March serial launch rockets mainly adopt the “control margin design” methodology to guarantee mission success and reliability due to the current limited onboard computational power. The method mainly consists of two key processes. First, the whole launch task process is thoroughly analyzed. Then, the control system margin is designed based on the most critical conditions. From the statistics of China’s Long March rocket operation histories, the launch vehicle with the control margin design method is of good attitude tracking ability when engine thrust drops 10–30% in the dense atmosphere layer or 30–50% in the vacuum layer. For example, in 2017, a 50% thrust drop fault of one core engine took place during the flight process at 346.7 s for China’s Long March 5 rocket. However, the rocket still lasted another 200 s in flight state with a 170 km–90 km height and 6 m/s velocity approximately. This example provides a good effectiveness verification of the control margin design. However, the present method will have some fatal drawbacks when dealing with random faults or complex aerodynamic interferences. Luckily, with the rapid development of advanced power units, it is possible to adopt FTC onboard (e.g., the attitude reconstruction strategy proposed by the paper), which can improve the launch vehicle mission success greatly.

It is worth mentioning that the verification and validation of attitude reconstruction methods is still a big problem because, in practical scenarios, it is almost impossible to collect real-time attitude tracking data under thrust drop fault. First, the rocket is usually not allowed to launch in a fault condition for safety reasons and to avoid catastrophic accidents. Second, the launch vehicle itself is scarcely broken down due to its high-reliability design and intelligent fault-tolerant control. Third, it is time-consuming, expensive, labor-intensive, and even dangerous to conduct fault injection experiments in engineering applications. Therefore, attitude-reconstruction-based FTC methods are usually validated and verified by simulation [27].

In order to validate the proposed model and method, the real fault mode (No.4 booster engine with thrust loss 100%) of the Falcon 9 rocket of the Space X company at time 79 s in 2012 is added to the proposed simulation model, and the results are shown in Figure 13, Figure 14 and Figure 15.

According to Figure 13, the flight velocity reduction and the flight height decrease can be compensated by the proposed attitude reconstruction strategy. Specifically, when the No.4 booster engine shuts down, the flight height can reach the predefined height after about another 10 s of flight, and the flight velocity can reach the predefined velocity after about another 17 s of flight with the help of attitude reconstruction.

Figure 14 shows that under the traditional PD control raw, there is a large attitude error in the yaw angle with a thrust drop fault, and the reconstructed rocket attitude curve is in good agreement with the curve during normal flight. The yaw angle deviates significantly at the time of the fault but quickly recovers to a stable state (the recovery time is about 2.5 s), and the roll angle can return to the equilibrium state after slight jitter. Compared with the failure without reconstruction, the flight attitude of the rocket was greatly improved.

Figure 15 shows the engine swing angle after rocket attitude reconstruction. Compared with PD control, the engine swing angle under shutdown fault was reduced to a certain extent, which shows that the control allocation algorithm based on the simplex method can obtain a better control solution. From Figure 13, Figure 14 and Figure 15, when a booster engine shuts down, the proposed attitude reconstruction method enables the flight attitude to reach the required value very quickly (only about 17 s), and the reconstructed attitude angles can match the predefined flight attitude command very well. Compared to the traditional “control margin” ideal, the novel method can reduce the time requirement that the reconstructed attitude takes to reach the predefined value greatly, which can reduce fuel consumption and provide enough energy for the second ignition, so as to ensure the smooth completion of space missions.

7. Conclusions and Future Works

In this paper, an excellent robust flight attitude reconstruction strategy was studied, which can regenerate virtual control command and alleviate the losses resulting from the thrust drop faults. The failure mode, failure cause, and failure severity of some of China’s strap-on launch vehicles were firstly analyzed by FMEA methodology. It is pointed out that the propulsion system is one of the most vulnerable units, and the thrust drop fault is the most common fault mode which can be dealt with using the FTC method effectively. Further, dynamic models, kinematic models, and geometrical relation models were formulated, respectively. The linearization dynamic model especially for attitude control study was also given. The models were validated through simulations under various fault scenarios. Compared with the predetermined attitude command, the deviation of the simulation results in normal flight is small, and the max deviation appears in pitch angle, which is only about 0.67 degrees. Finally, an automation attitude reconstruction strategy based on moment equivalent was presented, which reset the swing angle just only by adjusting the control allocation matrix. The optimal swing angle problem was formulated, which made the adjusting scheme with minimal energy. The effectiveness and practicability of the designed reconfiguration control strategy were also verified by some comparative simulations. The simulation results show that under the shutdown fault of a single engine, the attitude reconfiguration control method can adjust the rocket attitude to the predetermined program angle in about 2.5 s, and the flight speed and altitude can also meet the design requirements after extending the remaining engines to operate another 17 s. This method can effectively improve the rocket flight attitude under failure, save engine fuel consumption, and ensure the successful implementation of the space station mission.

Although the published literature has achieved great advancements in attitude reconstruction strategy, there are still several aspects that need to be further explored. Therefore, the authors would like to share some potential future research trends with the readers, researchers, and engineers who aim to promote the application and development of this field in safety-critical systems.

(1) How does one apply the FTC system in real application and weigh its advantages against its disadvantages?

As aforementioned above, the FTC system is seldom found in China’s launch vehicles due to computational limitations. In the future, we should adopt more powerful calculation units and more advanced algorithms. At the same time, adding the FTC system inevitably degrades the source system’s reliability, and thus we should take enough consideration of its advantages and disadvantages.

(2) How does one improve the experimental validation of the FTC system?

As described in Section 6.3, it is unrealistic to carry out a real fault mode (thrust drop) injection experiment at present. A feasible method that may combine real fault mode with a simulation platform deserves further study.

(3) How does one relax the assumptions of the proposed models and extend the application range?

The proposed models in the paper assumed that the launch vehicle’s flight met rigid body motion law and earth rotation was also neglected. At the same time, force and moment analysis mainly considered the ascending phase of the vehicle. In the future, it is of great significance to relax the model restrictions and take the aerodynamic interference variation into account, so as to realize attitude reconstruction in the whole flight process.

(4) How does one deal with multiple fault modes?

In this paper, we assumed that only the thrust drop fault will occur which may not always be true in real scenarios. Multiple fault modes such as thrust drop and stuck actuator will appear due to the complex structural dependence and other external factors. Attitude reconstruction with multiple fault modes is another hot topic.

(5) How does one use deep learning methods in the FTC field?

Recently, machine learning, especially deep learning methods, has become popular in the FTC field, and many review papers have considered how deep learning can enhance fault tolerance performance. Future works should focus on basic control law improvement and the corresponding control allocation law based on intelligent methods such as the recurrent neural network, convolutional neural network, and joint optimization problem of attitude control and trajectory control.