# Comparison of state observer schemes for leak detection and isolation: Application to the feeding lines of a reusable launcher

Renato Murata, Julien Marzat, Hélène Piet, Sandra Boujnah, François Farago

► To cite this version:

Renato Murata, Julien Marzat, Hélène Piet, Sandra Boujnah, François Farago. Comparison of state observer schemes for leak detection and isolation: Application to the feeding lines of a reusable launcher. IEEE CDC 2023, Dec 2023, Singapour, Singapore. hal-04617860

HAL Id: hal-04617860

https://hal.science/hal-04617860

Submitted on 19 Jun 2024

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_1.png" /></figure>

HAL
open science

# Comparison of state observer schemes for leak detection and isolation: Application to the feeding lines of a reusable launcher

Renato Murata, Julien Marzat, Hélène Piet, Sandra Boujnah, François Farago

<figure><img src="image_2.png" /></figure>

## To cite this version:

Renato Murata, Julien Marzat, Hélène Piet, Sandra Boujnah, François Farago. Comparison of state observer schemes for leak detection and isolation: Application to the feeding lines of a reusable launcher. CEAS EuroGNC 2024, Jun 2024, Bristol, United Kingdom. hal-04617860

HAL Id: hal-04617860

https://hal.science/hal-04617860v1

Submitted on 19 Jun 2024

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

<figure><img src="image_3.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

Bristol, UK

<figure><img src="image_3.png" /></figure>

University of
BRISTOL

<figure><img src="image_4.png" /></figure>

ROYAL
AERONAUTICAL
SOCIETY

June 11th-13th

<figure><img src="image_5.png" /></figure>

AIAA

2024

# Comparison of state observer schemes for leak detection and isolation: Application to the feeding lines of a reusable launcher

**Renato Murata** PhD student, DTIS, ONERA, Université Paris Saclay, F-91120, Palaiseau, France.
[renato.murata@onera.fr](mailto:renato.murata@onera.fr)

**Julien Marzat** Research Scientist, DTIS, ONERA, Université Paris Saclay, 91120, Palaiseau, France.
[julien.marzat@onera.fr](mailto:julien.marzat@onera.fr)

**Hélène Piet-Lahanier** Research Scientist, DTIS, ONERA, Université Paris Saclay, 91120, Palaiseau, France.
[helene.piet-lahanier@onera.fr](mailto:helene.piet-lahanier@onera.fr)

**Sandra Boujnah** Research Scientist, Sous-Direction Techniques Systèmes de Transport Spatial, CNES, 75612, Paris, France.
[sandra.boujnah@cnes.fr](mailto:sandra.boujnah@cnes.fr)

**François Farago** Research Scientist, Sous-Direction Techniques Systèmes de Transport Spatial, CNES, 75612, Paris, France.
[fracois.farago@cnes.fr](mailto:fracois.farago@cnes.fr)

## ABSTRACT

This paper presents a comparison between three state observer schemes, including a nonlinear high-gain observer, a Luenberger observer, and an unknown input observer, in order to detect and isolate leaks in the propellant feeding system of a reusable launcher. The results show that the high-gain observer had the best overall performance. On the other hand, due to decoupling strategies, the bank of unknown input observers generates a more robust fault signature matrix. Monte Carlo experiments under realistic measurement noise assumptions are included to compare the proposed approaches.

**Keywords:** Normal canonical form, Sequential Probability Ratio Test, Fault Signature Matrix, Monte Carlo simulations

## Nomenclature

$q$ = pipe mass flow [kg s⁻¹]

$P_{in}, P$ = inlet and outlet pressures [Pa]

$f_r$ = Darcy friction factor

$\rho$ = propellant density [kg/m³]

$S, V$ = pipe cross-sectional area [m²] and volume [m³]

$D, L$ = diameter and length [m]

$T_{in}, T$ = fluid inlet and outlet temperatures [K]

$\alpha$ = sound speed in the fluid [m s⁻¹]

$\tau$ = pipe roughness [m]

$Re$ = Reynolds number

<figure><img src="image_6.png" /></figure>
<figure><img src="image_4.png" /></figure>

Bristol, UK

<figure><img src="image_5.png" /></figure>

University of
BRISTOL

<figure><img src="image_6.png" /></figure>

ROYAL
AERONAUTICAL
SOCIETY

June 11th-13th

<figure><img src="image_7.png" /></figure>

AIAA

2024

# Comparison of state observer schemes for leak detection and isolation: Application to the feeding lines of a reusable launcher

**Renato Murata** PhD student, DTIS, ONERA, Université Paris Saclay, F-91120, Palaiseau, France.
[renato.murata@onera.fr](mailto:renato.murata@onera.fr)

**Julien Marzat** Research Scientist, DTIS, ONERA, Université Paris Saclay, 91120, Palaiseau, France.
[julien.marzat@onera.fr](mailto:julien.marzat@onera.fr)

**Hélène Piet-Lahanier** Research Scientist, DTIS, ONERA, Université Paris Saclay, 91120, Palaiseau, France.
[helene.piet-lahanier@onera.fr](mailto:helene.piet-lahanier@onera.fr)

**Sandra Boujnah** Research Scientist, Sous-Direction Techniques Systèmes de Transport Spatial, CNES, 75612, Paris, France.
[sandra.boujnah@cnes.fr](mailto:sandra.boujnah@cnes.fr)

**François Farago** Research Scientist, Sous-Direction Techniques Systèmes de Transport Spatial, CNES, 75612, Paris, France.
[fracois.farago@cnes.fr](mailto:fracois.farago@cnes.fr)

## ABSTRACT

This paper presents a comparison between three state observer schemes, including a nonlinear high-gain observer, a Luenberger observer, and an unknown input observer, in order to detect and isolate leaks in the propellant feeding system of a reusable launcher. The results show that the high-gain observer had the best overall performance. On the other hand, due to decoupling strategies, the bank of unknown input observers generates a more robust fault signature matrix. Monte Carlo experiments under realistic measurement noise assumptions are included to compare the proposed approaches.

**Keywords:** Normal canonical form, Sequential Probability Ratio Test, Fault Signature Matrix, Monte Carlo simulations

## Nomenclature

$q$ = pipe mass flow [kg s⁻¹]

$P_{in}, P$ = inlet and outlet pressures [Pa]

$f_r$ = Darcy friction factor

$\rho$ = propellant density [kg/m³]

$S, V$ = pipe cross-sectional area [m²] and volume [m³]

$D, L$ = diameter and length [m]

$T_{in}, T$ = fluid inlet and outlet temperatures [K]

$\alpha$ = sound speed in the fluid [m s⁻¹]

$\tau$ = pipe roughness [m]

$Re$ = Reynolds number

<figure><img src="image_8.png" /></figure>
# 1 Introduction

The next generation of European launchers is being designed with a multi-engine propulsion cluster [1], which should offer more reliability and availability compared to a single-engine launcher. In theory, even if a failure occurs in one engine, the mission can be completed thanks to the remaining healthy engines [2]. In order to complete the mission in a degraded scenario, every fault must be detected and isolated using a Fault Detection and Isolation (FDI) logic as the core part of a Health Monitoring System (HMS).

The development of a HMS for a rocket engine started in the 1970s with the analysis of some important operational parameters with fixed red line values [3]. More elaborated methods for fault detection and isolation were tested in the Space Shuttle Main Engine (SSME), as in [4], where data-driven algorithms such as Autoregressive Moving Average (ARMA) models were tested for fault detection, and in [5] multimodal learning was used for anomaly detection in rocket engines. However, those methods require an important amount of recorded data. An overview of different fault detection techniques applied to rocket engines is presented in [6]. The FDI techniques are usually applied for each engine separately, considering that they are a perfectly isolated system.

In this paper, a different strategy will be used to detect and isolate faults. Rather than using FDI methods for each engine, those methods will be applied to the propellant feeding system, which is shared by all the Liquid-Propellant Rocket Engines (LPREs) of the cluster. FDI techniques that take into account the multi-engine architecture of the cluster have not yet been investigated in the open literature. Studies concerning a single-engine cannot be directly extended to a multi-engine cluster due to the interconnection between engines. The type of fault considered is a leakage in the feeding lines of the launcher. It is related to leak detection and isolation problem in pipelines, an important research subject mainly applied to gas, oil, and water transportation industries, for which an overview of supervision techniques is presented in [7]. A difference that must be highlighted in the propellant feeding system is that some measurements, such as the feeding line mass flows, are unavailable in launchers due to their specific instrumentation constraints [8].

In order to detect and isolate the faults using measurements compatible with space applications, state observer schemes will be used. The FDI performance of three different strategies based on state observers designs will be compared: a full-state Luenberger observer, a bank of Unknown Input Observer (UIO), and interconnected High-Gain Observers (HGO). Each design has its own specificity, with Luenberger being the classical approach to estimate the states of a linear system. The UIO is also based on the linearized system, but it uses decoupling strategies to minimize the effects of the unknown input on state estimation. The HGO uses the differential observability property [9] to estimate the states directly from the nonlinear model. In [10] a comparison study between five nonlinear observers for fault diagnosis applied to a heat-exchanger has been performed, where the adaptive observer (AO) presented the best convergence and oscillation properties. However, decoupling strategies taking into account the dynamics of potential faults were not included, and the resulting FDI performances were not evaluated.

The main contributions of this paper are: first, a comparison study of three different families of state observers for FDI in the feeding lines of a reusable launcher under realistic measurement assumptions. Second, a mapping that transforms the model of the feeding lines into the canonical normal form is derived, so as to design a HGO. Third, the FDI in a reusable launcher, taking into account the multi-engine architecture of the propulsion cluster, has yet to be investigated in the open literature. The paper is organized as follows. The propellant feeding line model is presented in Section 2 and the adaptation of the three candidate observer designs are detailed in Section 3. The fault detection and localization strategy is presented in Section 4. Finally, Sections 5 and 6 present the simulation results and conclusions.

<figure><img src="image_7.png" /></figure>
# 1 Introduction

The next generation of European launchers is being designed with a multi-engine propulsion cluster [1], which should offer more reliability and availability compared to a single-engine launcher. In theory, even if a failure occurs in one engine, the mission can be completed thanks to the remaining healthy engines [2]. In order to complete the mission in a degraded scenario, every fault must be detected and isolated using a Fault Detection and Isolation (FDI) logic as the core part of a Health Monitoring System (HMS).

The development of a HMS for a rocket engine started in the 1970s with the analysis of some important operational parameters with fixed red line values [3]. More elaborated methods for fault detection and isolation were tested in the Space Shuttle Main Engine (SSME), as in [4], where data-driven algorithms such as Autoregressive Moving Average (ARMA) models were tested for fault detection, and in [5] multimodal learning was used for anomaly detection in rocket engines. However, those methods require an important amount of recorded data. An overview of different fault detection techniques applied to rocket engines is presented in [6]. The FDI techniques are usually applied for each engine separately, considering that they are a perfectly isolated system.

In this paper, a different strategy will be used to detect and isolate faults. Rather than using FDI methods for each engine, those methods will be applied to the propellant feeding system, which is shared by all the Liquid-Propellant Rocket Engines (LPREs) of the cluster. FDI techniques that take into account the multi-engine architecture of the cluster have not yet been investigated in the open literature. Studies concerning a single-engine cannot be directly extended to a multi-engine cluster due to the interconnection between engines. The type of fault considered is a leakage in the feeding lines of the launcher. It is related to leak detection and isolation problem in pipelines, an important research subject mainly applied to gas, oil, and water transportation industries, for which an overview of supervision techniques is presented in [7]. A difference that must be highlighted in the propellant feeding system is that some measurements, such as the feeding line mass flows, are unavailable in launchers due to their specific instrumentation constraints [8].

In order to detect and isolate the faults using measurements compatible with space applications, state observer schemes will be used. The FDI performance of three different strategies based on state observers designs will be compared: a full-state Luenberger observer, a bank of Unknown Input Observer (UIO), and interconnected High-Gain Observers (HGO). Each design has its own specificity, with Luenberger being the classical approach to estimate the states of a linear system. The UIO is also based on the linearized system, but it uses decoupling strategies to minimize the effects of the unknown input on state estimation. The HGO uses the differential observability property [9] to estimate the states directly from the nonlinear model. In [10] a comparison study between five nonlinear observers for fault diagnosis applied to a heat-exchanger has been performed, where the adaptive observer (AO) presented the best convergence and oscillation properties. However, decoupling strategies taking into account the dynamics of potential faults were not included, and the resulting FDI performances were not evaluated.

The main contributions of this paper are: first, a comparison study of three different families of state observers for FDI in the feeding lines of a reusable launcher under realistic measurement assumptions. Second, a mapping that transforms the model of the feeding lines into the canonical normal form is derived, so as to design a HGO. Third, the FDI in a reusable launcher, taking into account the multi-engine architecture of the propulsion cluster, has yet to be investigated in the open literature. The paper is organized as follows. The propellant feeding line model is presented in Section 2 and the adaptation of the three candidate observer designs are detailed in Section 3. The fault detection and localization strategy is presented in Section 4. Finally, Sections 5 and 6 present the simulation results and conclusions.

<figure><img src="image_9.png" /></figure>
## 2 Oxidizer feeding lines modeling

The multi-engine cluster configuration considered is composed of three identical LPREs. The launcher has two propellants: a fuel and an oxidizer. A simplified scheme of the multi-engine propulsion cluster considering only the oxidizer feeding system is illustrated in Fig. 1. The oxidizer feeding line is the pipe network connecting the oxidizer tank with the rocket engines. For a launcher with three engines, the structure with a single manifold seems to be the optimal option in terms of mass and pressure drop values [11], with one main line splitting into secondary lines each connected to one engine.

<figure><img src="image_8.png" /><figcaption>Fig. 1 Simplified scheme of the oxidizer feeding system.</figcaption></figure>

The engines must generate the adequate thrust in order to follow the planned trajectory. The thrust reference can be directly converted into mass flow references if the engine's efficiency is known. To build a model that simulates the behavior of the feeding line in a realistic scenario, the outlet mass flow of each secondary line is taken as known inputs of the system. This outlet mass flow must be equal to the mass flow required by the rocket engine to generate the expected thrust. The fluid's temperature and pressure at the output of the tank are also considered as inputs of the feeding lines.

A generic pipe model (Fig. 2) has two components: one segment and one cavity model. The momentum balance equation governs the segment model, and the cavity model is governed by the mass balance and energy balance equations. These three equations represent a pipe with a fixed volume of fluid. The fluid dynamics equations used in this section were obtained from [12] and the thermodynamic equation was based on the reference textbook [13]. The model was configured with thermophysical properties of LOX obtained in the NIST Chemistry WebBook [14].

<figure><img src="image_9.png" /><figcaption>Fig. 2 Pipe model</figcaption></figure>

One rigid pipe, considering the effects of the fluid inertia, dynamic compressibility, perfect thermal insulation, and neglecting the fluid thermal expansion, can be described by the following equations.

Momentum balance

Mass balance

Energy Balance

$$ \dot{q} = \frac{S}{L} \left( P_{in} - P - \frac{f_r L}{2\rho S^2 D} q^2 \right) \quad (1) $$

$$ \dot{P} = \frac{\alpha^2}{V} (q - q_{out}) \quad (2) $$

$$ \dot{T} = \frac{1}{\rho V} (T - T_{in}) q \quad (3) $$

The Darcy friction factor $f_r$ is calculated using the Haarland equation, which is valid for fully-developed turbulent flows.

$$ \frac{1}{\sqrt{f_r}} = -1.8 \log_{10} \left[ \left( \frac{\tau}{3.7D} \right)^{1.11} + \frac{6.9}{Re} \right] \quad (4) $$

During the nominal operation of the rocket engine, the mass flow through pipes follows a turbulent regime. The simulation considers the oxidizer feeding line (liquid oxygen – LOX, in this case). The pipeline network for the oxidizer feeding line with four pipes is shown in Fig. 3.

<figure><img src="image_10.png" /></figure>
## 2 Oxidizer feeding lines modeling

The multi-engine cluster configuration considered is composed of three identical LPREs. The launcher has two propellants: a fuel and an oxidizer. A simplified scheme of the multi-engine propulsion cluster considering only the oxidizer feeding system is illustrated in Fig. 1. The oxidizer feeding line is the pipe network connecting the oxidizer tank with the rocket engines. For a launcher with three engines, the structure with a single manifold seems to be the optimal option in terms of mass and pressure drop values [11], with one main line splitting into secondary lines each connected to one engine.

<figure><img src="image_10.png" /><figcaption>Fig. 1 Simplified scheme of the oxidizer feeding system.</figcaption></figure>

The engines must generate the adequate thrust in order to follow the planned trajectory. The thrust reference can be directly converted into mass flow references if the engine's efficiency is known. To build a model that simulates the behavior of the feeding line in a realistic scenario, the outlet mass flow of each secondary line is taken as known inputs of the system. This outlet mass flow must be equal to the mass flow required by the rocket engine to generate the expected thrust. The fluid's temperature and pressure at the output of the tank are also considered as inputs of the feeding lines.

A generic pipe model (Fig. 2) has two components: one segment and one cavity model. The momentum balance equation governs the segment model, and the cavity model is governed by the mass balance and energy balance equations. These three equations represent a pipe with a fixed volume of fluid. The fluid dynamics equations used in this section were obtained from [12] and the thermodynamic equation was based on the reference textbook [13]. The model was configured with thermophysical properties of LOX obtained in the NIST Chemistry WebBook [14].

<figure><img src="image_11.png" /><figcaption>Fig. 2 Pipe model</figcaption></figure>

One rigid pipe, considering the effects of the fluid inertia, dynamic compressibility, perfect thermal insulation, and neglecting the fluid thermal expansion, can be described by the following equations.

Momentum balance

Mass balance

Energy Balance

$$ \dot{q} = \frac{S}{L} \left( P_{in} - P - \frac{f_r L}{2\rho S^2 D} q^2 \right) \quad (1) $$

$$ \dot{P} = \frac{\alpha^2}{V} (q - q_{out}) \quad (2) $$

$$ \dot{T} = \frac{1}{\rho V} (T - T_{in}) q \quad (3) $$

The Darcy friction factor $f_r$ is calculated using the Haarland equation, which is valid for fully-developed turbulent flows.

$$ \frac{1}{\sqrt{f_r}} = -1.8 \log_{10} \left[ \left( \frac{\tau}{3.7D} \right)^{1.11} + \frac{6.9}{Re} \right] \quad (4) $$

During the nominal operation of the rocket engine, the mass flow through pipes follows a turbulent regime. The simulation considers the oxidizer feeding line (liquid oxygen – LOX, in this case). The pipeline network for the oxidizer feeding line with four pipes is shown in Fig. 3.

<figure><img src="image_12.png" /></figure>
Equations (1), (2), and (3) will be repeated for each one, resulting in 12 equations. Equation (2) must be adapted for the main line, since it has three outlet mass flows instead of one

$$ \dot{P}_m = \frac{\alpha_m^2}{V_m} (q_m - q_{s1} - q_{s2} - q_{s3}) \quad (5) $$

where subscripts .s1, .s2, .s3, and .m respectively denote the secondary lines 1, 2, 3 and the main line.

<figure><img src="image_11.png" /><figcaption>Fig. 3 Oxidizer feeding line</figcaption></figure>

Each equation represents the dynamics of one state of the oxidizer feeding line. The state vector x, the input vector u, and the output vector y are composed of the following variables:

$$ \begin{cases} x = [P_{s1}, T_{s1}, q_{s1}, P_{s2}, T_{s2}, q_{s2}, P_{s3}, T_{s3}, q_{s3}, P_m, T_m, q_m]^T \\ u = [P_{in}, T_{in}, q_{o1}, q_{o2}, q_{o3}]^T \\ y = [P_{s1}, T_{s1}, P_{s2}, T_{s2}, P_{s3}, T_{s3}, P_m, T_m]^T \end{cases} \quad (6) $$

The system has five known inputs: the outlet mass flow of each secondary line {$q_{o1}, q_{o2}, q_{o3}$}, and the inlet pressure and temperature in the main pipe $P_{in}, T_{in}$. The measurement vector y in (6) contains the outlet pressure and temperature of each pipe. The mass flows q are not measured, which is a challenge for estimation and control purposes.

Four faults were implemented: the first three are an external LOX leakage $f_{si}$ on each secondary line, where the subscript $i \in [1, 3]$ indicates in which secondary line the fault occurred. The fourth is a LOX leakage in the main line $f_m$. The fault vector can be written as $f = [f_{s1}f_{s2}f_{s3}f_m]^T$. The fault f and the inputs u are illustrated in Fig. 3. The faults can be simultaneous and no specific assumption on their time behavior is required. As in [15], these leakage faults are injected as an additive output to the mass balance equation given in (2). For the secondary line 1, for example, Eq. (2) is rewritten as:

$$ \dot{P}_{s1} = \frac{\alpha_{s1}^2}{V_{s1}} (q_{s1} - q_{o1} - f_{s1}) \quad (7) $$

The effect of the leakage in the main line $f_m$ affects the mass balance equation of the main line expressed in Eq. (5):

$$ \dot{P}_m = \frac{\alpha_m^2}{V_m} (q_m - q_{s1} - q_{s2} - q_{s3} - f_m) \quad (8) $$

## 3 Observer design

Three observer schemes have been studied to estimate the states of the system for FDI purposes:

* Luenberger: one observer that estimates the full $x \in \mathbb{R}^{12}$ vector;

* UIO: a bank of four UIOs, each observer estimates the full $x \in \mathbb{R}^{12}$ vector;

* HGO: four sub-observers, each one estimates a subset of three states of x that represents the dynamic of one pipe. The combination of the sub-observers is the estimation of $x \in \mathbb{R}^{12}$.

<figure><img src="image_12.png" /></figure>
Equations (1), (2), and (3) will be repeated for each one, resulting in 12 equations. Equation (2) must be adapted for the main line, since it has three outlet mass flows instead of one

$$ \dot{P}_m = \frac{\alpha_m^2}{V_m} (q_m - q_{s1} - q_{s2} - q_{s3}) \quad (5) $$

where subscripts .s1, .s2, .s3, and .m respectively denote the secondary lines 1, 2, 3 and the main line.

<figure><img src="image_13.png" /><figcaption>Fig. 3 Oxidizer feeding line</figcaption></figure>

Each equation represents the dynamics of one state of the oxidizer feeding line. The state vector x, the input vector u, and the output vector y are composed of the following variables:

$$ \begin{cases} x = [P_{s1}, T_{s1}, q_{s1}, P_{s2}, T_{s2}, q_{s2}, P_{s3}, T_{s3}, q_{s3}, P_m, T_m, q_m]^T \\ u = [P_{in}, T_{in}, q_{o1}, q_{o2}, q_{o3}]^T \\ y = [P_{s1}, T_{s1}, P_{s2}, T_{s2}, P_{s3}, T_{s3}, P_m, T_m]^T \end{cases} \quad (6) $$

The system has five known inputs: the outlet mass flow of each secondary line {$q_{o1}, q_{o2}, q_{o3}$}, and the inlet pressure and temperature in the main pipe $P_{in}, T_{in}$. The measurement vector y in (6) contains the outlet pressure and temperature of each pipe. The mass flows q are not measured, which is a challenge for estimation and control purposes.

Four faults were implemented: the first three are an external LOX leakage $f_{si}$ on each secondary line, where the subscript $i \in [1, 3]$ indicates in which secondary line the fault occurred. The fourth is a LOX leakage in the main line $f_m$. The fault vector can be written as $f = [f_{s1}f_{s2}f_{s3}f_m]^T$. The fault f and the inputs u are illustrated in Fig. 3. The faults can be simultaneous and no specific assumption on their time behavior is required. As in [15], these leakage faults are injected as an additive output to the mass balance equation given in (2). For the secondary line 1, for example, Eq. (2) is rewritten as:

$$ \dot{P}_{s1} = \frac{\alpha_{s1}^2}{V_{s1}} (q_{s1} - q_{o1} - f_{s1}) \quad (7) $$

The effect of the leakage in the main line $f_m$ affects the mass balance equation of the main line expressed in Eq. (5):

$$ \dot{P}_m = \frac{\alpha_m^2}{V_m} (q_m - q_{s1} - q_{s2} - q_{s3} - f_m) \quad (8) $$

## 3 Observer design

Three observer schemes have been studied to estimate the states of the system for FDI purposes:

* Luenberger: one observer that estimates the full $x \in \mathbb{R}^{12}$ vector;

* UIO: a bank of four UIOs, each observer estimates the full $x \in \mathbb{R}^{12}$ vector;

* HGO: four sub-observers, each one estimates a subset of three states of x that represents the dynamic of one pipe. The combination of the sub-observers is the estimation of $x \in \mathbb{R}^{12}$.

<figure><img src="image_14.png" /></figure>
The full-rank observers (Luenberger and UIOs) can be directly calculated using the linear approximation of the feeding lines around an operating point. The HGO requires the nonlinear system to be written in the canonical triangular form, which is not possible for any MIMO system. The problem can be simplified by separating the feeding lines into pipes. The pipe model can be expressed in the triangular form, and an HGO can be calculated.

## 3.1 System linearization

It has been chosen to perform a linearization of the nonlinear system presented in Section 2, so as to implement the linear observers. The system was linearized at a trimmed operating point using Simulink®. The operating point chosen for linearization should be consistent with the nominal state of a multi-engine cluster with three 1000kN class engines. The linear time-invariant system with faults obtained is given by

$$ \{\dot{x} = Ax + Bu + Ef, \quad y = Cx \tag{9} $$

where $x \in \mathbb{R}^{12}$ is the state vector, $u \in \mathbb{R}^{5}$ is the input vector, $y \in \mathbb{R}^{8}$ is the output vector, and $f \in \mathbb{R}^{4}$ is the fault vector; $A, B, C$, and $E$ are dynamic, input, output, and fault distribution matrices with appropriate dimensions, their structure is presented in the Appendix. The linear system is stable with oscillations, with 8 complex and 4 real poles.

The observability of (9) gives information about which sensors are necessary to implement the proposed approach. The system require at least six different pressure and temperature measurements for $(A, C)$ to be observable. So, the measurement vector presented in (6) is enough to estimate the entire state vector.

## 3.2 Luenberger observer

The Luenberger observer is a classical approach to estimate the states of a linear system, initially defined in [16]. Neglecting the fault term $Ef$, the Luenberger observer for the system (9) is given by

$$ \dot{\hat{x}} = A\hat{x} + Bu + L(y - C\hat{x}) \tag{10} $$

where the dynamics of the estimation error $e = x - \hat{x}$ is characterized by $(A - LC)$. A direct way to calculate the gain $L$ is to use the pole placement method to place the eigenvalues of the error dynamics in the stable left-half plane. The Luenberger observer can be directly applied on the linear system (9) because the pair $(A, C)$ is observable. The poles of the error dynamics $\lambda_L$ (see Appendix) were chosen in a Kalman-like way [17]. First, a Kalman filter is calculated considering prior knowledge about the measurement and process noise. Then, the Kalman gain, obtained after filter convergence is used to calculate the optimal poles of the observer.

## 3.3 Unknown input observer

If some prior knowledge is available on the dynamics of unknown inputs, UIOs can be employed to perform state estimation with minimal influence of the unknown input [18]. This can then be applied for fault detection and localization, by considering a given fault as an unknown input to which a UIO will be insensitive. Simultaneous fault detection and localization can then be achieved by using a bank of UIOs where each filter is sensitive to only one predefined fault. A bank of UIOs was successfully used in [19] for water leak detection and localization in a pipe. However, the proposed method requires mass flow measurements, which are not available for the system under study. The UIO equation for the system (9) is given by

$$ \{\dot{z} = Fz + TBu + (K_1 + K_2)y, \quad \hat{x} = z + Hy \tag{11} $$

<figure><img src="image_13.png" /></figure>
The full-rank observers (Luenberger and UIOs) can be directly calculated using the linear approximation of the feeding lines around an operating point. The HGO requires the nonlinear system to be written in the canonical triangular form, which is not possible for any MIMO system. The problem can be simplified by separating the feeding lines into pipes. The pipe model can be expressed in the triangular form, and an HGO can be calculated.

## 3.1 System linearization

It has been chosen to perform a linearization of the nonlinear system presented in Section 2, so as to implement the linear observers. The system was linearized at a trimmed operating point using Simulink®. The operating point chosen for linearization should be consistent with the nominal state of a multi-engine cluster with three 1000kN class engines. The linear time-invariant system with faults obtained is given by

$$ \{\dot{x} = Ax + Bu + Ef, \quad y = Cx \tag{9} $$

where $x \in \mathbb{R}^{12}$ is the state vector, $u \in \mathbb{R}^{5}$ is the input vector, $y \in \mathbb{R}^{8}$ is the output vector, and $f \in \mathbb{R}^{4}$ is the fault vector; $A, B, C$, and $E$ are dynamic, input, output, and fault distribution matrices with appropriate dimensions, their structure is presented in the Appendix. The linear system is stable with oscillations, with 8 complex and 4 real poles.

The observability of (9) gives information about which sensors are necessary to implement the proposed approach. The system require at least six different pressure and temperature measurements for $(A, C)$ to be observable. So, the measurement vector presented in (6) is enough to estimate the entire state vector.

## 3.2 Luenberger observer

The Luenberger observer is a classical approach to estimate the states of a linear system, initially defined in [16]. Neglecting the fault term $Ef$, the Luenberger observer for the system (9) is given by

$$ \dot{\hat{x}} = A\hat{x} + Bu + L(y - C\hat{x}) \tag{10} $$

where the dynamics of the estimation error $e = x - \hat{x}$ is characterized by $(A - LC)$. A direct way to calculate the gain $L$ is to use the pole placement method to place the eigenvalues of the error dynamics in the stable left-half plane. The Luenberger observer can be directly applied on the linear system (9) because the pair $(A, C)$ is observable. The poles of the error dynamics $\lambda_L$ (see Appendix) were chosen in a Kalman-like way [17]. First, a Kalman filter is calculated considering prior knowledge about the measurement and process noise. Then, the Kalman gain, obtained after filter convergence is used to calculate the optimal poles of the observer.

## 3.3 Unknown input observer

If some prior knowledge is available on the dynamics of unknown inputs, UIOs can be employed to perform state estimation with minimal influence of the unknown input [18]. This can then be applied for fault detection and localization, by considering a given fault as an unknown input to which a UIO will be insensitive. Simultaneous fault detection and localization can then be achieved by using a bank of UIOs where each filter is sensitive to only one predefined fault. A bank of UIOs was successfully used in [19] for water leak detection and localization in a pipe. However, the proposed method requires mass flow measurements, which are not available for the system under study. The UIO equation for the system (9) is given by

$$ \{\dot{z} = Fz + TBu + (K_1 + K_2)y, \quad \hat{x} = z + Hy \tag{11} $$

<figure><img src="image_15.png" /></figure>
where the matrices $F, T, K_1, K_2$, and $H$ must satisfy the following set of equations

$$ \begin{cases} 0 = (HC - I)E, & T = I - HC \\ F = A - HCA - K_1C, & K_2 = FH \end{cases} \qquad (12) $$

All the necessary conditions and the procedure to calculate the observer matrices detailed in [18] turned out to be applicable. A bank of four UIOs was thus implemented for fault detection and localization purposes. The first three observers take respectively into account the faults $f_{s1}, f_{s2}$ and $f_{s3}$ as unknown inputs and the fourth one considers the fault $f_m$. The four observers provide an estimate of the full-state vector (6). The state representation of the systems used to implement the bank of UIOs is given by

$$ \begin{cases} \dot{x} = Ax + Bu + E_{si}f_{si} \\ y = Cx \end{cases} \qquad \begin{cases} \dot{x} = Ax + Bu + E_m f_m \\ y = Cx \end{cases} \qquad (13) $$

where $E_{si}$ is the i-th column of the E matrix defined in (9) and $E_m$ is the fourth column of the E matrix.

The observer dynamics is defined by $(TA - K_1C)$. The observer gain $K_1$ can be calculated using the pole placement method. The poles of error dynamics of the UIO designed for (13) are $\lambda_{si}$ and $\lambda_m$ (see Appendix), respectively. The poles were selected in the same way as the Luenberger observer. The only difference is the process noise covariance matrix that was adapted to the measurement characteristics.

## 3.4 High gain observer

The feeding lines have been separated into four sub-systems so as to calculate a map that transforms it into the normal canonical form. The proposed scheme was inspired by [20], where HGOs were used in cascade to detect and isolate leaks in subterranean pipelines of liquefied gas. However, input and output mass flows were considered to be known, and the system in question had only pipes connected in series.

The first step is to find a map $T(\bar{x})$ to transform (1)(2)(3) into the normal form, with $\bar{x} = [\bar{x}_1 \bar{x}_2 \bar{x}_3]^T = [q P T]^T$. The system can be simplified if the thermophysical properties of the LOX ($\alpha$ and $\rho$), and the friction factor $f_r$ are considered constant. This simplification can be made because the pressure and temperature do not undergo major changes. Taking $\bar{u} = [\bar{u}_1 \bar{u}_2 \bar{u}_3]^T = [P_{in} q_{out} T_{in}]^T$, the equations of one rigid pipe can be rewritten as:

$$ \begin{aligned} \dot{\bar{x}}_1 &= K_1 \bar{u}_1 - K_1 \bar{x}_2 - K_2 \bar{x}_1^2 & \dot{\bar{x}}_2 &= K_3 (\bar{x}_1 - \bar{u}_2) & \dot{\bar{x}}_3 &= K_4 \bar{x}_1 (\bar{x}_3 - \bar{u}_3), & \bar{y} &= \{\bar{x}_2, \bar{x}_3\} \end{aligned} \qquad (14) $$

with

$$ K_1 = \frac{S}{L} \qquad K_2 = \frac{f_r}{2\rho SD} \qquad K_3 = \frac{\alpha^2}{V} \qquad K_4 = \frac{1}{\rho V} \qquad (15) $$

The system (14) has no relative degree. A dynamic extension must be done in order to define one and calculate $T(\bar{x})$. Two new states $\zeta_2$ and $\zeta_3$ are introduced, with $\zeta_2 = \bar{u}_2, \zeta_3 = \bar{u}_3$. The augmented system has three inputs $v = [v_1 \ v_2 \ v_3] = [\bar{u}_1 \ \dot{\zeta}_2 \ \dot{\zeta}_3]$ and is defined as

$$ \begin{aligned} \dot{\bar{x}}_1 &= K_1 \bar{u}_1 - K_1 \bar{x}_2 - K_2 \bar{x}_1^2 & \dot{\bar{x}}_2 &= K_3 (\bar{x}_1 - \zeta_2) & \dot{\bar{x}}_3 &= K_4 \bar{x}_1 (\bar{x}_3 - \zeta_3) & \dot{\zeta}_2 &= \bar{u}_2 & \dot{\zeta}_3 &= \bar{u}_3 \end{aligned} \qquad (16) $$

The system (16) has a vector relative degree $r_m = \{r_1, r_2\} = \{2, 2\}$. A change of coordinates $z = T(\bar{x})$ can be calculated using the procedure of coordinate transformations for multi-input multi-output (MIMO)

<figure><img src="image_14.png" /></figure>
where the matrices $F, T, K_1, K_2$, and $H$ must satisfy the following set of equations

$$ \begin{cases} 0 = (HC - I)E, & T = I - HC \\ F = A - HCA - K_1C, & K_2 = FH \end{cases} \qquad (12) $$

All the necessary conditions and the procedure to calculate the observer matrices detailed in [18] turned out to be applicable. A bank of four UIOs was thus implemented for fault detection and localization purposes. The first three observers take respectively into account the faults $f_{s1}, f_{s2}$ and $f_{s3}$ as unknown inputs and the fourth one considers the fault $f_m$. The four observers provide an estimate of the full-state vector (6). The state representation of the systems used to implement the bank of UIOs is given by

$$ \begin{cases} \dot{x} = Ax + Bu + E_{si}f_{si} \\ y = Cx \end{cases} \qquad \begin{cases} \dot{x} = Ax + Bu + E_m f_m \\ y = Cx \end{cases} \qquad (13) $$

where $E_{si}$ is the i-th column of the E matrix defined in (9) and $E_m$ is the fourth column of the E matrix.

The observer dynamics is defined by $(TA - K_1C)$. The observer gain $K_1$ can be calculated using the pole placement method. The poles of error dynamics of the UIO designed for (13) are $\lambda_{si}$ and $\lambda_m$ (see Appendix), respectively. The poles were selected in the same way as the Luenberger observer. The only difference is the process noise covariance matrix that was adapted to the measurement characteristics.

## 3.4 High gain observer

The feeding lines have been separated into four sub-systems so as to calculate a map that transforms it into the normal canonical form. The proposed scheme was inspired by [20], where HGOs were used in cascade to detect and isolate leaks in subterranean pipelines of liquefied gas. However, input and output mass flows were considered to be known, and the system in question had only pipes connected in series.

The first step is to find a map $T(\bar{x})$ to transform (1)(2)(3) into the normal form, with $\bar{x} = [\bar{x}_1 \bar{x}_2 \bar{x}_3]^T = [q P T]^T$. The system can be simplified if the thermophysical properties of the LOX ($\alpha$ and $\rho$), and the friction factor $f_r$ are considered constant. This simplification can be made because the pressure and temperature do not undergo major changes. Taking $\bar{u} = [\bar{u}_1 \bar{u}_2 \bar{u}_3]^T = [P_{in} q_{out} T_{in}]^T$, the equations of one rigid pipe can be rewritten as:

$$ \begin{gathered} \dot{\bar{x}}_1 = K_1 \bar{u}_1 - K_1 \bar{x}_2 - K_2 \bar{x}_1^2 \qquad \dot{\bar{x}}_2 = K_3 (\bar{x}_1 - \bar{u}_2) \qquad \dot{\bar{x}}_3 = K_4 \bar{x}_1 (\bar{x}_3 - \bar{u}_3), \qquad \bar{y} = \{\bar{x}_2, \bar{x}_3\} \end{gathered} \qquad (14) $$

with

$$ K_1 = \frac{S}{L} \qquad K_2 = \frac{f_r}{2\rho SD} \qquad K_3 = \frac{\alpha^2}{V} \qquad K_4 = \frac{1}{\rho V} \qquad (15) $$

The system (14) has no relative degree. A dynamic extension must be done in order to define one and calculate $T(\bar{x})$. Two new states $\zeta_2$ and $\zeta_3$ are introduced, with $\zeta_2 = \bar{u}_2, \zeta_3 = \bar{u}_3$. The augmented system has three inputs $v = [v_1 \ v_2 \ v_3] = [\bar{u}_1 \ \dot{\zeta}_2 \ \dot{\zeta}_3]$ and is defined as

$$ \dot{\bar{x}}_1 = K_1 \bar{u}_1 - K_1 \bar{x}_2 - K_2 \bar{x}_1^2 \qquad \dot{\bar{x}}_2 = K_3 (\bar{x}_1 - \zeta_2) \qquad \dot{\bar{x}}_3 = K_4 \bar{x}_1 (\bar{x}_3 - \zeta_3) \qquad \dot{\zeta}_2 = \bar{u}_2 \qquad \dot{\zeta}_3 = \bar{u}_3 \qquad (16) $$

The system (16) has a vector relative degree $r_m = \{r_1, r_2\} = \{2, 2\}$. A change of coordinates $z = T(\bar{x})$ can be calculated using the procedure of coordinate transformations for multi-input multi-output (MIMO)

<figure><img src="image_16.png" /></figure>
systems presented in [21]. The new system of coordinates is given explicitly by

$$z_1 = \bar{x}_2 \quad z_2 = K_3 \bar{x}_1 - K_3 \zeta_2 \quad z_3 = \bar{x}_3 \quad z_4 = K_4 \bar{x}_3 \bar{x}_1 - K_4 \bar{x}_1 \zeta_3 \quad (17)$$

The sum of relative degrees $r_1 + r_2$ is 4 and the system (16) has 5 states. One function $\phi_5$ must be defined to qualify (17) and $\phi_5$ as an admissible coordinate transformations of $\bar{x}$. We defined $\eta = \phi_5 = \bar{x}_1$. Applying the coordinate transformations (17) and $\eta$, the system can be written in the z coordinates as

$$\begin{aligned} \dot{z}_1 &= z_2, \quad \dot{z}_3 = z_4, \quad \dot{\eta} = -K_2\eta^2 + K_1v_1 - K_1z_1 \\ \dot{z}_2 &= K_1K_3v_1 - K_3v_2 - K_3(K_2\eta^2 + k_1z_1) \\ \dot{z}_4 &= K_4\eta \left( K_4z_3\eta + \frac{K_4\eta z_2 - K_3\eta}{K_3} \right) - (K_2\eta^2 + K_1z_1) \left( K_4z_3 + K_4\frac{z_2 - K_3\eta}{K_3} \right) + K_1v_1 \left( K_4z_3 + K_4\frac{z_2 - K_3\eta}{K_3} - K_4v_3\eta \right) \end{aligned} \quad (18)$$

The system (18) is said to be in the normal form. The new system in z coordinates can be rewritten as

$$\dot{z} = A_h z + B_h f(z, \eta, v) \quad \dot{\eta} = g(z, \eta, v), \quad y = C_h z, \quad (19)$$

where the matrices $A_h$, $B_h$ and $C_h$ and the functions $f$ and $g$ are given by

$$A_h = \begin{bmatrix} 0 & 1 & 0 & 0 \\ 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 1 \\ 0 & 0 & 0 & 0 \end{bmatrix} \quad B_h = \begin{bmatrix} 0 & 1 & 0 & 0 \\ 0 & 0 & 0 & 1 \end{bmatrix}^T \quad C_h = \begin{bmatrix} 1 & 0 & 0 & 0 \\ 0 & 0 & 1 & 0 \end{bmatrix} \quad f(z, \eta, v) = \{\dot{z}_2, \dot{z}_4\}^T \quad g(z, \eta, v) = \dot{\eta} \quad (20)$$

The system (19) can be used to implement the HGO presented in [22], which is defined by

$$\dot{\hat{z}} = A_h \hat{z} + B_h f(\hat{z}, \hat{\eta}, v) + H_h(y - C \hat{z}) \quad (21)$$

The observer gain $H_h$ was chosen as

$$H_h = \begin{bmatrix} \frac{a_1}{\epsilon} & \frac{a_2}{\epsilon^2} & 0 & 0 \\ 0 & 0 & \frac{a_3}{\epsilon} & \frac{a_4}{\epsilon^2} \end{bmatrix}^T \quad (22)$$

where $a_i$ ($i = 1, \dots, 4$) and $\epsilon \ll 1$ are positive constants. Four observers (21) have been implemented: HGO$_m$, HGO$_{s1}$, HGO$_{s2}$, and HGO$_{s3}$ respectively for the main and secondary lines 1, 2 and 3. All the observers have the same gain $H_h$, with $a_1 = a_3 = 1$, $a_2 = a_4 = 0.1$ and $\epsilon = 0.001$. The only difference between the observers are the constants $K_1, K_2, K_3$, and $K_4$ that are functions of geometrical parameters of each pipe.

From (6), the only known mass flows are [$q_{o1}, q_{o2}, q_{o3}$]. In order to implement the high gain observer for the main pipe, the sum of the estimation of the input mass flow of each secondary line ($\hat{q}_{s1} + \hat{q}_{s2} + \hat{q}_{s3}$) is used as input. This scheme with four sub-observers uses the measurement value of $P_m$ and $T_m$ as inputs of the secondary line observers. In the schemes with full-state observers (Luenberger and UIO), $P_m$ and $T_m$ are internal states of the system.

<figure><img src="image_15.png" /></figure>
systems presented in [21]. The new system of coordinates is given explicitly by

$$z_1 = \bar{x}_2 \quad z_2 = K_3 \bar{x}_1 - K_3 \zeta_2 \quad z_3 = \bar{x}_3 \quad z_4 = K_4 \bar{x}_3 \bar{x}_1 - K_4 \bar{x}_1 \zeta_3 \quad (17)$$

The sum of relative degrees $r_1 + r_2$ is 4 and the system (16) has 5 states. One function $\phi_5$ must be defined to qualify (17) and $\phi_5$ as an admissible coordinate transformations of $\bar{x}$. We defined $\eta = \phi_5 = \bar{x}_1$. Applying the coordinate transformations (17) and $\eta$, the system can be written in the z coordinates as

$$\begin{aligned} \dot{z}_1 &= z_2, \quad \dot{z}_3 = z_4, \quad \dot{\eta} = -K_2\eta^2 + K_1v_1 - K_1z_1 \\ \dot{z}_2 &= K_1K_3v_1 - K_3v_2 - K_3(K_2\eta^2 + k_1z_1) \\ \dot{z}_4 &= K_4\eta \left(K_4z_3\eta + \frac{K_4\eta z_2 - K_3\eta}{K_3}\right) - (K_2\eta^2 + K_1z_1) \left(K_4z_3 + K_4\frac{z_2 - K_3\eta}{K_3}\right) + K_1v_1 \left(K_4z_3 + K_4\frac{z_2 - K_3\eta}{K_3} - K_4v_3\eta\right) \end{aligned} \quad (18)$$

The system (18) is said to be in the normal form. The new system in z coordinates can be rewritten as

$$\dot{z} = A_h z + B_h f(z, \eta, v) \quad \dot{\eta} = g(z, \eta, v), \quad y = C_h z, \quad (19)$$

where the matrices $A_h$, $B_h$ and $C_h$ and the functions $f$ and $g$ are given by

$$A_h = \begin{bmatrix} 0 & 1 & 0 & 0 \\ 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 1 \\ 0 & 0 & 0 & 0 \end{bmatrix} \quad B_h = \begin{bmatrix} 0 & 1 & 0 & 0 \\ 0 & 0 & 0 & 1 \end{bmatrix}^T \quad C_h = \begin{bmatrix} 1 & 0 & 0 & 0 \\ 0 & 0 & 1 & 0 \end{bmatrix} \quad f(z, \eta, v) = \{\dot{z}_2, \dot{z}_4\}^T \quad g(z, \eta, v) = \dot{\eta} \quad (20)$$

The system (19) can be used to implement the HGO presented in [22], which is defined by

$$\dot{\hat{z}} = A_h \hat{z} + B_h f(\hat{z}, \hat{\eta}, v) + H_h(y - C \hat{z}) \quad (21)$$

The observer gain $H_h$ was chosen as

$$H_h = \begin{bmatrix} \frac{a_1}{\epsilon} & \frac{a_2}{\epsilon^2} & 0 & 0 \\ 0 & 0 & \frac{a_3}{\epsilon} & \frac{a_4}{\epsilon^2} \end{bmatrix}^T \quad (22)$$

where $a_i$ ($i = 1, \dots, 4$) and $\epsilon \ll 1$ are positive constants. Four observers (21) have been implemented: HGO$_m$, HGO$_{s1}$, HGO$_{s2}$, and HGO$_{s3}$ respectively for the main and secondary lines 1, 2 and 3. All the observers have the same gain $H_h$, with $a_1 = a_3 = 1$, $a_2 = a_4 = 0.1$ and $\epsilon = 0.001$. The only difference between the observers are the constants $K_1$, $K_2$, $K_3$, and $K_4$ that are functions of geometrical parameters of each pipe.

From (6), the only known mass flows are [$q_{o1}$, $q_{o2}$, $q_{o3}$]. In order to implement the high gain observer for the main pipe, the sum of the estimation of the input mass flow of each secondary line ($\hat{q}_{s1} + \hat{q}_{s2} + \hat{q}_{s3}$) is used as input. This scheme with four sub-observers uses the measurement value of $P_m$ and $T_m$ as inputs of the secondary line observers. In the schemes with full-state observers (Luenberger and UIO), $P_m$ and $T_m$ are internal states of the system.

<figure><img src="image_17.png" /></figure>
# 4 Residual generation and evaluation

The residuals are usually the difference between the estimated output ŷ and the actual output y of the system. From (6), the measurement vector is composed of eight outputs. So we will have eight different residuals.

$$r_i = y_i - \hat{y}_i \qquad (23)$$

with $i \in [1, 8]$. Fault detection is possible due to the sensitivity of the residuals to the faults. If each fault affects a different subset of residuals, i.e., each fault has a different signature, the faults can be isolated using a fault signature matrix.

First, the propagation of the faults into the states of the system is defined as follows. A leakage in one pipe will change the dynamics of the outlet pressure. From (7) for example, we can write $P_{s1}(x, f_{s1})$ to explicit the influence of fault $f_{s1}$ on $P_{s1}$. The outlet pressure is connected with the mass flow equation (1), so $q_{s1}(x, f_{s1})$, and the mass flow influences the outlet temperature $T_{s1}(x, f_{s1})$ from (3). The same effect is extended to $P_{s2}(x, f_{s2})$, and $P_{s3}(x, f_{s3})$. The dynamics of the main line pressure (5) is affected by the sum of outlet mass flows on each line, in other words, the entire fault vector $f$ influences the outlet pressure of the main line $P_m(x, f)$.

## 4.1 Residuals generated by the Luenberger observer

The first eight residuals (23) generated by the Luenberger observer can be expressed from the estimation error between the LTI system (9) and the Luenberger observer (10)

$$\dot{e}_L = (A - LC)e_L + Ef \quad \tilde{r}_L = Ce_L. \qquad (24)$$

The residual goes asymptotically to 0 if $f$ is a null vector. To analyze the sensitivity of $\tilde{r}_{L,i}$ the fault-residual transfer matrix can be calculated so as to quantify the impacts of $f$ on the residuals $\tilde{r}_{L,i}$.

$$G_f(s) = C[sI - (A - LC)]^{-1}E. \qquad (25)$$

The calculus of $G_f$ shows that every pressure residual from $\tilde{r}_{L,i}$ is sensitive to all the leak faults of $f$. However, the magnitude of the sensitivity varies according to the fault and the residual. For example, the step response of $\tilde{r}_{L,1}$ (residual of $P_{s1}$) to $f_{s1}$ has a peak value 44 and 146 times bigger than $f_{s2}$ and $f_m$ respectively. The other pressure residuals are also much more affected by the faults that occur in the same subsystem. In addition, the fault vector $f$ does not have any influence on the residuals of the temperature measurements.

## 4.2 Residuals generated by the bank of UIOs

Is it proven [18] that the estimation error $e_{UIO}$ of the UIO (11) for the (linearized) LTI system (3.3) is governed by

$$\dot{e}_{UIO} = Fe_{UIO} \qquad (26)$$

if conditions (12) are met, then the estimation error $e_{UIO}$ approaches zero asymptotically.

From the bank of four UIOs, $UIO_{fm}$ is used to denote the observer for the system in (13). This observer is not sensitive to $f_m$ but is subject to the other three faults. The residuals calculated with the estimates provided by $UIO_{fm}$ are defined as

$$\dot{e}_{fm} = F_m e_{fm} + E_s f_s \quad \tilde{r}_{fm} = Ce_{fm} \qquad (27)$$

where $\tilde{r}_{fm}$ is the linear approximation of the residuals (23), $E_s$ is the first three columns of $E$, and $f_s = [f_{s1}f_{s2}f_{s3}]^T$. The fault vector $f_s$ is needed to compute $\tilde{r}_{fm}$ because from (27), the only fault that

<figure><img src="image_16.png" /></figure>
# 4 Residual generation and evaluation

The residuals are usually the difference between the estimated output ŷ and the actual output y of the system. From (6), the measurement vector is composed of eight outputs. So we will have eight different residuals.

$$r_i = y_i - \hat{y}_i \qquad (23)$$

with $i \in [1, 8]$. Fault detection is possible due to the sensitivity of the residuals to the faults. If each fault affects a different subset of residuals, i.e., each fault has a different signature, the faults can be isolated using a fault signature matrix.

First, the propagation of the faults into the states of the system is defined as follows. A leakage in one pipe will change the dynamics of the outlet pressure. From (7) for example, we can write $P_{s1}(x, f_{s1})$ to explicit the influence of fault $f_{s1}$ on $P_{s1}$. The outlet pressure is connected with the mass flow equation (1), so $q_{s1}(x, f_{s1})$, and the mass flow influences the outlet temperature $T_{s1}(x, f_{s1})$ from (3). The same effect is extended to $P_{s2}(x, f_{s2})$, and $P_{s3}(x, f_{s3})$. The dynamics of the main line pressure (5) is affected by the sum of outlet mass flows on each line, in other words, the entire fault vector $f$ influences the outlet pressure of the main line $P_m(x, f)$.

## 4.1 Residuals generated by the Luenberger observer

The first eight residuals (23) generated by the Luenberger observer can be expressed from the estimation error between the LTI system (9) and the Luenberger observer (10)

$$\dot{e}_L = (A - LC)e_L + Ef \quad \tilde{r}_L = Ce_L. \qquad (24)$$

The residual goes asymptotically to 0 if $f$ is a null vector. To analyze the sensitivity of $\tilde{r}_{L,i}$ the fault-residual transfer matrix can be calculated so as to quantify the impacts of $f$ on the residuals $\tilde{r}_{L,i}$.

$$G_f(s) = C[sI - (A - LC)]^{-1}E. \qquad (25)$$

The calculus of $G_f$ shows that every pressure residual from $\tilde{r}_{L,i}$ is sensitive to all the leak faults of $f$. However, the magnitude of the sensitivity varies according to the fault and the residual. For example, the step response of $\tilde{r}_{L,1}$ (residual of $P_{s1}$) to $f_{s1}$ has a peak value 44 and 146 times bigger than $f_{s2}$ and $f_m$ respectively. The other pressure residuals are also much more affected by the faults that occur in the same subsystem. In addition, the fault vector $f$ does not have any influence on the residuals of the temperature measurements.

## 4.2 Residuals generated by the bank of UIOs

Is it proven [18] that the estimation error $e_{UIO}$ of the UIO (11) for the (linearized) LTI system (3.3) is governed by

$$\dot{e}_{UIO} = Fe_{UIO} \qquad (26)$$

if conditions (12) are met, then the estimation error $e_{UIO}$ approaches zero asymptotically.

From the bank of four UIOs, $UIO_{fm}$ is used to denote the observer for the system in (13). This observer is not sensitive to $f_m$ but is subject to the other three faults. The residuals calculated with the estimates provided by $UIO_{fm}$ are defined as

$$\dot{e}_{fm} = F_m e_{fm} + E_s f_s \quad \tilde{r}_{fm} = Ce_{fm} \qquad (27)$$

where $\tilde{r}_{fm}$ is the linear approximation of the residuals (23), $E_s$ is the first three columns of $E$, and $f_s = [f_{s1}f_{s2}f_{s3}]^T$. The fault vector $f_s$ is needed to compute $\tilde{r}_{fm}$ because from (27), the only fault that

<figure><img src="image_18.png" /></figure>
does not influence $UIO_{fm}$ is $f_m$. The fault-residual transfer matrix can be calculated as

$$G_{fm}(s) = C[sI - F]^{-1}E_s. \qquad (28)$$

The structure of $G_{fm}$ shows that all residuals, including the temperature, are sensitive to the faults $f_s$ with different magnitudes. In this case, the peak value of the step response of the residual $\tilde{r}_{fm,1}$ ($P_{s1}$ residual) to $f_{s1}$ is 153 times bigger than $f_{s2}$ or $f_{s3}$. For the temperature residuals, the difference is less important, with the residual of $T_{s1}$ being 7 times more affected than the residual of $T_{s2}$ when $f_{s1}$ is injected. To give an order of magnitude, an abrupt leak of $f_{s1}$ = 1kg s⁻¹ will lead to a peak value of the residuals $\tilde{r}_{fm,1}$ = 0.7bar, and $\tilde{r}_{fm,2}$ = 0.06K. The remaining UIOs of the bank have similar behavior of $UIO_{fm}$. The only difference is the fault that will not affect the state estimation.

## 4.3 Residuals generated by the HGO

In the nonlinear case, the fault-residual transfer matrix cannot be calculated. The impact of the faults on the estimations should be analyzed for each residual. The estimate $\hat{P}_{s1}$ of the pressure $P_{s1}$ from $HGO_{s1}$ using equation (21) can be written as (in original coordinates)

$$ \begin{aligned} \dot{\hat{P}}_{s1} &= \hat{z}_{2,s1} + \frac{a_1}{\epsilon} [P_{s1}(x, f_{s1}) - \hat{P}_{s1}] \\ \dot{\hat{z}}_{2,s1} &= K_{1,s1} K_{3,s1} P_m(x, f) - K_{3,s1} \dot{q}_{o1} - K_{3,s1} (K_{2,s1} \hat{q}_{s1}^2 + K_{1,s1} \hat{P}_{s1}) + \frac{a_2}{\epsilon^2} [P_{s1}(x, f_{s1}) - \hat{P}_{s1}] \end{aligned} \qquad (29) $$

From (29) the estimation of $P_{s1}$ is directly affected by $f_{s1}$ due to the output $P_{s1}(x, f_{s1})$, and also by the entire fault vector $f$ due to the input pressure $P_m(x, f)$. The HGO does not have any information about the faults or its dynamics, therefore the residual $r_{HGO,1}$ will be sensitive to the fault vector $f$. The subscript .HGO is used to denote the residual generated by the high-gain observer scheme. The same procedure can be used to show that each residual $r_{HGO,i}$ with $i \in [1, 8]$ is, in theory, sensitive to the entire fault vector $f$.

## 4.4 Differential mass flow residuals

Three additional residuals, calculated from fluid dynamics constraints (as in [23]), are introduced using the estimates of the mass flows

$$r_9 = \hat{q}_{s1} - \hat{q}_{s2} \quad r_{10} = \hat{q}_{s2} - \hat{q}_{s3} \quad r_{11} = \hat{q}_m - (\hat{q}_{s1} + \hat{q}_{s2} + \hat{q}_{s3}). \qquad (30)$$

The additional residuals are sensitive to some predefined faults. When $r_9$, and $r_{10}$ are calculated, the influence of $P_m(x, f)$ is canceled out and the residuals are sensitive only to the faults that directly affect the pressure in the line. The residual $r_{11}$ is sensitive to all faults because the effect of $P_m(x, f)$ propagates. The additional residuals sensitivity is summarized in a simplified fault signature matrix presented in Table 1, which is valid for the three observer schemes. It shows that each fault has a different signature and can thus be isolated using this set of residuals.

<table><caption>**Table 1** Simplified fault signature matrix</caption><thead><tr><th>Fault condition</th><th>r<sub>9</sub></th><th>r<sub>10</sub></th><th>r<sub>11</sub></th></tr></thead><tbody><tr><td>f<sub>s1</sub></td><td>1</td><td>0</td><td>1</td></tr><tr><td>f<sub>s2</sub></td><td>1</td><td>1</td><td>1</td></tr><tr><td>f<sub>s3</sub></td><td>0</td><td>1</td><td>1</td></tr><tr><td>f<sub>m</sub></td><td>0</td><td>0</td><td>1</td></tr></tbody></table>

<figure><img src="image_17.png" /></figure>
does not influence $UIO_{fm}$ is $f_m$. The fault-residual transfer matrix can be calculated as

$$G_{fm}(s) = C[sI - F]^{-1}E_s. \qquad (28)$$

The structure of $G_{fm}$ shows that all residuals, including the temperature, are sensitive to the faults $f_s$ with different magnitudes. In this case, the peak value of the step response of the residual $\tilde{r}_{fm,1}$ ($P_{s1}$ residual) to $f_{s1}$ is 153 times bigger than $f_{s2}$ or $f_{s3}$. For the temperature residuals, the difference is less important, with the residual of $T_{s1}$ being 7 times more affected than the residual of $T_{s2}$ when $f_{s1}$ is injected. To give an order of magnitude, an abrupt leak of $f_{s1} = 1\text{kg s}^{-1}$ will lead to a peak value of the residuals $\tilde{r}_{fm,1} = 0.7\text{bar}$, and $\tilde{r}_{fm,2} = 0.06\text{K}$. The remaining UIOs of the bank have similar behavior of $UIO_{fm}$. The only difference is the fault that will not affect the state estimation.

## 4.3 Residuals generated by the HGO

In the nonlinear case, the fault-residual transfer matrix cannot be calculated. The impact of the faults on the estimations should be analyzed for each residual. The estimate $\hat{P}_{s1}$ of the pressure $P_{s1}$ from $HGO_{s1}$ using equation (21) can be written as (in original coordinates)

$$ \begin{aligned} \dot{\hat{P}}_{s1} &= \hat{z}_{2,s1} + \frac{a_1}{\epsilon} [P_{s1}(x, f_{s1}) - \hat{P}_{s1}] \\ \dot{\hat{z}}_{2,s1} &= K_{1,s1} K_{3,s1} P_m(x, f) - K_{3,s1} \dot{q}_{o1} - K_{3,s1} (K_{2,s1} \hat{q}_{s1}^2 + K_{1,s1} \hat{P}_{s1}) + \frac{a_2}{\epsilon^2} [P_{s1}(x, f_{s1}) - \hat{P}_{s1}] \end{aligned} \qquad (29) $$

From (29) the estimation of $P_{s1}$ is directly affected by $f_{s1}$ due to the output $P_{s1}(x, f_{s1})$, and also by the entire fault vector $f$ due to the input pressure $P_m(x, f)$. The HGO does not have any information about the faults or its dynamics, therefore the residual $r_{HGO,1}$ will be sensitive to the fault vector $f$. The subscript .HGO is used to denote the residual generated by the high-gain observer scheme. The same procedure can be used to show that each residual $r_{HGO,i}$ with $i \in [1, 8]$ is, in theory, sensitive to the entire fault vector $f$.

## 4.4 Differential mass flow residuals

Three additional residuals, calculated from fluid dynamics constraints (as in [23]), are introduced using the estimates of the mass flows

$$r_9 = \hat{q}_{s1} - \hat{q}_{s2} \quad r_{10} = \hat{q}_{s2} - \hat{q}_{s3} \quad r_{11} = \hat{q}_m - (\hat{q}_{s1} + \hat{q}_{s2} + \hat{q}_{s3}). \qquad (30)$$

The additional residuals are sensitive to some predefined faults. When $r_9$, and $r_{10}$ are calculated, the influence of $P_m(x, f)$ is canceled out and the residuals are sensitive only to the faults that directly affect the pressure in the line. The residual $r_{11}$ is sensitive to all faults because the effect of $P_m(x, f)$ propagates. The additional residuals sensitivity is summarized in a simplified fault signature matrix presented in Table 1, which is valid for the three observer schemes. It shows that each fault has a different signature and can thus be isolated using this set of residuals.

<table><caption>**Table 1** Simplified fault signature matrix</caption><thead><tr><th>Fault condition</th><th>r<sub>9</sub></th><th>r<sub>10</sub></th><th>r<sub>11</sub></th></tr></thead><tbody><tr><td>f<sub>s1</sub></td><td>1</td><td>0</td><td>1</td></tr><tr><td>f<sub>s2</sub></td><td>1</td><td>1</td><td>1</td></tr><tr><td>f<sub>s3</sub></td><td>0</td><td>1</td><td>1</td></tr><tr><td>f<sub>m</sub></td><td>0</td><td>0</td><td>1</td></tr></tbody></table>

<figure><img src="image_19.png" /></figure>
## 4.5 Residual evaluation

The residual evaluation has been carried out by detecting a change in variance $\sigma_i^2$ for a given residual $r_i$ by applying the Wald's Sequential Probability Ratio Test (SPRT). The analysis of the variance was chosen due to the high-frequency oscillatory nature of the system, with complex poles p (See Appendix). Classical ratio tests are usually based on a fixed horizon with a predefined number of samples. The precision of the ratio test increases with the number of samples. On the other hand, the SPRT observation horizon is variable. If a decision cannot be taken for a given risk, the decision is reported and another sample is required. With a smaller observation horizon, a fault can be detected faster.

The equation of the SPRT for detecting a change of variance is presented in [24]. For a given residual $r$ with a nominal variance $\sigma_0^2$, two hypotheses are considered: the variance of $r$ is nominal ($H_0$) or $r$ has a variance $\sigma_1^2 > \sigma_0^2(H_1)$. The decision equation at the $k$th observation is written as:

$$ \frac{\ln A + \frac{k}{2} \ln \frac{\sigma_1^2}{\sigma_0}}{\frac{1}{2} \left( \frac{1}{\sigma_0^2} - \frac{1}{\sigma_1^2} \right)} < H_0 \sum_{i=1}^{k} (r_i - \mu_0)^2 < H_1 \frac{\ln B + \frac{k}{2} \ln \frac{\sigma_1^2}{\sigma_0}}{\frac{1}{2} \left( \frac{1}{\sigma_0^2} - \frac{1}{\sigma_1^2} \right)} \quad (31) $$

where $k$ is the number of observations, $\mu_0$ is the nominal mean. The parameter $\sigma_1$ can be adjusted according to the magnitude of the noise increment that is going to be detected. For instance, to detect a noise increment of $1.83\sigma_0$, the value of $\sigma_1$ must be $\sigma_1 = 5\sigma_0$ [24].

The constants $A$ and $B$ are decision thresholds. Those constants can be adjusted according to the target detection and false alarm rates. They also have a direct influence on the number of samples that is used to decide between the hypothesis. Taking $\sigma_1 = 5\sigma_0$, if a given fault $f$ increases the noise variance $\sigma_f^2 = 4\sigma_0^2$. A fault is detected when

$$ 4k\sigma_f^2 > \frac{\ln B + \frac{k}{2} \ln \frac{\sigma_1^2}{\sigma_0}}{\frac{1}{2} \left( \frac{1}{\sigma_0^2} - \frac{1}{\sigma_1^2} \right)} \quad k > \frac{50 \ln B}{96 - 25 \ln 25} \quad (32) $$

Considering a sensor with a measurement frequency of 1000Hz, taking $\ln B = 57$, the fault $f$ would need at last $k = 185$ measurements, or 0.185s to be detected. This detection delay remains reasonable and allows the choice of big value of $B$, decreasing the false alarm rate. The probability of non detection can be equated to the false alarm rate by taking $A = \frac{1}{B}$.

A practical implementation of (31) consists in resetting the decision equation (set $k = 0$) every time that it converges to one hypothesis. In addition, to avoid an important false alarm rate, a minimum number of samples ($k > 50$) is required to take a decision.

## 5 Simulation results

To compare the performance of the FDI observer schemes, the nonlinear model of the oxidizer feeding lines and the observers were implemented in Simulink®. Monte Carlo experiments were applied to analyse the proposed FDI schemes with 300 simulations for each fault, totalizing 1200 simulations. The FDI system is activated after 7 seconds, when the residuals are in steady state. If a fault is detected between the activation of the FDI system and before the injection of the fault, it is considered as a false alarm. The time and the magnitude of faults were uniformly randomly generated within a predefined interval reported in Table 2.

<figure><img src="image_18.png" /></figure>
## 4.5 Residual evaluation

The residual evaluation has been carried out by detecting a change in variance $\sigma_i^2$ for a given residual $r_i$ by applying the Wald's Sequential Probability Ratio Test (SPRT). The analysis of the variance was chosen due to the high-frequency oscillatory nature of the system, with complex poles p (See Appendix). Classical ratio tests are usually based on a fixed horizon with a predefined number of samples. The precision of the ratio test increases with the number of samples. On the other hand, the SPRT observation horizon is variable. If a decision cannot be taken for a given risk, the decision is reported and another sample is required. With a smaller observation horizon, a fault can be detected faster.

The equation of the SPRT for detecting a change of variance is presented in [24]. For a given residual $r$ with a nominal variance $\sigma_0^2$, two hypotheses are considered: the variance of $r$ is nominal ($H_0$) or $r$ has a variance $\sigma_1^2 > \sigma_0^2(H_1)$. The decision equation at the $k$th observation is written as:

$$ \frac{\ln A + \frac{k}{2} \ln \frac{\sigma_1^2}{\sigma_0}}{\frac{1}{2} \left( \frac{1}{\sigma_0^2} - \frac{1}{\sigma_1^2} \right)} < H_0 \sum_{i=1}^{k} (r_i - \mu_0)^2 < H_1 \frac{\ln B + \frac{k}{2} \ln \frac{\sigma_1^2}{\sigma_0}}{\frac{1}{2} \left( \frac{1}{\sigma_0^2} - \frac{1}{\sigma_1^2} \right)} \quad (31) $$

where $k$ is the number of observations, $\mu_0$ is the nominal mean. The parameter $\sigma_1$ can be adjusted according to the magnitude of the noise increment that is going to be detected. For instance, to detect a noise increment of $1.83\sigma_0$, the value of $\sigma_1$ must be $\sigma_1 = 5\sigma_0$ [24].

The constants $A$ and $B$ are decision thresholds. Those constants can be adjusted according to the target detection and false alarm rates. They also have a direct influence on the number of samples that is used to decide between the hypothesis. Taking $\sigma_1 = 5\sigma_0$, if a given fault $f$ increases the noise variance $\sigma_f^2 = 4\sigma_0^2$. A fault is detected when

$$ 4k\sigma_f^2 > \frac{\ln B + \frac{k}{2} \ln \frac{\sigma_1^2}{\sigma_0}}{\frac{1}{2} \left( \frac{1}{\sigma_0^2} - \frac{1}{\sigma_1^2} \right)} \quad k > \frac{50 \ln B}{96 - 25 \ln 25} \quad (32) $$

Considering a sensor with a measurement frequency of 1000Hz, taking $\ln B = 57$, the fault $f$ would need at last $k = 185$ measurements, or 0.185s to be detected. This detection delay remains reasonable and allows the choice of big value of $B$, decreasing the false alarm rate. The probability of non detection can be equated to the false alarm rate by taking $A = \frac{1}{B}$.

A practical implementation of (31) consists in resetting the decision equation (set $k = 0$) every time that it converges to one hypothesis. In addition, to avoid an important false alarm rate, a minimum number of samples ($k > 50$) is required to take a decision.

# 5 Simulation results

To compare the performance of the FDI observer schemes, the nonlinear model of the oxidizer feeding lines and the observers were implemented in Simulink®. Monte Carlo experiments were applied to analyse the proposed FDI schemes with 300 simulations for each fault, totaling 1200 simulations. The FDI system is activated after 7 seconds, when the residuals are in steady state. If a fault is detected between the activation of the FDI system and before the injection of the fault, it is considered as a false alarm. The time and the magnitude of faults were uniformly randomly generated within a predefined interval reported in Table 2.

<figure><img src="image_20.png" /></figure>
<table><caption>**Table 2** Intervals for random simulation inputs</caption><thead><tr><th></th><th>f<sub>si</sub>, i ∈ [1, 3]</th><th>f<sub>m</sub></th></tr></thead><tbody><tr><td>Injection time (s)</td><td colspan="2">[10, 11]</td></tr><tr><td>Magnitude (% of the nominal mass flow)</td><td>[0.009, 0.21]</td><td>[0.03, 0.15]</td></tr></tbody></table>

The pressure and temperature measurement noise are considered to be Gaussian, and have a standard deviation of $\sigma_P = 0.02$ bar and $\sigma_T = 0.02$ K respectively. A different seed is used to generate the measurement noise for each simulation.

The main results of the Monte Carlo experiments are presented in Table 3. Only one observer ($UIO_{fm}$) from the bank of UIOs is listed for better readability. In theory, this observer should not be affected by the fault $f_m$, and its detection rate for $f_m$ should be near zero. The fault localization is made using the fault signature matrix.

The range of possible fault magnitudes simulated was precisely selected to test the sensitivity of the FDI system. In other words, the fault magnitudes are small. In theory, as discussed in Sec. 4, the residuals $r_i, i \in [1, 8]$ are sensitive to the entire fault vector $f$. However, due to the small fault magnitude combined with measurement and process noise, the residuals $r_i, i \in [1, 8]$ are unaffected by the simulated faults. Only the subset of residuals $r_9, r_{10}$, and $r_{11}$ were sensitive and therefore used for fault detection. A fault is detected if any residual crosses the threshold. The fault signature matrix from Table. 1 is used for fault localization.

<table><caption>**Table 3** Fault detection and localization results</caption><thead><tr><th colspan="2">Faults</th><th>Detection rate</th><th>Mean detection delay</th><th>Mislocalization rate</th><th>Overall FDI performance</th><th>False alarm rate</th></tr></thead><tbody><tr><td rowspan="3">f<sub>s1</sub>, f<sub>s3</sub></td><td>HGO:</td><td>91.33%</td><td>0.07s</td><td>0%</td><td>91.33%</td><td>0%</td></tr><tr><td>Luen.:</td><td>96.33%</td><td>0.08s</td><td>0%</td><td>96.67%</td><td>0.33%</td></tr><tr><td>UIO<sub>fm</sub>:</td><td>86.33%</td><td>0.1s</td><td>10.42%</td><td>77.33%</td><td>16.67%</td></tr><tr><td rowspan="3">f<sub>s2</sub></td><td>HGO:</td><td>92.67%</td><td>0.07s</td><td>1.43%</td><td>91.33%</td><td></td></tr><tr><td>Luen.:</td><td>97.33%</td><td>0.08s</td><td>14.72%</td><td>83.00%</td><td></td></tr><tr><td>UIO<sub>fm</sub>:</td><td>83.67%</td><td>0.1s</td><td>20.31%</td><td>66.67%</td><td></td></tr><tr><td rowspan="3">f<sub>m</sub></td><td>HGO:</td><td>94.33%</td><td>0.08s</td><td>0%</td><td>94.67%</td><td></td></tr><tr><td>Luen.:</td><td>61.00%</td><td>0.17s</td><td>0%</td><td>61.33%</td><td></td></tr><tr><td>UIO<sub>fm</sub>:</td><td>10.00%</td><td>0.74s</td><td>-</td><td>-</td><td></td></tr></tbody></table>

The detection rate varies according to the fault magnitude interval. Fig. 4 shows the detection limit for $f_{s2}$ and $f_m$ for each observer scheme. Those faults were arranged in ascending order according to their magnitude. It can be seen that after a given minimum magnitude value, all faults are detected. This minimum magnitude value varies according to the observer scheme and is consistent with the detection rates presented in Table 3, with the schemes that presented a better detection rate having a smaller minimum fault magnitude value. The faults $f_{s1}$ and $f_{s3}$ presented exactly the same values due to the symmetry of the oxidizer feeding lines.

The HGO presented the best overall performance with high detection and low mislocalization rates. The Luenberger observer had the best detection rate for the faults that affected the secondary lines. The $UIO_{fm}$ presented a good decoupling from fault $f_m$, being affected by only 10% of those faults. In addition, $UIO_{fm}$ also presented the highest false alarm rate, indicating that the residual evaluation technique must be readapted to this observer. The mean detection delay is small and similar between the three observers schemes.

<figure><img src="image_19.png" /></figure>
<table><caption>**Table 2** Intervals for random simulation inputs</caption><thead><tr><th></th><th>f<sub>si</sub>, i ∈ [1, 3]</th><th>f<sub>m</sub></th></tr></thead><tbody><tr><td>Injection time (s)</td><td colspan="2">[10, 11]</td></tr><tr><td>Magnitude (% of the nominal mass flow)</td><td>[0.009, 0.21]</td><td>[0.03, 0.15]</td></tr></tbody></table>

The pressure and temperature measurement noise are considered to be Gaussian, and have a standard deviation of $\sigma_P = 0.02$ bar and $\sigma_T = 0.02$ K respectively. A different seed is used to generate the measurement noise for each simulation.

The main results of the Monte Carlo experiments are presented in Table 3. Only one observer ($UIO_{fm}$) from the bank of UIOs is listed for better readability. In theory, this observer should not be affected by the fault $f_m$, and its detection rate for $f_m$ should be near zero. The fault localization is made using the fault signature matrix.

The range of possible fault magnitudes simulated was precisely selected to test the sensitivity of the FDI system. In other words, the fault magnitudes are small. In theory, as discussed in Sec. 4, the residuals $r_i, i \in [1, 8]$ are sensitive to the entire fault vector $f$. However, due to the small fault magnitude combined with measurement and process noise, the residuals $r_i, i \in [1, 8]$ are unaffected by the simulated faults. Only the subset of residuals $r_9, r_{10}$, and $r_{11}$ were sensitive and therefore used for fault detection. A fault is detected if any residual crosses the threshold. The fault signature matrix from Table. 1 is used for fault localization.

<table><caption>**Table 3** Fault detection and localization results</caption><thead><tr><th colspan="2">Faults</th><th>Detection rate</th><th>Mean detection delay</th><th>Mislocalization rate</th><th>Overall FDI performance</th><th>False alarm rate</th></tr></thead><tbody><tr><td rowspan="3">f<sub>s1</sub>, f<sub>s3</sub></td><td>HGO:</td><td>91.33%</td><td>0.07s</td><td>0%</td><td>91.33%</td><td>0%</td></tr><tr><td>Luen.:</td><td>96.33%</td><td>0.08s</td><td>0%</td><td>96.67%</td><td>0.33%</td></tr><tr><td>UIO<sub>fm</sub>:</td><td>86.33%</td><td>0.1s</td><td>10.42%</td><td>77.33%</td><td>16.67%</td></tr><tr><td rowspan="3">f<sub>s2</sub></td><td>HGO:</td><td>92.67%</td><td>0.07s</td><td>1.43%</td><td>91.33%</td><td></td></tr><tr><td>Luen.:</td><td>97.33%</td><td>0.08s</td><td>14.72%</td><td>83.00%</td><td></td></tr><tr><td>UIO<sub>fm</sub>:</td><td>83.67%</td><td>0.1s</td><td>20.31%</td><td>66.67%</td><td></td></tr><tr><td rowspan="3">f<sub>m</sub></td><td>HGO:</td><td>94.33%</td><td>0.08s</td><td>0%</td><td>94.67%</td><td></td></tr><tr><td>Luen.:</td><td>61.00%</td><td>0.17s</td><td>0%</td><td>61.33%</td><td></td></tr><tr><td>UIO<sub>fm</sub>:</td><td>10.00%</td><td>0.74s</td><td>-</td><td>-</td><td></td></tr></tbody></table>

The detection rate varies according to the fault magnitude interval. Fig. 4 shows the detection limit for $f_{s2}$ and $f_m$ for each observer scheme. Those faults were arranged in ascending order according to their magnitude. It can be seen that after a given minimum magnitude value, all faults are detected. This minimum magnitude value varies according to the observer scheme and is consistent with the detection rates presented in Table 3, with the schemes that presented a better detection rate having a smaller minimum fault magnitude value. The faults $f_{s1}$ and $f_{s3}$ presented exactly the same values due to the symmetry of the oxidizer feeding lines.

The HGO presented the best overall performance with high detection and low mislocalization rates. The Luenberger observer had the best detection rate for the faults that affected the secondary lines. The $UIO_{fm}$ presented a good decoupling from fault $f_m$, being affected by only 10% of those faults. In addition, $UIO_{fm}$ also presented the highest false alarm rate, indicating that the residual evaluation technique must be readapted to this observer. The mean detection delay is small and similar between the three observers schemes.

<figure><img src="image_21.png" /></figure>
<figure><img src="image_20.png" /><figcaption>Fig. 4 Detection limits</figcaption></figure>

6 Conclusions

This paper has presented a comparison between three different observer schemes to detect and localize faults in the oxidizer feeding line of a reusable launcher. The model of such propellant feeding lines for a three-engine cluster has been derived from thermodynamics and fluid dynamics equations. Four generic fault cases were studied: a leak in the main line and three leaks localized in each secondary line. The linear observers were calculated based on a linear approximation of the system around a steady-state operating point. A diffeomorphism was calculated to recast the nonlinear model into the normal form and successfully design a High-Gain Observer. Monte Carlo simulations indicate that the HGO presents the best overall performance for detecting and localizing the faults. The Luenberger observer is a simpler alternative with good detection rates. The approach with UIOs did not present a good overall performance. On the other hand, the insensitivity of the UIOs to predefined faults allows them to detect and isolate even simultaneous faults. This suggests that the design feasibility of Unknown input HGO should be addressed in future work.

The three FDI observer schemes were implemented without mass flow measurements, which are hard to measure in embedded space applications. This shows that the leak location can be identified using only temperature and pressure sensors. Perspectives of this work will incorporate the dynamics of other cluster components, such as tanks and engines, to evaluate different model-based FDI approaches against a larger panel of failures, and find the most effective health monitoring strategy to supervise the propulsion cluster.

<figure><img src="image_21.png" /></figure>
<figure><img src="image_22.png" /><figcaption>Fig. 4 Detection limits</figcaption></figure>

6 Conclusions

This paper has presented a comparison between three different observer schemes to detect and localize faults in the oxidizer feeding line of a reusable launcher. The model of such propellant feeding lines for a three-engine cluster has been derived from thermodynamics and fluid dynamics equations. Four generic fault cases were studied: a leak in the main line and three leaks localized in each secondary line. The linear observers were calculated based on a linear approximation of the system around a steady-state operating point. A diffeomorphism was calculated to recast the nonlinear model into the normal form and successfully design a High-Gain Observer. Monte Carlo simulations indicate that the HGO presents the best overall performance for detecting and localizing the faults. The Luenberger observer is a simpler alternative with good detection rates. The approach with UIOs did not present a good overall performance. On the other hand, the insensitivity of the UIOs to predefined faults allows them to detect and isolate even simultaneous faults. This suggests that the design feasibility of Unknown input HGO should be addressed in future work.

The three FDI observer schemes were implemented without mass flow measurements, which are hard to measure in embedded space applications. This shows that the leak location can be identified using only temperature and pressure sensors. Perspectives of this work will incorporate the dynamics of other cluster components, such as tanks and engines, to evaluate different model-based FDI approaches against a larger panel of failures, and find the most effective health monitoring strategy to supervise the propulsion cluster.

<figure><img src="image_23.png" /></figure>
# Appendix

$$A = \begin{bmatrix} 0 & 0 & A_{1 \times 3} & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & -A_{2 \times 2} & 0 & 0 & 0 & 0 & 0 & 0 & 0 & A_{2 \times 2} & 0 & 0 & 0 \\ -A_{3 \times 1} & 0 & -A_{3 \times 3} & 0 & 0 & 0 & 0 & 0 & 0 & -A_{3 \times 11} & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & -A_{2 \times 2} & 0 & 0 & 0 & 0 & 0 & A_{3 \times 1} & -A_{3 \times 11} & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & A_{2 \times 2} & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & -A_{3 \times 11} & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & A_{9 \times 2} \\ 0 & 0 & 0 & -A_{9 \times 2} & 0 & 0 & 0 & -A_{3 \times 1} & 0 & -A_{3 \times 3} & A_{3 \times 1} & -A_{3 \times 11} & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & -A_{11 \times 11} & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & -A_{12 \times 12} & 0 \end{bmatrix} \quad (33)$$

$$B = \begin{bmatrix} 0 & 0 & -A_{1 \times 3} & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & -A_{1 \times 3} & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & A_{11 \times 11} & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & -A_{9 \times 2} & 0 & 0 \\ -A_{3 \times 3} & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \end{bmatrix} \quad E = \begin{bmatrix} -A_{1 \times 3} & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & -A_{1 \times 3} & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \end{bmatrix} \quad (34)$$

$$p = \{-0.25 \pm 164.7, -0.34 \pm 782, -0.34 \pm 672.3, -0.34 \pm 672.3, -4.75, -4.75, -4.75, -1.58\} \quad (35)$$

$$\lambda_m = \{-104.9 \pm 772.9, -174.9 \pm 219.5, -131.6 \pm 659.3, -131.6 \pm 659.3, -4.7, -4.7, -4.5\}, \quad \lambda_{si} = \{\lambda_m, -10\} \quad (36)$$

$$\lambda_L = \{-33.73 \pm 781.1, -69.17 \pm 175.9, 41.62 \pm 671, -41.62 \pm 671, -4.7, -4.7, -4.7, -1.6\} \quad (37)$$

# Acknowledgments

This paper is a result of a study supervised by CNES and ONERA, involving experts in propulsion and FDI domains, to propose solutions for the diagnosis of reusable launchers.

# References

[1] Stephane Colas, Serge Le Gonidec, Philippe Saunois, Martine Ganet, Antoine Remy, and Vincent Leboeuf. A point of view about the control of a reusable engine cluster. In *EUCASS, Madrid, Spain*, 2019.

[2] Renato Murata, Louis Thioulouse, Julien Marzat, Hélène Piet-Lahanier, Marco Galeotta, and François Farago. Optimal reconfigurable allocation of a multi-engine cluster for a reusable launch vehicle. In *EUCASS, Lille, France*, 2022.

[3] Jianjun Wu. Liquid-propellant rocket engines health-monitoring—a survey. *Acta Astronautica*, 56(3):347–356, 2005.

[4] Michael W Hawman, William S Galinaitis, Sharayu Tulpule, and Anita K Mattedi. Framework for a space shuttle main engine health monitoring system. *Report 185224*, NASA, USA, 1990.

[5] Xinwei Zhang, Jun Wang, Jinglong Chen, Zijun Liu, and Yong Feng. Retentive multimodal scale-variable anomaly detection framework with limited data groups for liquid rocket engine. *Measurement*, page 112171, 2022.

[6] Tao Wang, Lin Ding, and Huahuang Yu. Research and development of fault diagnosis methods for liquid rocket engines. *Aerospace*, 9(9):481, 2022.

[7] Lawrence Boaz, Shubi Kaijage, and Ramadhani Sinde. An overview of pipeline leak detection and location systems. In *PACT, Arusha, Tanzania*, pages 133–137, 2014.

[8] Noriyasu Omata, Daiwa Satoh, Seiji Tsutsumi, Kaname Kawatsu, and Masaharu Abe. Model-based supervised sensor placement optimization to detect propellant leak in a liquid rocket engine. *Acta Astronautica*, 195:234–242, 2022.

<figure><img src="image_22.png" /></figure>
[9] Pauline Bernard, Vincent Andrieu, and Daniele Astolfi. Observer design for continuous-time dynamical systems. *Annual Reviews in Control*, 2022.

[10] Xue Han, Zetao Li, Michel Cabassud, and Boutaib Dahhou. A comparison study of nonlinear state observer design: Application to an intensified heat-exchanger/reactor. In *28th Mediterranean Conference on Control and Automation (MED)*, pages 162–167, 2020.

[11] Valentin Miquel. Propellant feeding system of a liquid rocket with multiple engines. KTH Royal Institute of Technology, 2020.

[12] Frank M White. *Fluid mechanics*. Tata McGraw-Hill Education, 1979.

[13] Yunus A Cengel, Sanford Klein, and William Beckman. *Heat transfer: a practical approach*, volume 141. WBC McGraw-Hill Boston, 1998.

[14] Peter J Linstrom and William G Mallard. *NIST Chemistry WebBook*, NIST Standard Reference Database Number 69. National Institute of Standards and Technology, 2022.

[15] JR Bermúdez, Francisco-Ronay López-Estrada, Gildas Besançon, Guillermo Valencia-Palomo, and C Martinez-Garcia. Optimal control in a pipeline coupled to a pressure reducing valve for pressure management and leakage reduction. In *SysTol, Saint Raphael, France*, pages 181–186, 2021.

[16] David G Luenberger. Observing the state of a linear system. *IEEE transactions on military electronics*, 8(2):74–80, 1964.

[17] Rudolph Emil Kalman. A new approach to linear filtering and prediction problems. 1960.

[18] JIE Chen. *Robust residual generation for model-based fault diagnosis of dynamic systems*. PhD thesis, University of York, 1995.

[19] Cristina Verde. Multi-leak detection and isolation in fluid pipelines. *Control Engineering Practice*, 9(6):673–682, 2001.

[20] Lizeth Torres, Cristina Verde, Gildas Besançon, and Omar González. High-gain observers for leak location in subterranean pipelines of liquefied petroleum gas. *International Journal of Robust and Nonlinear Control*, 24(6):1127–1141, 2014.

[21] Alberto Isidori and Alberto Isidori. Elementary theory of nonlinear feedback for multi-input multi-output systems. *Nonlinear Control Systems*, pages 219–291, 1995.

[22] Hassan K Khalil. *Nonlinear control*, volume 406. Pearson New York, 2015.

[23] Camille Sarotte, Julien Marzat, Hélène Piet Lahanier, Marco Galeotta, and Gérard Ordonneau. Fault detection and isolation with fluid mechanics constraints for cryogenic combustion bench cooling circuit. In *Annual Conference of the PHM Society, Philadelphia, PA, USA*, 2018.

[24] Jean Brunet, Daniel Jaume, Michel Labarrère, André Rault, and Michel Vergé. Détection et diagnostic de pannes: approche par modélisation. *Hermès Sciences publication*, 1990.

<figure><img src="image_23.png" /></figure>
[9] Pauline Bernard, Vincent Andrieu, and Daniele Astolfi. Observer design for continuous-time dynamical systems. *Annual Reviews in Control*, 2022.

[10] Xue Han, Zetao Li, Michel Cabassud, and Boutaib Dahhou. A comparison study of nonlinear state observer design: Application to an intensified heat-exchanger/reactor. In *28th Mediterranean Conference on Control and Automation (MED)*, pages 162–167, 2020.

[11] Valentin Miquel. Propellant feeding system of a liquid rocket with multiple engines. KTH Royal Institute of Technology, 2020.

[12] Frank M White. *Fluid mechanics*. Tata McGraw-Hill Education, 1979.

[13] Yunus A Cengel, Sanford Klein, and William Beckman. *Heat transfer: a practical approach*, volume 141. WBC McGraw-Hill Boston, 1998.

[14] Peter J Linstrom and William G Mallard. *NIST Chemistry WebBook*, NIST Standard Reference Database Number 69. National Institute of Standards and Technology, 2022.

[15] JR Bermúdez, Francisco-Ronay López-Estrada, Gildas Besançon, Guillermo Valencia-Palomo, and C Martinez-Garcia. Optimal control in a pipeline coupled to a pressure reducing valve for pressure management and leakage reduction. In *SysTol, Saint Raphael, France*, pages 181–186, 2021.

[16] David G Luenberger. Observing the state of a linear system. *IEEE transactions on military electronics*, 8(2):74–80, 1964.

[17] Rudolph Emil Kalman. A new approach to linear filtering and prediction problems. 1960.

[18] JIE Chen. *Robust residual generation for model-based fault diagnosis of dynamic systems*. PhD thesis, University of York, 1995.

[19] Cristina Verde. Multi-leak detection and isolation in fluid pipelines. *Control Engineering Practice*, 9(6):673–682, 2001.

[20] Lizeth Torres, Cristina Verde, Gildas Besançon, and Omar González. High-gain observers for leak location in subterranean pipelines of liquefied petroleum gas. *International Journal of Robust and Nonlinear Control*, 24(6):1127–1141, 2014.

[21] Alberto Isidori and Alberto Isidori. Elementary theory of nonlinear feedback for multi-input multi-output systems. *Nonlinear Control Systems*, pages 219–291, 1995.

[22] Hassan K Khalil. *Nonlinear control*, volume 406. Pearson New York, 2015.

[23] Camille Sarotte, Julien Marzat, Hélène Piet Lahanier, Marco Galeotta, and Gérard Ordonneau. Fault detection and isolation with fluid mechanics constraints for cryogenic combustion bench cooling circuit. In *Annual Conference of the PHM Society, Philadelphia, PA, USA*, 2018.

[24] Jean Brunet, Daniel Jaume, Michel Labarrère, André Rault, and Michel Vergé. Détection et diagnostic de pannes: approche par modélisation. *Hermès Sciences publication*, 1990.

<figure><img src="image_24.png" /></figure>