D Diameter

Constant pressure heat capacity [J/kg/K] C v Constant volume heat capacity [J/kg/K]

I would like to thank all the people who contributed to the success of my Ph.D. and who helped me through those three years.

First and foremost I want to thank my thesis director Hélène Piet-Lahanier, research director in the Information Processing and Systems department at ONERA, and my co-director Julien Marzat, research engineer in the same department, for their interest, support and judicious advice.

I gratefully acknowledge the funding sources that made my Ph.D. work possible. I was funded by the CNES and ONERA, which allowed me to devote myself to the elaboration of my thesis.

I would also like to thank my supervisors Marco Galeotta, engineer in the CNES Launcher Directorate and Gérard Ordonneau, Launch Vehicles program director at ONERA, for their availability and for sharing their different expertise. Also, this work could not have been carried out without the availability and warm welcome shown to me by Mr Lucien Vingert at ONERA, who shared his archives with me and provided me with valuable documents. I would like to express my gratitude to the following people: Mr Ioannis Sarras who shared his knowledge and experience in this field. The joy and enthusiasm he shows for his research was contagious and motivational for me, even during tough times in the Ph.D.

The Ph.D. students and colleagues from the Information Processing and Systems department (but also other departments), for sharing with me their technical and personal experience. They were very supportive in many ways. The different teams and the Ph.D. students group have been a real source of friendships.

My time at ONERA was made enjoyable in large part due to the many friends and groups that became a part of my life. I am grateful for the time spent with neighbour friends [START_REF] Seliger | Robust residual evaluation by threshold selection and a performance index for nonlinear observer-based fault diagnosis[END_REF], sport and music buddies, especially Camille Palmier, Emilien Flayac, Sergio Pérez Roca, Esteban Restrepo Ochoa and Matthieu Nugue but also many other people.

Finally I would like to thank those who are dear to me and whom I have somewhat neglected in the last months to complete this thesis. Their attention and encouragement have accompanied me throughout these years. I am indebted to my family, for their moral and material support and their unwavering confidence in my choices.

Nomenclature

Introduction Context

Monitoring and optimizing the operating modes of launcher propulsion systems are major challenges in the aerospace industry. Since the objective of these launchers is to facilitate the access to space, it is necessary to ensure the reliability, safety and economic performance of space flights [START_REF] Fekih | Fault diagnosis and fault tolerant control design for aerospace systems: A bibliographical review[END_REF][START_REF] Nie | Liquid-propellant rocket engine online health condition monitoring base on multi-algorithm parallel integrated decision-making[END_REF][START_REF] Hayton | Static and dynamic novelty detection methods for jet engine health monitoring[END_REF][START_REF] Figueroa | Rocket testing and integrated system health management[END_REF]. Indeed, a failure or malfunction of the propulsion system can have a significant impact for institutional or private customers (loss of satellites) and can results to environmental or human catastrophes in case of uncontrolled destruction. In addition, the 21 st century has seen the rise of new nations on the satellite launch market (China, India, Japan)

and the emergence of private actors (Stratolaunch, Virgin Galactic, Space X, Blue Origin).

The emergence of these new competitors has highlighted the economic interest of reusability [START_REF] Wu | Liquid-propellant rocket engines health-monitoring: A survey[END_REF] and the development of new markets (tourism / private infrastructures, small space boom, constellations...) points out the necessity to improve health management and monitoring systems to remain competitive. Launching a rocket, bringing it back to Earth and sending it back into space again is one possible way to reduce the costs of space transport. Moreover, the new private launch services sector addresses the problem of reusability, cost optimization, fast development and manned flight which imply a focus on technical and economic optimization of the entire system. In order to maintain its space access independence and meet its institutional needs (placement of satellites in low and medium orbit), the European Space Agency (ESA) has decided to launch various development programs for future European launchers (Ariane 6, Ariane Next). The technical choices are based on concept analyses carried out jointly by the French National Space Center (CNES), ESA, industry and the French aerospace lab (ONERA).

Health Management Systems (HMS) for propulsion systems, especially Liquid Propellant Rocket Engines (LPREs), have considered the current challenges and need of improvement.

They emerged in the early 1970's and have since been developed to address safety and reliability issues. Their objective in the field of space launchers was initially to detect a failure or malfunction, locate them and take a decision [START_REF] Shen Yin | A review on recent development of spacecraft attitude fault tolerant control system[END_REF]: to stop or not operations. Launchers and ground system reliability, availability, maintainability and safety (RAMS) was originated in the USA after the Apollo 1 accident. NASA's approach to safety was based on this accident, at that time, a risk analysis was not a systematic approach. Effective qualitative safety barriers were lacking as a global approach to risk considering design, processes, operations and human factor. After this incident, qualitative approaches have gained importance with respect to the probabilistic approach which have initiated the use of health monitoring systems. On the European side, the experience acquired during the years of Ariane launchers system's exploitation has pointed out the complexity of the implementation of cryogenic propulsive systems as well as the necessity to get a specialized expertise on physical phenomenon to perform health management [START_REF] George | Rocket propulsion elements[END_REF][START_REF] Karimi | Dynamic and nonlinear simulation of liquid-propellant engines[END_REF].

During Ariane 1 to 3 development, the margins to detect faults were then either lacking or not fully determined leading to different failures (LOX failure in 1980, flights 15 in 1985 and 18 in 1986). Since then requirements for characterization of engine operating ranges and demonstration margins have been implemented for Ariane. The methods commonly used nowadays for HMS dedicated to Rocket Engine (HMSRE) [START_REF] Gubanov | USSR main engines for heavy-lift launch vehicles-Status and direction[END_REF][START_REF] Huang | Key reliability drivers of liquid propulsion engines and a reliability model for sensitivity analysis[END_REF] are a basic engine redline system as well as advanced sensors and algorithms including multiple engine parameters that infer an engine anomaly condition from sensor data and take mitigation action accordingly.

Those basic redlines are straightforward in that they usually act on a single operating parameter anomaly [START_REF] Feng | Research on health evaluation system of liquid-propellant rocket engine ground-testing bed based on fuzzy theory[END_REF]. If this parameter is higher than a predicted nominal value approaching a fixed limit, then a fault is detected. Those methods can induce false alarms or undetected failures that can be critical for the operation safety and reliability. Hence, the current works aim at eliminating some catastrophic failures but also to mitigate benign shutdowns to non-shutdown actions based on smart algorithms, therefore improving total engine reliability and mission success probability.

The objectives of HMS are then to design efficient, fast and reliable approaches to detect faults of various magnitudes. The different approaches can be divided in two different categories, data-based and model-based ones. Unlike the aviation or automotive industries, databases are not large enough to only use data-based methods in an efficient way. For that reason, in the case of rocket engines, qualitative or quantitative model-based methods are essentially used, coupled if needed with data-based methods. These systems which operate using intelligent algorithms therefore depend on the proper modeling of the physical phenomena involved in order to use model-based methods. However, the description of complex physical phenomenon as well as the compliance with sensors sensitivity and thermo-mechanical positioning constraints may constitute some important limitations. Moreover, since the developed algorithms must allow fault detection in real time [START_REF] Betta | Instrument fault detection and isolation: State of the art and new research trends[END_REF] the methods used under this constraint must be fast and robust. Hence, the first task of the HMS is to detect component and / or instrument failures with a model-based Fault Detection and Isolation (FDI) approaches [START_REF] Hwang | A survey of fault detection, isolation, and reconfiguration methods[END_REF][START_REF] Shen Yin | A review on recent development of spacecraft attitude fault tolerant control system[END_REF]. If the failure is considered to be minor, non-shutdown actions have to be defined to maintain the overall system current performances close to the desirable ones and preserve stability conditions [START_REF] Ye | Adaptive fault-tolerant tracking control against actuator faults with application to flight control[END_REF][START_REF] Yang | Adaptive Fault-tolerant H∞ Control via State Feedback for Linear Systems against Actuator Faults[END_REF][START_REF] Yang | Fault tolerant control and hybrid systems[END_REF]. For this reason, it is required to perform a reconfiguration [START_REF] Petros | Robust adaptive control[END_REF] of the engine using Fault Tolerant Control Systems (FTCS). Active FTC Systems are characterized by online FDI processes as described in [START_REF] Zhang | Bibliographical review on reconfigurable fault-tolerant control systems[END_REF][START_REF] Zhang | Active fault-tolerant control system against partial actuator failures[END_REF].

This system firstly detects and estimates faults, the second step is to achieve a steady-state tracking of the reference input by compensating the fault [START_REF] Theilliol | Actuator fault tolerant control design based on a reconfigurable reference input[END_REF]. For that purpose, FDI methods have been developed to evaluate failures and take a decision using all available information with the help of explicit or implicit models [START_REF] Zhong | A survey on model-based fault diagnosis for linear discrete time-varying systems[END_REF]. The most common model-based approach for FDI makes use of observers to generate residuals as presented in [START_REF] Steven X Ding | Model-based fault diagnosis techniques: Design schemes, algorithms, and tools[END_REF][START_REF] Hwang | A survey of fault detection, isolation, and reconfiguration methods[END_REF]. Faults are then detected by setting a fixed or variable threshold on each residual signal [START_REF] Basseville | Detection of abrupt changes: theory and application[END_REF]. The developed FTCS should be robust to modeling uncertainties and unknown disturbances [START_REF] Chen | Design of unknown input observers and robust fault detection filters[END_REF][START_REF] Yang | Observers for linear systems with unknown inputs[END_REF][START_REF] Bittner | An integrated process for FDIR design in aerospace[END_REF] since in practice it is challenging to design representative mathematical models of the system dynamics [START_REF] Paul | Handling modelling uncertainty in fault detection and isolation systems[END_REF][START_REF] Gertler | Fault detection and diagnosis[END_REF].

Finally, due to physical actuators characteristics or performances, unlimited control signals are not available, and saturations should be taken into account in the control law design.

Indeed, as part of the reusability as well as optimization of operations for conventional launchers in terms of cost and robustness to disturbances, fast and robust FTCS must be developed [START_REF] Yang | Fault tolerant control and hybrid systems[END_REF]. This is to maintain the performance of the overall system while preserving stability conditions in the event of minor failures affecting components or instrumentation [START_REF] Bittner | An integrated process for FDIR design in aerospace[END_REF] and respecting the physical and response time constraints to operate in real time [START_REF] Betta | Instrument fault detection and isolation: State of the art and new research trends[END_REF].

Problems addressed in this thesis

For this purpose, this thesis was supervised by the Department of Information and Signal Processing (DTIS) and the Department of Multi-physics for Energy (DMPE) of ONERA. This thesis was also co-supervised and co-financed by CNES, which provided its system expertise, especially through simulation tools such as the software CARINS. In order to carry out this work successfully, a test bench dedicated to the study of LPREs, MASCOTTE (CNES/ONERA, see [START_REF] Vingert | Dossier de Définition et de réalisation de Mascotte V05[END_REF]), has been used to validate offline algorithms from available data but also online after implementation by replaying firing tests.

MASCOTTE test bench is a test facility dedicated to the experimental study of cryogenic rocket engines fueled with oxygen and hydrogen or methane. The obtained measurements will allow updating and adapting the simulation models as well as validating by identification the engine characteristics on offline tests. The different types of faults were simulated with CARINS simulation software (CNES). CARINS is a software developed for simulation and modeling with a system-based approach (see [START_REF] Ordonneau | CARINS: A Future Versatile and Flexible Tool for Engine Transient Prediction[END_REF]).

The three objectives of this thesis were therefore:

1. The modeling of the different main subsystems of a liquid propellant engine:

A first difficulty is to model the evolution of the physical phenomena involved, whose characteristics can be identified online and make it possible to detect changes in behavior [START_REF] Zhong | A survey on model-based fault diagnosis for linear discrete time-varying systems[END_REF] in a robust and fast way. Models representing the dynamics evolution of the cooling system, propellant injection into the combustion chamber and supply lines have therefore been developed, with specific application to MASCOTTE test bench. Those models are partial differential equations transformed into ordinary differential equations. On the basis of the previous works of [START_REF] Iannetti | Development of model-based fault diagnosis algorithms for MASCOTTE cryogenic test bench[END_REF], approaches have been developed to allow the comparison between the evolution of the complete state (pressure, temperature, mass flow) and a prediction under nominal operating hypothesis.

2. The development of failures detection and isolation algorithms from the previously developed models:

The developed models are combined with observers or filters to generate signals called residuals [START_REF] Steven X Ding | Model-based fault diagnosis techniques: Design schemes, algorithms, and tools[END_REF]. This, in order to be able to detect and isolate a change in the behavior of a subsystem of the engine. In the case of non-accessible measurements (impossibility to place a sensor), the estimated state of our system with the help of Unknown Input Observers (UIO) then allows to overcome this lack of information using reconstruction methods. The developed detection method is then based on adaptive thresholds with the use of an Adaptive Cumulative SUM algorithm (ACUSUM). As said before, most of previous failure detection methods in the field of Liquid Propellant Rocket Engine (LPRE)

were based on fixed thresholds, if several parameters exceeded these thresholds, a failure was detected [START_REF] Wu | Liquid-propellant rocket engines health-monitoring: A survey[END_REF]. However, it has been shown that these methods were not robust to uncertainties and sensor noise and could cause early shutdown of operations, poor isolation of the failure and mission failure [START_REF] Basseville | Detection of abrupt changes: theory and application[END_REF]. In contrast, adaptive thresholds allow the correct detection of a fault regardless of the component of the system state affected by taking into account these constraints [START_REF] Iannetti | Méthodes de diagnostic pour les moteurs de fusée à ergols liquides[END_REF], [START_REF] Palmer | Active Fault Diagnosis with Sensor Selection in a Diesel Engine Air Handling System[END_REF]. Methods for fault isolation [START_REF] Nie | Liquid-propellant rocket engine online health condition monitoring base on multi-algorithm parallel integrated decision-making[END_REF] are then developed making use of a Parity Space (PS) approach in order to be able to localize a fault in an under-monitored part, especially the engine cooling system where it is currently impossible (expensive, technological limitation) to obtain a measurement of the circulating flows. The isolation algorithm developed makes it possible to obtain the location and dynamics of failures by coupling fluid mechanics constraints with signal processing methods.

3. The definition of a real-time engine reconfiguration system to compensate for certain types of failures:

The first step is to model the link between the inputs (flow rates, pressures) and the nominal operating points of the system [START_REF] Huang | Key reliability drivers of liquid propulsion engines and a reliability model for sensitivity analysis[END_REF], [START_REF] Shen Yin | A review on recent development of spacecraft attitude fault tolerant control system[END_REF]. Then, in a second step, to determine a control law in order to maintain the desired operating point when a fault is detected and located. An Active Fault Tolerant Control System (AFTCS) has therefore to be developed [START_REF] Zhang | Bibliographical review on reconfigurable fault-tolerant control systems[END_REF]. This system makes it possible to maintain a nominal operating point when one or more faults impacting the system actuators are detected [START_REF] Theilliol | Actuator fault tolerant control design based on a reconfigurable reference input[END_REF]. Since the system actuators must comply with thermo-mechanical constraints, the control law may include an antiwindup loop in order to comply with them by modifying the transients. On this basis, the developed algorithms make it possible to ensure the stability of the system around a nominal trajectory and to compensate for failures affecting the actuators. These results are not achievable with the usual rocket engine control methods which are based on non-optimized, non-fault-tolerant open-loop setpoint settings or PID (for example see [START_REF] Fang | Closedloop combustion phase control for multiple combustion modes by multiple injections in a compression ignition engine fueled by gasoline-diesel mixture[END_REF]).

Hence, the methods used had to be developed based on new control methods as those for reusable engines. They have been developed for the linearized and nonlinear models. The nominal control law is obtain via a Linear Quadratic command (LQ) or a Model Predictive Control (MPC) controller type with error feedback and a fault compensation. Those kinds of approaches allow to ensure the system stability around an operating trajectory and to compensate for an additive actuator failure. Moreover, the error feedback allows to take into account the state estimation error directly in the control design. An anti-windup scheme has been proposed to account for actuator saturations. In this approach, the set of admissible initial states and its associated domain of stability are determined to take into account the compensation of additive actuator faults. In addition, the new methods developed make it possible to take into account the estimation error of the overall state of the system directly in the drafting of the control law ensuring the proper monitoring of its health status.

The developed Fault Detection, Isolation and Reconfiguration (FDIR) scheme on the basis of those three objectives has then been validated with the help of simulations with CARINS and the MASCOTTE test bench.

Thesis organization

In Chapter 2 the main fault diagnosis and fault-tolerant control methods and their application to LPREs is introduced.

In Chapter 3, a description of LPRE is given and models are developed for different subsystems such as the combustion chamber, the distributing manifolds, the injection and cooling system.

Those models are adapted to the MASCOTTE test bench and validated offline with real data test.

In Chapter 4, a FDI system is proposed and designed, this system is composed of extended unknown input observers and Kalman filters, unknown input reconstruction methods, ACUSUM algorithms and a Parity Space approach for fault isolation, this last method is based on fluid mechanical constraints to determine the projection matrix instead of defining robustness / sensitivity criteria as in [START_REF] Zhong | Parity space-based fault detection for linear discrete time-varying systems with unknown input[END_REF].

Chapter 5, describes the reconfiguration part of the developed Active FTCS composed of an error feedback, an UIO to compensate the fault and an anti-windup part in the case of actuator additive faults and saturation.

The Chapter 6, describes the firing test operations and preparations as the different operating machines and safety task of MASCOTTE test bench. Then the first implementation work of the previously developed AFTC methods. For the implementation purpose, a virtual instrument have been created calling a dynamic links library containing functions using the designed algorithms.

Publications

The work presented in this thesis has resulted in the following publications:

• Iannetti, A., Marzat, J., Piet-Lahanier, H., Sarotte, C., Ordonneau, G. (2017). Promising HMS approaches for liquid rocket engines. In 7th European Conference for Aeronautics and Space Sciences (EUCASS)

• Sarotte, C., Marzat, J., Piet-Lahanier, H., Iannetti, A., Galeotta, M., [START_REF] Sarotte | Actuator Fault Tolerant System for Cryogenic Combustion Bench Cooling Circuit[END_REF].

Actuator Fault Tolerant System for Cryogenic Combustion Bench Cooling Circuit. IFAC-PapersOnLine, 51 [START_REF] Gubanov | USSR main engines for heavy-lift launch vehicles-Status and direction[END_REF], 592-599.

• Sarotte, C., Marzat, J., Piet-Lahanier, H., Galeotta, M., Ordonneau Chapter 2

State-of-the-art

Generalities and definitions

HMS have to allow the continuous real-time determination of the conditions of a physical system, by recording information, recognizing and indicating anomalies in the behavior. The developed HMS have to improve the reliability, the safety and availability [START_REF] Isermann | Process fault detection based on modeling and estimation methods -A survey[END_REF].

Definition 2.1.1. Reliability Ability of a system to perform a required function under stated conditions, within a given scope, during a given period of time.

Definition 2.1.2. Safety Ability of a system not to cause danger to persons or equipment or the environment.

Definition 2.1.3. Availability Probability that a system or equipment will operate satisfactorily and effectively at any point of time.

To ensure and improve those points, alarms are generated for the operator and automatic protections are developed. Then, the monitoring function allows checking measurable variables with regard to tolerances and in the case of a dangerous process state, the function automatically initiates an appropriate counteraction. This counteraction depends on the observed deviation between a measured or computed value and the true, specified or theoretically correct value.

Hence, those systems are composed of FDI algorithms then, a FTCS can be developed [START_REF] Gao | A survey of fault diagnosis and fault-tolerant techniques -Part I: Fault diagnosis with model-based and signal-based approaches[END_REF]. The first system detects and estimates faults; the second system achieves a steady-state tracking of the reference input by compensating the fault [START_REF] Hwang | A survey of fault detection, isolation, and reconfiguration methods[END_REF]. Faults can be classified either by their location (sensor, actuator, component) or by their type of signal (bias, drift, slow varying fault, abrupt changes, stochastic).

Definition 2.1.4. Fault

Unauthorized deviation of at least one characteristic property or parameter of the system from the acceptable / usual / standard condition.

We can also distinguish failures, malfunctions, disturbances and perturbations [START_REF] Isermann | Supervision, fault-detection and fault-diagnosis methods-an introduction[END_REF]. An input acting on a system, which results in a temporary departure from the current state.

To set the fault tolerances, compromises must be made between the detection size of abnormal deviations and unnecessary alarms because of normal fluctuations of the variables. Most frequently, simple limit value checking is applied, which works especially well if the process operates approximately in a steady state. However, the situation becomes more complicated if the process operating point changes rapidly.

In the case of closed loops, changes in the process are covered by control actions and cannot be detected from the output signals, if the manipulated process inputs remain in the normal range.

Therefore, feedback systems hinder the early detection of process faults. The big advantage of the classical limit-value-based supervision methods is their simplicity and reliability. However, they are only able to react after a relatively large change of a feature: after either a large sudden fault or a long-lasting gradually increasing fault. In addition, an in-depth fault diagnosis is usually not possible. Advanced methods of supervision and fault diagnosis have then to be used, ensuring:

• The early detection of small faults with abrupt or incipient time behavior.

• The diagnosis of faults in the actuator, process components or sensors.

• The detection of faults in closed-loops.

• The supervision of processes in transient states.

Fault diagnosis is a combination of fault detection, isolation and identification methods. Based on the observed analytical and heuristic symptoms, i. e. a change of an observable quantity from normal behavior, its tasks are the following:

• Fault Detection (FD): indication that something is going wrong in the system.

• Fault isolation: determination of the exact location of the fault.

• Fault identification: the determination of the size, type and nature of the fault.

The performance indices of FD are usually considered to be:

• Missed alarm: the monitor does not indicate fault when a fault has occurred in the system.

• False alarm: the monitor indicates a fault when the system is normal.

• Detection delay: has to be monitored for a fixed false alarm rate.

The knowledge of the observed analytical and heuristic symptoms allow supervising or protecting the physical system: monitoring and taking appropriate actions to maintain the operation in the case of faults and suppressing if possible potentially dangerous behavior, or avoiding the consequences of a dangerous behavior. Since the goal for the early detection and diagnosis is to have enough time for counteractions such as reconfiguration, maintenance or repair, the task of fault diagnosis consists also in determining its time of detection. The earlier detection can then be achieved by gathering more information, especially by using the relationship between the measurable quantities in the form of mathematical models. For fault diagnosis, the knowledge of cause-effect relations has to be used. The cause-effect relations can be represented in the form of a fault indicator, based on a deviation between measurements and a mathematical model, named residual.

Those mathematical models or diagnosis models consist in a set of static or dynamic relations which link the symptoms to the faults and can be separated in two categories:

• Quantitative model using static and dynamic relations among system variables and parameters in order to describe a system's behavior in quantitative mathematical terms [START_REF] Venkatasubramanian | A review of process fault detection and diagnosis (Part I): Quantitative model-based methods[END_REF].

• Qualitative model using static and dynamic relations among system variables and parameters in order to describe a system's behavior in qualitative terms such as causalities or if-then rules.

If no further knowledge of fault symptom causalities is available, classification methods can be applied which allow a mapping of symptom vectors into fault vectors. To this end, methods like statistical and geometrical classification or neural nets and fuzzy clustering can be used. If, however, prior knowledge of fault-symptom causalities is available then diagnosis reasoning strategies can be applied.

The basic FDI / Fault Detection and Diagnosis (FDD) methods are the following, see Figure 2.1:

• Limit value checking of direct, measurable signals. The characteristic values are the exceeded signal tolerances. This includes ruled-based expert systems.

• Signal analysis of directly measurable signals using signal models like correlation functions, frequency spectra, regression analysis (e.g., AR, ARMA), the characteristic values (e.g., variances, amplitudes, frequencies or model parameters) or trend analysis.

• Process analysis by using mathematical process models together with parameter estimation, state estimation and parity equation methods or pattern recognition, statistical classifier and neural networks. The characteristic values are parameters, state variables or residuals. In the case of LPREs, advanced launching systems are developed with increased performance and service life, and emphasis is placed upon engine health monitoring to reduce direct costs such as hardware, operations and fuel consumption. The first approaches for engine health monitoring made use of advanced integrated multi-sensor networks (hardware) and expert systems (software) for damage detection, monitoring and prognosis to deduce the safety state of any subsystem or associated operation. Then the information was used to modify accordingly the mission scenario if imposed to maintain an acceptable level of risk. The expendable LPREs were monitored by redlines on some important operational parameters, and automatic test-data analysis systems. In order to develop higher performance HMS for Space Shuttle Main Engine (SSME) and next-generation reusable rocket engines, several architectures such as HMSRE, Integrated Health Monitoring (IHM), ICS, etc., were proposed and studied intensively from the late of 1980's to the early of 1990's [START_REF] Michael W Hawman | Framework for a space shuttle main engine health monitoring system[END_REF]. The operation covered by the health-monitoring techniques was also extended from ground test to flight and post-flight evaluation. Last years have seen the rise of these HMS methods which have been developed based on many different approaches and implementation strategies. The aim of these methods is to perform manual, semi-automated, or fully automated FDI on critical systems. Hence, since modern technological systems rely on sophisticated control systems to meet increased performance and requirements, some approaches aim at allowing a reconfiguration of the system once a failure is detected and isolated. Faults in automated complex systems will often cause undesired reactions and shutdown of a controlled subsystem, and the consequences could be damages to technical parts of the system or to its environment, so that FDI and FTC based on advanced advanced data-based and / or model-based methods are highly required .

The main objective of this part is to present a general description of the State-of-the-art regarding FDIR methods and their application for LPREs based on analytical (model-based) and classification methods (data-based).

Data-based methods -Heuristic symptoms

Data-based structure and parameters are all identified from plant data in order to obtain datadriven or empirical models. The aim of those models is to know which variables are related causally or not. A model causally relates two variables, if it correctly shows that a change of a certain magnitude in one will result in a change of a certain magnitude of the other. In data-driven models, causality among variables is determined entirely by the nature of the data and by the structure of the empirical model. If an independent variation is not present in certain manipulated variables, then no causality information for the effects of those individual variables will be present in the data, nor in any model built from them. Causal models are not always useful for monitoring but are essential for active applications such as control and optimization.

These data are of different nature and may be collected under designed experiments where major identification is done from the introduction of independent variations into all manipulated variables. Data collected under routine operation are unlike these data. These variations in the process data define a causal subspace within which the process moves, but they do not provide causal information on individual variables. This issue lies at the heart of defining useful data-driven models developed from these data. Their common characteristic is that they can be implemented on closed sets: the set of all faults to be identified are listed and associations between data and faults are created. This association can be made by using:

• Quantitative models.

• Black-box models.

• Statistical classification techniques.

Different data-driven methods for building models from process data have been proposed. These include regression methods / classifiers:

• Independent Component Analysis (ICA): it is a statistical and computational method for revealing hidden factors that underlie sets of random variables, measurements, or signals by separating a multivariate signal into additive subcomponents. This is done by assuming that the subcomponents are non-Gaussian signals and that they are statistically independent from each other.

• Artificial Neural Networks (ANN): it is a stochastic and heuristic tool that learns the relationship between the parameters and their responses when trained with a finite number of input data and predicts the values of response from the new set of independent variables based on its training experience.

• Support Vector Machines (SVM): it is a class of learning algorithms constructing a real data classifier considering two problems, the nonlinear transformation of the inputs and the choice of an optimal linear separation. It constructs a hyperplane or set of hyperplanes in a high-or infinite-dimensional space, which can be used for classification, regression, or other tasks like outliers detection.

The most popular data-driven process monitoring approaches include:

• Principal Component Analysis (PCA): it is a mathematical procedure that transforms a set of observations of possibly correlated variables into a set of values of linearly uncorrelated variables called principal components. It can be used for extracting information from a high-dimensional space by projecting it into a lower-dimensional sub-space with an orthogonal transformation.

• Fisher discriminant analysis: it is a linear dimensionality reduction technique, optimal in terms of maximizing the separation between several classes. It is similar to PCA except that it projects data to a line preserving direction, which is useful for data classification.

• Partial Least-Squares (PLS) analysis: it is a statistical method close to PCA, but instead of finding hyperplanes of maximum variance between the response and independent variables, it finds a linear regression model by projecting the predicted variables and the observable variables into a new space.

• Canonical variate analysis: it is a multivariate technique used to determine the relationships between groups of variables in a data set. The data set is split into two groups, based on some common characteristics. The purpose of canonical analysis is then to find the relationship between them by finding the linear combination of the variables of the two groups, which are most highly correlated.

Statistical methods

Among these, PCA and PLS have been increasingly adopted for feature extraction from historical databases developed from process operations. PCA can facilitate process monitoring by projecting data into a lower-dimensional space that characterizes the state of the process. PCA is a dimensionality reduction technique that produces a lower-dimensional representation while preserving the correlation structure between the process variables; it is thus optimal in terms of capturing variability in the data [START_REF] Leo H Chiang | Pattern Classification. In Fault detection and diagnosis in industrial systems[END_REF]. The visualization and structure abstracted from the multidimensional data can assist operators and engineers in interpreting the significant trends in the process. In situations where it is impossible, modified versions of the PCA method have been developed to automate the process monitoring procedures based on the following three considerations [START_REF] John | Statistical process control of multivariate processes[END_REF], [START_REF] Raich | Statistical process monitoring and disturbance diagnosis in multivariable continuous processes[END_REF]:

• PCA can produce lower dimensional representations of the data, which are better for generalizing data independent of the training set than using the entire dimensionality of the observation space. This approach therefore improves proficiency of detecting and diagnosing faults.

• The structure abstracted by PCA can be useful for identifying either the variables responsible for the faults and / or the variables most affected by the faults.

• PCA can separate the observation space into subspaces capturing the systematic trends of the process, and subspaces containing the random noise.

PLS, also known as projection to latent structures is a dimensionality reduction technique for maximizing the covariance between the independent predictor matrix and the dependent predicted matrix, for each component of the reduced space [START_REF] Robert | A description classifier for the predicate calculus[END_REF]. A popular application of PLS is to include process variables in the predictor matrix and product quality data in the dependent matrix, which can include offline measurement data [START_REF] Kruger | Extended PLS approach for enhanced condition monitoring of industrial processes[END_REF]. Such inferential models (also known as soft sensors) can be used for online prediction of product quality data. PLS has also been incorporated into process monitoring and control algorithms. Both approaches can also be used for multivariate statistical monitoring, such that if the operating point is beyond the acceptable range of values, then the operation can be regarded as abnormal.

Qualitative methods

An expert system is a software system commonly used for fault diagnosis that captures human expertise for supporting decision-making. The first attempts to use expert system are surveyed in [START_REF] Paul | Fault diagnosis in dynamic systems using analytical and knowledge-based redundancy: A survey and some new results[END_REF]. This is useful for dealing with problems involving incomplete information or large amounts of complex knowledge. Expert systems are particularly useful for online operations in the control field because they incorporate symbolic and rule-based knowledge that relate situation and action(s), and they also could explain and justify a line of reasoning. Typically, the basic components of an expert system include:

• A knowledge base: coding of the representation of knowledge acquisition. It contains either shallow knowledge based on heuristics, or deep knowledge based on structural, behavioral or mathematical models. Various types of knowledge representation schemes can be used, including production rules, frames, and semantic networks

• An inference engine: procedures for diagnosis reasoning. It provides inference mechanisms for a direct use of the knowledge, and the mechanisms typically include backward and forward chaining, hypothesis testing, heuristic search methods, and meta-rules (see the survey [START_REF] Venkatasubramanian | A review of process fault detection and diagnosis (Part I): Quantitative model-based methods[END_REF]).

• A user interface: input / output interfaces. It translates user input into a computer understandable language and presents conclusions and explanations to the user.

The main advantages in the development of expert systems for diagnosis problem-solving are: ease of development, transparent reasoning, and the ability to reason under uncertainty and the ability to provide explanations for the solutions provided. However, even if expert systems have been widely adopted for process control there are some well-known limitations, see the survey [START_REF] Macgregor | Monitoring, fault diagnosis, fault-tolerant control and optimization: Data driven methods[END_REF]:

• Control over inference application is implicit in the structure of the knowledge base, for example in the ordering of rules for a rule-based system.

• As the size of the knowledge base increases, the inference engine may be unable to identify the solutions in a timely fashion.

• Most expert systems are domain specific and typically, an expert system is only developed for an individual application.

• Knowledge from experts is difficult to acquire and represent, and most often involves uncertainty.

To overcome the above limitations, a commonly used approach is the integration of expert systems with other solution approaches such as fuzzy logic, machine learning, and pattern recognition techniques, for example see [START_REF] Merrill | A reusable rocket engine intelligent control[END_REF][START_REF] Hirpa | An expert system for engine fault diagnosis: development and application[END_REF]. The uncertain knowledge can be handled by incorporating fuzzy logic into the knowledge representation. Knowledge-based approaches as implemented in automated reasoning systems incorporate heuristics and reasoning, which involve uncertain, conflicting, and non-quantifiable information [START_REF] Lou | Knowledge-based Engineering (Part I): Overview[END_REF]. The artificial intelligence technologies that are associated with knowledge-based approaches and adopted for monitoring, control, and diagnosis in the process industries include:

• Expert systems,

• Fuzzy logic,

• Machine learning,

• Pattern recognition.

Fuzzy logic provides a mechanism for approximation using graded statements instead of ones that are strictly Boolean. It is useful for representing process descriptions such as "high or low", which are inherently fuzzy and involve qualitative conceptualizations of numerical values meaningful to operators [START_REF] Patton | Fuzzy observers for nonlinear dynamic systems fault diagnosis[END_REF]. Fuzzy logic systems handle the imprecision of input and output variables directly by defining them with fuzzy memberships and sets that can be expressed in linguistic terms. Complex process behavior can be described in general terms without precisely defining the complex phenomena involved. However, it is difficult and time consuming to determine the correct set of rules and membership functions for a reasonably complex system; and fine-tuning a fuzzy solution can be time-consuming. To solve some of these weaknesses, pattern recognition and / or machine learning are often adopted to learn the best membership functions through its training algorithms [START_REF] Shatnawi | Fault diagnosis in internal combustion engines using extension neural network[END_REF].

Pattern recognition and machine learning

Pattern recognition approaches are applicable to process monitoring because of the assumed relationship between the data patterns and fault classes while ignoring the internal process states or structures. A widely adopted pattern recognition approach for FDD is the ANN [START_REF] Uraikul | Artificial intelligence for monitoring and supervisory control of process systems[END_REF].

A neural network is a computer model whose architecture essentially mimics the knowledge acquisition and organizational skills of the human brain [START_REF] Wu | Investigation of engine fault diagnosis using discrete wavelet transform and neural network[END_REF]. A neural network consists of several interconnected processing elements, commonly referred to as neurons. The neurons are logically arranged into two or more layers and interact with each other via weighted connections. These scalar weights determine the nature and strength of the influence between the interconnected neurons. Each neuron is connected to all the neurons in the next layer. There is an input layer where data is presented to the neural network, and an output layer that holds the response of the network to the input [START_REF] Hunt | Neural networks for nonlinear internal model control[END_REF]. It is the intermediate layers, also known as hidden layers that enable these networks to represent and compute complicated associations between patterns.

Neural networks essentially learn through the adaptation of their connection weights [START_REF] Hinton | Improving neural networks by preventing co-adaptation of feature detectors[END_REF].

The ANN approach involves a nonlinear mapping between input and outputs, which consist of interconnected neurons arranged in layers. The overall nonlinear behavior of the neural network is determined by the choice of network topology and the weight of connections between neurons. The neural network paradigm which has been the most adopted uses the backpropagation learning algorithm. Back-propagation neural networks with a single hidden layer have been shown to be capable of providing an accurate approximation of any continuous function provided there are enough hidden neurons [START_REF] Hecht-Nielsen | Theory of the backpropagation neural network[END_REF]. In back-propagation neural networks [START_REF] Fernando | Generalization of back-propagation to recurrent neural networks[END_REF], the mathematical relationships between the various variables are not specified. Instead, they learn from the examples fed to them. In addition, they can generalize correct responses that only broadly resemble the data in the learning phase. The back-propagation learning algorithm works as following, the first phase is a training phase:

• Presentation of a series of example patterns of associated input and target (expected) output values: each hidden and output neuron processes its inputs by multiplying each input by its weight, summing the product and then passing the sum through a nonlinear transfer function to produce a result.

• Learning: modification of the weights of the neurons in response to the errors between the actual output values and the target output values. One pass through the set of training patterns along with the updating of the weights is called a cycle or epoch.

• Convergence: repeated presentation of the entire set of training patterns (with the weights updated at the end of each cycle) until the average sum squared error over all the training patterns is minimized and within the tolerance specified for the problem.

• Storage: the associated trained weights of the neurons are then stored in the neural network memory.

• Comparison: the trained neural network is fed a separate set of data and the predictions (using the trained weights) are compared with the target output values. This assesses the to be used as the input parameters for the neural network model must be identified [START_REF] Kumpati | Identification and control of dynamical systems using neural networks[END_REF]. This requires an understanding of the problem domain and may require insights from specialists in that field. To minimize the number of input parameters, statistical methods are sometimes used to identify the most significant variables in the model [START_REF] Murata | Network information criteriondetermining the number of hidden units for an artificial neural network model[END_REF]. Data-driven models such as standard statistical regression models and artificial neural network models that do not explicitly recognize the nature of these process data are of limited or no value to exploit these data.

Data-based methods for liquid propellant rocket engines fault diagnosis

Failures of LPREs are divided into slow and urgent categories. Since it is difficult to model the engine system accurately and that the developed algorithm has to be robust to uncertainties and random disturbances, plus have real-time abilities by increasing the response speed, qualitative and quantitative fusion and integration should be a natural idea to solve diagnosis problem in the case of LPREs. In nature, fault diagnosis is an intelligent problem-solving and decision-making.

It can be said that the traditional FDD methods combined with Artificial Intelligence (AI) and computing intelligence represents a way forward into the next generation of fault diagnosis. This is particularly relevant since a nonlinear simulation cannot be used in most cases to generate data in real time to describe the normal mode of operation.

Significant progress has been made in the NASA and Air Force communities toward performance of the HMS function in instrumentation, analysis techniques, and envelope (trends and rate of change) monitoring. Current techniques in the late 80's and 90's, required domain experts to be integrally involved in the analysis session and make online decisions to direct the analysis. An example of a SSME HMS expert system is given in [START_REF] Pooley | Rocket Engine Health Monitoring System (MHS) via an Embedded Expert System (EES)[END_REF]. AI techniques, specifically a rule-based expert system can enhance the functions of an HMS. Hence, SPARTA has developed and adapted a set of algorithms originally used for image processing in the LANDSAT program to produce an innovative application of AI techniques. The keystone of this application is a method for unsupervised classification that uses confidence levels to resolve conflicts among compound data, and that trains on each data set to derive (or modify) classification rules. This expert system has been named SPARTA Embedded Expert System (SEES), see Table 2.1.

SEES is an intelligent system that directs the analysis by placing confidence factors on possible engine status, then recommends a course of action to an engineer or the engine controller. In SEES, conventional computation methods are used to reduce the raw data to a much smaller but manageable "derived" data set, and to extract pertinent information (signatures) from the derived data set. This information is then used to establish a knowledge base. This technique aims at preventing catastrophic failures or costly rocket engine down time because of false alarms and at being an on-board flight monitor for reusable rocket engine systems. The SEES methodology integrates:

• Vibration analysis: it comprises signal analysis techniques that convert raw count accelerometer data to engineering units and transform the data to the frequency domain using Fast Fourier Transforms (FFT) to derive a Power Spectral Density (PSD) for input to a data conditioning module. The data conditioning module processes the PSD signal to remove the extraneous components.

• Pattern recognition: the conditioned PSD is evaluated as a candidate for signatures derived during this processing (by the Pattern Matcher) or binned to be considered for establishment of another signature,

• Embedded Expert System (EES): this is a rule-based knowledge system that uses forward chaining strategy and has the ability to categorize performance and recognize impending failure and the need for remedial action. Like most typical expert systems, the EES must have a learnable element in the sense that it can interact with a domain expert (online or offline) to generate new rules that may be added to its knowledge base This integration affords a robustness via the analysis techniques with an ability to resolve conflicts by the expert system approach.

• The first group of rules are intimately related to SSME operation, and are derived from PSD and signature contents. This group of rules gives an indication of whether the engine is in normal operating condition or a catastrophic failure will occur in the near future, and provides a quantative measure of the engine degradation during a test.

• The second group of rules relate to incipient failures. With the help of Systemic Functional Linguistics (SFL), this group of rules quantifies indication of incipient failure modes, thereby allowing the inference engine to predict the expected time to next failure and recommend a scheduled maintenance in a timely fashion.

• The third group of rules relates to environmental data obtained from various sensors (thermal, pressure, vibration, etc). These rules provide additional information for monitoring engine performance during tests. Additionally, there may also be rules for correctly detecting sensor failures so that unnecessary engine over-haul may be avoided. while signatures at the same power level measured some degradation from nominal. It remains to be determined how this relates to SSME components at risk to fail. However, this approach lacks of adaptability since it depends on historical data and may be inefficient in the case of certain failures combinations or even induce false alarms.

In [START_REF] Duyar | Fault diagnosis for the space shuttle main engine[END_REF], Duyar and Merril generated linear-point models offline with an identification algorithm to develop an HMS for the SSME, see In this paper they use a neural classifier composed of two layers combined with a backpropagation algorithm. Those two levels are: the classifier level where the faults are classified as belonging to a particular category (fault detection) and the severity level where the magnitude of the fault that was identified in the classifier level is estimated. The classifier is composed of two networks, one for each residual. There are three feedforward networks layers with nonlinear hidden and output units. One output node is activated if an oxidizer and fuel preburner opening valves stuck condition is activated. To train their network, six fault scenarios were generated from the nonlinear dynamic simulation for different conditions. During training, a residual pattern representing a fault condition is applied to the input level and one is applied to the corresponding output node. The network weights are adjusted invoking the back-propagation algorithm, thus enabling the neural network to learn the imposed input-output pattern. The severity level consists of four networks associated with the residuals; those networks are three-layer feedforward networks corresponding to the three severity levels. Their algorithms have been validated on nonlinear simulations of the SSME for two failed oxidizer valve scenarios and appear to correctly identify both the fault types and their severity even on severity scenarios not included in the training set.

Another method is proposed in [START_REF] Zhang | Liquid-propellant rocket engine health-monitoring techniques[END_REF], see 2.3. The System for Anomaly and Failure Detection (SAFD) developed for SSME ground test is used for fault detection during the main-stage operation. Instead of using a classical redline method, the average value of 23 parameters selected for monitoring is calculated in a statistical window, and compared to thresholds. A shutdown command will be given if the average parameters of any four sensors exceed their threshold during engine operation. This method is reported to be better than redlines.

An HMS was proposed to enhance the monitoring of SSME and consists in three detection algorithms, ARMA, RESID and Cluster used in the first level to process sensor data in parallel.

Then to improve the flexibility, operability and availability of reusable propulsion systems, an Intelligent Control System (ICS) is used. It synthetizes FDD and multivariable control techniques.

The engine operation parameters are then: the thrust, mixture ratio, turbo-pump rotation speed, and high-pressure turbine temperatures. Even if sensor techniques appear to be the basis of HMS, because algorithms depend on data from them and dedicated sensors can be used for the direct health evaluation of engine components; it is not reliable because the possibility of sensor anomaly is sometimes much higher than that of the engine components. Hence, for FDD they use three different methods:

• Model-based methods with ARMA algorithm or higher-order state space model by means of estimation or parameter identification.

• Pattern recognition-based diagnosis for the monitoring; ANN with for example radial basis function classifier networks to predict element concentration and combustion temperature in a plume spectrum.

• Expert systems algorithms which apply human experts' experience to the detection and diagnosis of rocket engines. few measurement parameters, resulting in difficulties for parameter estimation, they explain that experience in fault analysis indicates that the engine faults are always caused by one or two faulty components. Then FDD may be adopted using the inference procedure of fault hypothesis.

They diagnosed 25 categories of simulated engine faults out of five measurements parameters and a correct diagnosis is obtained. However, with this method, oxidizer pump faults, fuel pump faults, and turbine faults in the engine cannot be isolated using the five measurement parameters used here.

They also discuss the use of FDI based on Fuzzy Hypersphere Neural Network (FHNN).

The In [START_REF] Tulpule | Health monitoring system for the SSME-Fault detection algorithms[END_REF], they present the SSME database, test stand and analytical models to develop a HMS.

The primary goal of the SSME HMS is to detect engine failures as early as possible to minimize damage, see 2.4. • The Power Balance Model (PBM) models the SSME with a set of nonlinear equations and calculates the engine steady-state power balance through iterative techniques. The governing equations are focused upon a conservation of energy approach. The model progresses step by step through SSME sections and iterates parameters until pressures, temperatures, and flowrates for the section assembly are continuous: the energy available, based upon these parameters, is equal to the energy required by the assembly. It provides steady state "design point" values for SSME operation from minimum power level of 50% rated thrust to full power level of 109% rated thrust, and at mixture ratios from 5.8 to 6.2.

• The Digital Transient Model (DTM) simulates the SSME through startup, mainstage and shutdown operations. The model partitions the engine into a set of subsystems of component processes. These process elements are modeled with collections of equations which describe both the static and dynamic physical processes which occur in the engine subsystems. The DTM does not, however, model low frequency effects at a steady power level.

• A data-driven approach to the algorithm development process was chosen due to inadequately defined fault characteristics which precluded the definition of precise analytical models of failure modes. The lack of analytical programs for fault modeling, and the availability of a large SSME database of nominal and failure data also contributed to the decision to use empirical methods.

The SSME analytical models were mainly used to generate "design point" values for the engine parameters during nominal operation.

The HMS failure detection algorithms developed by the United Technologies Corporation successfully cover all modes of SSME operation. A nonlinear regression algorithm (RESID), which exploits the nonlinear relationships between engine parameters, was used to detect fail-

ures during the open-loop startup and shutdown modes. FD during SSME mainstage operation was covered by both time series analysis and cluster analysis. The time series ARMA models use the behavior of past data to predict the behavior of future data and can detect rapid or oscillatory failures during mainstage. Cluster analysis utilizes the pattern of differences between measured and design point data to detect gradual, slow trend failures as well as rapid failures.

The UTC failure detection algorithms were run on test data from a total of 16 failure incidences and two nominal tests. The individual algorithms, when used with a complete sensor set, had no false alarms when tested on nominal data. For each test, the UTC HMS algorithm detection times are compared to those from SAFD and redline cutoff. The failure detection times were earlier than the redline cutoff times except in cases of structural failures, where there were no prior indications. In most cases, the failures were detected early enough to allow for a normal engine shutdown.

In [START_REF] Nie | Liquid-propellant rocket engine online health condition monitoring base on multi-algorithm parallel integrated decision-making[END_REF], to overcome the false alarm problem they present the Multi-algorithms Parallel Integrated Decision-making (MPID) framework model for LPRE systems in order to obtain consistent and useful detection results, considering the prior information of detection algorithms (for example the possibility of missed alarms and false alarms), see Table 2.5. • Data are sent to different detection algorithms which make a decision: normal or faulty, taking the value 0 or 1.

• Global judgment based on the received decision set containing all the previous decisions (first theorem): develop Bayesian hypothesis testing to minimize the risk / cost of integrated decision-making. For that they consider that the cost of deciding and the prior probability of the hypothesis are known to minimize Bayes' risk function assuming that the costs are known and that the detection algorithms are preassigned.

• Perform the computation feasibly and easiness (second theorem): use the prior probability of every detection algorithm by determining a judgment threshold and the algorithms weighting representing the influence of the different detection algorithms in the judgment method (a larger weighting equates to better performance of the algorithm).

For the judgment threshold selection, normally the Bayes' risk cost is given by engineering experience and correct judgment incurs no cost. When the risk cost ratio is a fixed value, they show that when the system is reliable, the cost of false alarms is enormous; in order to reduce the cost of false alarms, a large judgment threshold can be set. When the fault probability of the system is large, a low judgment threshold can be set so as to reduce the cost of missed alarms.

Then, they discuss the determination of judgment time, earlier or later judgment times (start of judgment method) may have different sets so the result of MPID may be limited. In order to obtain more useful detection information, after the first alarm emerges some amount of time is proposed to be allowed to elapse before starting the judgment method that is called lag time and is set according to historical information for the detection algorithms. The proposed method is the following: if a first alarm appears, start timing, and set the judgment lag time and start time, otherwise continue and record the increase of time after start; if the lag time is too high start again otherwise count the result of every detection algorithm, obtain the value of the set decision and proceed to MPDI result judgment and apply alarm rule.

They validated their method on 229 ground testing data with 26 faulty tests. To analyze the capabilities of the MPID judgment method they compare it to the voting method assuming that the cost of a missed alarm is bigger than the cost of a false alarm (ground testing). In the voting method, each detection algorithm has the same influence. In some situations this method can be useless as only one algorithm has better historical performance. In contrast, the proposed method gives accurate results which show that it can integrate information from the different algorithms effectively and give reliable detection of the LPRE condition. Owing the fact that the judgment foundation of the vote method is based on minorities submitting to majorities, when the error results are the more correct ones the global judgment is wrong.

Hence, when some process history is available, diagnosis can be viewed as a pattern recognition task where newly acquired measurements are to be classified in predetermined modes. Prior knowledge takes the form of a database comprising observations of the monitored variables, which may be state variables or data parameters. First, two offline operations have to be carried out: the data are clustered into classes and a decision rule is trained. Classes are thus defined and each vector of the database is assigned to one of them. For diagnosis, the modes to be considered are the healthy one and all of the possible faulty ones. If the database contains only non-faulty measurements, another solution is to perform one-class classification, although this will not make fault isolation practicable. Once the training data have been labelled, a decision rule must be chosen and trained to classify new vectors in the proper classes.

Other methods have been introduced in [START_REF] Schwabacher | Unsupervised anomaly detection for liquid-fueled rocket propulsion health monitoring[END_REF], they first present anomaly detection algorithms whose aim is to find portions of the data set that are somehow different from the rest of the data set, see • GritBot [START_REF] Schwabacher | A survey of data-driven prognostics[END_REF] searches for subsets of the data set in which an anomaly is apparent. Like Orca, GritBot assumes that the training data could contain a small number of anomalies, and can be used to find anomalies in the training data.

• Inductive Monitoring System (IMS) [START_REF] David L Iverson | Inductive system health monitoring[END_REF] is similar to Orca in that it is distance-based, it uses Euclidean distance as its distance metric. However, unlike Orca, it does not explicitly support discrete variables, so they did not include any discrete variables in their experiments with IMS. The major difference between Orca and IMS is that during the training step, IMS clusters the nominal training data into clusters representing different modes of the system. Each cluster is represented using the smallest bounding hyperbox containing the points in the cluster. At run time, it uses the distance to the bounding hyperbox of the nearest cluster as an anomaly measure. It assumes that all of the training data are guaranteed to be nominal, and will always return zero as the anomaly score when tested, since all of them are within the bounding hyperboxes found in the training data.

It was also used to detect anomalies in data from the International Space Station (ISS)

and in data from an electrical power system testbed, and in the past was used to detect anomalies in data from sensors on the leading edges of the Space Shuttle's wings.

• One-class SVM [START_REF] Johan | Least squares support vector machine classifiers[END_REF] One-class SVMs first map the training data from the original data space into a much higher-dimensional or possibly infinite-dimensional feature space and then find a linear model (hyperplane) in that feature space that allows almost all the normal data to be on one side (and to be separate from abnormal training data if available).

They have approximately 90 sensors and many of them are redundant for reliability reasons for the SSME monitoring. The rocket engine test stand used to test algorithms and generate data, provides a structure strong enough to hold a rocket engine in place as it is fired and a fuel feed system to provide fuel to the engine. A smaller test stand is used for a variety of integrated systems health management technologies and experimental rocket engines. In their tests, the four algorithms successfully detected one major system failure, and several sensor failures.

They also detected some other anomalies that were not considered to be failures.

Synthesis

Data-based methods rely on physical system data in order to obtain data-driven or empirical models to perform FDI by determining which variables are related causally or not. Causal models are not always useful for monitoring but are essential for active applications such as control and optimization. Those methods can be classified as statistical and qualitative methods.

Statistical methods make use of projections and dimension reduction techniques to produce a lower-dimensional representation while preserving the correlation structure between the process variables to be able to determine signatures and proceed to data analysis. Nevertheless, those methods are limited if the data involve uncertain, conflicting, and non-quantifiable information.

For those reasons, these methods are coupled with qualitative methods making use of expert systems, neural network, fuzzy logic, etc. The aim of those methods is to extract patterns from the historical data of a physical system from expert experiences, machine learning or approximations classification techniques. Although these methods can be useful in some cases, even with process data, they do not provide unique models, nor allow for interpretation, nor provide any form of causality. They also have limited ability to handle missing data or test for outliers in new data. Since performance of the expert system is highly dependent on the correctness and completeness of the information stored in the knowledge base, updates to the knowledge base is necessary if the industrial process changes.

Data-based methods for HMSRE initially relied on expert systems, pattern recognition and the direct exploitation of historical data however those methods were not robust to a wide range of faults, noise and were difficult to use during transients. For those reasons more advanced methods were used as neural networks, Fuzzy logic, etc. These ones made it possible to classify failures and to perform health monitoring in the case of new failures. However, it appeared that those methods had to be couple with model-based methods to improve the robustness to noise, perturbations and overcome the lack of information. The first reason is that neural networks for example have to be trained on test sets, but it might be complicated to obtain enough significant information. The other reason is the use of redlines which may induce false alarms and limits the HMS performances.

Due to those limitations, model-based methods are considered in this work for the development of LPREs HMS.

Model-based methods -Analytic symptoms

Model-based fault diagnosis was originated by Beard in 1971 [START_REF] Beard | Fault accommodation in linear systems through self-reorganization[END_REF] in order to replace hardware redundancy by analytical redundancy [START_REF] Gertler | Analytical redundancy methods in fault detection and isolation-survey and synthesis[END_REF], [START_REF] Staroswiecki | Analytical redundancy relations for fault detection and isolation in algebraic dynamic systems[END_REF], [START_REF] Didier Maquin | Generation of analytical redundancy relations for FDI purposes[END_REF]: the use of two or more, but not necessarily identical, ways to determine a variable, where one way uses mathematical process model in analytic form [START_REF] Isermann | Model-based fault-detection and diagnosis -Status and applications[END_REF], [START_REF] Gertler | Survey of model-based failure detection and isolation in complex plants[END_REF], [START_REF] Chow | Analytical redundancy and the design of robust failure detection systems[END_REF], [START_REF] Martin L Leuschen | Fault residual generation via nonlinear analytical redundancy[END_REF]. The models of the physical systems are required to be available, which can be obtained by using either physical principles (quantitative) or system identification techniques (qualitative) [START_REF] Steven X Ding | Model-based fault diagnosis techniques: Design schemes, algorithms, and tools[END_REF]. FD algorithms are then developed to monitor the consistency between the measured outputs of the practical systems and the model-predicted outputs. Model-based fault diagnosis methods can be declined into four categories following the types of the models used [START_REF] Isermann | Trends in the application of model-based fault detection and diagnosis of technical processes[END_REF]:

• deterministic fault diagnosis methods,

• stochastic fault diagnosis methods,

• fault diagnosis for discrete-events and hybrid systems,

• fault diagnosis for networked and distributed systems.

However, a perfectly accurate and complete mathematical model of a physical system is never available. The parameters of the system may vary with time in an uncertain manner, and most of the time, characteristics of the disturbances and noise are unknown so they cannot be modeled accurately. Hence, there is always a mismatch between the actual process and its mathematical model even if there are no process faults. To overcome those difficulties, the notion of robustness has been introduced [START_REF] Paul | Survey of robust residual generation and evaluation methods in observer-based fault detection systems[END_REF], [START_REF] Paul | Enhancement of robustness in observer-based fault detection[END_REF].

It is also interesting to note two underlying differences between the stochastic fault diagnosis methods and the deterministic fault diagnosis methods. The former enables the modern mathematics to more closely characterize physical situations being treated; the latter tremendously broadens the range of problems which may be studied.

From the practical viewpoint, to pursue a complete model-based fault diagnosis the following three steps have to be realised, see Figure 2.2:

• Residual generation: generation of the signals that reflect the fault. Typically, the residual is defined as a difference between the outputs of the system and its estimate obtained with the mathematical model;

• Residual evaluation: logical decision making on the time of occurrence and the location of faults;

• Fault identification: determination of the type of a fault, its size and cause.

Residual generation methods

Residual generation for FDI is a development of the traditional limit checking method. The check threshold have to be set quite conservatively since the system variables may vary widely. The residuals generated have to be independent of the system operating state. The generation of residuals reflecting the faults can be done by estimating outputs or parameters of the process and using the estimation error as residuals [START_REF] Frank | Nonlinear observers for fault detection and isolation[END_REF]. The different methods for residual generation can then be classified as state estimation, parameter estimation, simultaneous state and parameter estimation and parity space methods (see Figure 2.1).

Parameter estimation methods

For the FD task, a parameter estimation approach which makes use of the fact that component faults of a dynamic system are reflected in the physical parameters can be used [START_REF] Simani | Model-based Fault Diagnosis using Identification Techniques[END_REF]. In this approach, a reference model is obtained by identifying the system in a fault free situation. In most practical cases the process parameters are partially not known or not known at all. Then, they can be determined with parameter estimation methods by measuring input and output signals using the basic model structure. FD via parameter estimation relies in the principle that possible faults in the monitored system can be associated with specific parameters and states of the mathematical model of the system given in the form of an input-output relation. For this purpose, the parameters are repeatedly re-identified online. Deviations from the reference model serves as a basis for detection and isolation of different faults.

One of the first methods was the Least-Squares (LS) method, where parameters were estimated by minimizing a loss function of the terms affecting the process. This method can be improved in term of performances using Recursive LS (RLS) and forgetting factors. Those methods may be more reliable [START_REF] Bilal | Parameter Estimation Based Fault Diagnosis in Dynamic Systems[END_REF], but they are demanding in terms of online computation and input excitation requirements. Different other techniques of recursive identification be used see [START_REF] Id Landau | Techniques de modélisation récursive pour l'analyse spectrale paramétrique adaptative[END_REF], most of them have been developed for the identification of input-output models of physical systems to be controlled in the case of unknown or time varying parameters. The ARMA model [START_REF] Astrom | Uniqueness of the maximum likelihood estimates of the parameters of an ARMA model[END_REF] is one example. With this type of model, if the parameters are unknown or slowly time-varying they can be adjusted in an adaptive way. Those methods were mainly used due to their low computational burden, their fastness, and the simplicity of the representation.

For the adaptive prediction, different structures exist. The serial parallel structure (recursive or extended least mean squares, maximum likelihood) which are based on the minimization of an error criterion leading to an innovation sequence and the parallel structure based on adaptive system principles with reference models (extended estimation, output error with fixed or adjustable compensator) using the orthogonality principle between the optimal estimation and the predicted error.

However, the generation of residuals by estimating parameters of the process is not always representative of the system health. If process faults are indicated by internal, non-measurable process state variables, attempts can be made to reconstruct / estimate these state variables from the measurable signals by using a known process model or to use analytical redundancy relations.

Parity space-based approaches

The isolation problem is usually addressed through directional residuals designed with deterministic rejection (decoupling) methods. One of the basic statistical approach to residual generation for isolation purposes consists in using parity space approaches.

A parity space is a space in which all elements are residuals. The relation which generates the residual is called a parity relation. The task of FDI is then to construct a parity space and analyse its elements. Parity relations use direct analytical redundancy [START_REF] Gertler | Analytical redundancy methods in fault detection and isolation-survey and synthesis[END_REF] with the help of algebraic static relations linking different signals or temporal redundancy from dynamics relations. For those structures, the number of measurements is higher than the number of variables and residuals are directly obtained from redundancy. They are designed in order to enhance fault isolation with the help of a projection matrix, so that they exhibit directional or structural properties in response to particular faults, parametric or additives. The designed residuals can either be diagonal (for multiple simultaneous faults), directional (for simultaneous faults if the response directions are independent), or structured (not for simultaneous faults but unlimited number of faults) depending on the design of the projection matrix. This matrix can also be designed in order to enhance the response dynamics with respect to different constraints (fast fault detection, suppression of noise and / or ease of computation).

Different approaches for residual generation were proposed in [START_REF] Gertler | Fault detection and isolation using parity relations[END_REF], where a first approach for linear discrete-time systems described by transfer functions for additive faults and parametric faults is introduced. This approach presents in different cases how to build a residual generator.

They also study the response specification to enhance the fault isolation and facilitate the fast detection of faults for different residuals: diagonal, directional and structured. Then they discussed the residual decoupling from specific disturbances. Usually, the model of the monitored plant needs to be obtained by identification before parity relations may be designed. One possible strategy is to identify a base set of model equations and then compute the parity relations by algebraic transformations, as described in this paper. Alternatively, but only if structured parity relations are designed for sensor and actuator faults, all the "transformed" relations may be obtained by directly identifying the underlying model equations in the selected structures.

In [START_REF] Ding | A characterization of parity space and its application to robust fault detection[END_REF], they established a relation between the order of the parity relation and the dimension of the parity space for linear discrete-time systems with unknown disturbances and additive faults to characterize the vectors belonging to the parity space and to study the robustness problem. They consider the parity relation-based FD approach using temporal redundancy. For that they consider the system under its canonical form to determine the minimum order of the parity relations which is given by the minimum observability index. The size of the parity space is expressed explicitly as a function of the rank of the observability matrix. They established the explicit link between the observability and the parity space dimension and proposed an algorithm to determine the parity vector in order to optimize the robustness of the parity space approach so that it will reduce to an eigenvalue-eigenvector problem. They showed that increasing the order of parity space relations improves the system robustness. The response specifications must be chosen so that the residuals support the isolation of faults and suppression of disturbances.

Moreover, the response dynamics must facilitate the fast detection of faults or the suppression of noise. While the enhancement schemes apply to both additive and parametric faults, generators designed for the latter have no dynamics. Parity space approaches are then proved to have the same properties as observers [START_REF] Christophe | Link between high gain observer-based residual and parity space one[END_REF], [START_REF] Christophe | Link between high-gain observerbased and parity space residuals for FDI[END_REF], [START_REF] Cocquempot | On the equivalence between observerbased and parity space approaches for FDI in non-linear systems[END_REF]. This approach is especially attractive when the model is nonlinear; identification may then be performed according to the particular model configuration and no nonlinear algebraic transformation is necessary.

In [START_REF] Martin L Leuschen | Fault residual generation via nonlinear analytical redundancy[END_REF] Leuschen, Walker, and Cavallaro introduced the notion of analytical redundancy exploiting the notion of observability: the key information which can be learned about the modelbased behavior of a system can be inferred from the observation space. The Auto-Regressive (AR) residuals are guaranteed both to be linearly independent and to test for all detectable deviations from the system model. They show that the Nonlinear AR (NLAR) residuals maintain the linear AR guarantees that the residuals will span the entire observable fault space and will do so with the minimal number of residuals. They consider an affine linear state space control system model with modeling error and system disturbances, fault signals, sensor noise. The considered systems have to be smooth because nonlinear systems theory includes the notion of local observability. The sampling rate has to be high which is not restrictive in the case of analytical redundancy. The developed NLAR technique uses the Isidori formulation of nonlinear observability [START_REF] Isidori | The observability of cascade connected nonlinear systems[END_REF]. The system is assumed to be locally observable in order to calculate the Lie derivative of the scalar function. Then they explain how to determine the null-spaces required by the AR equation. Only deriving the function in order to follow the linear AR method as closely as possible may not directly lead to any useful AR relations. For that, they developed a novel grouped formulation summing the elements of the observation matrix that are Lie differentiated to the same degree. This leads to the canonical AR equation, then they reformulate this canonical observability matrix in terms of control inputs and sensor readings to complete the NLAR parity equation. They assume that the sensor function is linear and that there is a single input. Since many of the terms contain explicit references to the state, this method requires that the system is observable. To determine the minimal set of residuals, they show that the number of residuals to be retained correspond to the sum of the observation spaces for each sensor. Then NLAR residuals that are not independent will be generated, eliminating those redundant equations from valid NLAR is said to be trivial. The full algorithm is then summarized and an application to direct drive motor is given. They showed the improvement in performance generated by the approach compared with the traditional linear AR approach. The introduced NLAR approach is valid for the physically significant class of affine nonlinear systems and is shown to be a generalization of the classical linear AR approach. However, due to the repeated derivatives, the introduced NLAR approach is best suited to nonlinear systems that are well-modeled and relatively noiseless, with clean sensor data.

Observer and filter-based methods

In the field of quantitative model-based methods, the observer-based and filter-based approaches are in fact mainly used [START_REF] Zhang | An integrated trade-off design of observer based fault detection systems[END_REF], [START_REF] Rajamani | Observer design for nonlinear systems: stability and convergence[END_REF]. Observers play a key role in model-based fault diagnosis for monitored systems / processes characterized by deterministic models [START_REF] Ciccarella | A Luenberger-like observer for nonlinear systems[END_REF], [START_REF] Krishnaswami | A survey of observer based residual generation for FDI[END_REF], [START_REF] Garcia | Deterministic nonlinear observer-based approaches to fault diagnosis: A survey[END_REF] with the advantage of the flexibility in the choice of the gain matrix leading to a wide range of different structures for FDI purposes. As for filter-based approaches for stochastic systems, they were developed starting in the early 1970's, faults were then diagnosed by the means of an estimator, based on statistical testing on whiteness, mean and covariance of residuals [START_REF] Frank | Current developments in the theory of FDI[END_REF]. In observer and filter based methods, the feedback gain is important to compensate for differences in the initial conditions, provide overall stabilization of a closed-loop system, and to provide freedom for the design of the observer.

General procedures for FDI using innovations (or residuals) generated by a Kalman Filter (KF) have then started to be developed. This filter is said to be an optimal estimator in the case on linear systems. An optimal estimator is defined as a computational algorithm that processes measurement to deduce a minimum error estimate of the state of a system by utilizing knowledge of system and measurement dynamics, assumed statistics of system noises and measurement errors, and initial condition information. Then Luenberger [START_REF] Luenberger | Observers for multivariable systems[END_REF] introduced the general theory of observers for deterministic linear systems. How the available system inputs and outputs may be used to construct an estimate of the system state vector has been shown.

The device which reconstructs the state vector is called an observer. The observer is defined as a time-invariant linear system driven by the inputs and outputs of the system it observes. The observer model of the physical system is then typically derived from the system state dynamics equations. Additional terms may be included in order to ensure that, on receiving successive measured values of the system's inputs and outputs, the model's state converges to that of the system. In particular, the output of the observer may be subtracted from the output of the plant and then multiplied by a matrix gain; this is then added to the equations for the state of the observer to produce a Luenberger observer.

For real-time applications, most models of processes are assumed to be linear or are linearized state-space models. In [START_REF] Welch | An introduction to the Kalman filter[END_REF] the KF theory was introduced. The aim of this filter is to obtain an a-priori state estimate of the observation by minimizing the estimate error covariance

[112], [START_REF] Gelb | Applied optimal estimation[END_REF]. The covariance is a measure of the joint variability of two random variables. The sign of the covariance shows the tendency in the linear relationship between the variables. For Gaussian uncorrelated white noises only, the variances are considered. They correspond to the expectation of the squared deviation of a random variable from its mean: the estimator is consistent if the estimate it constructs is guaranteed to converge to the true state value as the quantity of data to which it is applied increases. The Kalman gain obtained to satisfy such conditions appears to depend on the measurement error covariance. This filter is based on the Bayes' rule and maintains the first two moments of the state distribution (the mean and the variance). Bayes' theorem then links the degree of belief in a proposition, the predicted state, before and after accounting for evidence, the state measurement. This filter estimates the process state at some time and then obtains feedback in the form of noisy measurements. The two steps are the state prediction equations and the measurement update equations. The first one corresponds to a projection forward to obtain a-priori estimates; the second one corresponds to the incorporation of a new measurement into the a-priori estimate to obtain an improved a-posteriori estimate. They are the prediction and correction steps. The KF uses a complete description of the probability distribution of its estimation errors in determining the optimal filtering gains, and this probability distribution may be used in assessing its performance as a function of the "design parameters" of an estimation system, such as the measurement error and the process noise covariance matrices or the date sampling rates. Those parameters can be tuned offline which is practical for validations.

Some process analysis combines the state estimation and parameter estimation by using mathematical process models together with parameter estimation [START_REF] Kravaris | Advances and selected recent developments in state and parameter estimation[END_REF]. KFs can be used for both state and parameter estimation, for example with the consideration of an augmented state including state and parameter. Adaptive filters have also been developed in order to estimate at the same time the state and unknown parameters. In [START_REF] Zhang | Adaptive observer for multiple-input-multiple-output (MIMO) linear timevarying systems[END_REF], the problem of the joint estimation of the state and unknown parameters is considered. A natural idea for this purpose is to consider an extended system depending on them. The extended system remains in this case linear; hence, a KF can be used. However, it is not easy to guarantee the convergence of the filter since the system is time varying. It is complicated to ensure the uniform complete observability because the extended system should take into account a persistent excitation condition. Instead of that, the proposed a method is based on the stabilizability of the system and on some persistent excitation condition for adaptive control or FDI purposes. The state dynamics depends on two exogenous excitation terms, one depending on input and output measures, the other depending on the unknown parameter. The "classical" (input and output measures) part is easily estimated with an usual observer. The second observer used for the other part depends on the unknown parameter estimate and an extra term is added in order to compensate the estimation error of this parameter. They assume that the estimate of the state part depending on the unknown parameter is a linear function of the parameter estimate using a time-varying matrix. Then they propose a theorem and lemmas to design a global exponential adaptive observer for the considered system. To calculate the gain, if the system is uniformly completely observable, the Kalman gain can be used. In other cases, one way is to check the boundness (triangular form or Gramian matrix calculation), otherwise, if the system is slowly varying or even time-invariant then the detectability is enough. The matrix weighting the influence of different output components can be chosen as the inverse of the covariance matrix of the output noises or as a positive diagonal matrix. The matrix compensating the scale of the weighting matrix is chosen to be positive diagonal to balance the convergence speeds of the state and parameter estimation or it can be designed by a LS algorithm with exponential forgetting factor. The global convergence of the algorithm guarantees that, for any initial condition, the errors of state and parameter estimation converge to zero. Therefore, in principle, the initialization of the algorithm can be arbitrary. However, in order to reduce the transient time, prior knowledge on the values of the state and the parameter, if available, should be used in the initialization. Then considering a noise corrupted system assumed to be bounded, zero means and independent of the distribution matrices, they gave an exponential convergence condition. The global exponential convergence is established for noise-free systems. In the presence of noises, it is proved that the estimation errors are bounded and converge in the mean to zero if the noises are bounded and have zero means. Those residual generation methods based on extended system observers and adaptive observers are mainly efficient to estimate states and slow time-varying parameters. For the estimation of unknown parameters, another solution is to use UIO.

Many works have been conducted to design observers which are able to reconstruct the state of the system which is excited by several unknown inputs. First methods assumed that a-priori information on non-measurable inputs is available. The second ones imply the estimation or elimination of unknown inputs. The UIO designed as initially proposed by Viswanadham and Srichander in 1987 [START_REF] Nukala | Fault detection using unknown input observers[END_REF] and Hou and Muller in 1992 [START_REF] Hou | Fault detection and isolation observers[END_REF], [START_REF] Hou | Optimal filtering for systems with unknown inputs[END_REF], consists in transforming the system equations, such that the state vector can be divided into two parts: a part that can be directly obtained from the measurements, and another part consisting of the states that have to be estimated. In [START_REF] Darouach | Full-order observers for linear systems with unknown inputs[END_REF] the design of a full order UIO considering a linear time-invariant system is proposed. The design matrices of the observer and the gain matrix are determined in order to ensure the asymptotic convergence of the state estimate and stabilize the full-order observer system [START_REF] Chen | Design of unknown input observers and robust fault detection filters[END_REF]. They give necessary conditions for the existence of the observer by generalizing the previous works to give a simple design procedure for full order unknown input observers with system observability conditions and stabilization conditions. Nevertheless, this method only works for full order systems.

For reduced-order systems, Zhu proposed for example in [START_REF] Zhu | State estimation and unknown input reconstruction via both reduced-order and high-order sliding mode observers[END_REF] a reduced-order observer with auxiliary outputs for minimum phase systems with bounded state, unknown input and their derivatives as in [START_REF] Koenig | Design of a class of reduced order unknown inputs nonlinear observer for fault diagnosis[END_REF]. The unknown input is assumed to be a continuous function of time. It was shown that the invariant zeros of the original system and those of the system with the auxiliary output are identical. It was also shown that if the system respects a Lyapunov type equation then the Smith orthogonal projection of this system holds the same properties and the observer dynamics can be expressed in this new space so that it would not depend on the unknown input but on the auxiliary output vector. To estimate the auxiliary output vector and its derivative a high-order sliding mode observer was designed from the output and its successive derivatives.

The unknown input reconstruction method considered in this work is based on the estimates of the states and some derivatives of the auxiliary outputs. Then a reduced order observer was designed for linear time invariant with minimum phase systems with unknown inputs based on an auxiliary output vector in the case where the observer matching conditions are not satisfied.

Also, they designed a reduced order observer to estimate the auxiliary output vector and its successive derivatives for state estimation and unknown input reconstruction purposes. This method assumes that the system is linear time invariant minimum phase, the system and its inverse have to be causal and stable which may not be the case for most physical systems.

Hence, other works have developed the use of UIO for nonlinear systems such as [START_REF] Zarei | Robust sensor fault detection based on nonlinear unknown input observer[END_REF], [START_REF] Witczak | Design of an extended unknown input observer with stochastic robustness techniques and evolutionary algorithms[END_REF].

When the model is nonlinear, one can proceed to a linearization around a steady-state trajectory to obtain new governing equations, applied to the KF this method has been introduced as the Extended Kalman Filter (EKF). The distribution matrices correspond to the Jacobian matrices of partial derivatives of the nonlinear function with respect to its different variables. The basic operations are the same as the linear discrete KF [START_REF] Simon | New extension of the Kalman filter to nonlinear systems[END_REF]. The recursive definition of the KF or EKF makes them well adapted to practical implementation compared to the Wiener filter [START_REF] Zolghadri | An algorithm for real-time failure detection in Kalman filters[END_REF]. Although the KF was originally derived for linear problems, the KF has also been applied to many nonlinear problems using its extended version. However, this assumes that errors are small so that one can use an approximation of the system dynamics with Taylor series.

Those approximations are only of first order and can induce a lack of accuracy in the transients since most of complex physical systems have a nonlinear dynamic. It can be clearly seen that the use of Kalman filtering-based methods requires an accurate modeling of the physical systems. However, model-based methods have to take into account limited variations of the model parameters (modeling errors or nonlinearities), non-measurable system variables or faults [START_REF] Patton | Observer-based fault detection and isolation: Robustness and applications[END_REF], [START_REF] Paul | Survey of robust residual generation and evaluation methods in observer-based fault detection systems[END_REF], [START_REF] Trinh | Disturbance decoupled observers for systems with unknown inputs[END_REF]. Those ones can be represented under the form of unknown inputs [START_REF] Gaddouna | Fault detection observers for systems with unknown inputs[END_REF]. It might then be interesting to estimate at each moment their values [START_REF] Edwards | A comparison of sliding mode and unknown input observers for fault reconstruction[END_REF], [START_REF] Zhu | State estimation and unknown input reconstruction via both reduced-order and high-order sliding mode observers[END_REF]. Then, to solve the robust FDI problem, a robust sensor detection method using UIO has been introduced.

In [START_REF] Patton | Observer-based fault detection and isolation: Robustness and applications[END_REF], an observer-based approach for continuous-time and linear model-based fault diagnosis is introduced. They synthesized the basic properties of model-based FDI and proposed a generalized representation of all residual generators in which the residual is generated based on the information provided by the system input and output signals. They presented a fault detectability condition and introduced the fault isolability / residual set isolability property. If each residual is designed to be sensitive to a subset of faults, then a structured residual set is designed. Another proposed solution is to design a fault-specified direction (or subspace) in the residual space. To estimate the outputs of the system from the measurements they proposed a

Luenberger observer [START_REF] Luenberger | Observers for multivariable systems[END_REF] in a deterministic setting. The problem of robustness in FDI has been described and they discussed a way to deal with robustness in frequency and time domains for linear systems with unknown inputs and modeling errors. They introduced the essential differences between various methods such as disturbance decoupling, passive / adaptive threshold for optimizing robustness based on whether the uncertainty can be considered as structured or unstructured. They also proposed an approach to deal with the observer design for a class of systems with additive unknown disturbances. To achieve the disturbance decoupling for robust FDI they proposed the use of an UIO or an eigen structure assignment as in [START_REF] Patton | On eigenstructure assignment for robust fault diagnosis[END_REF]. Their work gives a generalized representation of a residual generator for continuous-time or discrete-time systems and a condition to ensure the fault detectability in the residual design. The proposed observer allows describing the residual so that it depends solely and totally on faults. They proposed a condition which allows knowing if a perfect (accurate) decoupling is achievable or not and demonstrate that if a system's dynamic structure and nonlinearity are not well known then an approximate uncertainty decoupling strategy must be used. For the UIO they showed that the maximum number of disturbances which can be decoupled cannot be larger than the number of independent measurements. When it is not necessary to ensure that the state estimates is insensitive to disturbances an eigen structure assignment approach can be used and it is formally equivalent to an UIO for the design of robust residuals except that it employs fewer design constraints. Nevertheless, considering a linearized system around an operating point transformed into an equivalent one where the nonlinearities are considered to be an unknown input can imply a difficulty to decouple faults dynamics from nonlinearities [START_REF] Frank | Nonlinear observers for fault detection and isolation[END_REF]. For this reasons, residual generation methods for nonlinear systems have been developed.

Most of the time, the monitored system has a nonlinear dynamic. If the residual generator is based on a model linearized around an operating point, then, when the system state is shifted away from this nominal operating point, important shifts can be observed due to this approximation. To generate robust residuals in this case, it is necessary to use a nonlinear model with a better system description. However, the developed methods are quite complex and can only be used in the case of particular nonlinearities. In [START_REF] Simon | New extension of the Kalman filter to nonlinear systems[END_REF], they consider a discretetime nonlinear system with measurements and process modeled as additive Gaussian and uncorrelated white noises and seek a state estimator. The state estimate is a probability distribution conditioned on all prior observations and control inputs, expressing the one step ahead predictions of the state estimation and its covariance. The equations are then updated with the innovation corresponding to the estimation error and a Kalman gain. For nonlinear systems two methods have been compared, the EKF corresponding to the nonlinear model linearization and the Unscented Kalman Filter (UKF) using an unscented transform [START_REF] Eric | The unscented Kalman filter for nonlinear estimation[END_REF]. The first method is however suboptimal for nonlinear systems because it assumes that the errors in truncating the Taylor series to the first order are small and is adjusted to compensate for linearization error. Hence, they introduce a general method for predicting mean and covariance. This method aims at finding a parametrization which captures the mean and covariance information while at the same time permitting the direct propagation of the information through an arbitrary set of nonlinear equations. For that they want to generate a discrete distribution having the same first and second (and possibly higher) moments, where each point in the discrete approximation can be directly transformed. For a n-dimensional Gaussian distribution they generate a set of n points having the same sample covariance of mean the state mean. Then those points are propagated with the nonlinear transformation. Rather than projecting the mean and covariance through separate equations, the covariance ellipse is approximated by a discrete set of points.

This second method is more efficient than the EKF because it is not necessary to make approximations of the model. A new filter is then introduced with this method, the noise can be injected in a nonlinear way and not only as separate additional terms and its effects on the mean are accounted for. For that they consider an augmented state composed of the state vector and the process noise vector.

Another alternative is to use a particle filter. In [START_REF] Kwok | Real-time particle filters[END_REF] Kwok, Fox, and Meila introduced the basic idea of particle filters. Those filters are sampled-based variant of Bayes filters [START_REF] Weber | Increasing effectiveness of model-based fault diagnosis: A dynamic Bayesian network design for decision making[END_REF]; the basic form realizes the recursive Bayes filter according to a sampling procedure called Sequential Importance Sampling with Resampling (SISR) [START_REF] Sanjeev | A tutorial on particle filters for online nonlinear/non-Gaussian Bayesian tracking[END_REF]. The dynamics of the system is described using the state and previous control information. The samples are then weighted by the observation likelihood and a random state is drawned according to the discrete distribution defined through the importance weights. Each of these three steps generates a sample representing the posterior. After a number of iterations, the importance weights of the samples are normalized so that they sum up to one. Those kinds of filters assume that all the samples can be updated whenever new sensor information is available. Under real-time conditions, this is not always the case.

To overcome this, most of the filters skip sensor information during the update step of the filter. In this paper they propose a real time particle filter to deal with limited computational resources and consider all sensor measurements by distributing the samples among the observations within an update window. A virtual sample set over this window is maintained, the mixture components of this set represents the state of the system at different points in time. This method has the advantage of not skipping any observations as in [START_REF] Carpenter | Improved particle filter for nonlinear problems[END_REF]; the belief propagation is simulated with only the total number of observations divided by the number of the window samples. The weights are chosen in order to minimize the Kullback-Leibler divergence between the mixture belief and the optimal belief. The optimal belief is obtained from iterative application of the Bayes filter over the update window [START_REF] Van Der Merwe | The unscented particle filter[END_REF]. The mixture of the distributions is the weighted sum of the mixture components. With this description of the mixture, each trajectory selectively integrates only one of the window observations within the estimation interval. To optimize the mixture weights they propose to determine them by minimizing the Kullback Leibler (KL)-divergence and so a gradient descent depending on those weights. The starting point is chosen to be the center of the weight domain. To compute the gradients, they use a Monte Carlo approximation. This approach is based on the observation that the beliefs share the same trajectories through space and differ only in the observations they integrate. Then, the trajectories are grouped by determining connected regions in a grid over the state space which reduces the number of trajectories needed to get smooth gradient estimates. Their approach makes near-optimal use of sensor information by dividing sample sets between all available observations and then representing the state as a mixture of sample sets. Then they optimized the mixing weights in order to be as close to the true posterior distribution as possible. Optimization is performed efficiently by gradient descent using a Monte Carlo approximation of the gradients. However their approach can be improved considering moving window sizes in order to optimize the computational burden.

Other methods have been proposed for Lipschitz systems using the nonlinearities bound properties. In [START_REF] Schreier | Observer design for a class of non-linear systems[END_REF], they consider a nonlinear system with a linear part and constant distribution matrices. They want to supply an upper bound of the nonlinearity which guarantees the stability of the reconstruction of the system state. They propose an observer under two hypotheses, the nonlinear function is Lipschitz, and the system is observable. They study the stability of an observer with a classical innovation part and a gain depending on the solution of a Lyapunov equation with a positive parameter which is chosen under the constraint that the corresponding matrix is positive definite. Then they propose two criteria giving the upper bound of the Lipschitz constant depending on the upper and lower singular values. They show that the best Lipschitz constant is as great as possible. For that they study the observer dynamics and show that if three criteria are verified then the observer is stable. To ensure the stability of the system, they calculate the derivative of the state estimation error and prove that the quadratic Lyapunov candidate depending on this error is a Lyapunov function. They rewrite the Lyapunov equation and calculate the derivative of the Lyapunov function depending on the eigenvalue of the error distribution matrix and dominate its derivative by determining a relationship between the eigenvalues and the upper bound. Then they discuss the verification of the Lipschitz condition for polynomial nonlinearity depending on the state. They find the degree of freedom for the worst case of the Lipschitz condition. For that they expressed the nonlinear function by expanding the nonlinearity with Taylor series. They determined two upper bounds for the Lipschitz condition that they have compared to design an observer and gave the link between the bound of the modeling errors and the dynamic of the observer. This paper gives a procedure to design an observer for Lipschitz systems considering the worst case for the gain calculation. However, this method does not take into account perturbations and uncertainties which are taken into account with unknown input observers.

Residual analysis methods

For a fault-free system, the residuals are only due to unmodeled noise and disturbance (near zero), but when a fault occurs, the residuals deviate from zero in characteristic ways. Hence, once the residuals have been generated, the next step is to determine whether any fault has occurred and to determine the location or type of each fault based on statistical tests of the residuals [START_REF] Basseville | Information criteria for residual generation and fault detection and isolation[END_REF]. For all the residual generation methods, false alarms may potentially occur due to modeling errors, disturbances and noise. When residuals cannot be made robust against system uncertainty, the robust FDI can be achieved at the level of decision making [START_REF] Seliger | Robust residual evaluation by threshold selection and a performance index for nonlinear observer-based fault diagnosis[END_REF], [140].

Change detection algorithms consider a sequence of independent random variables with a given probability density depending upon one scalar parameter. This parameter changes after an unknown change time and the aim of those algorithms is to detect and estimate this change in parameter considering two hypothesis: the parameter has its initial value, the parameter value has changed. A Student's test can be used to test those hypothesis in the case of a student distribution. But since a change in the parameter is reflected as a change in the sign of the mean value of the log-likelihood ratio of the independent random variables sequence, the Kullbach information between the two models before and after change can also be used to define the detectability of change in a more general case. To test a change in a parameter, thresholding techniques are used. Those techniques can broadly be classified as constant or variable thresholds.

The simplest decision rule is to declare that a fault occurs when the instantaneous value of a residual exceeds a constant threshold [START_REF] Pukelsheim | The three sigma rule[END_REF]. The constant thresholds are designed by considering the upper bound of the unknown inputs and admissible uncertainties. An extensive study on the computation of constant thresholds in linear systems can be found in [START_REF] Neyman | The testing of statistical hypotheses in relation to probabilities a priori[END_REF], where different kinds of thresholds both under deterministic settings using signal norms of the unknown inputs and stochastic settings using statistical properties of unknown inputs, are proposed. Setting a threshold too high may result into a missed-detection, which means that a set of faults may remain undetected. Similarly, selecting a threshold too low may lead to false alarms. The authors of [START_REF] Emami-Naeini | Effect of model uncertainty on failure detection: The threshold selector[END_REF] addressed the problem of finding the optimal threshold to be used in innovations-based failure detection algorithms as well as computing the size of minimum detectable failures. The detection filter used is a constant gain KF. A technique is developed to evaluate the effect of model uncertainty on the ability to detect sensor failures with five assumptions:

• the noise and model uncertainty are bounded,

• the detection strategy is based on innovations from an estimator,

• the reference input signal (known completely) and the failure (class given) signal are both polynomials in time,

• the reference signal excites the system at the start of the detection window,

• the relative time of the occurrence of the reference and failure signals is unknown.

They evaluate the effect of model uncertainty on the ability to detect a failure. The threshold selector is defined as an inequality which provides an upper bound on the threshold to find the threshold failure set. They estimate the size of minimum detectable failure. They consider an innovation approach which is representative of the following two situations: nominal system or a reconfigured system. The threshold is defined from a measure of the innovations size over a sliding window, and then it is possible to detect the presence of a failure for relatively small failure signals. They estimate the smallest size of failure which is detectable, and the associated threshold can be calculated.

With the constant threshold method, if the model error dominates sensor noise, there may be false alarms and missed detection. In the presence of noise, the detection window must be large enough to separate noise from the signal due to sensor failure. This method is then noise sensitive and may induce false alarms. In those cases, the FD system indicates a fault; however, in reality, there is no fault in the system. This threshold is usually viewed as a tolerant limit for unknown inputs and model uncertainties. Due to this reason, the way of evaluating the unknown inputs plays an important role in the residual evaluation and determination of thresholds. In addition, the chances of false alarms and missed detection are likely to be higher with constant thresholds as compared to variable thresholds.

The variable thresholds vary with the instantaneous values of the process input and some system parameters. These include dynamic threshold [START_REF] Seliger | Robust residual evaluation by threshold selection and a performance index for nonlinear observer-based fault diagnosis[END_REF] and adaptive threshold [START_REF] Gustafsson | Adaptive filtering and change detection[END_REF], [START_REF] Le | Adaptive thresholding: A robust fault detection approach[END_REF].

Since the variable threshold is usually a function of the instantaneous values of the control input instead of the norm values, its magnitude is smaller than the constant threshold. The way to reduce the influence of the noise is to take a decision not only considering the estimate at only one sample but to take it considering an average over an observation window [START_REF] Verdier | Adaptive threshold computation for CUSUM-type procedures in change detection and isolation problems[END_REF]. There have also been suggestions on how to decrease the sensitivity to modeling errors, either by a proper choice of threshold based on statistical decision theories such as Generalized Likelihood Ratio (GLR) test or Sequential Probability Ratio Test (SPRT) methods of detecting a change in signals or system parameters which correspond to faults [START_REF] Basseville | Detection of abrupt changes: theory and application[END_REF].

In some applications, stochastic system models are considered, and the residuals generated are known or assumed to be described by some probability distributions. It is then possible to design decision tests based on adaptive thresholds such as Cumulative Sum (CUSUM) algorithms [START_REF] Ryu | Optimal design of a CUSUM chart for a mean shift of unknown size[END_REF]. Those methods can be used to detect a known or an unknown mean shift.

In the case of an unknown mean shift, an Exponentially Weighted Moving Average (EWMA) statistic can be used. In [START_REF] Jiang | Adaptive CUSUM procedures with EWMAbased shift estimators[END_REF], they proposed a generalization of the EWMA shift estimator [START_REF] Stuart | The exponentially weighted moving average[END_REF] and investigated the use of a Huber's score function to track large shifts quickly. They also investigated the average run length performance using a Markov chain model. They showed that the introduction of a parameter can be chosen to achieve a relatively large improvement in the Average Running Length (ARL) performance at large shifts while only causing slight loss in the efficiency in detecting small shifts. They showed that the Adaptive CUSUM (ACUSUM) chart performs better than the combined Shewart CUSUM chart and has a better zero-state or even steady state ARL performance than the CUSUM in the worst-case performance. They also provided guidelines for the choice of parameters. It appeared that small values or large values of the parameters taken independently tend to improve the detection of large or small mean shift. Since the choice of those parameters cannot be taken independently, they showed that they can be jointly adjusted to greatly improve the performance of ACUSUM-C charts for larger mean shifts while only causing a minor loss in the detection performance at small mean shifts. They proposed to choose the value of the minimal acceptable shift in advance and then to choose the other parameters in order to provide an overall good performance.

They proposed an extension of Sparks' ACUSUM chart using a linear weight function and incorporated the developed EWMA-C estimator into the traditional ACUSUM chart to further improve its performance at large shifts.

However, finding the best parameter values for one specific shift may not be useful because this set of parameters may perform poorly for other shifts. To overcome this problem, more robust decision logics use the history and trend of the residuals and use powerful or optimal statistical test techniques. Yashchin [START_REF] Yashchin | Estimating the current mean of a process subject to abrupt changes[END_REF] discusses the estimation of the current process mean in situations in which this parameter is subject to abrupt changes of unpredictable magnitude at some unknown points in time. It introduces performance criteria for this estimation problem and discusses in detail the relative merits of several estimation procedures. He shows that an estimate based on EWMA of past observations has optimality properties within the class of linear estimators and proposes alternative estimating procedures to overcome its limitations.

He considers two primary types of estimation procedures, Markovian estimators, in which the current estimate is obtained as a function of the previous estimate and the most recent data point, and adaptive estimators, based on identification of the most recent change point. He

gives several examples that illustrate the use of the proposed techniques. Furthermore, the fault detection time is smaller in a variable threshold as compared to the one in case of the constant threshold.

Model-based methods for liquid propellant rocket engines fault diagnosis

In the case of LPREs, it is not realistic to collect enough data to only use data-based methods, qualitative or quantitative model-based methods are consequently essentially used. However, the use of model-based methods implies the description of complex physical phenomenon as well as the compliance with sensors sensitivity and thermo-mechanical positioning constraints.

Moreover, since the developed algorithms have to allow fault detection in real time [START_REF] Betta | Instrument fault detection and isolation: State of the art and new research trends[END_REF] the methods used have to be fast and robust. The methods commonly used nowadays for HMSRE [START_REF] Zhang | Bibliographical review on reconfigurable fault-tolerant control systems[END_REF],

[34] are a basic engine redline system as well as advanced sensors and algorithms including multiple engine parameters that infer an engine anomaly condition from sensor data and take mitigation action accordingly. Basic redlines are straightforward in that they usually act on a single operating parameter anomaly [START_REF] Feng | Research on health evaluation system of liquid-propellant rocket engine ground-testing bed based on fuzzy theory[END_REF]. Those methods can induce false alarms or undetected failures that can be critical for the operation safety and reliability. Moreover, designing representative mathematical models is challenging in practice because of the presence of modeling uncertainties and unknown disturbances [START_REF] Chen | Design of unknown input observers and robust fault detection filters[END_REF], [START_REF] Yang | Observers for linear systems with unknown inputs[END_REF], [START_REF] Bittner | An integrated process for FDIR design in aerospace[END_REF].

The robustness issue in quantitative model-based methods for FD in jet engine control systems is studied in [START_REF] Patton | Robustness issues in fault-tolerant control[END_REF]. Results based on the application of the eigenvalue assignment technique to robust model-based FD are presented. The detection algorithm is applied to a complex thermodynamic system and the results illustrate very well the potential that a model-based method can gives when robustness to modeling errors (uncertainty) are correctly accounted for, see Table 2.7.

The control system of the introduced jet engine has the function of coordinating the main burner fuel flow and the propelling exhaust nozzle. They use a two-stage model-based FDI process composed of a residual generator and a decision-making process. They consider a linear As said before, the development of advanced sensor technology plays a key role in the practical engineering application of LPREs health-monitoring. Firstly, almost all the detecting and diagnosis results of the algorithms and their efficiency directly depend on the quality of information from sensors, and, secondly, specially dedicated sensors can be used for direct health evaluating of engine components. It is viewed as a very important and key issue to select and integrate appropriate advanced sensors, which are reasonably equipped on engine system for the design and implementation of LPRE's HMS. To maintain the inherent reliability of a rocket engine itself, it is also required that sensors for FDD should be minimally incorporated into the engine system hardware. Generally, the specially developed sensors used can decrease the computational cost of executing FDD algorithms and reduce the requirement for on-board computer's quality.

Moreover, those technologies facilitate the use of quantitative model-based methods instead of qualitative methods.

In [START_REF] Ho | A model based Vehicle Health Monitoring system for the Space Shuttle Main Engine[END_REF], a Vehicle Health Monitoring (VHM) system is designed to detect and isolate failures in the engines of Reusable Launch Vehicles (RLV), see Table 2.8. This VHM system takes into account engine failures in both sensors and valves, as well as internal components such as turbo-pumps, injectors, and the combustion chamber. Their 37 nonlinear ordinary differential equations with seven types of dynamics equations forming the nonlinear model of the engine are delivered by Rocketdyne. Specifically, using information from a thermodynamic model of the engine together with sensor measurements, they use linearized models to design KFs blocks to predict sensor outputs. Sensor and valve failures are then isolated using the GLR test. Internal component failures (correlated residuals), on the other hand, are isolated using the Multi-Model (MM) method. They consider a number of models; the residual generated by each filter is small if the hypothesized model is close to the true model.

Consequently the filter generating the smallest residual is the one whose model best matches that of the true system. These methods permit to detect where a fault occurs in the LPRE thanks to the probabilities associated to each mode. The proposed methodology can be used for online FDI as well as for post flight analysis. At the engine design stage, it can be useful to determine the detectability and distinguishability of failures given a candidate sensor configuration. The FDI algorithms are applied to a simulation of the SSME to demonstrate their performance.

In [START_REF] S Mohsen | Parametric fault estimation based on H∞ optimization in a satellite launch vehicle[END_REF] (see Table 2.9), the structural analysis approach was applied to identify the monitorable parts / subsystems of a propulsion system turbo-pumps and provide information about the possibility of detecting and isolating the considered faults in the system. The obtained filter was based on the parametric fault diagnosis filter design approach based on H ∞ optimization. They consider a LOX/LH 2 gas generator cycle, where the turbine inlet gas comes from a separate gas generator. The dynamic model of LH 2 turbo-pump includes three important elements: the pump speed, the pump flow, and the mixture ratio. The same model is used for LOX turbo-pump but to avoid repeating design procedure, they only consider the LH 2 turbo-pump in this paper.

The efficiency loss has been considered as a parametric fault for LH 2 turbo-pump. The common approach which is used, is to model a potentially faulty component as a nominal component in parallel with a fictitious error component. The optimization procedure suggested here then tries to estimate the in-going and outgoing signals from the error component. This works well only in cases where the component is reasonably well excited, but on the other hand, if the component is not active at all, there is no possibility to detect whether it is faulty. Then they use two filters to achieve the fault and the output estimation. Then they express the fault parameter as a polynomial function of the efficiency loss in order to respect boundary conditions to detect faults. The designed H ∞ filter is implemented for different fault models in this system. The output of the filter is processed in a way to produce the estimation of a possible fault. Finally, the method has been verified in launch simulator and the results for different design factors have been compared then a trade-off in the design has been demonstrated. However, they did not propose a procedure to find the optimal parameters which make it difficult to tune the filter.

An example of a quantitative HMS approach is given in [START_REF] Cha | Fault detection and diagnosis algorithms for transient state of an open-cycle liquid rocket engine using nonlinear Kalman filter methods[END_REF], see Table 2.10. process. For that they consider various parameters as the turbine starter power profile, the momentum inertia of the rotational turbo-pump, ignition time for the combustion chamber, ignition time for the gas generator, injection head and efficiency of the turbo-pump. They modeled the state change from no combustion to combustion state using a tangent hyperbolic function. They use lumped parameter modeling approach because definite errors occur at each integration step.

Estimating the accumulation of error is required in the distributing parameter modeling since it depends on spatial scale, contrary to distributed parameter modeling the accumulation of error can then be negligible. They use nonlinear KF such as EKF and UKF to generate residuals. They also use a redline method with limits or threshold on some important operational parameters and the generated residuals. Those threshold values are chosen using Neyman-Peason theorem based on the false alarm probability. By comparing the two filters it appears that they have similar results even if the UKF mean error is closer to zero, the threshold test is also used to settle the parameters of the UKF. Then to diagnose a fault they use the MM method.

However, even if advanced sensors technologies are used, since the modern LPRE is a complex fluid-thermomechanical dynamical system and it usually operates under extreme physical conditions (very high temperature and pressure, strong erosion, and high-density energy release) and because of this complexity and strong random disturbances in the operation, it is very difficult to model the engine system accurately and completely. Therefore, the detection and diagnosis algorithms must be designed to be robust in terms of model uncertainties and random disturbances, to be sensitive to faults with very low false-alarm probability. To maintain the inherent reliability of a rocket engine, it is required that its HMS is not incorporated into the engine system hardware. In [START_REF] Butas | Rocket engine health monitoring using a model-based approach[END_REF] a first rocket engine performance analysis to predict engine system operating conditions is proposed. Those conditions are predicted for a specific control state using mathematical models of hardware functions within an engine. The models typically contain a number of fixed parameters whose values are estimated from accumulated test experience. To fix parameters they determine the operating condition and hardware parameter partitions. To tune the model performances, they modify the adjustable hardware parameters to fit current test data. To do that they solve operating conditions and hardware adjustments simultaneously coupling the performance prediction and data reduction processes. They present a linear data reduction problem and want to determine the hardware adjustable parameters in order to obtain a system depending on test measured physical conditions, modeled physical conditions, system control and boundary settings that are the most representative of the real system. To determine the most appropriate solution they use a closure principle using the fact that the most likely operating state of the engine will require the smallest shift in hardware state consistent with observation. The presented Generalized Data Reduction optimization problem is calculated by solving a weighted LS problem with equality constraint(s). The solution gives the baseline hardware shifts of smallest weighted least square value that are consistent with agreement of test data and computed values for a stable set of measured parameters. Those methods have been validated on MC-1 engine (RP-1 and liquid oxygen). demonstration bench for cryogenic rocket engines representative of the operating conditions of a real engine, in an ONERA / CNES collaboration, see Table 2.12. In [START_REF] Iannetti | Méthodes de diagnostic pour les moteurs de fusée à ergols liquides[END_REF], a model-based diagnosis strategy is given for the water cooling system of MASCOTTE. This strategy consists in identifying one characteristic parameter of the hydraulic behavior via a recursive least square parameter identification algorithm, then to provide a parallel pressure estimation based on signals and the prediction of nominal model characteristics via an EKF. For the thermal behavior one EKF was developed as well. The model details can be found in [START_REF] Iannetti | Development of model-based fault diagnosis algorithms for MASCOTTE cryogenic test bench[END_REF] and [START_REF] Iannetti | Fault diagnosis benchmark for a rocket engine demonstrator[END_REF] together with offline tests. In this work, the focus was on the hydraulic behavior to test the detection performance with different residual analysis approaches are used. Starting from conservation laws a simplified functional model was derived, which could be applied to each section of the water circuit where pressure, temperature and mass flow are available. A CUSUM algorithm was used to detect failures and test diagnosis method on three simulated failures corresponding respectively to: a GH 2 valve partial obstruction, an outlet water cooling channel obstruction and a first water cooling system cavity leakage. Different types of failure transient and intensities

were also tested. The good and false detection rates have been calculated. This complete work as well as a synthesis of rockets engines diagnosis and benchmark methods can be found in the thesis report [START_REF] Iannetti | Méthodes de diagnostic pour les moteurs de fusée à ergols liquides[END_REF].

Synthesis

In some cases, it might be difficult to perform a data-based health monitoring due to the lack of information or causalities in the data. Those limitations have then to be considered in the development of HMS for complex physical systems such as LPRE. Model-based methods can then be used to overcome them. Those methods can be classified as state / parameter estimation and analytical redundancy methods. One of the most commonly used methods is the KF for its optimality and design simplicity. However, its design assumes that errors are small so that one can use an approximation of the system dynamics with Taylor series which can induce a lack of accuracy in the transients since most of complex physical systems have a nonlinear dynamic. So, it can be clearly seen that the use of Kalman filtering methods imply an accurate modeling of the physical systems which may not be easy in most cases due to noises, parameter uncertainties / variations and non-measurable system variables or faults. To overcome this problem UIO have been developed, even in the case of reduced order systems.

However, those methods assume most of the time that the systems are linear and time-invariant which may not be the case for most physical systems. In some works, nonlinearities have been addressed by linearizing around an operating point and transforming the system to an equivalent one where the nonlinearities are considered to be an unknown input which can imply a difficulty to decouple faults dynamics from them. Hence, other works have extended the use of observers or parameter estimation techniques to nonlinear systems. Those works are more efficient than the linearization techniques because it is not necessary to make approximations of the model and for example, the noise can be injected in a nonlinear way and not only as separate additional terms and its effects on the mean are accounted for. One of these techniques is to design the estimation method under certain assumptions which make it possible to use Luenberger observers or the Lyapunov theory. Those assumptions are boundary conditions over the system parameters, dynamics, or uncertainties and perturbations. The global convergence of the designed algorithm guarantees that, for any initial condition, the errors of state and parameter estimation converge to zero. Therefore, in principle, the initialization of the algorithm can be arbitrary. However, in order to reduce the transient time, prior knowledge on the values of the state and the parameter, if available, should be used in the initialization which implies a prime validation. Another method is to use an unscented transform in order to find a parametrization which captures the mean and covariance information while at the same time permitting the direct propagation of the information through an arbitrary set of nonlinear equations.

Since in most cases it is not possible to diagnose a fault with the filtering effects of the residual generation methods, advanced residual analysis methods must be used to determine whether any fault has occurred and to determine the location or type of each fault based on statistical tests. When residuals cannot be made robust against system uncertainty, the robust FDI can be achieved via decision making with constant or variable threshold methods. The first methods were based on constant threshold selected with the help of expert systems or simple data analysis, called redlines. However, those methods did not allow dealing with transient behavior, noises nor model uncertainties which imply a high rate of false alarms. Hence, there have been suggestions on how to decrease the sensitivity to those errors, either by a proper choice of threshold based on statistical decision theories as for example methods of detecting a change in signals or system parameters which correspond to faults. Those methods are said to be adaptive since the decision functions which are compared to the threshold are calculated over a moving window so that it is possible to detect a shift in the system behavior. The threshold can then be calculated depending on the shift size. However, in most cases the shift is unknown even if the minimum tolerable shift is known from experience. Moreover, finding the best parameter values for one specific shift may not be useful because this set of parameters may perform poorly for other shifts. To overcome this problem, more robust decision logics use the history and trend of the residuals and use statistical test techniques to estimate the shift amplitude in order to determine a threshold.

Model-based methods have been initially used for EHM purpose to generate models of the engine to overcome the lack of information by exploiting the simulation data. But they have also been used to generate residuals that can be made robust to certain perturbations, uncertainties or noise. For those reasons it might be pertinent to adapt recent developments in residual generation and analysis.

In this work UIO and Kalman filters have then been used to generate robust residuals considering linearized and nonlinear models (in their extended version) of the engine different subsystems. In the nonlinear case, the adaptation of unscented transform to UIO is also considered in our work for its design simplicity, and its low computational burden needed for online FDI in contrary to particle filters or Monte-Carlo methods. Those methods allow a more accurate use of the information. Techniques using an estimate of the shift amplitude have also been used and further developed with the use of adaptive thresholding such as UIO and ACUSUM to improve the existing HMSRE.

Reconfiguration mechanisms

Generally speaking, FTCS can be classified into two types: passive (PFTCS) [START_REF] Jiang | Fault-tolerant control systems: A comparative study between active and passive approaches[END_REF] and active (AFTCS) [START_REF] Zhang | Bibliographical review on reconfigurable fault-tolerant control systems[END_REF], [START_REF] Jiang | Fault-tolerant control systems: An introductory overview[END_REF]. In PFTCS, controllers are fixed and are designed to be robust against a class of presumed faults [START_REF] John S Eterno | Design issues for fault tolerant-restructurable aircraft control[END_REF]. This approach needs neither FDD schemes nor controller reconfiguration, but it has limited fault-tolerant capabilities. In the literature, PFTCS is also known as reliable control systems or control systems with integrity. In contrast to PFTCS, AFTCS reacts to the system component failures actively by reconfiguring control actions so that the stability and acceptable performance of the entire system can be maintained. In certain circumstances, degraded performance may have to be accepted, [START_REF] Jiang | Fault-tolerant control systems: A comparative study between active and passive approaches[END_REF]. AFTCS can also be named as fault detection, identification (diagnosis) and accommodation schemes. In such control systems, the controller compensates for the impacts of the faults either by selecting a pre-computed control law or by synthetizing a new one online. To achieve a successful control system reconfiguration, both approaches rely heavily on real-time FDD schemes to provide the most up-to-date information about the true status of the system. Therefore, the main goal in a fault-tolerant control system is to design a controller with a suitable structure to achieve stability and satisfactory performance, not only when all control components are functioning normally, but also in cases when there are malfunctions in sensors, actuators, or other system components. It is important to point out that the emphasis on system behaviors in these two modes of operation can be significantly different. During normal operations, more emphasis should be placed on the quality of the system behavior. In the presence of a fault, however, how the system survives with an acceptable (probably degraded) performance becomes a predominant issue. Typically, AFTCS can be divided into four sub-systems:

• A reconfigurable controller,

• A FDD scheme

• A controller reconfiguration mechanism

• A command / reference governor.

Based on the online information on the post-fault system model, the reconfigurable controller should be designed automatically to maintain stability, desired dynamic performance and steadystate performance. In addition, in order to ensure the closed-loop system to track a command input trajectory in the event of faults, a reconfigurable feedforward controller often needs to be synthesized. Although a rich theory has been developed for the robust control of linear systems, very little is known about the robust control of linear systems with constraints. When we say that a control system is robust, we mean that stability is maintained and that the performance specifications are met for a specified range of model variations and a class of noise signals (uncertainty range). To be meaningful, any statement about "robustness" of a particular control algorithm must make reference to a specific uncertainty range as well as specific stability and performance criteria.

Linear quadratic methods

The aim of the LQR is to synthesize control laws depending on the active selection of design parameters. One of the applications is to balance the outputs and inputs solicitation shifts.

Considering an input / output criterion, the design parameters can be chosen in order to obtain smaller transient shifts or a faster convergence. Those parameters can be initialized based on a physical input / output setting using Bryson law [START_REF] Brian | Optimal control: Linear quadratic methods[END_REF]. Veillette, in [START_REF] Robert | Reliable linear-quadratic state-feedback control[END_REF], consider a linear continuous time system under a loss of actuators efficiency. He demonstrates that if a reliable state feedback exists and a Linear Quadratic (LQ) approach can be developed by the choice of diagonal definite positive design matrices, by solving an algebraic Riccati equation [START_REF] Emre | LQR-based coupling gain for synchronization of linear systems[END_REF], this gain design approach verifies the following properties: the state feedback system remains stable despite simultaneous insertion of any positive gain into feedback loops and the elimination of feedback to any or all considered actuators, in the case of the elimination of feedback to all actuators, the quadratic cost converges to the initial system state. This method is more efficient and robust than a classical pole placement since it allows a better mutual balance between inputs and / or outputs and it ensures that a small variation of the gain or phase would not destabilize the system in its margins. LQR optimization is equivalent to a H 2 optimization. The H 2 norm measures the energy of the gap between the command and the output of the system [START_REF] Rotea | The generalized H2 control problem[END_REF]. It can be linked to the variance of the system state. However, this method only ensures robust performances for a single kind of system's operation and does not allow the adaptability of the FTCS. To overcome this problem, adaptive methods have been developed.

Adaptive methods

A common approach in reconfigurable control is to use an adaptive controller to ensure robust or acceptable level of performance under abrupt changes in system parameters. This is known as the adaptive control approach and it is generally classified into two methods: the indirect adaptive control method which employs a parameter isolation process and the direct adaptive control method which does not require an explicit parameter isolation process. The technology of continuous adaptation is based on the concept of continuously identifying system parameters and adjusting the control parameters in accordance with the identified parameters. The control parameter selection change based on a number of criteria, including pole placement, LQ design, or model following control [START_REF] Mou Chen | Adaptive tracking control of uncertain MIMO nonlinear systems with input constraints[END_REF]. In [START_REF] Ye | Adaptive fault-tolerant tracking control against actuator faults with application to flight control[END_REF], they consider a continuous time invariant system and a loss of actuator effectiveness and that the state of the system is available at every instant to design an adaptive controller. Their controller is based on direct adaptive control method which does not require an explicit parameter isolation process. It is designed so that during normal operation the closed-loop system is stable, and the output tracks the reference signal without steady-state error and also in order to minimize the upper bound of a quadratic linear performance index. They consider an augmented state composed of the tracking error and the system state and present a Linear Matrix Inequality (LMI) condition for the optimization of the guaranteed cost control problem of the augmented normal system. The nominal control law is designed in order to minimize a nominal LQR criterion. The choice of the additive control law gain is based on the resolution of a LMI in order to ensure the closed-loop system for the considered candidate Lyapunov function. The Lyapunov approach also called second method or direct Lyapunov approach is used to ensure the stability of a system. This approach aims at finding a function with the properties necessary to demonstrate the stability of the system.

This function must measure the distance between the state and its origin. If one considers the derivative of the Lyapunov function along the system trajectories, if it is strictly monotone and decreasing then the system is stable or asymptotically stable. This Lyapunov candidate is of classical form plus an additive term depending on a gain chosen in order to minimize the actuator efficiency loss effects on the dynamics. The added new control law depends then on the computed loss of effectiveness dynamics assumed to be bounded. In [START_REF] Yang | Adaptive Fault-tolerant H∞ Control via State Feedback for Linear Systems against Actuator Faults[END_REF] Yang and Dan Ye consider a linear continuous time system subject to an exogenous disturbance; the actuator fault is modeled as a bounded loss of actuation efficiency. They choose an adaptive H ∞ performance index for a prefixed upper bound with performances close to the standard H ∞ performance index in some cases. The H ∞ norm is an interesting mathematical norm for optimization problems which corresponds in the multi-variable case to the maximal observable power in the worst case [START_REF] Apkarian | Self-scheduled H∞ control of linear parameter-varying systems: A design example[END_REF]. A H ∞ optimization corresponds then to seek the minimal value of a maximum also referred to "min-max" optimization problem [START_REF] Gutman | Properties of min-max controllers in uncertain dynamical systems[END_REF]. The loss of efficiency is determined according to an adaptive law. The upper bound of the performance index for faulty and nominal cases are determined in order to ensure the system stability for the chosen Lyapunov function depending on the adaptive law gain and minimized. The other part of the control law is determined by the resolution of LMIs to ensure the asymptotic stability with respect to the performance constraint which gives better performances than a classical state feedback H ∞ fault-tolerant control method.

To avoid potential actuator saturation and to take into consideration the degraded performance after fault occurrence, in addition to a reconfigurable controller, a command / reference governor may also need to be designed to adjust command input or reference trajectory automatically.

The principal advantages of continuous adaptation are that it is backed by a well-developed theory and several successful applications.

Under ideal circumstances, it provides good results for degradation and FTCS recovery.

However, these nominal advantages are somewhat deceiving. Most adaptive control algorithms, when faced with unmodeled dynamics and disturbance signals can produce catastrophic instabilities and unacceptably high bandwidths. Most successful applications have been on systems with long time constants and widely separated dynamics that allow the adaptive system bandwidth to be artificially limited.

Feedback linearization methods

Feedback linearization methods are a class of nonlinear control techniques that can produce a linear model that is an exact representation of the original nonlinear model over a large set of operating conditions unlike Jacobian linearization methods [START_REF] Yeşildirek | Feedback linearization using neural networks[END_REF]. The general approach is based on two operations:

• nonlinear change of coordinates,

• nonlinear state feedback.

Most feedback linearization approaches are based on input-output linearization or state-space linearization. In the input-output linearization approach, the objective is to linearize the map between the transformed inputs and the actual outputs. A linear controller is then designed for the linearized input-output model [START_REF] Leonid | Performance recovery of feedback-linearizationbased designs[END_REF]. Process input and output constraints may be included directly in the problem formulation so that future constraint violations are anticipated and prevented [START_REF] Charlet | Sufficient conditions for dynamic state feedback linearization[END_REF]. The first input of the optimal input sequence can be injected into the plant and the problem is solved again at the next time interval using updated process measurements.

Model predictive control methods

To develop more flexible control technology, a new process identification technology has been developed to allow quick estimation of empirical dynamic models from test data, substantially reducing the cost of model development. This new methodology for industrial process modeling and control to address this type of problem has been addressed under the name of MPC [START_REF] David Q Mayne | Constrained model predictive control: Stability and optimality[END_REF]. The name MPC comes from the idea of employing an explicit model of the plant to be controlled which is used to predict the future output behavior [START_REF] Qin | A survey of industrial model predictive control technology[END_REF]. At each control interval an MPC algorithm attempts to optimize future plant behavior by computing a sequence of future manipulated variable adjustments. The first input in the optimal sequence is then sent into the plant, and the entire calculation is repeated at subsequent control intervals. MPC is also named

Receding Horizon Control and Moving Horizon Optimal Control and has been widely adopted in industry as an effective mean to deal with multivariable constrained control problems. The ideas of receding horizon control and MPC have been introduced in the 1960's [START_REF] Bemporad | Robust model predictive control: A survey[END_REF], but interest in this field has only started in the 1980's after the publication of the first papers on IDCOM and Dynamic Matrix Control (DMC) [START_REF] Dw | Adaptive predictive control[END_REF], and the first comprehensive exposition of Generalized Predictive Control (GPC) [START_REF] Dw | Properties of generalized predictive control[END_REF]. Although at first sight the ideas underlying the DMC and GPC are similar, DMC was conceived for multivariable constrained control, while GPC is primarily suited for single variable, and possibly adaptive control. When the model is linear, then the optimization problem is quadratic if the performance index is expressed through the H 2 norm, or linear if expressed through the H ∞ norm [START_REF] Pierre | Min-max feedback model predictive control for constrained linear systems[END_REF]. The prediction capability of this method allows solving optimal control problems online, where tracking error, namely the difference between the predicted output and the desired reference, is minimized over a future horizon, possibly subject to constraints on the manipulated inputs and outputs. The result of the optimization is applied according to this receding horizon philosophy: At time t only the first input of the optimal command sequence is actually applied to the plant. The remaining optimal inputs are discarded, and a new optimal control problem is solved at time t + 1. As new measurements are collected from the plant at each time t, the receding horizon mechanism provides the controller with the desired feedback characteristics. The issues of feasibility of the online optimization, stability and performance are well understood for systems described by linear models, as testified by several books and papers. MPC have been extended to wider ranges of operations with tube-based controllers. For example, in [START_REF] Raimondo | Faulttolerant model predictive control with active fault isolation[END_REF], a FTCS have been proposed for a linear discrete-time system subject to input disturbances and measurement noise. They considered a set of all possible linear models, composed of the nominal one and faulty systems. The aim was to be able to detect additive abrupt faults in sensors, actuators and internal process behavior. Inputs were assumed to be compact polytopes and the disturbances are zero-centered zonotopes as in [START_REF] Vu Tuan | Robust tube-based constrained predictive control via zonotopic set-membership estimation[END_REF] based on fault-tolerant control with set-theoretic methods [START_REF] Stoican | Fault tolerant control based on set-theoretic methods[END_REF], [START_REF] Puig | Fault diagnosis and fault tolerant control using set-membership approaches: Application to real case studies[END_REF]. During nominal operation, the system was assumed to be robustly controlled around a feasible equilibrium point and a passive FD method is employed. When a fault was detected then it was isolated with the help of an algorithm and a new controller was implemented that robustly controls the system around a feasible equilibrium point (computed offline). They developed a Luenberger type observer; a compact set containing the estimation error is described and then proposed a tube-based MPC composed of two terms: a nominal input determined through the solution of an open-loop optimal control problem subject to a nominal model and a linear feedback term designed to track the prediction of the model. Hence, the control law was of the form of an error tracking feedback.

The gain was chosen so that this error is bounded using the observer design results. The cost function was chosen to be linear quadratic over a finite horizon. They gave a sufficient condition for the existence of this control law for a given convex polytope containing the feasible states estimated states in order to ensure the exponential convergence [START_REF] Blanchini | Set invariance in control[END_REF], [START_REF] Ocampo-Martinez | Actuator fault-tolerance evaluation of linear constrained model predictive control using zonotope-based set computations[END_REF]. They introduced passive and active FDI methods. The passive method consists in checking if the measured outputs belong to the nominal output set. The active fault isolation is done over a fixed isolation horizon, the developed algorithm checks if the output belongs to the possible output set, if the other active models respect the state constraints and if the controller coupled with the previous observer can be feasibly implemented once the fault has been detected. They proposed a reformulation of the constraints to solve the problem by simplifications with results on zonotopes.

Some notable advantages of the constrained zonotope representation are the following:

• Accuracy: when the complexity of the representation is not limited, it can describe arbitrarily convex polytopes;

• Efficiency: standard set operations, including intersections, can be computed exactly through simple identities;

• Tunability: effective techniques are provided to conservatively reduce the complexity of a given set, enabling a highly tunable tradeoff between efficiency and accuracy.

Much progress has been made on these issues for nonlinear systems, but for practical applications many questions remain, including the reliability and efficiency of the online computation scheme. Recently, application of MPC to hybrid systems integrating dynamic equations, discrete variables, and logic conditions, heuristic descriptions, constraint prioritization, and switching have been considered.

Variable structure control methods

Variable Structure Control (VSC) with Sliding Mode Control (SMC) [START_REF] Vadim Utkin | Variable structure systems with sliding modes[END_REF] was first proposed and elaborated in the early 1950's by Emelyanov [START_REF] Sv Emel | Theory of variable-structure control systems: Inception and initial development[END_REF] and several co-researchers [START_REF] John Y Hung | Variable structure control: A survey[END_REF]. In their works, the plant considered was a linear second-order system modeled in phase variable form. Since then, VSC has been developed into a general design method being examined for a wide spectrum of system types including nonlinear systems [START_REF] Gao | Variable structure control of nonlinear systems: A new approach[END_REF], multi-input/multi-output systems [START_REF] Raymond A Decarlo | Variable structure control of nonlinear multivariable systems: A tutorial[END_REF], discrete-time models [START_REF] Gao | Discrete-time variable structure control systems[END_REF], large-scale and infinite-dimensional systems, and stochastic systems. The objectives of VSC have also been extended from stabilization to other control functions. The most distinguished feature of VSC is its ability to result in very robust control systems. In many cases, it leads to a completely insensitive system to parametric uncertainty and external disturbances also called invariant control systems. Today, research and development continue to apply VSC to a wide variety of engineering systems. During the control process, the structure of the control system varies from one structure to another [START_REF] Furuta | Variable structure control with sliding sector[END_REF].

To emphasize the important role of the sliding mode, the control is also often called SMC.

Furuta considers in [START_REF] Furuta | Sliding mode control of a discrete system[END_REF] a linear discrete-time system and defines a sliding mode so that the system is stable as long as the state remains on a hyperplane. He gives an equivalent control law to keep the state on this hyperplane, the sliding mode is then chosen so that the closed loop system under the obtained state feedback is stable. In the design of this control law, the sliding mode is designed firstly, then, the control to transfer the state to the sliding mode is designed. A Lyapunov function depending on the state belongings to the sliding mode is determined for a feedback gain composed of the initial gain (for the system stability) and a second part to transfer the state to the sliding mode if it is not belonging to the hyperplane. He also proposes an extension for discrete-time systems such that the sliding mode is determined using the recurrence property of the discrete time system. Then he proposes a method to determine the hyperplane so that the controlled system is stable by solving a LMI corresponding to the closed loop system and constraints of the problem for a given a Lyapunov function. The Lyapunov function depends on the sliding surface characteristics and the VSC law to stabilize the system is composed of a feedback gain part transferring the state to the sliding mode if it does not belong to a defined neighborhood. The SMC of a discrete system is different from that of a continuous system in that the switching surface is different from the sliding mode hyperplane and there exists a switching region along the sliding mode. The proposed control has three different feedback coefficients. He considers the robustness and prove that in the considered case the amplitude of the uncertain control should be of smaller order to stabilize the uncertain system. The switching region becomes larger as the uncertainty increases.

Lan and Patton [START_REF] Lan | A new strategy for integration of fault estimation within fault-tolerant control[END_REF] proposed a new Fault Estimator (FE) / FTC method. This method does not depend on a FDI and the necessity of a reconfiguration mechanism. The faults are automatically compensated by the fault accommodation part based on faults estimation. They then introduced different FE methods. They consider a linear continuous time uncertain system with additives / multiplicatives and bounded actuator/sensor faults plus external disturbances.

The first FE is based on a full order UIO to estimate an augmented state composed of the system state and the faults despite the unknown external disturbance. The unknown faults dynamics are also considered to be unknown inputs. The second FE is based on a reduced order UIO using the successive derivatives of the output over the same previous augmented state. For the FTC part they proposed an output or a state feedback and sliding surface methods. This method allows the convergence to a neighborhood of the nominal system behavior for different control structures. This method does not need to use tracking, the control changes as the state trajectory changes. This method allows overcoming system uncertainties. They design the FTC on the resolution of LMIs which gives a nonlinear SMC law with H ∞ performances. They then consider the case of a dynamic system whose state variables are subject to constraints that define an admissible set in the state space. Due to the system dynamics, in general, not all the trajectories originating from admissible initial states will remain in such a set. Conversely, for any initial condition which belongs to a positively invariant subset of the admissible domain, constraints violations are avoided. A subset of the state space is said invariant if the inclusion of the state at some times implies the inclusion in both the future and the past. Thus, the inclusion of the state in a positively invariant set provides fundamental a-priori information about any trajectory originating from it. Therefore, a domain of attraction is also a safety region for the initial state.

One fundamental problem they deal with is the trade-off between the complexity of the description of a family of sets and its optimality properties. Indeed, the determination of invariant sets which are in some sense the best, for instance finding the largest controlled invariant set inside a prescribed domain, is often frustrated by the complexity of the representation. This aspect concerns, for instance, ellipsoids and polytopes as candidate invariant sets: the former is simple but conservative, the latter is non-conservative but arbitrarily complex. Using a static state feedback control law constrains the system performances. A solution is to use a receding horizon approach and recompute the feedback gain at each sampling time, which shows significant improvement in performances [START_REF] Bemporad | Robust model predictive control: A survey[END_REF].

It should be noted that a VSC system can be devised without a sliding mode. One of the different methods is the phase plane method. As a powerful graphical tool for studying secondorder dynamic systems, the phase plane method was established in the work on the qualitative (geometric) theory of differential equations and oscillation theory. The classical literature of Andronov and Flugge-Lotz cited many early works in these areas. In their works, two contributions provided the foundation for the emergence of VSC:

• Region wise linearization of nonlinear dynamic systems: linearization of nonlinear systems was applied in partitioned regions of the phase plane. This gave the initial prototype VSC systems.

• Sliding mode motion: this was the first concept of SMC theory of differential equations with a non-analytic right-hand side [START_REF] Edwards | Sliding mode control: Theory and applications[END_REF], [START_REF] Furuta | Sliding mode control of a discrete system[END_REF].

The problem is that a differential equation is not defined at the point where the right-hand side of the equation is not analytic because the existence and uniqueness of the solutions at these points are not guaranteed. Hence, the phase plane method cannot give a complete solution without defining an auxiliary equation at these points. The auxiliary equation is the model of switching that occurs in VSC systems with discontinuous control.

In [START_REF] Kim | Robust discrete-time variable structure control methods[END_REF], they consider a linear discrete-time uncertain system. The system is assumed to be controllable and the matching condition holds. They introduce the notion of quasi-sliding mode or pseudo-sliding mode, for Discrete-time VSC (DVSC) the motion remains within some neighborhood of the sliding surface. However, the use of DVSC induces chattering phenomenon, to overcome this problem they propose the use of a saturation function or a switching region.

The controller is designed in order to move from the outside of the predefined switching region to its inside. They discussed the two approaches to design control laws, the gain selection one and the reaching law approach. The gain selection approach is based on a Lyapunov function design. The Reaching law approach (RDVSC) is based on the selection of a switching function dynamics satisfying the reaching condition, this function is a sign function with design parameters in order to ensure the robustness and the stability. Since this does not ensure the asymptotic convergence, a saturation function can be used instead. The introduced method is based on built-in invariance and robustness to upper-bounded disturbances and uncertainties.

In the case of external disturbances two methods are introduced: high gain methods or in the case of slow varying disturbance, disturbance compensator based on the disturbance estimation.

For a more generalized disturbance they introduced the combination between a disturbance compensator and a separation principle to achieve robustness. This method is based on a reference trajectory taken into account in the control input and fault compensation from the FE part. The nominal gain is designed in order to ensure a contraction mapping of the tracking (model-measure) error and ensure its asymptotic convergence to zero. The designed sliding surface dynamics depends then on the disturbance dynamics which must be slow to ensure the asymptotic convergence or to be upper-bounded to ensure the sliding surface convergence to the boundary layer of a chosen thickness. The parameters are then function of the disturbance changing rate upper-bound. They also introduced the recursive method which does not need the disturbance decoupling estimation scheme for constant or slowly time varying disturbances.

Hence, they proposed to combine RDVSC with Decoupled Disturbance Compensator (DDC) because the DDC structure implies estimation errors which impact the sliding mode effects, in RDVSC the system response can cause overshoots which then leads to abrupt changes.

They decrease the influence of the estimation errors on the tracking dynamics using recursive switching functions. This method allows to overcome the chattering problem for discrete-time system switching control however it only works for slow time-varying faults. Those switching methods can then be extended to more various operating conditions using MM methods.

Multi-model methods

In the MM approach, a bank of parallel models is used to describe the system under nominal operating mode and under various fault conditions, such as actuator failures. A corresponding controller is designed for each of these models. A suitably chosen switching mechanism is designed to determine the mode of the system at each time step, and to select the corresponding controller that is designed for that mode. This results in robust and improved performance under various operating conditions.

In [START_REF] Yu | Multiple model-based adaptive reconfiguration control for actuator fault[END_REF], an AFTCS is developed to compensate for the effect of actuator fault in the presence of non-measurable rate on the actuator second-order dynamics. The proposed control scheme is a combination between multiple model and adaptive reconfiguration control. By means of the designed method, the system output can track the reference model asymptotically, and the simulation results have illustrated the effectiveness of the proposed algorithms for linearized aircraft models. Typical actuator faults are classified into two categories, the case of total loss of effectiveness and partial loss of effectiveness so that they consider the parameterization of different types of actuator faults. For this parameterization they used adaptive observers in order to estimate the actuators effectiveness. Then they use an adaptive reconfiguration method to overcome a partial loss of effectiveness. As said, it was shown that adaptive control using a single model may not be adequate for achieving this task in the presence of faults. This is due to the fact that in a particular flight regime, the fault can be such that the corresponding parameter jumps are large, and the time interval needed for a single adaptive controller to adapt to the new operating regime may be large. Over this interval, the performance can deteriorate substantially and may be unacceptable in practice. Hence, single model-based adaptive controller may be too slow to bring the closed-loop system close to the new operating regime, which may result in unacceptably large transients. On the other hand, a well-known problem in adaptive control is the poor transient response which is observed when adaptation is initiated. In such a case, placing several models in the parametric set, switching to the model close to the dynamics of the failed plant, and adapting from there can result in fast and accurate control reconfiguration. The actuator model is described by second-order dynamics with non-measurable rate. The proposed design based on a multiple model adaptive control approach with appropriate switching logic achieves the control objective of asymptotic output tracking while ensuring closed-loop stability.

In [START_REF] Mayuresh V Kothare | Robust constrained model predictive control using linear matrix inequalities[END_REF], they present two paradigms for robust control, the MM paradigm and the linear system with a feedback uncertainty robust control model. They consider a linear time-varying system. For the MM paradigm, the different models, nominal and other ones are represented by a polytopic system which is assumed to be equivalent to the real system. The structured feedback uncertainty model is the modeling of systems with uncertainties or perturbations appearing in the feedback loop. In this representation, factors such as nonlinearities, unknown, unmodeled or neglected dynamics and / or parameters are included in a repeated scalar block or a full block matrix. Then they present the MPC method used, they assume that exact measurement of the state of the system is available at each sampling time. They consider a quadratic objective depending on the state and controls over an infinite horizon because finite horizon control laws have been known to have poor nominal stability properties by requiring the imposition of a terminal state constraint and / or use of the contraction mapping principle (use of a contractive function properties). With finite horizon methods, the states only approach zero asymptotically and the online optimization can be extremely time consuming. The infinite horizon control laws have been shown to guarantee nominal stability. The output constraint is imposed strictly over a future horizon because the current output cannot be influenced by the current or future control.

The input constraints are considered to be hard constraints (saturations). They give a brief introduction to LMIs and some optimization problems based on LMIs. The use of LMIs is justified by the fact that LMI problems can be solved in polynomial time which means that they have low computational complexity. They also discuss the problem formulation for robust MPC using and their extension to discrete-time case and conjunction with S-procedure, a mathematical result that gives conditions under which a particular quadratic inequality is a consequence of another quadratic inequality. For the nominal case this approach is equivalent to the LQR solution. In the presence of uncertainty even without constraints on the control input or plant output, the feedback gain can show a strong dependence on the state of the system. This feedback can be reinterpreted as potentially reducing the conservatism in their worst case MPC synthesis. The speed of the closed-loop response can be influenced by specifying a minimum decay rate on the state. Thus, an additional tuning parameter is introduced to influence the speed of the closed-loop response. Then the authors show how input and output constraints can be incorporated as LMI constraints in the robust MPC problem. For that they propose a lemma giving an invariant ellipsoid for the predicted states of the uncertain system, whose size is maximized over the system set in order to be used for prediction of the future states of the

Control systems for liquid propellant rocket engines

Engine controllers are designed to satisfy certain operability and performance constraints.

Some are engine-related, such that the engine integrity and performance; some are externally imposed, such as administrative requirements. Durability is also one of the key goals, so it is reasonable that it should be taken into consideration in the design process of future engine control algorithms. Since a conventional feedback control design for a complex system may result in an unsatisfactory performance, or even instability, in the event of malfunctions in actuators, sensors or other system components FTCS have been developed to overcome those problems.

FTC aims at guaranteeing the system goal to be achieved despite faults [START_REF] Petros | Robust adaptive control[END_REF]. To overcome such weaknesses, new approaches to control system design have been developed in order to tolerate component malfunctions while maintaining desirable stability and performance properties. If a minor component and / or instrument fault is detected by the FDI approaches [START_REF] Hwang | A survey of fault detection, isolation, and reconfiguration methods[END_REF], [START_REF] Shen Yin | A review on recent development of spacecraft attitude fault tolerant control system[END_REF], nonshutdown actions have to be defined to maintain the overall system current performances close to the desirable ones and preserve stability conditions [START_REF] Ye | Adaptive fault-tolerant tracking control against actuator faults with application to flight control[END_REF], [START_REF] Yang | Adaptive Fault-tolerant H∞ Control via State Feedback for Linear Systems against Actuator Faults[END_REF], [START_REF] Yang | Fault tolerant control and hybrid systems[END_REF].

Life extending control

The idea of Life Extending Control (LEC) is to design a control system which provides acceptable engine response while minimizing component damage. The concept of LEC has demonstrated that, by using smart MR and combustion chamber pressure regulation logic for engine control, the thermomechanical fatigue damage accumulated during typical engine transient can be significantly decreased without any noticeable loss in engine performance. By slightly reducing the peak temperature during a transient, a significant life span can be saved. For example, in [START_REF] Jung | Thrust and propellant mixture ratio control of open type LPRE using Q-ILC[END_REF], Jung and Oh propose a controller design for LEC (see Table 2.13).

Adaptive control and fault-tolerant control

Adaptive control and fault-tolerant are two main different means considered to improve or maintain liquid rocket engine performances and stability. The aim of adaptive control is to adapt the controller parameters to changes of the system parameters, most of the time to enlarge the operability domain. In the case of linear models with slowly time varying parameters, if these changes are caused by a fault, adaptive control may provide active fault tolerance. However those restrictions are usually not met by systems under the influence of faults. The aim of fault-tolerant control is to achieve the system objectives despite the occurrence of faults. The design objective is then to design a control law which is able to respect the system objectives in the presence of certain faults. It is then interesting to oppose those two methods concerning the application field of liquid rocket engines reconfiguration.

Generally, adaptive control involves the matching of a closed-loop transfer function, and as the physical system changes, due to variations in operating point for instance, the controller adjusts its gains to match an identified plant model. In current engines the PI or PID (see [START_REF] Pérez-Roca | A survey of automatic control methods for liquid-propellant rocket engines[END_REF]) controller gains are scheduled on a parameter. This method assumes that the engine dynamics does not change significantly over time relative to the scheduling parameter, or that the controller is designed to be robust enough to accommodate the changes. Although the controller gains change with operating conditions, there is some argument over whether this should be considered as an adaptive technique since they are scheduled based on a measured or computed parameter in a predetermined way without any attempt at system identification. An opportunity for adaptation within the current engine control framework concerns adjusting the schedules and limits within the controller. In former engine control systems [START_REF] Krishnakumar | Intelligent systems for aerospace engineering-an overview[END_REF], a PI controller was used to maintain control parameters such as engine pressure ratio at a steady-state point.

When the reference signal changes significantly such that the engine will no longer remain near steady-state, transients schedules or limits come into play, which determine the rate at which the engine will transition to its new operating point. These schedules are based on considerations such as MR limits and over temperature avoidance. Thus, the response of the engine may be slowed down in order to stay within operability limits. There has been some promising preliminary work replacing the traditional limit logic with fuzzy limit logic, resulting in improved transient performance with potentially less fine-tuning of the controller. Additionally, no matter how the schedules and limit logic are implemented, it may be appropriate to override them in some emergencies. Emergency regress, and compensation for damage are all examples of situations where rapid transients might be critical to save the vehicle. One solution to these problems involves developing reconfigurable schedules that allow the engine to operate beyond its normal boundaries for a short time, at the risk of component life, but with the benefit of potentially saving the vehicle and passengers or payload. After faults are found by FDD algorithms, effective means to control under faulty situations have to be carried out in due time so as to reduce the direct failure effects or minimize the extend of engines' damage. Based on practical availability in near term, some basic means to control faults such as locking actuator, reducing engine's thrust level, and emergency shutdown were proposed. If engine's faults take place during ground testing, emergency shutdown may be a proper control mean because it can minimize the engine's damage and the possibility of other experimental failures. If the faults, in particular, critical failures, occur during real launch, reducing engine's thrust level may be a reasonable choice to minimize fault's damage, extend engine's life and finish the launch task and prevent unnecessary shutdown. Some main parameters such as pressure, temperature, rotating speed, vibration and component's stress will decrease with the reduction of thrust level, thus, the rate of fault propagation is also reduced.

For those reasons, the first developed systems mainly based on PI, PID or I control methods considering single variable subsystems have been extended to multivariable considerations and more advanced control methods such as MPC [START_REF] Lorenzo | An intelligent control system for rocket engines: need, vision, and issues[END_REF]. The premise behind it is that an on-board model is running faster than real time, using simulated control inputs over a time horizon. The best simulated control input at the current time can then be used as input to the real engine. This sequence is repeated at each time step, computing and applying the best the two preburners (see [START_REF] Merrill | A reusable rocket engine intelligent control[END_REF]). Additionally, alternative modes were included to limit maximum temperatures in the turbo-pumps. They also considered modes that would accommodate the control reconfiguration selected by the intelligent coordinator due to failure detection, and actively control engine operation to diagnose or predict component failure [START_REF] Krishnakumar | Intelligent systems for aerospace engineering-an overview[END_REF]. The notion of altering the structure of the controller to accommodate changes in the plant is a considered way towards fault tolerance [START_REF] Jeffrey L Musgrave | Real-time accommodation of actuator faults on a reusable rocket engine[END_REF]. The intelligent coordinator is based on Fuzzy logic control, they also considered MPC for its adaptability [START_REF] Lee | Intelligent control based on fuzzy logic and neural net theory[END_REF]. It is a complex, computationally intensive scheme, however, which requires a lot of on-board computing power to run a model many times faster than real time. Additionally, the model must be highly accurate, even at off-nominal conditions, for the MPC methodology to be successful. The aims of the developed systems are to diagnose an actuator failure with the help of combined data-based and model-based FDI systems, then to choose the controller to reconfigure and perform fault-tolerant control with the help of Fuzzy Logic.

In [START_REF] Carl | Overview of rocket engine control[END_REF], Lorenzo and Musgrave explained the fundamentals of cryogenic rocket engine control (see Table 2.14). They describe the SSME main engine control system as the first large scale reusable rocket engine developed from a long line of expendable liquid rocket propulsion technology (see Table 2.15). Hydrogen is used to cool the Main Combustion Chamber and drives the low-pressure fuel pump while bleed flow from the high pressure LOX pump drives the low pressure LOX pump.

The engine control is accomplished through five valves (Main oxidizer, main fuel, coolant Regulation of LOX flow into the LOX preburner and fuel preburner adjusts the high-pressure pump discharge pressures which determine the pressure and MR in the main chamber. Hence, they present a multivariable controller based on a linear state-space model of the process which corresponds to a perturbation model of a simplified nonlinear dynamic engine model. This method allows the integration of multiple objectives while decoupling each of the loops from the others using all six valves. Reference commands are kept constant at their respective 100% power values for their tests. The controller automatically allows a slight decrease. In this framework they discuss an intelligent control method, whose key functionalities are:

• Life extending control,

• Adaptive control,

• Real-time engine diagnostics and prognostics,

• Component condition monitoring,

• Real-time identification,

• Sensor/actuator fault tolerance. A multivariable controller exploits both the knowledge of the physical system, such as the propellant valves, and the multiple inputs and outputs to the control system. This additional complexity can provide the control system designer additional techniques to optimize the physical system performance. However, as said before these schemes rely on the existence of good models for the design process. Trade-offs can be made between model uncertainty and performance. In order to achieve a successful multivariable control implementation, the control designer must first develop a robust, adequately descriptive model of the plant, derived from the inherent physics. Next, the control system must be designed with a properly designed loop structure which adequately considers the multiple input and output variables as well as their interactions. Finally, it must be extensively validated and calibrated against experimental data, such as that collected on the engine test stand and in-flight test. Multivariable control offers superior performance to traditional PI control and avoids the pitfall of multi-loop control, specifically the need to sub-optimize the control loops to avoid system instability due to the interaction of the separate control loops. Instead, it takes into account loop interactions and their destabilizing effects, allowing the overall system to be optimized, and augmentation with AI techniques may produce even better performance. Furthermore, it provides "virtual measurement" of system parameters that are not directly measured but can nevertheless be used for monitoring or even control.

Control systems for engines of the new generation of launchers

The development of the new launcher generation leads to actual challenges such a reusability, toss-back etc. For propulsion systems consisting of multiple engines, in order to meet the thrust space vehicle requirements, it is necessary to coordinate different engines thrust level after the shutdown of faulty engine. For the situation mentioned above, some aspects including requirement to finish flight tasks, operational condition change of other normal engines, available emergency measures, and safety needs should be considered at a propulsion systems level. For reusable engines, the information resulting from fault diagnosis will be available to maintenance and repair and can also be utilized to reconfigure control laws for intelligent FTC. Within the framework of ICS suggested, in order to reach high engine performance, efficiency, lifetime, reliability, and reduced maintenance effort, a real-time control decision was made according to the hierarchical levels (mission coordination, propulsion system coordination, and engine control) which coordinate the requirements on engine's performance (thrust and mixture ratio)

with prognostic information of critical components life. The goal of performance seeking control is to operate the engine to achieve optimal performance based upon the current condition of the engine and the current mission. Optimal performance is typically defined in terms of fuel burn, thrust, engine life, or a combination of these objectives. The engine control system is responsible for providing the desired level of thrust while maintaining the necessary operability margins at steady-state and transient operating conditions throughout the engine operating envelope. Since engine parameters such as thrust and stall margin are not directly measurable, the conventional control design approach is to infer these parameters through other direct sensor measurements. Furthermore, the engine will naturally undergo degradation over its lifetime of use. To account for these variations the conventional control system must be designed to ensure robust operation for a range of engine conditions from fully healthy to fully degraded. However, this robustness is obtained in exchange for performance. In [START_REF] Colasurdo | Optimal performance of a dual-fuel single-stage rocket[END_REF], they first state the problem by considering a LPRE working with liquid oxygen and kerosene in one engine and hydrogen for the second engine (see Table 2.16). Bang-bang optimal control, payload / gross-mass ratio performance index They want to find the optimal MR to move the rocket in vacuum considering the system effective exhaust velocity. They make the problem dimensionless by dividing all masses by rocket initial mass. The mass flow ratio is then the control variable of the problem and optimal control theory is used to maximize the rocket performance and to provide the best values of the mixture ratios which are constant during the engine operation. They define the Hamiltonian of their system which is linear with respect to the mass flow ratio, and a bang-bang control is therefore optimal. According to Pontryagin maximum principle the rewritten Hamiltonian is maximized by either the maximum or minimum admissible value of the control, if the sign of the switch function is positive or negative respectively. Then they give the boundary conditions, considering two analyses, one minimizes the system gross mass, the other is the minimization of the rocket dry mass. The MRs are not specified and do not appear in the performance indices. As the masses of the exhausted propellants are free, they give necessary conditions for optimality.

The minimization of the gross mass is obtained via the maximization of the payload ratio. The performance index is actually the payload / gross-mass ratio: when the payload is assigned, the optimal strategy minimizes the gross mass. To solve the boundary value problem, they first consider an assigned characteristic velocity, a single-fuel rocket and the behavior of the switch function is analyzed. To compute their results the effective velocity of the hydrogen engine is approximated with a parabolic relation.

Performance seeking control aims at addressing some of the shortcomings of conventional control logic by directly controlling the parameters of interest and optimizing engine operation based upon the current condition of the engine. This is achieved by using a real-time on-board thermomechanical engine model incorporated into the engine control architecture. An associated online parameter estimation algorithm, or tracking filter, adjusts model tuner parameters to match the performance of the physical engine. Linear estimation techniques, such as Kalman filters, are a solution to implement the tracking filters, see part 2.1. Once the on-board model is accurately tuned it provides accurate estimates of sensed engine outputs as well as estimates of unmeasurable engine parameters, such as the MR, for direct feedback control purposes. By adapting to account for engine variations and controlling directly on the parameters of interest, the engine control can be optimized to provide enhanced performance while still providing the necessary degree of robustness.

Synthesis

The use of PFTCS which are designed to be robust to a certain class of presumed faults may be limited in the case of complex systems depending on many different parameters and with a wide range of perturbations or possible failures. The use of AFTCS is more pertinent for the development of LPRE FDIR mechanism. Those systems react to the system component failures actively by reconfiguring control actions so that the stability and acceptable performance of the entire system can be maintained which imply the use of online FDD algorithms. Then the main goal in a FTCS is to design a controller with a suitable structure to achieve stability and satisfactory performance even in the case of degraded operations. Based on the online information on the post-fault system model, the reconfigurable controller should be designed automatically to maintain stability, desired dynamic performance and steady-state performance.

In addition, in order to ensure the closed-loop system to track a command input trajectory in the event of faults, a reconfigurable feedforward controller often needs to be synthesized. To maintain the stability and preserve the desired performances, control optimization methods have been developed such as the LQ control method. This method is more efficient and robust than a classical pole placement since it allows a better mutual balance between inputs and / or outputs and it ensures that a small variation of the gain or phase would not destabilize the system in its margins. However, this method only ensures robust performances for a single kind of system's operation and does not allow the adaptability of the FTCS. To overcome this problem, adaptive methods have been developed. Those methods can be direct or indirect and use parameter tuning in order to enlarge the FTCS range of operations. The principal advantages of continuous adaptation are that it is backed by a well-developed theory and several successful applications. However, the definition of the parameter dynamics can be complicated or limit the control system performances. Under ideal circumstances, it provides goods results for certain degradations and FTCS recovery. However, most adaptive control algorithms, when faced with unmodeled dynamics and disturbance signals can produce catastrophic instabilities and unacceptably high bandwidths due to this parameter dynamics definition. Those methods are well developed in the case of linear systems. However, in most cases, the physical systems are nonlinear. To overcome this problem, one way is to use a feedback linearization method.

A more advanced and flexible method known as MPC has also been developed. This method has been extended with tube-based MPC to consider a wider range of operation to improve the accuracy, efficiency and tunability of the controller. Much progress has been made on these issues for nonlinear systems, but for practical applications many questions remain, including the reliability and efficiency of the online computation scheme. Recently, application of MPC to hybrid systems integrating dynamic equations, discrete variables, and logic conditions, heuristic descriptions, constraint prioritization, and switching have been considered. Other methods have also been developed for the design of robust controller ensuring the system stability over a wider range of operations. A VSC method allows varying from one control structure to another during the control process. The key point of this method is then the definition of a switching function, this can be done considering a sliding surface or the phase plane method based on the qualitative theory. However, as the uncertainties increase, the switching region increases, and this method can imply chattering. To overcome this problem, one way is to decrease the influence of the estimation errors on the tracking dynamics using recursive switching functions. This method allows overcoming the chattering problem for discrete-time system switching control however it only works for slow time-varying faults. Those switching methods can then be extended to more various operating conditions using MM methods where a bank of parallel models is used to describe the system under nominal operating mode and under various fault conditions, such as actuator failures. A corresponding controller is designed for each of these models. This results in robust and improved performance under various operating conditions.

In the case of engine controllers, they were developed to ensure the engine operability and performance constraints such as the system integrity or thrust performances. There are then different objectives: durability, optimize the system performances, robustness to certain failures.

In the last case, FTCS are developed in order to guarantee the system objectives in the case of instability, malfunctions in actuators, sensors, or system components. For that, the developed For those reasons multivariable control methods have started to be used with MPC or adaptive control based on Fuzzy Logic decision making algorithms. Those methods allow to control directly the parameters of interest and optimize the engine performances by using a real-time on-board thermomechanical engine model incorporated into the engine control architecture.

They also allow to reconfigure in the case of actuator failures by choosing the controller based on experience. The emergence of new challenges such as reusability or toss-back points out the necessity to improve the existing control systems.

For those reasons, the development of a real-time AFTCS is studied in this thesis. For this type of application including reconfiguration it is necessary to adapt and combine recent control methods with the response time and embeddability constraints of rocket engines regardless of the operating mode. The LQR method was first considered in this work since it is well adapted to our system for the simplicity of the obtained linear control law. Then, the MPC method has been considered for the control law performances and its tuning which is close to the first developed LQR controller. The algorithms considered must make it possible to ensure the stability of the system around a modifiable nominal trajectory and to compensate for additive failures impacting the actuators when they are detected and then isolated. For this reason an active fault compensation part is included in the design of the control law. Then, the system actuators must comply with thermomechanical constraints, for this purpose, the controller can then include an anti-windup loop to respect these by modifying the transients.

Chapter 3

Cryogenic bi-propellant liquid propellant rocket engine

A LPRE propulsion system combine all the hardware components and propellants necessary for its operation. It basically consists of one or more thrust chamber, one or more tanks to store the propellants, a feed mechanism to force the propellants from the tanks into the thrust chamber(s), a power source to furnish the energy for the feed mechanism, suitable piping to transfer the liquids, a structure to transmit the thrust force, and control devices to initiate and regulate the propellant flow and thus the thrust. The design of any propulsion system has to meet specific application or mission requirements. These requirements include constraints on cost, schedule, operating conditions (such as temperature limits), storage conditions, or safety rules. In this chapter the basic elements and functions of LOX/LH 2 a LPRE composed of a thrust chamber, a nozzle and propellants manifolds are introduced. Models are then proposed for the different LPRE's subsystems, adapted to MASCOTTE test bench and validated on real test data.

Basic liquid propulsion elements

Chemical propulsion works thanks to the energy released during the combustion of liquid or solid propellants [START_REF] Paul | Rocket propulsion elements[END_REF]. High pressure combustion produces hot gases that are then accelerated by expansion into a nozzle and ejected at high velocity to generate a thrust. Combustion temperatures can vary from 2773 to 4373 Kelvin and the velocity of the ejected gases from 1800 to 4300m/s.

Thrust chamber

The basic elements of a thrust chamber, include a combustion chamber section, an expansion nozzle section, an injector, an ignition device for non-hypergolic propellant combinations, propellant inlets and distributing manifolds, and interconnecting surfaces for component and thrust mounts. The primary function of the thrust chamber is to convert the energy of propellants into thrust. In a liquid bi-propellant rocket engine, this process is characterized by the following basic functional steps (Figure 3.1):

1. The liquid propellants, at their proper mixture ratio, are injected into the combustion chamber through orifices in an injector, as jets. These jets either impinge to form a mixed droplet spray or the liquid jet is atomized by an annular gaseous coflow into a series of droplets running straight into the chamber.

2. The droplets are subsequently vaporized by heat transfer from the surrounding gas. The size and velocity of the droplets change continuously during their entrainment in the combustion gas flow.

3. The vaporized propellants are mixed rapidly, further heated and promptly reacted at their stoichiometric mixture ratio wherever they are formed, thus effecting a continuous increase of the gaseous mass flow rate within the combustion chamber. The combustion is essentially completed upstream of the chamber throat, when all liquid droplets have been vaporized. Under certain conditions, shock and detonation waves may be generated by local disturbances in the combustion front, possibly caused by instability of mixing process and propellant now prior to reaction. These effects may trigger sustained pressure oscillations at certain frequencies within the thrust chamber, resulting in destructive combustion instability. A major portion of the design and development effort, therefore, is directed toward achievement of stable combustion.

4. As the gaseous products of the combustion process pass toward and through the throat, they are accelerated to sonic, and then to supersonic, velocities within the convergingdiverging nozzle, and are finally ejected to the rear.

Propellants

Bi-propellants systems have one propellant playing the role of oxidizer and the other of fuel in order to achieve the combustion. The propellants furnish the energy and the working substance for the rocket engines. The selection of the propellants is one of the most important steps in the design of an engine. It greatly affects the overall engine system performance as well as the design criteria for each engine component. Present-day liquid propellant rocket engines use bi-propellants systems almost exclusively because they offer higher performance, combined with safer operation. The combustion of many bi-propellant combinations is initiated by ignition devices such as: chemical pyrotechnic igniters, electric spark plugs, injection of a spontaneously ignitable liquid fuel or oxidizer ("pyrophoric fluid ") ahead of the propellant injection, a small combustor where the ignition is started by devices, which in turn starts the main chamber by the hot gas produced. Other bi-propellant combinations ignite spontaneously upon mixing.

Those combinations are defined as hypergolic and permit greatly simplified ignition but pose certain hazards. For instance, accidental mixing of the fuel and oxidizer due to tank and other hardware failures could cause a violent explosion. The propellants are stored separately and then mixed in the combustion chamber. There are several types of propellants. Some liquid propellants are liquefied gases with a very low boiling point at ambient pressure and a low critical temperature, they are called cryogenic propellants, i.e. gases at room temperature that change to liquid state at very low temperature (approximately 20K for LH 2 and 90K for LOX). Cryogenic propellants pose storage and handling problems. Elaborate insulation must be provided in order to minimize losses due to boil off, the complexity depending on storage period and type of cryogenic. Adequate venting systems are needed for the developed gases. Storage and handling equipment and their components are extremely sensitive to atmospheric or other moisture; even minute quantities may cause a jamming of, for instance, a valve. Likewise, the detection of a failure is an important part of the process.

These hazards must be considered when designing an engine system using bi-propellant chemical propulsion systems. Propellants are then chosen according to several criteria. Their chemical nature, the economic factor as well as the performance of their combustion. Indeed, the propellants must:

• Be easily available and in sufficient quantity.

• Be economically affordable.

• Take into account several factors concerning the supply chain, production, storage and handling: the complexity of production, the equipment required, accessibility, toxicity, safety, production times, storage materials and staff training.

• Produce efficient combustion: high specific thrust / heat and high combustion energy for mass unit of propellants.

In addition, several safety criteria must be considered:

• Corrosion: changes in chemical and physical properties in contact with corrosive products, damage to the structure or parts.

• Explosions: instability of the propellants (impurities, temperature, shocks, mixtures).

• Leaks: operations, transport, fire risk, health risk, environmental risk.

• Toxicity: contact, poisoning, long-term or short-term illnesses.

• Compatibility of the equipment: Fire risk, leakage, corrosion, malfunction, stress resistance, temperature resistance, catalysis, explosions.

• Stability: weak reaction with the atmosphere, decomposition, deterioration. The most commonly used propellant distribution system employs turbo-pumps to deliver the propellants to the injectors at high pressure and flow rate. The turbo-pumps are driven by hot gas, generated in a separate combustion chamber or gas generator; in some cases hot gas, bled off from the cooling system or from the combustion chamber itself, is used.

Combustion chamber

A certain ratio of oxidizer to fuel in a bipropellant combustion chamber will usually yield a maximum performance value. This is defined as the optimum mixture ratio. As a rule, the optimum mixture ratio is richer in fuel than the stoichiometric mixture ratio, at which theoretically all the fuel is completely oxidized, and the flame temperature is at a maximum. This is because a gas which is slightly richer in fuel tends to have a lower molecular weight due to presence of hydrogen molecule or atom. The optimum mixture ratio of some propellant combinations shifts slightly with changes in chamber pressure. Also, in actual application the mixture ratio may be shifted away from the optimum value for one of the following reasons: lower chamber temperature to stay within the temperature limitations of chamber construction material, required coolant flow, improved combustion stability. The detection of failures in the injection is then an important part of the process performance and safety.

Cooling system

Because of the high combustion temperatures, thrust chamber cooling becomes major design consideration. For short duration operation (up to a few seconds), uncooled chamber walls can be used. In this case, the heat can be absorbed by the sufficiently heavy chamber wall material which acts as a heat sink, before the wall temperature rises to the failure level. Moreover, some thermal barrier coating can be applied. For more longer duration applications, a steady-state chamber cooling system has to be employed. The following chamber cooling techniques:

1. Regenerative cooling: Regenerative cooling is the most widely applied method and utilizes one or possibly both of the propellants, feed through passages in the thrust chamber wall for cooling, before they are injected into the combustion chamber. Thus, the thermal energy is not wasted and reinjected in the combustion chamber for a maximum efficiency.

2. Dump cooling: With this principle, a small percentage of the propellant, is fed through passages in the thrust chamber wall for cooling and subsequently dumped overboard through opening at the rear end of the nozzle skirt. Because of inherent problems, this method has only limited application.

3. Film cooling: Here, exposed chamber wall surfaces are protected from excessive heat with thin film of coolant or propellant which is introduced through manifold orifices in the chamber wall near the injector and usually in several more planes toward the throat.

The method has been widely used, particularly for high heat fluxes, either alone or in combination with regenerative cooling.

Transpiration cooling:

Transpiration cooling is accomplished by introducing a coolant (either gaseous or liquid propellants) through porous chamber walls at a sufficient rate to maintain the desired combustion gas side chamber wall temperature. This method is essentially special type of film cooling and has been widely used.

Ablative cooling:

In this process a sacrifice of combustion-chamber gas-side wall material made by melting and subsequently vaporizing it to dissipate heat. As a result, relatively cool gases flow over the wall surface, thus creating a cooler boundary layer assisting the cooling process. Ablative cooling has been used in numerous designs, initially mainly for solid propellant systems, but later equally successfully for low chamber pressure pressurefed liquid systems. Usually, this technique is use for the throat region, where heat fluxes are maximum.

6. Radiation cooling: With this method, heat is radiated away from the surface of the outer thrust chamber wall. It has been successfully applied to low heat flux regions, such as nozzle extensions.

In practice, the design of thrust chamber cooling systems is a major step in the complete engine system design. It cannot be treated independently without due consideration of other engine system aspects. For instance, optimization of the chamber pressure value for a highperformance engine system is largely limited by the capacity and efficiency of the chamber cooling system. In turn, chamber pressure will affect other design parameters such as nozzle expansion area ratio, propellant injection pressure, and weight.

Engine cycles

Engines with turbo pumps in their feed systems have become the favorite approach for almost all largest LPRE [START_REF] George P Sutton | History of liquid propellant rocket engines[END_REF]. There are several different designs whereby a turbine can be integrated into a LPRE, and this has been classified as different engine cycles (see Figure 3.2). An engine cycle describes the propellant flow paths through the major engine components, the method of providing hot gas to one or more turbines, and the method of handing and discharging the turbine exhaust gas. During a closed cycle, all of the propellants go through the combustion chamber, where they are burned efficiently, whereas an open cycle has most of the gasified propellant go through the combustion chamber, but a small flow coming from the turbine exhaust is dumped overboard or dumped into the nozzle exit at a pressure lower than the combustion chamber pressure.

There are actually five principal flown cycles. Gas generator cycle: The gas-generator (GG) cycle has a separate gas generator, where fuel and oxidizer are burned at a mixture ratio that results in low enough temperature for the turbine inlet gases to allow uncooled turbines. The gas is then exhausted. This cycle is the simplest, often the lowest in cost, gives a low engine inert (empty) mass, but gives somewhat lower performance than the expander or the staged combustion cycles. There are several advantages to the gas-generator cycle over its counterpart, the staged combustion cycle. The gas generator turbine does not need to deal with the counter pressure of injecting the exhaust into the combustion chamber. This simplifies plumbing and turbine design, and results in a less expensive and lighter engine. The main disadvantage is a loss of efficiency due to discarded propellant. Gas-generator cycles tend to have lower specific impulse than staged combustion cycles because they usually have lower internal pressures. However, there are forms of the gas-generator cycle that recycle the exhaust into the nozzle of the rocket engine. The GG cycle is used in Vulcain engine.

Expander and bleed cycles:

The expander-engine cycle relies on using a cryogenic fuel, which is gasified and heated in the thrust chamber cooling jacket, to drive the turbine(s). The relatively cool turbine exhaust gas of evaporated fuel is subsequently fed into the combustion chamber. There are no GGs or preburners. The performance of such an engine is slightly better than the gas-generator cycle (they are linked to the open / closed nature of the cycle and closed cycles have better performances than open ones), but the internal fuel pressures and inert engine mass are somewhat higher than an engine with an equivalent GG cycle. The expander cycle works only with a cryogenic fuel that can be evaporated, such as hydrogen. It would not work with storable fuels, such as kerosene. To date all LPRE with an expander engine cycle have used LOX/LH 2 .

A variation of this expander cycle is the coolant bleed cycle. The turbine exhaust flow is dumped into the nozzle exit, and this gas flow contributes to some of the nozzle gas expansion. An engine with this cycle is not quite as efficient as one with a pure expander cycle, but its performance is better than an engine with a GG cycle.

Staged combustion cycle:

The staged combustion cycle uses propellant flows through multiple combustion chambers. Typically, propellant flows through two kinds of combustion chambers; the first called preburner and the second called main combustion chamber. In the preburner, a small portion of propellant is combusted, and the over-pressure produced is used to drive the turbo-pumps that feed the engine with propellant. In the main combustion chamber, the propellants are combusted completely to produce thrust. The main advantage relative to other rocket engine power cycles is high fuel efficiency, measured through specific impulse, while its main disadvantage is engineering complexity. The fuel efficiency of the staged combustion cycle is in part a result of all propellant ultimately flowing to the main combustion chamber; contributing to thrust. The staged combustion cycle is sometimes referred to as closed cycle, as opposed to the gas generator, or open cycle where a portion of propellant never reaches the main combustion chamber.

Tap-off cycle:

The combustion tap-off engine cycle has also been called a topping cycle or a chamber bleed cycle, and it uses a bleed or tap-off of a small quantity of combustion gas, which is cooled to a warm gas temperature and used to drive the turbine. The turbine exhaust is either dumped overboard or into the lower part of the diverging nozzle. This is an open cycle, since not all the propellants are evacuated through the main chamber. The tap-off cycle is similar to a gas generating cycle where the turbine is fed by the main combustion chamber rather than by a separate gas generator. The cycle performances have been shown to be the same as the one with gas-generator cycle, but the investigators believed that it could be improved.

MASCOTTE test facility description

The MASCOTTE test facility was developed by ONERA to study elementary processes (atomization, droplets vaporization, turbulent combustion...) which are involved in the combustion of cryogenic propellants [START_REF] Ordonneau | PLIF investigation of reactive flows in the separation region of an over-expanded twodimensional nozzle[END_REF][START_REF] Ordonneau | First results of heat transfer measurements in a new water-cooled combustor on the Mascotte facility[END_REF]. Those studies in well-controlled and representative operating conditions are needed to optimize the design of high performance LPREs. For this purpose, MASCOTTE is aimed at feeding a single element combustor with actual propellants [START_REF] Vingert | Evolution of the MASCOTTE test bench to high pressure operation and related 234 combustor technology issues[END_REF]. Five successive versions of this test facility were built up. The MASCOTTE project started in 1991.

The civil engineering, the fluid storage and feeding lines were achieved in 1992; the electrical systems and computerization, as well as the level O and improve the knowledge and the modeling of physical phenomena, provide experimental results for computer code validation, improve and assess diagnostic techniques.

In this section we describe the different configurations and operating modes of MASCOTTE test bench (Figures 3.4 and 3.3) [START_REF] Vingert | Dossier de définition et de réalisation de Mascotte V05[END_REF]. The thrust chamber body subassembly (Figure 3.5) consists of:

• a cylindrical section in which the combustion occurs;

• a section narrowing toward a throat;

• an expanding nozzle section through which the combustion gases are expelled.

This chamber is composed of three ferrules (Figure 3.3):

• Two heat measurement ferrules.

• The upstream ferrule is slightly more complex; it is equipped with the ignition torch and a larger number of thermocouples. The igniter is located in the uphill flange of the first ferrule.

MASCOTTE test bench operates with oxygen (liquid or gaseous) and hydrogen or methane (gaseous) propellants. The combustion is initiated by ignition devices such as chemical pyrotechnic igniters (ignition torch). The propellants flow through the injector orifices into the thrust chamber combustion zone. The thrust chamber injector (Figure 3.6) is a round plate, honeycombed with circular and radial inner passages, leading to drilled orifices. A threaded hole is provided in the center of the injector face to permit pyrotechnic thrust chamber igniter installation. The injector is composed of Pitots fed from the main propellant systems.

The main techniques to cool the MASCOTTE chamber are the following:

• Water cooling via tubular heat exchanger.

• Helium film cooling of the throat.

As for MASCOTTE test bench, this circuit permits to cool the ferrules of the combustion chamber, the cuff and the axisymmetric nozzle. As said before, the detection of a leak or an obstruction is a critical safety task for the bench operation. The water-cooling circuit consists of different pipes sections with multiple valves and a tank at the inlet. The available measurements are pressure, mass flow and temperature. Sections are separated by sliding valves with additional pressure measurements. The diameters of the diaphragms fixing mass flow rates were determined at the end of the development tests of the water circuit. The water tank is pressurized thanks to the high pressure (HP) air network distributed on the various facilities of the ONERA Center. So, we can consider the HP air pressure sensor downstream of the regulator as part of the water circuit.

Thermal measurements configuration

As part of the joint CNES/ONERA program, it was decided in 2006 to develop experimental means to conduct [START_REF] Hervat | Projet CONFORTH: Dossier de définition[END_REF], under conditions similar to those encountered in rocket engine combustion chambers (i.e. high pressure and mixing ratio close to the stoichiometric value), research on wall heat transfers in both the combustion chambers and nozzles (CONFORTH). In this context, ONERA has undertaken a study to design a cooled assembly consisting of a multi-injector injection head, a modular combustion chamber and a planar nozzle, compatible with operation at high pressure and high mixing ratio. This new assembly must allow a liquid propellant supply by multiple coaxial injectors to obtain a good homogeneity of the flow temperature throughout the outlet section from the combustion chamber. The objective of studying thermal transfers also requires different subsets of a multitude of temperature sensors distributed in such a way as to go back to a complete mapping of wall temperatures and heat flows exchanged.

This configuration must allow the following operations:

• The mixing ratio for the oxygen/hydrogen pair will be between 0.9 and 8 (the more constraining conditions). This leads to gas temperatures up to 3600 Kelvin.

• The maximum operating pressure will be of 70 bar.

The sub-assembly "injection head" is composed of four main elements:

• the head body,

• the injection studs of oxygen,

• plugs,

• a sleeve.

The mechanically welded body, the main part of the injection head, ensures the supply of propellants and has a liquid nitrogen cooling circuit for maintaining oxygen in the liquid phase for

• The part cooling the walls before the visualization window,

• The part cooling the bottom before the visualization window,

• The part after the visualization window composed of four lines,

• The part cooling the walls after the visualization window,

• The part cooling the bottom after the visualization window,

• The line cooling the helium throat.

Visualization module configuration

The visualization module has two identical flanges so that it can be turned over in order to move away from the optical measurement area from the injection location. In addition, it can be mounted directly behind the injection head (need for a suitable sleeve) or after a section of thermal measurements. Depending on the configuration, one or two cross-section transformation parts are required to switch from the cylindrical section to the section with the four plates. The eight cooling channels have special forms to bring water to all areas to be cooled.

Sensors equipment

The measuring sleeves are equipped with different sensors to control the parameters of the test run and to provide better safety in the operation of the unit. These additional measures are arranged as follows. Upstream ferrule:

• One dynamic pressure sensor,

• One static pressure sensor.

Downstream ferrule:

• One dynamic pressure sensor,

• One static pressure sensor.

Upstream ferrule, water side:

• One static pressure taps at the inlet,

• One static pressure measurement at the outlet.

Downstream ferrule, water side:

• One static pressure taps at the inlet,

• One static pressure taps at the outlet,

• One output flow measurement.

Dynamic pressure sensors are not used for the development of the HMS system. In the downstream flange of the first measuring sleeve, a thermocouple is used to ensure that the temperature at the piston-mounted seal remains acceptable throughout the boost. Along the water circuit (see Figure 3.8) there are in total:

• Six "inlet" pressure sensors: located respectively at the top of the water sphere, after a valve, at the inlet of the cuff, at the inlet of the first ferrule, at the inlet of the nozzle and on the water torus.

• Six "output" pressure sensors: located respectively at the foot of the sphere, at the outlet of the sleeve, at the exit of the first ferrule, at the exit of the second ferrule, at the exit of the third ferrule and at the throat of the nozzle.

• A flow-meter: one at the inlet of the nozzle, one at the exit of the ferrules and one at the exit of the sleeve. The injection head has measurements to define the exact operating conditions for each of the propellants' circuits:

• LOX circuit: One Kistler pressure sensor and one thermocouple located upstream of the Pitot support;

• Fuel circuit: One Kistler pressure sensor, one static pressure measurement, and one thermocouple located upstream of the Pitot support.

In addition, failure mode analysis has highlighted the need for a thermocouple in the cavity just before the injection (safety measurement). This thermocouple allows to notice a flame rising in this cavity and in this case to consider a control of the internal state of the injection head.

Synthesis of failure modes and effects analysis

The most common failures for MASCOTTE test bench operations are the followings [START_REF] Vingert | Analyse des risques génériques du banc Mascotte[END_REF]: This FMEA extract (Table 3.3) points out the necessity to monitor the lines and cooling circuit pressures or mass flow rates and temperatures, as well as the injection pressure-drops. Those kinds of failures may be critical or simply impact the engine performances.

Thrust chamber modeling and main equations

In this section we first consider a non-viscous ideal fluid system with heat exchanges. The notations are in the nomenclature.

Balance equations for non-viscous compressible unsteady flows

Continuity equation:

The total mass can be represented by the sum of the densities over the total volume and does not change over time. According to the Leibniz-Reynolds theorem and the Gauss theorem, we find an equation of mass balance (continuity equation).

dM dt = d dt V (t) ρdV (3.1) ∂ ∂t V (t) ρdV + S ρu.ndS = 0 (3.2)
The time evolution of the mass is equal to the sum of the input and output flows.

Momentum balance equation:

The Euler momentum equation is an extension of Newton's law M Γ = F ext to fluids. According to the Leibniz-Reynolds theorem, the Gauss and Green-Ostrogradsky theorem, we find an equation for the momentum conservation.

Γ = du dt (3.3) M du dt = F ext (3.4) M u = V (t) ρudV (3.5) ∂ ∂t V (t) ρudV + S ρu(u.n)dS = F ext (3.6) V (t) ∂ρu ∂t dV + S ρu(u.n)dS + S P ndS = 0 (3.7)
The difference between the input and output momentum over a period ∆t causes an increase in the momentum contained in the control volume. Speed is transported at its own velocity and the pressure gradient creates a movement.

For a moderate turbulent flow in a smooth pipe the momentum balance equation considering friction forces is given by:

V (t) ∂ρu ∂t dV + S ρu(u.n)dS + S P ndS = -F f (3.8)
The friction forces can be expressed using the Blasius relation and the Darcy-Weisbach friction factor [START_REF] Nakayama | Introduction to fluid mechanics[END_REF]:

F f = λ f ρ Lu 2 2D h (3.9)
with

λ f := 0.316R -1 4 e (3.10)

Energy balance equation:

From the first law of thermodynamics, considering the total amount of energy in the entire control volume E t = V (t) ρEdV , we obtain the following equation:

d dt V (t) ρEdV = - S ρEu.ndS - dW dt + dQ dt (3.11) d dt V (t) ρEdV = - S ρEu.ndS - S P u.ndS + S q.ndS (3.12)
For heat exchanges, it can be written, taking into account that the wall-fluid system tends towards thermal equilibrium we have:

d dt V (t) ρEdV = - S ρEu.ndS - S P u.ndS + S k∇T.ndS (3.13)
Then the global heat transfer coefficient λ can be calculated by taking into account the thermal conduction in the walls and the convection over a heat transfer surface.

In the case of internal forced convection for short pipes with laminar flow, an initial simple approach is to utilize the dimensional analysis to obtain important parameters and dimensionless numbers. For the coolant side flow, considering a steady laminar flow of an incompressible fluid in a convectional tube. The local heat transfer coefficient can then be determined from the Nusselt number as a function of the fluid properties, geometry, temperature, and flow velocity: The Reynolds number R e is given by:

N u := hL c λ (3.
R e := ρD h u µ = D h ṁ µS = 4 ṁ πD h µ (3.16)
for a fully established flow in a circular pipe. The Prandtl number P r is defined as:

P r := µC p k (3.17)
The global heat transfer coefficient is given by:

λ := h 1 1 + he wall k wall S exc (3.18)
Here, he wall k wall is the Biot number characterizing the impact of the internal flux and external flux via the ratio of the heat transfer resistances.

In other cases, for the gas side flow, in order to compensate for some of the boundary layer temperature gradient effects on the various gas properties in rocket combustion, one can use Bartz semi-empirical correction factors [START_REF] John | Comparative Studies of Convective Heat Transfer Models for Rocket Engines[END_REF]:

h g := ρu g C p,0 0.026 µ 0 0.2 C p,0 0.6 k 0 µ 0 0.6 ṁ-0.2 S 0.1 exc π/4 R curv D th 0.1 (3.19)
The subscript 0 refers to properties evaluated at the stagnation or combustion temperature and ρ is the free-stream value of the local gas density. The gas velocity u g is the local free-stream velocity corresponding to the density ρ.

Combustion model for a GH2/LOX ideal rocket engine

The engine is supposed ideal, those assumptions are supposed valid [START_REF] Martin | Rocket and spacecraft propulsion: Principles, practice and new developments[END_REF]:

1. The working substance (or chemical reaction products) is homogeneous.

2. All the species of the working fluid are gaseous. Any condensed phases (liquid or solid) add a negligible amount to the total mass.

3. The working substance obeys the perfect gas law. There is no heat transfer across the rocket walls; therefore, the flow is adiabatic.

4. There is no appreciable friction and all boundary layer effects are neglected.

5. There are no shock waves or discontinuities in the nozzle flow.

6. The propellant flow is steady and constant. The expansion of the working fluid is uniform and steady, without vibration. Transient effects (i.e., start up and shut down) are of very short duration and may be neglected.

7. All exhausts gases leaving the rocket have an axially directed velocity.

8. The gas velocity, pressure, temperature, and density are all uniform across any section normal to the nozzle axis. 9. Chemical equilibrium is established within the rocket chamber and the gas composition does not change in the nozzle (frozen flow). 10. Stored propellants are at room temperature. Cryogenic propellants are at their boiling points.

Chemistry model:

In the combustion of hydrogen with oxygen it is possible to identify six main products: water, di-hydrogen, di-oxygen, hydroxyl radical, atomic oxygen, and atomic hydrogen. In this case all the reactants and products are gaseous. Theoretically, there could be two additional products: ozone O 3 and hydrogen peroxide H 2 O 2 ; however, these are unstable materials that do not readily exist at high temperature, and they can be ignored. The chemistry model used is a simplified version of the Eklund model [START_REF] Ranzi | A wide-range kinetic modeling study of oxidation and combustion of transportation fuels and surrogate mixtures[END_REF] and contains six reacting species denoted • α :

H 2 , O 2 , H 2 O,
OH, H and O. The considered reactions are the following:

H 2 + O 2 ↔ 2OH (3.20) H + O 2 ↔ O + OH (3.21) OH + H 2 ↔ H 2 O + H (3.22) O + H 2 ↔ OH + H (3.23) 2OH ↔ H 2 O + O (3.24) OH + H ↔ H 2 O (3.25) 2H ↔ H 2 (3.26)
The left side shows the condition before (denoted • d ) and the right side after the reaction (denoted • in ). Rocket propulsion systems usually do not operate with the proportion of their oxidizer and fuel in the stoichiometric mixture ratio. Instead, they usually operate fuel-rich because this allows lightweight molecules such as hydrogen to remain unreacted; this reduces the average molecular mass of the reaction products, which in turn increases the specific impulse. For rockets using H 2 and O 2 propellants the best operating mixture mass ratio for high performance rocket engines is typically between 4.5 and 6.0, not at the stoichiometric value of 8.0.

Reactive conservation equations:

For a liquid propellant rocket the idealized theory postulates an injection system in which the fuel and oxidizer are mixed perfectly so that a homogeneous working substance result. A good rocket injector can approach this condition closely. As said before, since temperature is typically high, all gases are well above their respective saturation conditions, they actually follow the perfect gas law very closely [START_REF] Phibel | CARINS: Modèle de chambre de combustion à gaz parfaits non idéaux avec phase liquide (Dossier de définition)[END_REF].

The mass fractions are given by:

dc αi dt = 1 ρV i =j (c αj -c αi ) ṁe ji + Ẇiα ρ i (3.27)
The chamber pressure is given by:

dP i dt = γ i -1 V j =i γ j P j (γ j -1)ρ j + C vjα C vi (γ j -γ i )P i (γ i -1) 2 ρ i ṁe ijα (3.28) - P i γ i ρ i V ṁs ij -(γ i -1) Ẇi + γ i γ i -1 P i ρ i α C pα C pi - C vα C vi Ẇiα (3.29)
where i and j corresponds respectively to the chamber cavity and the injections cavities. α corresponds to the reactants and products.

Using the perfect gas law, the chamber temperature is given by:

T i = P i ρr i (3.30)
with the gas constant r i = ( α C α r α ) i . The density in the chamber is given by:

dρ i dt = ṁe ij -ṁs ij V (3.31)
The ideal engine hypothesis implies the use of the isentropic expansion relations in the expansion nozzle, thereby describing the maximum conversion of heat to kinetic energy of the jet. This also implies that the nozzle flow is thermodynamically reversible. The throat pressure P th for which the isentropic mass flow rate is a maximum is called the critical pressure. The maximum gas flow per unit area occurs at the throat where there is a unique gas pressure ratio which is only a function of the ratio of specific heats γ. This pressure ratio is found by setting M = 1. The ejected mass flow rate is then given by:

ṁs ij = S th ρc 2 γ + 1 γ+1 2(γ-1) (3.32)
Ẇ corresponds to the global reaction rate:

Ẇ = Ẇ d -Ẇ i (3.33)
The global direct and inverse reaction rates given by:

Ẇ d = K d (T ) α [C d α ] n d α (3.34) Ẇ in = K in (T ) α [C in α ] n in α (3.35) K d (T ) = A d T αr d exp - T d Ar T (3.36) K in (T ) = A in T αr in exp - T in Ar T (3.37)
with T Ar the activation temperature and . r the modified Arrhenius temperature exponent.

Characteristic velocity:

The characteristic velocity is basically a function of the propellant characteristics and combustion chamber design and is independent of nozzle characteristics. It is defined as:

c = P th S th ṁexp (3.38)
This equation allows the determination of c from experimental data of ṁ, P th , and S th .

Specific impulse:

The specific impulse I s is the total impulse per unit weight of propellant. It is an important performance parameter of a rocket propulsion system. A high value means better performance.

For a constant thrust and propellant flow it is expressed as:

I s = F ṁg 0 (3.39)
where F is the thrust, ṁ is the propellant mass flow and g 0 is the standard acceleration of gravity.

MASCOTTE test facility models

The objective of this section is to design representative models of the evolution of a thrust chamber health that are simple enough (nonlinearities, uncertainties) to used real-time model-based HMS on their basis. For this purpose it is necessary to take into account the thermomechanical positionning and working range constrainsts of the sensors and actuators. From those constraints and the FMEA analysis in section 3.3, models of the propellant feeding lines mass flow rates, propellants injection pressure and cooling system mass flow rates, pressures and temperatures have be designed. Those models are obtained from the continuity, momentum balance and energy balance equations given in section 3.4. A Sobol sensitivity analysis is used to investigate how perturbations on the input variables of the models cause perturbations on the response variables. The Sobol sensibility analysis is a global sensitivity analysis method, which focus on the variability of the models' output over their entire range of variation. The overall sensitivity analysis studies how the variability of inputs affects the variability of outputs, determining how much of the variance of output is due to a particular input or set of inputs. The number of Monte-Carlo simulations used is of 1e5. The given inputs are real input data from MASCOTTE test facility.

Cooling system

The circuit between two ferrules can be modeled by two cavities defined in pressure and temperature linked by a pipe where friction forces and heat flux exchanges are taken into account, see [START_REF] Iannetti | Development of model-based fault diagnosis algorithms for MASCOTTE cryogenic test bench[END_REF]. The flow is assumed to stay monophasic and incompressible. The cavity section is assumed constant. We assume that the fluid flow velocity in cavities is negligible in comparison to the velocity of sound.

The flow crossing cavities respects the conservation of continuity equation (3.2), after integrating this equation over the cavity volume, we obtain:

∂P ∂t = c 2 V ( ṁe -ṁs ) (3.40)
The flow through the pipe between the two cavities respects the momentum balance equation with friction forces (3.8), expressed with the Darcy-Weisbach and Blasius equations for moderate turbulent flows in a smooth pipe.

After integrating this equation over the pipe volume and the flow cross-section, we obtain:

1 S 2 ∂ ṁ ∂t + ∆P V pi = -0.316 4 ṁ πDµ -1 4 L D h ṁ2 2ρV pi S 2 (3.41)
with ∆P := P s -P e , where e is for the input cavity and s for the output cavity.

The model of this part of the cooling system is then:

∂ ṁe ∂t = θ 1 ṁ 7 4 e -θ 2 ∆P ∂Ps ∂t = -θ 3 ∆ ṁ (3.42) with ∆ ṁ := ṁs -ṁe , θ 1 := -0.316( 4 πDµ ) -1 4 L D h 1 2ρV pi , θ 2 := S 2
V pi and θ 3 := c 2 V . For AFTC purposes, the mass flow rates between the different pressure and temperature sensors as well as those variables are considered, so that the cooling system is divided in different sections. The parameter θ 1 must be identified since the distance L is unknown. We can assume here that the density and the viscosity remain constants for the considered pressures and temperature ranges. A first model with a constant mass flow rate, of the cooling circuit has been proposed in [START_REF] Iannetti | Development of model-based fault diagnosis algorithms for MASCOTTE cryogenic test bench[END_REF].

One way to identify θ 1 is to use recursive LS by selecting one steady-state equilibrium point for the mass flow rate and the pressures. An alternative used here is the Hagen-Poiseuille formula [START_REF] Nakayama | Introduction to fluid mechanics[END_REF] in one steady-state equilibrium point for the mass flow rate and the pressures to express the unknown length as a function of the average mass flow rate ṁav :

L = - ρS 32µ ∆P ṁav D 2 (3.43)
The Sobol sensitivity analysis indicates that the parameter θ 1 has a global sensitivity index of 0.9952. This is coherent with the implied physical phenomenon since the mass flow rate variation is mainly due to pressure losses in the pipe. This result combined with the satisfactory obtained deviations (see Table 3.5) indicate that the formula used to evaluate θ 1 is accurate.

A previous model (denoted model 1) of the cooling system for FDI purposes was developed in [START_REF] Iannetti | Fault diagnosis benchmark for a rocket engine demonstrator[END_REF]. This model presented approximations in the transient assuming that the mass flow rate was constant (see Table 3.4). So that the mass flow rate dynamics was not modeled. The new model presented here allows to determine the pressure but also the mass flow rate and it is now possible to model their evolution during the engine transients. The model was tested offline with real measurements of MASCOTTE as inputs and compared to the previous model. The final evolution of the pressure dynamics is well reconstituted (Figure 3.9, Table 3.4, Table 3.5). The energy balance can be written for the cavities using equation (3.13). The heat flux is written:

∆Q = h 1 1 + he wall k wall (T wall -T av )S exc (3.44)
We denote ∆T := T s -T e . To obtain the water convection coefficient we use the Colburn correlation [START_REF] Frederick | Process heat transfer[END_REF]:

h = λ D 0.023 ṁL µ 0.8 µC v λ 1/3 (3.45)
After integration, the temperature model is given by (Figure 3.10):

∂T av ∂t = S exc θ 1 ṁ0.8 (1 + θ 1 ṁ0.8 θ 2 ) -1 ρC v V (T wall -T av ) - ṁ ρV ∆T (3.46)
with θ 1 := λ D 0.023( L µ ) 0.8 ( µCv λ ) 1/3 , θ 2 := e wall k wall and T av := 1 2 (T s + T e ). The Sobol sensitivity analysis indicates that the parameter θ 1 has a global sensitivity index of 0.8738 and the parameter θ 2 has a global sensitivity index of 0.2364. Those values are coherent with the modeled physical phenomenon. Indeed, the water convection coefficient h represents the capacity of the water to exchange heat in the pipe for a given flow velocity. In addition, the wall stiffness e wall combined with the wall conductivity k wall represent the resistance to the flow of heat by the material of the pipe wall.

Propellant feeding lines

The portion of the gaseous oxygen (GOX) / gaseous hydrogen (GH 2 ) lines modeled is located between the outlet of the heat exchanger and the sensor upstream of the nozzle fixing the injection rates. Using the momentum balance (3.8), taking into account regular pressure drops for perfect gases and assuming that the temperature is remaining constant along this section of the line (the sound velocity is also assumed to be constant); then after integrating over the pipe volume and the flow cross-section we have:

∂ ṁ ∂t = - c 2 λ f L γ2DV ∆P ṁ2 ln P (L) P (0) -S L ∆P -c 2 ṁ2 γV 1 P (L) -1 P (0) (3.47)
with ∆P := P (L) -P (0), where L and 0 are respectively the pressure measurements at the end and the beginning of the pipe. The friction coefficient is determined from the following correlation: λ f = 64 Re , for a laminar flow in a tubular pipe. The Sobol sensitivity analysis indicates that the friction coefficient has a global sensitivity index of 0.8738. This value is coherent with the modeled physical phenomenon. Indeed, the mass flow rate variation is mainly due to pressure losses in the pipe.

The model has been tested on offline real data and has been validated in comparison with the incompressible model of CARINS (low Mach) (see Figures 3.11 The satisfactory deviations in Table 3.6 and the Sobol sensitivity analysis indicate that the correlation used to evaluate the fiction coefficient is accurate and this part of the model is representative of the pressure losses in the propellant feeding pipes.

Propellant injection

The flow after the diaphragm of the lines is given by the isentropic expansion equation. The characteristic speed is assumed to be given for a nominal operation, the mixture ratio can be calculated from the flow measurements or assumed to be constant in nominal operation (these values are predetermined before a test and must remain constant in order to maintain the engine performance see Figures 3.13 and 3.14). The continuity equation at the injection (3.2) plus the expression of the mass flow rate after the sonic throat is given by: ṁline = γP th S th,line c

2 γ + 1 γ+1 2(γ-1) (3.48)
The injected propellant flow rate approximated for the fuel is given by (for the oxidant one replaces M R with 1/M R):

ṁinj = P c,div S th,div c (M R + 1) (3.49)
Which gives after integration, the evolution of the injection pressure over time:

∂P inj ∂t = - c 2 V γP th S th,line c 2 γ + 1 γ+1 2(γ-1) - P c,div S th,div c (M R + 1) (3.50)
The Sobol sensitivity analysis indicates that the unknown term c (M R + 1) obtained from correlations based on experience has a global sensitivity index of 0.5431. This value is coherent with the modeled physical phenomenon. Indeed, the correlation used to approximate c is obtained for the permanent phases for a given chamber temperature. This approximation is the reason why in the transient the deviations are higher. From those figures and the deviations (Table 3.7) we can see a deviation of the GOX injection pressure model from the measured output. This can be explained by the shutdown sequence, the GOX injection is stopped before the GH 2 injection which implies a pressure drop that is not taken into account in the model. As said before, the transient deviation is due to the input mass flow rate definition, for validation purposes we use a constant characteristic speed implying a faster pressure variation. However, in the case of the developed AFTC the parameter c (M R + 1) will be taken into account as an unknown input so that the pressure estimate will not depends on it. The other variations are due to input noises.

Chamber pressure

The model of the chamber pressure based on the ideal rocket engine assumption for a LOX/GH 2 operation can be found in Appendix A. This model has not been exploit but can be used in further works to control the MR.

Chapter analysis and comments

In this chapter, models have been established for the different subsystems of the MASCOTTE test bench and principal subsystems of an ideal LPRE. Those models do not take into account the start-up and shutdown phases. They describe the evolution of the critical parameters of MASCOTTE following the FMEA: the combustion chamber pressure, the propellants lines mass flow rates and injections pressures, and the cooling system pressures, mass flow rates and temperatures. Those models are sufficiently accurate to use model-based FDI and FTC techniques. However, the established models can be improved by modeling the temperature evolution in the combustion chamber, improving the mass concentrations of the different species model and modeling the start-up and shutdown phases to developed an AFTCS over a wider range of applications.

nonlinear models with unknown inputs based on an Unscented Unknown Input Observer (UUIO) is developed. The unknown input is then reconstructed with the help of a high-order sliding mode observer or a direct inversion method in the case of the nonlinear system. Then the residual analysis method is presented in the next section with a CUSUM algorithm using an EWMA chart to detect a mean shift. This part of the AFTCS can be seen in Figure 4.1. The residual generation algorithms have been validated on MASCOTTE test bench real data and residual evaluations methods have been tested on simulated data generated with CARINS.

Observer-based residual generation

As introduced in section 2.3, the most common model-based approach for FDI makes use of observers to generate residuals as presented in [START_REF] Steven X Ding | Model-based fault diagnosis techniques: Design schemes, algorithms, and tools[END_REF], [START_REF] Hwang | A survey of fault detection, isolation, and reconfiguration methods[END_REF]. Faults are then detected by setting a fixed or variable threshold on each residual signals as in [START_REF] Basseville | Detection of abrupt changes: theory and application[END_REF]. Those FDI methods assume that the mathematical model used is representative of the system dynamics [START_REF] Paul | Handling modelling uncertainty in fault detection and isolation systems[END_REF][START_REF] Gertler | Fault detection and diagnosis[END_REF]. The methods commonly used nowadays for HMSRE [START_REF] Gubanov | USSR main engines for heavy-lift launch vehicles-Status and direction[END_REF][START_REF] Huang | Key reliability drivers of liquid propulsion engines and a reliability model for sensitivity analysis[END_REF] are a basic engine redline system as well as advanced sensors and algorithms including multiple engine parameters that infer an engine anomaly condition from sensor data and take mitigation action accordingly. Basic redlines are straightforward in that they usually act on a single operating parameter anomaly [START_REF] Feng | Research on health evaluation system of liquid-propellant rocket engine ground-testing bed based on fuzzy theory[END_REF]. Those methods can induce false alarms or undetected failures that can be critical for the operation safety and reliability. Moreover, designing representative mathematical models is challenging in practice because of the presence of modeling uncertainties and unknown disturbances [START_REF] Chen | Design of unknown input observers and robust fault detection filters[END_REF], [START_REF] Yang | Observers for linear systems with unknown inputs[END_REF], [START_REF] Bittner | An integrated process for FDIR design in aerospace[END_REF] to which the developed FTCS should be robust. The employed method is then a model-based approach making use of observers to estimate the state of the system and to generate residuals for detection purposes. The considered states are:

• The output pressures, temperatures and input mass flow rates of each line of the cooling system. For detection purpose, only the pressures and mass flow rates are considered.

• The mass flow rates in the propellant feeding lines

• The injection pressure of the propellants in the combustion chamber

Observer definition

The objective of an observer is to reconstruct the internal state of a system using a dynamic algorithm and hence, depends on the linear or nonlinear nature of the dynamics and observations. Considering a general system of the form:

Ẋ = f (X, U ) Y = h(X, U ) (4.1)
with X the state in R n , U an input with values in R nu , Y the output with values in R m and f and h sufficiently many times continuously differentiable functions defined on R n × R nu . A more rigorous mathematical definition of observer is then given in [START_REF] Bernard | Synthèse d'observateur pour systèmes non linéaires[END_REF].

It is denoted:

X((X 0 , Z 0 ); t; U ) can be read directly from n components of Z(Z 0 ; t; U, Y X 0 ,u ). In the particular case where n = n z and T is the identity function, we may omit to precise T . Finally, when X 0 = R n , i.e. the convergence is achieved for any initial condition of the system, we say "observer" without specifying X 0 .

In the linear case to obtain an estimate of the state without using the derivatives of the output and the input, we can copy the dynamics of the system by directly integrating the system state equation from an initial condition. If the state distribution matrix is stable, then the observer state can be taken as an estimate because the estimation error tends towards zero. If the distribution matrix is unstable this method will not work because a small initial error will be amplified exponentially. It is then possible to modify the observer state by adding a linear application of the gain and the observation error. Thus, it is possible to choose the gain matrix so that the state solution of the new observer system converges towards the system state. In the nonlinear case an observer can be designed considering a cost function to minimize depending on the observer error, or with linearization techniques to use linear observers.

Observability

In order to build an observer, an observability property must be satisfied. A system is said to be observable if, for any possible sequence of state and control vectors, the current state can be determined in finite time using only the outputs. In the case of linear systems in the state space representation, there is a convenient test to check whether a system is observable with the Kalman criterion, if the row rank of the observability matrix is equal to the state dimension then the system is observable. In the case of nonlinear systems, a system is globally observable if for two dynamics there is an admissible input such that the outputs are identical. Since the global observability is not always verified, one can consider the local observability. A system is locally observable if one can instantaneously distinguish each state from its neighbors by carefully choosing the input. A criterion can then be verified considering the successive derivatives of the application associating the output to the state.

Extended observers

In the case of non-linear systems, one of the developed techniques is to linearize and design an extended observer or filter. For fault detection purpose, an EKF is used to generate the residuals (cooling system temperature, lines mass flow rates) or an EUIO (cooling system mass flow rate and pressure, propellant injection) as described in [211] in the case of unknown information that can be described as unknown inputs. Models from section 3.5 can be rewritten as a linear time-varying system with an unknown input by linearizing around a steady-state equilibrium trajectory. In EKF and EUIO, the state distribution is approximated by a Gaussian Random Variable (GRV) which is then propagated analytically through the "first-order" linearization of the nonlinear system. Then, the system can be transformed into an equivalent discrete-time state space system:

X k+1 = A k ( X)X k + BU k + ED k + w k Y k+1 = CX k+1 + v k+1 (4.6)
where X k is the state vector, Y k the measured output vector, U k the known measured input vector, D k the unknown input vector, and X the equilibrium state. With A k the state matrix, B the known input distribution matrix, E the unknown input distribution matrix, C the output distribution matrix, w k and v k are respectively the state noise and the measurement noise which are assumed to be zero-mean Gaussian with covariance matrices Q k and R k (see [START_REF] Iannetti | Méthodes de diagnostic pour les moteurs de fusée à ergols liquides[END_REF]).

Extended Kalman filter design

The KF is an optimal linear estimator for linear system models with additive independent white noise in both the transition and the measurement systems. In the case of differentiable Gaussian nonlinear systems without unknown inputs we use an EKF where the system is rewritten as a linear discrete time-varying system by linearizing around a steady-state equilibrium trajectory.

X k+1 = A k ( X)X k + B(U k + w k ) Y k+1 = CX k+1 + v k+1 (4.7)
The MASCOTTE test bench subsystems whose states are estimated with the help of an EKF can be found in Table 4.1.

Y := ṁinj Y := T av U := [P (L) P (0)] T U := [ ṁ T wall T e ] T
Given a random variable X, its expected value is denoted (X) = X and its covariance matrix P = ((X -X)(X -X) T ). The aim is then to build a recursive observer that computes an estimate Xk+1 of X k+1 from Y k+1 and the previous estimate Xk .

The first step is the prediction. We want to generate an intermediate estimate Xk+1|k by propagating Xk using the process dynamics described by our model.

The second step is the correction. We will correct the prediction on the basis of the difference between the measured and the predicted output.

The state covariance matrix is given by:

P k = ((X k -Xk )(X k -Xk ) T ) (4.8)
The EKF has then the following structure:

Xk+1 = Xk + K k (Y k -C Xk ) (4.9)
The prediction step gives:

P k+1|k = ((X k+1 -Xk+1|k )(X k+1 -Xk+1|k ) T ) (4.10) P k+1|k = A k+1 P k A T k+1 + B k+1 Q k B T k+1 (4.11)
In order to obtain the gain matrix K k which minimizes the variance of the state estimation error, the gain matrix is chosen then to be:

K k = P k C T (CP k C T + R k ) -1 (4.12)
The covariance matrix is then updated (corrected) with:

P k+1 = (1 -K k C)P k (4.13)
The residual is given by:

e k+1 = C Xk+1 -Y k+1 (4.14)

Extended unknown input observer design

In the case of non-linear systems one of the developed techniques is to linearize and design an EUIO as described in [211]. The MASCOTTE test bench subsystems whose states are estimated with the help of an EUIO can be found in Table 4.2. The objective is to design an observer depending only on known input and output measurements to tackle the problem of unknown disturbances. An EUIO with the following structure is proposed [211]:

Z k+1 = N k+1 Z k + K k+1 Y k + GU k Xk+1 = Z k+1 + HY k+1 (4.15)
The above matrices are designed in such a way as to ensure unknown input decoupling as well as the minimization of the state estimate error.

e k = Xk -X k = Z k -X k + HY k (4.16) e k+1 = (T A k -K k+1 1 C)e k + (G k+1 -T B k )U k (4.17) -(T A k -N k+1 -K k+1 C)Z k + (K k+1 2 -(T A k -K k+1 1 C)H)Y k -T ED k with K k+1 = K k+1 1 + K k+1 2 .
To reduce its expression to a homogeneous equation we impose:

G = T B (4.18) T A k -N k+1 -K k+1 1 C = 0 (4.19) T E = 0 (4.20) K k+1 2 = N k+1 H (4.21)
with:

T = I n -HC and n the dimension of the state, N k+1 Hurwitz to ensure the asymptotic convergence of the state estimation.

A necessary condition for the existence of a solution is rank(CE) = rank(E). A particular solution is then:

H = E((CE) T (CE)) -1 (CE) T N k+1 = T A k -K k+1 1 C (4.22)
The covariance matrix is given by:

P k+1 = (T A) k+1 P k (T A) T k+1 + K k+1 1 (CP k C T -R k )K k+1 1 T -(T A) k+1 P k C T K k+1 1 T -K k+1 1 CP k (T A) T k+1 + HR k+1 H T + T Q k T T (4.23)
In order to obtain the gain matrix K k 1 which minimizes the variance of the state estimation error, it is chosen to be:

K k+1 1 = T A k+1 P k C T (CP k C T -R k ) -1 (4.24)
The covariance matrix is then obtained as:

P k+1 = T A k+1 P k T A T k+1 -K k+1 1 CP k T A T k+1 + HR k+1 H T + T Q k T T (4.25)
The residual is given by:

e k+1 = C Xk+1 -Y k+1 (4.26)

Unknown input reconstruction via high-order observer

For the reconfiguration purpose, a control law has to be designed. Hence, it is useful to dispose of all the system information by estimating the entire system state. In [START_REF] Zhu | State estimation and unknown input reconstruction via both reduced-order and high-order sliding mode observers[END_REF] and [START_REF] Kalsi | Sliding-mode observers for systems with unknown inputs: A high-gain approach[END_REF], an auxiliary output vector is introduced so that the observer matching condition is satisfied and is used as the new system output to asymptotically estimate the system state without suffering from the influence of the unknown inputs. From this result, it is possible to build an unknown input reconstruction method based on both the state and the auxiliary output derivative estimates. The auxiliary output is defined as: Y i a,k := C i a,k X k with i = 1, ..., p and p is the number of rows of Y k . The auxiliary output vector contains the output information of the original system. If we denote:

C a,k := C 1 ... C 1 A γ 1 -1 k ... C p ... C p A γ p-1 k T with 1 ≤ γ i ≤ n i i = 1, ..., p
where n i is defined as the smallest integer such that:

c i A γ i k E = 0 γ i = 0, 1, ..., n i -2 c i A n i -1 k E = 0 (4.27)
and C i the i th row of C then, we denote

C i a,k := C i ... C i A γ i -1 k T
. Since the auxiliary output vector depends on unmeasured variables, we can design a high-order observer to get the estimates of both the auxiliary output vector and its derivative as presented in [START_REF] Kalsi | Sliding-mode observers for systems with unknown inputs: A high-gain approach[END_REF]. The observer is said to be of high-order because the system is augmented with the auxiliary output vector successive derivatives.

After discretization we have:

Y i a,k+1 = C i a,k+1 (A k X k + BU k + ED k ) (4.28)
If we denote:

Λ i := 0 I γ i -1 0 0 , r i := 0 (γ i -1)×1 1 , Ψ i k := C i a,k B
Then (4.28) can be written as:

Y i a,k+1 = Λ i Y i a,k + r i f i k (X k , D k ) + Ψ i k U k (4.29)
where

f i k (X k , D k ) := C i A γ i -1 k (A k X k + ED k )
The last equation of this n i size system is:

C i A γ i -1 k ED k = Y γ i a,k+1 -C i A γ i -1 k (A k X k + BU k ) (4.30)
The above p equations can be unified into a single matrix:

M k D k = ξ k+1 -C k (A k X k + BU k ) (4.31)
if we denote

M k := C k E C k := (C 1 A γ 1 -1 k ) T (C 2 A γ 2 -1 k ) T . . . (C p A γp-1 k ) T T ξ k+1 := (Y γ 1 a,k+1 ) T (Y γ 2 a,k+1 ) T . . . (Y γp a,k+1 ) T T Since rank(M k ) = rank(C a,k D k ) = rank(D k ) = q, M T k M k is invertible because M k
has full column rank. So the input vector satisfies:

D k = (M T k M k ) -1 M T k (ξ k+1 -C k (A k X k + BU k )) (4.32)
An estimation of it is then:

Dk = (M T k M k ) -1 M T k ( ξk+1 -C k (A k Xk + BU k )) (4.33) with ξk+1 :=       C 1 A γ 1 +1 k Xk + C 1 A γ 1 -1 k BU k C 2 A γ 2 +1 k Xk + C 2 A γ 2 -1 k BU k . . . C p A γp+1 k Xk + C p A γp-1 k BU k      
In the case of the cooling system:

ξk+1 := [CA 2 k Xk + CBU k ] M k := CE

Unscented unknown input observer

The linearization techniques used by the EKF and EUIO imply the definition of a steady state reference and can introduce large errors in the true posterior mean and covariance of the transformed GRV, which may lead to sub-optimal performance and sometimes divergence of the filter as presented in [START_REF] Eric | The unscented Kalman filter for nonlinear estimation[END_REF]. For those reasons, Unscented Observers (UO) based on the unscented transform have been developed. UO are based on a parameterization which captures the mean and covariance information and at the same time permits the direct propagation of the information through an arbitrary set of nonlinear equations which overcome the previous limitations of extended observers, see [START_REF] Józefowicz | Design of an unscented unknown input filter with interacting multiple model algorithm[END_REF] and section 2.3. The system considered is then of the more general form:

X k+1 = f (X k , U k ) + ED k + w k Y k+1 = CX k+1 + v k+1 (4.34)

Unscented unknown input observer design

A discrete distribution having the same first and second moments is generated, where each point in the discrete approximation can be directly transformed (see [START_REF] Eric | The unscented Kalman filter for nonlinear estimation[END_REF]).

Given a n-dimensional Gaussian distribution having covariance P , we can generate a set of O(n) points having the same sample covariance from the columns of the matrices ± √ 2P . This set of points is zero mean, but if the original distribution has mean X, then adding X to each of the points yields a symmetric set of 2n + 1 Sigma points having the desired mean and covariance.

To choose a matrix square root a Cholesky decomposition is applied. Every positive definite matrix A ∈ R n×n can be factored as A = C T h C h where C h is upper triangular with positive diagonal elements called the Cholesky factor of A. C h can be interpreted as "square root" of A. One can use this methodology to derive a filtering algorithm. The augmented state vector composed of the state and the process noise is defined as:

X a,k|k := [X k T w k T ] T
this augmented vector has a covariance matrix: P a,k|k = P k|k P x,w,k|k

P w,x,k|k Q k
where Q k is the covariance of w k and R k is the covariance of v k . The previous transformation is then used on the Sigma points χ i,k|k with i = 1, . . . , 2n + 1 from X a,k|k :

χ i,k|k := X a,k|k ± (n + κ)P a,k|k χ 0,k|k := X a,k|k
κ is a scaling parameter which may be chosen equal to 2 in the case of Gaussian distribution. To evaluate the set of the transformed set of Sigma points in spite of the presence of an unknown input, one can write [START_REF] Józefowicz | Design of an unscented unknown input filter with interacting multiple model algorithm[END_REF]:

D k = H(Y k+1 -C(f (X k , U k ) + w k ) -v k+1 ) (4.35)
A necessary condition for the existence of a solution is rank(CE) = rank(E). A particular solution is then:

H = ((CE) T (CE)) -1 (CE) T (4.36)
Then the transformed set of Sigma points are evaluated for each of the 0 to 2n points by: χ i,k+1|k := f (χ i,k|k , U k+1 , k) + ĒY k+1 + wk (4.37)

where f = T f , T = I n -EHC and n the dimension of the state. And wk = T w k -EHv k+1 . The predicted mean is computed as:

Xk+1|k = 1 n + κ κχ 0,k+1|k + 1 2 2n i=1 χ i,k+1|k (4.38)
The predicted covariance is then computed as:

P k+1|k = 1 n + κ κ(χ 0,k+1|k -Xk+1|k )(χ 0,k+1|k -Xk+1|k ) T (4.39) + 1 2 2n i=1 (χ i,k+1|k -Xk+1|k )(χ i,k+1|k -Xk+1|k ) T + Q k
To complete the design of the filter, the equivalent statistics for the innovation sequence and the cross correlation must be determined. The observation model gives:

Y i,k+1|k = Cχ i,k+1|k + v k+1 (4.40)
Then the mean observation is:

Ŷk+1|k = 1 n + κ κY 0,k+1|k + 1 2 2n i=1 Y i,k+1|k (4.41)
123

The measurements covariance matrix is determined from:

P yy,k+1|k = 1 n + κ κ(Y 0,k+1|k -Ŷk+1|k )(Y 0,k+1|k -Ŷk+1|k ) T (4.42) + 1 2 2n i=1 (Y i,k+1|k -Ŷk+1|k )(Y i,k+1|k -Ŷk+1|k ) T + R k
If the disturbances wk and v k are uncorrelated, the cross correlation matrix is:

P xy,k+1|k = 1 n + κ κ(χ 0,k+1|k -Xk+1|k )(Y 0,k+1|k -Ŷk+1|k ) T (4.43) + 1 2 2n i=1 (χ 0,k+1|k -Xk+1|k )(Y i,k+1|k -Ŷk+1|k ) T
The updated equations are then:

K k+1 = P xy,k+1|k P -1 yy,k+1|k (4.44
)

Xk+1|k+1 = Xk+1|k + K k+1 (Y k+1 -Ŷk+1|k ) (4.45) Pk+1|k+1 = P k+1|k -K k+1 P yy,k+1|k K k+1 T (4.46)
The gain matrix K k+1 is chosen to minimize the variance of the state estimation error.

Application and comparison to the extended unknown input observer

On the basis of MASCOTTE test bench real data, the UUIO has been tested and compared to the EUIO on the same project CONFORTH test data (see section 3. The noise increase with time observable in Figure 4.5 is due to the actual increase in measurements noise see Figure 3.9, the observer performances were then also validated from simulation results (constant mean noise) with the simulation software CARINS (see Figure 4.6). It appears that the UUIO estimation and fault reconstruction performances are higher than the EUIO ones for the mass flow rate estimation and equivalent for the pressure estimation for this application. Those performances in the transient are satisfying even if a deviation appears at the beginning of the trial, since the feeding valve is not directly opened, but the mass flow rate information is not needed at that time. The offset in the steady-state part of the trial is reduced.

Residual analysis 4.2.1 Residual analysis algorithm

The FD mechanism is supposed to detect and diagnose any relevant failure and shall react sufficiently early to set up timely safe recovery actions. The observed output can be decomposed according to two components, one depending on the system's inputs and the other one depending on the system dynamics' errors. One way to proceed to detect faults is to estimate and compare directly the output of the system with a given threshold. If the threshold is defined as an upper bound of the system's inputs and the system dynamics error deviations, in the case where no false alarm is tolerated, it is possible to define the threshold as twice the maximum of the output norm for a nominal behavior, see section 2.3. However, in this case, faults with smaller size become undetectable. A way to solve this problem is to evaluate the residual as argued in [START_REF] Paul | Survey of robust residual generation and evaluation methods in observer-based fault detection systems[END_REF]. Hence, to complete the FDIR system one needs to define residual analysis algorithms. The objective is to be able to detect a residual mean shift from a nominal behavior, see [START_REF] Basseville | Detection of abrupt changes: theory and application[END_REF]. The observers from the previous subsection permits to estimate outputs and generate the residual defined as the state estimate error defined by r k := Y k -C Xk . The two hypotheses considered are:

H 0 :
The mean value of the residual is nominal µ = µ 0 .

H 1 : The mean value of the residual has a shift µ = µ 1 .

In the case of different distributions, a statistical test can then be used.

Known mean shift case

In the case of a known mean shift, it is possible to use a two-sided CUSUM algorithm to detect a positive or a negative mean shift. This algorithm is a combination of two algorithms, one to detect an increase in the mean shift; another to detect a decrease with two log-likelihood ratios, two cumulative sums and two evaluation functions [START_REF] Ryu | Optimal design of a CUSUM chart for a mean shift of unknown size[END_REF]. The CUSUM algorithm consists in the design of a decision rule corresponding to the comparison of the difference between the value of s k and its current minimum value to a threshold. This algorithm is based on a repeated SPRT algorithm. As long as the cumulative sum L r k [k] over an observation window of stopping time T does not exceed upper or lower thresholds, the test is restarted. If L r k [k] exceed one of the thresholds, the corresponding time T is then the alarm time. The lower threshold is usually set as 0. We consider that r k is a sequence of independent random variables with a probability density denoted p(r k , µ) depending on its mean µ and its variance σ. To design the online change detection algorithm under a Gaussian hypothesis, we consider the log-likelihood ratio because a change in µ is reflected as a change in the sign of the mean value of the log-likelihood ratio denoted s k .

G r,N := max 1≤i≤N L r k [N, i] (4.47)
G r,N := max

1≤i≤N N k=i ln p(r k , µ 1 ) p(r k , µ 0 ) (4.48)
The hypothesis H 1 is chosen when G r,N > Threshold (otherwise H 0 ). G r,N is a suitable evaluation function and can be defined at each time step. In the case of measurements constituted of independent and identically distributed variables according to a Gaussian distribution (Gaussian white noise) of mean µ and variance σ 2 the probability density function is given by:

p(r k , µ j ) = 1 σ √ 2π exp - (r k -µ j ) 2 2σ 2 (4.49)
The log-likelihood ratio is given by:

s k = ln exp - (r k -µ 1 ) 2 2σ 2 + (r k -µ 0 ) 2 2σ 2 (4.50) = (µ 1 -µ 0 )(2r k -µ 1 -µ 0 ) 2σ 2 (4.51) = (µ 1 -µ 0 ) σ 2 r k - (µ 1 + µ 0 ) 2 (4.52)
If we denote δ as the mean shift, µ 1 = µ 0 ± |δ|. The log-likelihood ratio is:

s k = ± |δ| σ 2 r k -µ 0 ± |δ| 2 (4.53)

Unknown mean shift case

For most common practical cases, µ 1 is unknown. One way to proceed is to use the GLR test to search for the optimal window size to maximize the likelihood-ratio and compare it with a certain threshold.

G r,N := max

1≤i≤N sup µ 1 N k=i ln p(r k , µ 1 ) p(r k , µ 0 ) (4.54)
The hypothesis H 1 is chosen when G r,N > Threshold (otherwise H 0 ). G r,N is a suitable evaluation function and can be defined at each time step. It is then possible to use an ACUSUM which estimates µ 1 as in [START_REF] Jiang | Adaptive CUSUM procedures with EWMAbased shift estimators[END_REF]. To estimate the unknown mean shift δ, a generalization of the EWMA control (EWMA-C) chart has then be proposed allowing for a same set of parameters to improve the algorithm detection performances in the case of failures of various amplitudes and dynamics. By the choice of the weighting factor, the EWMA-C can be made sensitive to a small or gradual drift in the process. The weighting factor λ determines the rate at which "older" data enter into the calculation of the EWMA statistic. A value of λ = 1 implies that only the most recent measurement influences the EWMA (degrades to Shewhart chart). Thus, a large value of λ (closer to 1) gives more weight to recent data and less weight to older data; a small value of λ (closer to 0) gives more weight to older data. The shift amplitude estimate is defined as:

δk = δk-1 + Φ γ (e p,k ) (4.55)
with e p,k = r k -δk-1 the prediction error, Φ γ is defined as a Huber score function.

Φ γ :=      e p,k + (1 -λ)γ , e p,k < -γ λe p,k , |e p,k | ≤ γ e p,k -(1 -λ)γ , e p,k > γ
with γ ≥ 0, usually constant. γ is defined here at each step by γ :=| r k-1 -δk-1 | /2 to improve the algorithm efficiency for the detection of small shifts. If there is an important variation between the prediction error at the instant k and the gap between the residual at k -1 and the estimated

deviation at k -1 then a correction is applied (+(1 -λ) or -(1 -λ)) otherwise no correction is
applied and the prediction error is just weighted. This leads to the following ACUSUM Statistic:

s k = ± δ± σ 2 r k -µ 0 ± δ± 2 (4.56)
where for a mean shift increase or decrease: δ+ := max (δ +,min , δk ), and δ-:= min (δ -,min , δk ).

δ +,min and δ -,min are here the minimum mean shifts amplitudes to detect. Those parameters can be determined from the transients dynamics by two means: from the pre-calculated reference trajectories or from the obtained startup transient residual. The threshold is chosen to be a security coefficient multiplying δ+ .

This generalization (4.55) is referred to as an EWMA-C statistic, its performances are similar to an EWMA statistic when prediction errors are small and performs similar to a Shewhart statistic when prediction errors are large.

Fault detection application

The objective of the FD system composed of an UIO and an ACUSUM is to be able to detect abrupt changes and to differentiate state perturbations and speed transients characterized by slower variations from a failure. After eliminating the effect of process input signals, filtering the effect of disturbances and model uncertainties on the residual, a residual evaluator has been designed by choosing an evaluation function and determining the threshold. To evaluate the effectiveness of the designed algorithm, the good detection (GDR) and false detection rates (FDR) have been calculated for a simulated obstruction in the cooling system.

The good detection rate (GDR) is defined as:

GDR = 100.N GD /∆t f ault (4.57)
and, the false detection rate (FDR) is defined as:

F DR = 100.N F D /(∆t detection -∆t f ault ) (4.58)
with N GD the number of good detection, N F D the number of false detection, ∆t f ault the fault timespan and ∆t detection the detection timespan. To choose the coefficients values and evaluate the algorithm performances, three sets of faults, composed of ten trials with different noises, have been simulated using CARINS. Each set has been simulated with various closure and opening profiles of the cooling system inflow valves (see Table 4.6, Figure 4.8).

The algorithm parameters are the following:

• δ +,min and δ -,min are fixed at ±4e -2 .

• The threshold security coefficient is chosen to be equal to 4.5: it is chosen from experience.

• λ is set to 0.95: in order to give more weight to the most recent prediction errors.

The first fault simulated is abrupt with a large mean shift (Figure 4.9), the second one has a slow variation with also a large mean shift (Figure 4.10) and the third one contains two faults one with a small mean shift, another one with a large mean shift (Figure 4.11). The first one has a slow shift then an abrupt recovery; the second one has an abrupt shift and a slow recovery. The total time of the simulation is 60 seconds with a time step of 1 millisecond (Table 4.6). The cadence of the estimation and the detection is 1 time step per 30 milliseconds which corresponds to the safety machine acquisition rate. The residual defined as the state estimate error of the EUIO from section 4.1 is given by: large mean shift slow recovery

r k = Y k -C Xk (4.59)
The settings have been chosen to optimize the good detection rate and minimize the false detection rate of abrupt mean shifts. Results on Fault 2 are satisfactory since it is mandatory not to detect slow variations that can be confused with transients. Good results are obtained for Faults 1 and 3. The last case permits to evaluate the algorithm performance for successive faults of different sizes. In some rare cases the system nominal behavior between two faults can be considered to be faulty if the transition is done in a short time (hence the FDR rate) but in most cases the two faults in 3 are well detected separately.

Fault isolation system

For some subsystems of the bench the isolation is immediate since the different subsystems have "independent" inputs / outputs for the monitored parts, whereas this is not the case in other ones treated in this chapter. Hence, in interdependent subsystems, once failures are detected with the ACUSUM algorithm it is necessary to be able to isolate one or several failures. The objective of this part is to isolate a fault in one or two branches (simultaneously) of the cooling system. We still consider an additive actuator failure on the system. Once the fault has been detected by an online and real-time first FDI mechanism the goal is to isolate the fault by a parity check (Figures 4.12), see section 2.3.

Figure 4.12: MASCOTTE test bench -Cooling system -Visualization configuration -FDI scheme Indeed, a fault in a line will lead to a residual mean shift in the faulty line but also in all other interdependent lines. Then it is not possible to only use a Distributed Observer System (DOS) to isolate the faulty part of the subsystem. This is the reason why a method based on a projection in a parity space will be used, in order to generate structured residuals depending on fluid mechanics constraints on the overall subsystem.

An obstruction has been simulated on the part before the visualization window of the cooling system (surface reduction) for fault isolation, see Figure 3.7 for the subsystem description. The faults have been simulated for each case in one or two different parallel lines (1, 2 or 3). For our model of this part, we consider 3 input cavities (1, 2, 3), giving input pressures, linked by orifices (4e, 5e, 6e), giving the mass flow rates, to 3 output cavities [START_REF] Zhang | Liquid-propellant rocket engine health-monitoring techniques[END_REF][START_REF] Tulpule | Health monitoring system for the SSME-Fault detection algorithms[END_REF][START_REF] Nie | Liquid-propellant rocket engine online health condition monitoring base on multi-algorithm parallel integrated decision-making[END_REF], giving the output pressures (Figure 4.13).

The parity space-based FD approach is also one of the most common approaches to residual generation by using parity relations [START_REF] Chow | Analytical redundancy and the design of robust failure detection systems[END_REF]. Those relations are rearranged direct input-output model equations subject to a linear dynamic transformation. The design freedom obtained through the transformation can be used to decouple disturbances and improve fault isolation [START_REF] Ding | A characterization of parity space and its application to robust fault detection[END_REF]. The parity space methodology using the temporal redundancy may allow to overcome time delays with recursion over a sliding window see [START_REF] Wang | Fault Detection and Isolation Scheme Based on Parity Space Method for Discrete Time-Delay System[END_REF], [START_REF] Kratz | Fault detection for time-delay systems: A parity space approach[END_REF] especially for discrete-time systems [START_REF] Amol S Naik | Recursive identification algorithms to design fault detection systems[END_REF]. In most existing works, the projection matrix for a parity check is chosen arbitrarily [START_REF] Gao | A survey of fault diagnosis and fault-tolerant techniques-Part I: Fault diagnosis with model-based and signal-based approaches[END_REF] or by establishing a relationship between parity space-based FD and a minimization problem [START_REF] Zhong | Parity space-based fault detection for linear discrete time-varying systems with unknown input[END_REF], [START_REF] Schneider | Parity space based FDI-scheme for vehicle lateral dynamics[END_REF]. A new parity space approach is proposed in [START_REF] Soo | A new parity space approach to fault detection for general systems[END_REF], it assumes that the fault is constant and includes methods to design the projection matrix for realistic situations considering the general system with both system and measurement noises and both actuator and sensor faults simultaneously. In our case, the fault has its own known dynamics which allow us to use direct fluid mechanics constraints based on the energy, momentum, and mass balance equations. A dynamic parity space approach is then proposed to isolate one or two simultaneous faults in the cooling system since in this subsystem the lines are interdependent. The initial system model, for each line composing the cooling system, is augmented with constraints based on the mass flow rate continuity and the energy conservation for the overall system. Time delays in the transients are accounted for by recursive equations over a sliding window. The method allows settling adaptive thresholds that avoid pessimistic decision about the continuation of tests while detecting and isolating faults in the transient and permanent states of the system.

To perform a parity check, we define the faulty system as:

X k+1 = A k X k + BU k + ED k + F f k Y k+1 = CX k+1 (4.60)
The fault distribution matrix F could be different from the unknown input distribution matrix E.

In this more general case, the projection matrix for the parity test will remain of the same form but its coefficients will change. In the studied system (the cooling system) and for the type of simulated fault (an obstruction), those matrices are the same.

Algorithm design

The balance equations can be augmented in order to define parity relations. After a linear dynamic transformation, these relations can be used for disturbance decoupling and isolation.

Modeling the dynamics of our system during the transient phase requires integrating time delays in the model. The fault dynamics for the next time step is not only determined by the current state but also by its former values. Considering these equations from time instant k -L to time instant k is a solution to overcome this problem and to ensure a temporal redundancy (over this window we assume the matrix A k to be constant in time):

Y L,k = A L X k-L + B L U L + E L (D L + f L ) (4.61) Assuming A L := C T (CA) T . . . (CA L ) T T , B L :=       0 0 . . . 0 0 CB 0 . . . 0 0 . . . . . . . . . . . . . . . CA L-1 B CA L-2 B . . . CB 0      
, and

E L :=       0 0 . . . 0 0 CE 0 . . . 0 0 . . . . . . . . . . . . . . . CA L-1 E CA L-2 E . . . CE 0       .
The aim is to design a residual signal which is close to zero in fault-free case and non-zero when a fault occurs in the monitored system. Then, for the parity check we search the projection matrix H L such that:

H L (Y L -B L U L -E L D L ) = H L A L X k-L + H L E L f L = H L E L f L (4.62)
For the considered cooling system with parallel lines, the projection matrix for the parity check can then be chosen by augmenting our previous system of equations with the following relations (4.63), (4.64), (4.65), (4.66). The parallel lines have to respect the mass flow rate continuity and the energy conservation. An obstruction in a line induces an increase of the mass flow rate in the other lines and a pressure drop in a line induces a pressure increase in the other lines. The mass flow rate continuity gives:

ṁ0,k = ṁ1,k + ṁ2,k + ṁ3,k (4.63)
We can then use Euler conservation equations for an incompressible fluid.

P i,k+1 -P i,k = -d t c 2 V i ( ṁi,k,e -ṁi,k,s ) (4.64) ṁj,k+1,e -ṁj,k,e = - d t S 2 i (P j,k -P i,k ) V i + k p d t ṁ2 j,k,e 2ρV i (4.65)
P j,k+1 -P j,k = -d t c 2 V i ( ṁj,k,s -ṁj,k,e ) (4.66)
We denote ∆P q,k+1,k := P q,k+1 -P q,k for q = 1, ..., 6. This yields:

ṁ0,k = ṁ4,k,e + V 1 ∆P 1,k+1,k d t c 2 + V 2 ∆P 2,k+1,k d t c 2 + V 3 ∆P 3,k+1,k d t c 2 + ṁ5,k,e + ṁ6,k,e
The detection algorithm is then triggered after the transient to not consider them as failures in a first time. A failure is assumed to impact proportionally the mass flow rate:

ṁj,k,e := (f r,i,k + 1) ṁj,k,e,nominal (4.67)
or again:

ṁj,k,e := (f r,i,k + 1) 2S 2 (∆P nominal ) k p - 2ρV (∆ ṁe,nominal ) k p d t (4.68)
We obtain the expression of faults in each line f r,i,k in the case of a single fault and two simultaneous faults. With the help of those expressions we can then find the projection matrices.

We have:

Y k+1 -CBU k -CED k = CEf k + CA k X k (4.69)
Since CB = 0, we have:

Y k+1 -CBU k -CED k = Y k+1 -CED k (4.70) CED k = -c 2 dt V 1 ṁ4,k,s -c 2 dt V 2 ṁ5,k,s -c 2 dt V 3 ṁ6,k,s T (4.71)
and ṁj,k,s = ṁj,k,e -

V i (∆P j,k+1,k ) c 2 dt
for i = 1, ..., 3, j = 4, ..., 6. Then: The projection matrix H has to verify:

Y k+1 -CED k =    c 2 dt V 1 ( ṁ0,k -ṁ6,k,e -ṁ5,k,e ) -∆P 1,k+1,k - V 2 (∆P 2,k+1,k ) V 1 - V 3 (∆P 3,k+1,k ) V 1 + P 4,k c 2 dt V 2 ( ṁ0,k -ṁ4,k,e -ṁ6,k,e ) - V 1 (∆P 1,k+1,k ) V 2 -∆P 2,k+1,k - V 3 (∆P 3,k+1,k ) V 2 + P 5,k c 2 dt V 3 ( ṁ0,k -ṁ5,k,e -ṁ4,k,e ) - V 1 (∆P 1,k+1,k ) V 3 - V 2 (∆P 2,k+1,k ) V 3 -∆P 3,k+1,k + P 6,k    (4.72) with: ṁj,k,e =
HCA k X k = 0 (4.73)
Using (4.72), H is then equal to:

H :=    h 1 h 2 h 3 h 1 h 2 h 3 h 1 h 2 h 3    with: h i := 3ω k 3 d t c 2 V i ṁj,k,e +3P j,k -ω k , i = 1...3, j = 4...6,
and

ω k := ( ṁ0,k - V 1 ∆P 1,k+1,k dtc 2 - V 2 ∆P 2,k+1,k dtc 2 - V 3 ∆P 3,k+1,k dtc 2
).

Since for i = 1, ..., 3, j = 4, ..., 6 we have:

P j,k = P j,k+1 + d t c 2 V i ( ṁj,k,s -ṁj,k,e ) (4.74)
= Y i,k+1 -(CED k ) i - d t c 2 V i ṁj,k,e (4.75)
Then:

H L :=       H 0 ... 0 0 H ... 0 ... ... ... ... 0 0 ... H       .
The estimate of faults f L is then obtained from (see Figure 4.14 for results on the example):

f L = (H L E L ) -1 H L (Y L -E L D L ) (4.76)
+/- ↓/↑ ↓/↑ r 2 ↓/↑ +/- ↓/↑ r 3 ↓/↑ ↓/↑ +/-
+ - -max + max + min -min r 2 + - + min -max -max + min r 3 ↓ ↑ / ↓ ↑ /

Residuals

Case 5 fault in lines 1 and 3

r 1 + - -max + max + min -min r 2 ↓ ↑ / ↓ ↑ / r 3 + - + min -max -max + min

Residuals

Case 6 fault in lines 2 and 3

r 1 ↓ ↑ / ↓ ↑ / r 2 + - -max + max + min -min r 3 + - + min -max -max + min
The faults dynamics calculation for the considered cases can be found in Appendix B. For isolation purpose, we can compare the variation of faults : The first fault simulated is an abrupt obstruction with a large mean shift on the line 1, the second is the same on the line 2 and the third one on the line 3. It is sufficient to simulate faults in this part of the circuit since the method used will remain the same in the other part with 4 lines. The total time of the simulation is 1090 seconds with a time step of 1 millisecond. The cadence of the estimation and the detection is 1 time step per 3 milliseconds to adapt to the simulation cadence and duration.

Chapter analysis and comments

The aim of this part was to design a FDI system in order to improve the reliability of MASCOTTE operation by adopting a fault-tolerant strategy in the case of failures. Faults in the actuators are detected with observer-based residual generation. Residuals are then analyzed by the means of an ACUSUM. The FD scheme is composed of an EUIO or an EKF in the linearized case and an UUIO in the nonlinear case, a CUSUM algorithm and an EWMA-C chart. The application and its validation focused specifically on the cooling system which is a critical subsystem of the bench. This method was tested in realistic simulations with the software CARINS and has been implemented on the MASCOTTE test bench and tested by replaying trials, see section 4.2.2.

The EUIO and UUIO were used to decouple the unknown input effects on the system dynamics as well as to ensure the system stability and the state estimation error convergence.

The high-order UIO and inversion method were used to reconstruct the input from an auxiliary output vector and known input vector to overcome the lack of information. The adaptive two-sided CUSUM algorithm composed of a GLR test and an EWMA chart allowed in a first time to detect a positive or a negative mean shift and in a second time to estimate the shift amplitude for a same set of parameters. Those methods gave satisfactory results with high good detection rates of faults with various amplitude and dynamics, and at the same time gave low false detection rates which is useful to maintain the bench operation performances in the case of failures.

Then a parity space-based method has been proposed in section 4.3 to isolate faults, using a projection matrix defined by fluid mechanics relations for the overall system. This method combines residual generation methods and physics-based constraints, giving a simple FDI algorithm design which does not imply the solving of an optimization problem. This method has been tested with good results on simulations of the bench for different cases of failures, including simultaneous ones. This method allows to differentiate transients from failures since the mechanical constraints would not be verified in the last case.

Design of a closed-loop fault-tolerant control system

For systems such as MASCOTTE, which relies on main propellant flow variation, the closed-loop control system has to operate on the principle of variable fluid resistances (pressure dome-loaded regulators) in the main oxidizer and fuel feed lines to achieve propellant flow-rate modulation or in the cooling system lines to overcome performances losses. In practice, combustion disturbances are not entirely avoidable, but can be minimized by maintaining a given resistance ratio between the two main propellant control valves throughout the control range. A most reliable method toward this objective would be mechanical coupling of the two propellant valves. The principal reasons for mixture-ratio control are recalled:

• Optimum engine performance (important)

• Complete propellant utilization; i. e., minimum residuals (most important)

Based on the FMEA in 3 section 3.3, in a first approach one can see that an obstruction or a leakage in the propellant manifolds may be critical and imply a shutdown action. For that reason, we will validate our AFTC system (see Figure 5.1) with only faults simulated in the cooling system, we still consider in this part an additive actuator failure on the system, which may correspond to an obstruction or a leakage. We also study the possibility of a reconfiguration of the propellants mass flow rates in order to maintain a suitable MR.

Active fault-tolerant control for linear systems

The method proposed here consists in the design of a controller based on an UIO by considering the fault to be the unknown input similar to [START_REF] Tariq Hamayun | A fault tolerant control allocation scheme with output integral sliding modes[END_REF] and the design of an anti-windup strategy in the same idea as [START_REF] Jm Gomes Da | Anti-windup design with guaranteed regions of stability for discrete-time linear systems[END_REF] in order to ensure the asymptotic stability of the saturated system for a given set of initial conditions and determine the stability domain. This FTC strategy permits to with a filter and the gain W c is calculated with a LQ controller [START_REF] Theilliol | Actuator fault tolerant control design based on a reconfigurable reference input[END_REF][START_REF] Sarotte | Actuator Fault Tolerant System for Cryogenic Combustion Bench Cooling Circuit[END_REF].

The reference state trajectory X k is predetermined and its dynamics is given by:

X k+1 = A c Xk + B c Ūk (5.17)
with Ūk the nominal input. Since the fault-tolerant control is activated once a fault has been detected, the nominal input can be chosen as the mean input over a sliding window during nominal performances.

The control law can be alternatively written as:

U c,k := -B + c B c fk + W c e c,k + W c η k (5.18)
For that, we assume that the observer giving the additive actuator fault amplitude estimate converges fast enough to neglect its estimation error in the control law design.

The dynamics of the augmented state is expressed as:

ζ k+1 = A c + B c W c B c W c 0 N c ζ k (5.19)
where

ζ k := η k e c,k T , with e c,k = Xc,k -X k the estimation error, η k = X k -X k the reconfig-
uration error and X k the state reference. N c is the gain of an observer ensuring the estimation error convergence so that its dynamics reduces to e c,k+1 = N c e c,k .

For the nominal system, the gain W c must stabilize (A c + B c W c ). Since the pair (A c , B c ) is assumed to be controllable, a LQ formulation can be adopted where W c is selected to minimize

J k := k ζ T k Sζ k + U T c,k OU c,k (5.20)
where S and O are symmetric positive definite design matrices.

It is also possible to proceed to a pole placement for the continuous time system (small time constant), we can choose to fix a damping ratio and a natural frequency which is easier to implement in the case of second-order systems. For a global state configuration the computational burden might be too high to calculate the gain at each time step. To overcome this issue, one can use the result on polytopes in Appendix C. This result gives a global gain matrix based on a Lyapunov stability demonstration, considering that the matrices A k are bounded and belong to a polytopic set (see [START_REF] Domingos | A less conservative LMI condition for the robust stability of discrete-time uncertain systems[END_REF], [START_REF] Domingos | An LMI approach to compute robust stability domains for uncertain linear systems[END_REF]).

Application

The desired transient behavior depends on the gain choice (Table 5.1), in our case we have to limit the overshoots to maintain the cooling system performances (Figure 5.2). The fault was implemented as in the previous section. The aim of this simulation is to see if the controller is able to stabilize the closed-loop system after the detection, see Table 5.2. If a fault is detected, then the system switches to the closed-loop one. When the fault is detected the system switches to the FTCS. The fault is compensated and it can be seen that the control law for the rewritten system permits to stabilize the system around the reference steady-state equilibrium with sufficient precision.

Actuator additive faults with input saturations

As said before, the main objective of a FTCS is to maintain, with a control reconfiguration mechanism, current performances close to the desirable ones and preserve stability conditions in the presence of component and / or instrument faults. However, due to physical actuators characteristics or performances, unlimited control signals are not available, and saturations should be taken into account in the control law design. Multiple solutions have been studied

to compensate for a decrease in system performance caused by the saturation of one or more actuators, one way is to add a so-called anti-windup command, another way is to use direct synthesis methods by considering the saturations in the control law.

Direct synthesis methods aims at taking into account the nonlinearities due to the saturations in the development of the control law in order to preserve the performances while improving the stability [START_REF] Lin | Output regulation for linear systems subject to input saturation[END_REF][START_REF] Benzaouia | Stability and control synthesis for discrete-time linear systems subject to actuator saturation by output feedback[END_REF]. Some methods determine a stabilizing gain based on a stochastic linearization of the saturations. The choice of this gain is very restrictive because it limits the stability domain. Indeed, these methods require to determine the parameters on which the gain depends [START_REF] Gokcek | An LQR/LQG theory for systems with saturating actuators[END_REF], these parameters making it possible to ensure a semi-global stability. Methods that consist of a state, output or linear error feedback to remain below the limits of the actuator often have a slow dynamical behavior in order to avoid overshoots [START_REF] Lin | Output regulation for linear systems subject to input saturation[END_REF][START_REF] Mantri | Output regulation for linear discrete-time systems subject to input saturation[END_REF][START_REF] Stoorvogel | Output regulation of linear plants with actuators subject to amplitude and rate constraints[END_REF]. These methods are based on low gains whose values are limited to avoid saturation and therefore have a relatively slow response in time which is undesirable for fault-tolerant control. The gain choice is then carried out by the resolution of LMIs and a Riccati equation whose solution depends on weighting matrices that must respect certain constraints in order to not exceed the limiting value.

However, in these works, the choice of these weighting matrices on the stability domain is not clearly established. These methods have therefore to be improved thanks mainly to two types of methods: the addition of a control part based on high-gain methods or the addition of a nonlinear part to the command [START_REF] Venkataramanan | Discrete-time composite nonlinear feedback control with an application in design of a hard disk drive servo system[END_REF][START_REF] Ben M Chen | Composite nonlinear feedback control for linear systems with input saturation: Theory and an application[END_REF][START_REF] He | Improving transient performance in tracking control for linear multivariable discrete-time systems with input saturation[END_REF]. The use of these transient performance enhancement methods also requires the selection of parameters that can be constraining. These parameters make it possible to adjust the control in order to improve the performance of the closed loop of the system, in particular by activating the nonlinear part of the control law when one moves away from the reference to follow, in order to respect the limit on the system inputs. This type of methods remains close to the anti-windup.

The idea of the anti-windup approach is to add a state, output or error feedback so that the actuator remains within its limits. This consists in neglecting the saturation in the first stage of the control design process, and then to add some problem-specific schemes to deal with the adverse effects caused by saturation. In the case of discrete systems, our interest is the development of control laws that provide a semi-global convergence on any arbitrarily large set of the state space. They usually have a simpler structure and the controller is less sensitive to model and disturbance uncertainties. The system performance one wants to achieve can range from the classic system stabilization problem to expanding the area of attraction, rejecting disturbances, and regulating the output of the system [START_REF] Hu | Control systems with actuator saturation: Analysis and design[END_REF].

The advantage of the presented control method is that it studies the determination of the stability regions of a discrete-time linear system and allows to determine an anti-windup control law which ensures the asymptotic stability of the saturated system as inputs. Unlike conventional anti-windup methods based on the resolution of bilinear matrix inequalities, this method is relatively simple and proposes an iterative algorithm of LMI in the same spirit as [START_REF] Jm Gomes Da | Anti-windup design with guaranteed regions of stability for discrete-time linear systems[END_REF]. In this approach, the set of admissible initial states and its associated domain of stability are determined to take into account the compensation of additive actuator faults.

System description

When the input is assumed to be saturated the system considered becomes:

X k+1 = A c X k + B c sat(U k ) + B c f k Y k+1 = CX k+1 (5.21) with sat(U k ) :=      U sat if U k > U sat U k if -U sat ≤ U k ≤ U sat -U sat if U k < -U sat     
where U k ∈ R l is the control law and Theorem 1.

Define E(P ) = ζ k ∈ R 2n , ∀i = 1, . . . , l; ζ k T P ζ k ≤ 1 + ((B + c Bc fk ) i -U i,k ) 2 (B + c Bc fk ) i -U i,k 2
with P ∈ R 2n×2n a positive definite matrix and W := P -1 . If W satisfies (5.37) for each input value, then E(P ) ⊂ S.

    W 0 2n,1 0 1,2n -1 WK T i -(GW) i T (B + c Bc fk ) i -U i,k K i W-(GW) i (B + c Bc fk ) i -U i,k U i,sat 2 (B + c Bc fk ) i -U i,k 2     ≥ 0 (5.37) ∀i = 1, . . . , l Assume that (B + c B c fk ) i -U i,k = 0.
Proof. By Schur's complement, (5.37) gives ∀i = 1, . . . , l:

W 0 2n,1 0 1,2n -1 - WK T i -(GW) i T Y i 1 U i,sat -2 Y i -2 K i W-(GW) i Y i 1 ≥ 0 (5.38) with P = W -1 , Y i = (B + c B c fk ) i -U i,k
, K i and G i are the i th lines of K and G. Then we have:

P 0 2n,1 0 1,2n -1 -
K T i -G T i Y i -1 U i,sat -2 Y i -2 K i -G i Y i -1 ≥ 0 (5.39)
Left multiplying by

ζ k Y i Y i T and right multiplying by ζ k Y i Y i
we obtain:

ζ k Y i Y i T P 0 2n,1 0 1,2n -1 ζ k Y i Y i ≥ (5.40) ζ k Y i Y i T K T i -G T i Y i -1 U i,sat -2 Y i -2 K i -G i Y i -1 ζ k Y i Y i then ζ k T P ζ k - Y 2 i Y i 2 ≥ ζ k T K T i -G T i Y i -Y i Y i U i,sat -2 Y i -2 K i -G i Y i ζ k -Y i Y i (5.41) So ζ k ∈ S since ζ k T P ζ k - Y 2 i Y i 2 ≤ 1: ζ k T P ζ k - Y 2 i Y i 2 U i,sat 2
Y i 2 ≥ ζ k T K T i -G T i Y i -Y i Y i K i -G i Y i ζ k -Y i Y i (5.42) U i,sat 2 Y i 2 ≥ ζ k T K T i -G T i Y i -Y i Y i K i -G i Y i ζ k -Y i Y i (5.43)
we then have:

-U i,sat ≤ ((K i -G i )ζ k + U i,k -(B + c B c fk ) i ) ≤ U i,sat (5.44)
so that E(P ) ⊂ S

Determination of the associated domain of stability

In this part, we denote:

A := A c + B c W c B c W c 0 N c . Z ∈ R n×l and ∆ ∈ R l×l a diagonal
positive definite matrix are parameters which will be chosen in order to maximize the size of the set of admissible initial states and ensure the exponential asymptotic stability of the augmented system (5.26).

Theorem 2. The ellipse

E(P ) = ζ k ∈ R 2n , ∀i = 1, . . . , l; ζ k T P ζ k ≤ 1 + ((B + c Bc fk ) i -U i,k ) 2 (B + c Bc fk ) i -U i,k 2
with P = W -1 is a region of exponential asymptotic stability for the augmented system, if for

E c = Z∆ -1 :    W -(GW) T -WA T -(GW) 2∆ Z T R T -AW RZ W    > 0 (5.45)
for the considered Lyapunov candidate quadratic function:

V (ζ k ) := ζ k T P ζ k , P = P T > 0, P ∈ R 2n×2n (5.46) V (ζ k ) is a Lyapunov function since: 1. δV (ζ k ) < 0, ∀ζ k ∈ E(P ), ζ k = 0 2. ∃α ∈ R + , δV (ζ k ) ≤ -αV (ζ k )
Proof. We calculate δV (ζ k ):

δV (ζ k ) = V (ζ k+1 ) -V (ζ k ) = ζ k T A T P Aζ k -2ζ k T A T P (RE c )Ψ(Kζ) + Ψ(Kζ k ) T (RE c ) T P (RE c )Ψ(Kζ k ) -ζ k T P ζ k (5.47)
Using Lemma 1, we have:

δV (ζ k ) ≤ -(ζ k T A T P Aζ k + 2ζ k T A T P (RE c )Ψ(Kζ k ) -Ψ(Kζ k ) T (RE c ) T P (RE c )Ψ(Kζ k ) + ζ k T P ζ k ) -2Ψ(Kζ k ) T T [Ψ(Kζ k ) -Gζ k ] (5.48)
We can write this inequality under the form:

δV (ζ k ) ≤ -ζ k T Ψ T X 1 X 2 X 2 T X 3 ζ Ψ (5.49) With X 1 := P -A T P A, X 2 := A T P (RE c ) -G T T , X 3 := 2T -(RE c ) T P (RE c ).
By Schur's complement, (5.45) gives:

W -(GW) T -(GW) 2∆ - -WA T Z T R T P -AW RZ > 0 (5.50)
• Case 2, 3, and 4: time varying closing profile (successive faults of different magnitudes) no actuator saturations.

• Case 5: constant valve closing profile, with actuator saturations and a new state reference.

For the first four trials, faults are compensated and it can be seen that the control law for the rewritten system permits to stabilize the system around the reference steady-state equilibrium with sufficient accuracy. The FTCS with anti-windup trial (Case 5) aims at compensating the fault and at converging to a different reference state than the nominal one (chosen arbitrarily). We fixed the saturated value at U sat = 3.782 • 10 6 P a in this case, the saturation value has been chosen in order to allow the convergence to the new state reference. This trial shows that the fault is well compensated, see Table 5.3 (average values from the failure time), and the convergence to the nominal value is faster than in the case of a controller with a fixed limit value. We can also see that since the reference state dynamics is modified by the anti-windup scheme in order to ensure the exponentially asymptotic convergence, the trajectory is more stable in this case than in the case of a fixed imposed limit (Figures 5.4 and 5.5). The new reference state dynamics is consistent with the established model; we can see that the dynamics relations between the state and the input are respected.

The simulated cases for the propellants injection are the following:

• Case 1: maintain the current performances.

• Case 2: change the reference state to decrease or increase the mixture ratio value. In this case, the performances (Table 5.4 and Figure 5.6) are satisfying however, the simulations consider isolated systems and do not take into account the impact on the combustion chamber pressure which is linked to the mass flow rate injection. The closed-loop performances for the cooling system are lower than the performances for the propellants injection regulation due to the fault compensation error; however, the results are satisfying. Table 5.3 shows that even in the case of successive faults, once the system has switched to closed-loop FTCS the performances are maintained. It is then not required to switch back to the open-loop system once the stability around a nominal value is obtained. This command with the linearized system is sufficient for the steady-state, but not suited to the transient. To take into account the nonlinearities it is then necessary to develop AFTC methods for nonlinear systems.

Active fault-tolerant control for nonlinear systems

LQR or linear MPC have been widely used in different industry [START_REF] Maciejowski | Modelling and predictive control: Enabling technologies for reconfiguration[END_REF], [START_REF] Abbas-Turki | Robust gain scheduled control of a space launcher by introducing LQG/LTR ideas in the NCF robust stabilisation problem[END_REF]. However, for engine applications, nonlinear effects may affect the controller performances and a nonlinear approach may allow to consider a wider range of operating points [START_REF] Michael | Nonlinear process control[END_REF][START_REF] Kim | Automotive engine diagnosis and control via nonlinear estimation[END_REF][START_REF] Mhaskar | Fault-tolerant control of nonlinear processes: performance-based reconfiguration and robustness[END_REF]. For that reason, a nonlinear MPC may be used [START_REF] Magni | Robust model predictive control for nonlinear discrete-time systems[END_REF]. The MPC approach provides a framework with the ability to handle, among other issues, multi-variable interactions, constraints on controls, and optimization requirements, all in a consistent, systematic manner [START_REF] Maciejowski | Modelling and predictive control: Enabling technologies for reconfiguration[END_REF].

Actuator additive faults

In this part, a nonlinear control for Lipschitz systems with error feedback and fault compensation is developed. The fault reconstruction expression (4.35) is also used in this part to write the system 4.34 from section 4.1 under a new form where the only unknown input is an additive actuator failure. Then, in order to annihilate the actuator fault effect on the system, another UIO with an unscented transform is used to estimate the fault magnitude, the estimated state at the instant k is then denoted Xc,k and the estimation error e c,k . A control law has then to compensate the fault and be computed such that the faulty system is as close as possible to the nominal one.

         -X * * * * √ 1 + (AX + BY ) -X * * * (1 + 1 + 2 )W Z 0 -αI * * S 1/2 X 0 0 -γI * O 1/2 2 Y 0 0 0 -γI          ≤ 0, (5.63)
where * stands for symmetric terms in the matrix,

O 2 = (1 + 2 )O. And -I * ζ k -X ≤ 0.
(5.64)

Proof. The linear quadratic function V k has to satisfy (5.62) then: where λ max is the maximum eigenvalue of P and µI is a design parameter corresponding to the upper bound of the maximum eigenvalue of P .

Aζ k + B(∆U k + f ak ) + CΦ k T P Aζ k + B(∆U k + f ak ) + CΦ k -ζ k T P ζ k ≤ -(ζ k T Sζ k + ∆U k T O∆U k ) (5.65) Defining the function g(ζ k , ∆U k , f ak ) as g(ζ k , ∆U k , f ak ) = Aζ k + B(∆U k + f ak ) T P Aζ k + B(∆U k + f ak ) + Aζ k + B(∆U k + f ak ) T P (CΦ k ) + (CΦ k ) T P Aζ k + B(∆U k + f ak ) + (CΦ k ) T P (CΦ k ) (5
g(ζ k ,∆U k , f ak ) ≤ (1 + ) Aζ k + B(∆U k + f ak ) T P Aζ k + B(∆U k + f ak ) + (1 + -1 )µ(CΦ k ) T (CΦ k ) (5.69)
Since Φ k is Lipschitz we have:

Φ k T C T CΦ k ≤ [η k T ∆U k T ]W T C T CW [η k ∆U k ] T (5.70) Then g(ζ k , ∆U k , f ak ) ≤ (1 + ) Aζ k + B(∆U k + f ak ) T P Aζ k + B(∆U k + f ak ) + (1 + -1 )µ[η k T ∆U k T ]W T C T CW [η k ∆U k ] T (5.71)
We then have:

ζ k T Sζ k + ∆U k T O∆U k -ζ k T P ζ k + (1 + ) Aζ k + B(∆U k + f ak ) T P Aζ k + B(∆U k + f ak ) + (1 + -1 )µ[η k T ∆U k T ]W T C T CW [η k ∆U k ] T ≤ 0 (5.72)
Considering the following error feedback control:

∆U k = Gζ k -B + B fak (5.73)
With the Lemma 2, the previous equation is rewritten as:

ζ k T Sζ k + (1 + 2 )ζ T k G T OGζ k -ζ k T P ζ k + (1 + )(Aζ k + BGζ k ) T P (Aζ k + BGζ k ) + (1 + -1 + 2 )µ[η k T ζ T k G T ]W T C T CW [η k Gζ k ] T -(1 -2 -1 ) f T a,k ([0 1,1:n, (B + B) T ]W T C T CW [0 1:n,1 (B + B)] T + (B + B) T O(B + B)) fa,k ≤ 0 (5.74)
Since 2 is chosen high enough so that (1 -2 -1 ) is positive and fak is positive by construction, we can solve:

ζ k T S + G T O 2 G -P + (1 + )(A + BG) T P (A + BG) + (1 + -1 + 2 )µ[H T G T ]W T C T CW [H G] T ζ k ≤ 0 (5.75)
where

O 2 = (1 + 2 )O.
That is satisfied if:

S +G T O 2 G -P + (1 + )(A + BG) T P (A + BG) (5.76)
+(1 + -1 + 2 )µ[H T G T ]W T C T CW [H G] T ≤ 0
We then denote:

X := γP -1 , X > 0, Y := GX, α := γµ -1 , Z := X[H G] T .
Applying Schur complements give:

         -X * * * * √ 1 + (AX + BY ) -X * * * (1 + 1 + 2 )CW Z 0 -αI * * S 1/2 X 0 0 -γI * O 1/2 2 Y 0 0 0 -γI          ≤ 0, (5.77)
-X + αI ≤ 0 (5.78) in order to verify (5.68), where * stands for symmetric terms in the matrix. In the previous section 5.1 a FTCS has been developed and tested on the same model, linearized around a steady state trajectory, with an EUIO for the fault estimation and an LQ controller for the system convergence and stability. The performances of those two methods can now be compared, see Table 5.6. The control law performances in terms of fault compensation and stability performances are increased with the UUIO-MPC control method for the pressure and mass flow rate regulation. The control law allows to compensate for a failure in the transient and to track down a reference trajectory (see Figures 5.10,5.11,5.12). Since the system is not linearized around a steady-state reference in the case of the nonlinear FTCS, the stability domain is larger, and the fault compensation error has less impact on the system performances.

And

Actuator additive faults and input saturation

As presented in the anti-windup part of the section 5.1, to maintain with a control reconfiguration mechanism the current performances close to the desirable ones, preserve the stability conditions in the presence of component and / or instrument faults and taking into account the physical actuators characteristics or performances, input saturation should be taken into account in the control law design.

The previous anti-windup control law can then to be extended to Lipschitz nonlinear systems since it modifies the reference state trajectory in order to prevent the input saturation. Hence, we can combine this method and the previously developed control law for Lipschitz nonlinear system to obtain the AFTCS.

System description

When the input is assumed to be saturated the system considered becomes:

X k+1 = AX k + BU sat,k + f (X k , U sat,k ) + Bf ak + wk Y k+1 = CX k+1 + v k (5.80)
Where X k ∈ R 2 is the state vector, Y k ∈ R is the measured output, U k ∈ R is the known input and C T ∈ R 2 the output distribution matrix, f ak ∈ R is the actuator additive fault.

with sat(U k ) :=

     U sat if U k > U sat U k if -U sat ≤ U k ≤ U sat -U sat if U k < -U sat     
where U k ∈ R l is the control law and U sat ∈ R l + is the actuator limit.

Design of the anti-windup control law

We want to determine the anti-windup gain matrix E c such that for a set S of admissible initial states (ζ 0 ∈ S), the corresponding trajectory converges asymptotically to the origin of the subset

E ⊂ S.
Then, E is a region of asymptotic stability. For that, we want to determine a new control law of the form U k + = U k -Gζ k when the control law U k reaches its bounds with G ∈ R l×2n .

The reference state dynamics for the anti-windup strategy is chosen as:

X k+1 := AX k + BU k + f (X k , U k ) + E c (sat(U k ) -U k ) U k := U k -B + B fa,k + Gζ k (5.81)
If the control law is saturated then U k = ±U sat :

X k+1 = AX k + BU k + f (X k , U k ) + E c (±U sat -U k + B + B fa,k -G 1:n,1 e c,k -G 1:n,1 η k ) (5.82)
We can then write:

X k+1 -X k+1 = A(X k -X k ) + BU k + Bf a,k -B fa,k -BU k + BG 1:n,1 e c,k + BG 1:n,1 η k + f (X k , U k ) -f (X k , U k ) + E c (±U sat -U k + B + B fa,k -G 1:n,1 e c,k -G 1:n,1 η k ) (5.83)
which gives

η k+1 = Aη k + BG 1:n,1 e c,k + BG 1:n,1 η k + f (X k , U k ) -f (X k , U k ) + E c (±U sat -U k + B + B fa,k -G 1:n,1 e c,k -G 1:n,1 η k ) (5.84)
we then have:

ζ k+1 = A + BG 1:n,1 BG 1:n,1 0 KC ζ k -(RE c )Ψ(Kζ k ) + CΦ k (X k , U k , X k , U k ) (5.85)
with

Ψ(u) :=      u i -U i,sat + U i,k -(B + B fk ) i if u i + U i,k -(B + B fk ) i > U i,sat 0 if -U i,sat ≤ u i + U i,k -(B + B fk ) i ≤ U i,sat u i + U i,sat + U i,k -(B + B fk ) i if u i + U i,k -(B + B fk ) i < -U i,sat      (5.86) where R = I n 0 , K = G, ∀i = 1, . . . , l.
The set of admissible initial states S considered will be defined as a polyhedral set and the domain of stability E will be designed as an ellipsoid.

Determination of the set of admissible initial states

For the determination of the set of admissible initial states, one can use the Lemma and the Theorem from section.

Determination of the associated domain of stability

In this part, we denote:

A := A + BG 1:n,1 B c G 1:n,1 0 KC . Z ∈ R n×l and ∆ ∈ R l×l a diagonal
positive definite matrix are parameters which will be chosen in order to maximize the size of the set of admissible initial states and ensure the exponential asymptotic stability of the augmented system (5.26).

Theorem 4. The ellipse

E(P ) = ζ k ∈ R 2n , ∀i = 1, . . . , l; ζ k T P ζ k ≤ 1 + ((B + c Bc fk ) i -U i,k ) 2 (B + c Bc fk ) i -U i,k 2
with P = W -1 is a region of exponential asymptotic stability for the augmented system, if for

E c = Z∆ -1 :       W -(GW) T 0 -WA T -(GW) 2∆ 0 Z T R T 0 0 0 -WC T -AW RZ -CW W       > 0 (5.87)
for the considered Lyapunov candidate quadratic function:

V (ζ k ) := ζ k T P ζ k , P = P T > 0, P ∈ R 2n×2n (5.88) V (ζ k ) is a Lyapunov function since: 1. δV (ζ k ) < 0, ∀ζ k ∈ E(P ), ζ k = 0 2. ∃α ∈ R + , δV (ζ k ) ≤ -αV (ζ k )
Proof. We calculate δV (ζ k ):

δV (ζ k ) = V (ζ k+1 ) -V (ζ k ) = ζ k T A T P Aζ k -2ζ k T A T P (RE c )Ψ(Kζ k ) + Ψ(Kζ k ) T (RE c ) T P (RE c )Ψ(Kζ k ) + Φ T k C T P CΦ k -ζ k T P ζ k -2Φ T k C T P (RE c )Ψ(Kζ k ) + 2ζ T k A T P CΦ k (5.89)
Using Lemma 1, we have:

δV (ζ k ) ≤ -(-ζ k T A T P Aζ k + 2ζ k T A T P (RE c )Ψ(Kζ k ) + 2Φ T k C T P (RE c )Ψ(Kζ k ) -2ζ T k A T P CΦ k -Ψ(Kζ k ) T (RE c ) T P (RE c )Ψ(Kζ k ) -Φ T k C T P CΦ k + ζ k T P ζ k ) -2Ψ(Kζ k ) T T [Ψ(Kζ k ) -Gζ k ] (5.90)
We can write this inequality under the form:

δV (ζ k ) ≤ -ζ k T Ψ T Φ k T    X 1 X 2 X 3 X 2 T X 4 X 5 X 3 T X 5 T X 6       ζ k Ψ Φ k    (5.91)
with:

X 1 := P -A T P A,

X 2 := A T P (RE c ) -G T T , X 3 := A T P C, X 4 := 2T -(RE c ) T P (RE c ), X 5 := -C T P C, X 6 := C T P (RE c ).
By Schur's complement, (5.87) gives:

   W -(GW) T 0 -(GW) 2∆ 0 0 0 0    -    -WA T Z T R T -WC T    P -AW RZ -CW > 0 (5.
   X 1 X 2 X 3 X 2 T X 4 X 5 X 3 T X 5 T X 6    > 0 (5.93)
Then we have δV (ζ k ) < 0 for all ζ k ∈ E(P ), ζ k = 0 , so V (ζ k ) is strictly decreasing along the system trajectories. Then E(P ) is a stability region for the system. We can see that there always exists a positive scalar γ such that:

δV (ζ k ) ≤ -γ ζ k 2 -γ Ψ 2 -γ Φ k 2 ≤ -γ ζ k 2 ≤ -γζ k T P ζ k (5.94)
which ensures the exponential convergence with γ := δ λmax(P ) and λ max (P ) the maximum eigenvalue of P .

Application

The results are obtained with offline tests based on real experimental data and the reconfiguration control law was validated on realistic simulations based on the established model.

As said in the previous part. The water cooling system is regulated with a pressure domeloaded regulator (sphere) and valves. The actuator is saturated since the pressure is limited by thermo-mechanical constraints. An obstruction at the input of the ferrules part has been simulated by computing a closure profile of the valves. The closure profile is computed as a modification of the cross-sectional area of the actuator. The faults were implemented as in the previous section.

The simulated case for the cooling system is a constant valve closing profile, with actuator saturations and a new state reference. The fault is in a first time compensated and it can be seen that the control law for the rewritten system permits to stabilize the system around the nominal reference steady-state equilibrium with sufficient accuracy. The reference state is modified and the anti-windup aims at compensating the fault and at converging to this different reference state than the nominal one (chosen arbitrarily). We fixed the saturated value at U sat = 3.864 • 10 6 P a in this case, the saturation value has been chosen in order to allow the convergence to the new state reference.

Chapter analysis and comments

In this chapter, once an additive fault in the actuator has been detected by the FDI method composed of a first observer, the designed FTCS based on a FE and a second observer allows to compensate the failure and to converge if necessary, to a chosen steady state. This FTCS in the linear case consist in a LQ controller on an equivalent system where the unknown input is expressed as a function of the known state and known input vectors in order to decouple only the fault effect on the system. The next step was to address the design of a method to calculate another steady point which may be reachable in the case where the previous nominal steady point cannot be reached because of the actuator failure and the effect of the saturation. Being able to shape the nominal behavior of the system is useful to consider actuator saturation. A method to design an anti-windup scheme in order to compute another steady point has been proposed. The first anti-windup scheme is designed for discrete-time linear systems. This method is based on the resolution of LMIs and ensures exponential asymptotic stability in an ellipsoidal domain for a polyhedral set of admissible initial states. It appears that the anti-windup can be improved by taking into account cost functions depending on the reconfiguration objectives, for example, enlarging the stability domain. Those methods were tested on the model proposed for the evolution of pressure and mass flow rates in the cooling system of MASCOTTE for additive actuator faults and on the lines model for MR regulation.

In a second section, a nonlinear FTC scheme has been proposed to ensure the pressure and mass flow rates stability in the cooling system of MASCOTTE as well as to compensate for an additive actuator failure. Once the fault in the actuator has been detected by the FDI method composed of a first UUIO, the designed FTCS based also on a FE and a second UUIO permits to compensate for the failure and to converge if necessary, to a chosen steady state. This FTCS consists in a MPC scheme based on the minimization of an infinite horizon cost function and a direct fault compensation under the resolution of LMIs on an equivalent system where the unknown input is expressed as a function of the known state and known input vectors in order to decouple only the fault effect on the system as the method used for linear system. This method has been compared to the linear FTCS composed of an EUIO and a LQ controller and shows better performances for fault compensation and state reference tracking in the transients.

of the bench, then the different steps of the test facility firing tests' operations are introduced in a second section. In lasts sections the implementation method is described and an application example is given. The implementation is validated by replaying existing firing tests. The control law is calculated but the command is not sent to the actuators for safety considerations.

Monitoring

All the information technology of MASCOTTE, piloting, measurement acquisition and security, is actually based on a LabVIEW application distributed initially on on four computers, see Figure 6.2:

• the Safety Machine (SM),

• the Display Machine (DM) or Principal Machine (PM),

• the Acquisition Machine (AM),

• a PCI eXtensions for Instrumentation (PXI). National Instruments PXI controller. They are transmitted to the SM via the intranet network using LabVIEW's "VI-server" functionality.

For the water-cooling system, it is possible to enable or disable monitoring of all four water flows and specify a tolerance by duration and the minimum and maximum threshold values for each of them, see Figure 6.3. The configuration with four independent circuits is maximum and corresponds to the use of the ATAC nozzle.

Safety machine

The SM program consists of two essential steps: one is the preparation of the trial during which the parameters to be monitored are selected and the other is during the automatic sequence where the monitoring is effective. Here are the different steps for the SM monitoring setting:

• Activation of the essential or relevant monitors: they are independent and must be activated via the corresponding box on the front panel of the SM.

• Setting of the alert thresholds levels and tolerance values in seconds: it defines the periods during which measurements are allowed to exceed the thresholds before triggering the automatic shutdown sequence.

This method prevents a possible parasite from being triggered by a measure that would result in an erroneous value that fleetingly exits the normal ranges. This also avoids stopping the firing because of a peak pressure at ignition.

Prior to the CONFORTH project, the parameters to be monitored are of two types, measurements (analog quantities), communicated by the DM and logical quantities read directly from the channels of the DIO card. The former are compared with high and low thresholds, constant values or templates following the considered case.

Templates are prepared in advance and read in a file because interactive keyboard would be both tedious and error-prone. For the same reasons, values by default are pre-programmed for the other thresholds and tolerances, but the operator can to modify them one by one to adapt them to the fire test. The seconds are used to monitor the progress of the chronogram, i.e.

checking that the opening and closing orders of valves are sent at the times specified by the Principal Machine (PM) and that the valves react normally. For this purpose, the PM output signals sent to the relays are duplicated and read back at the SM input. Similarly, valve limit switch signals are sent to the general synoptic and are also read back at the SM input.

To add the parameters specific to CONFORTH, the same philosophy has been maintained.

The four valves added to the cooling water circuit are treated like all other piloted valves.

Temperature and pressure measurements, although transmitted by the PXI and not by the AM, are, as other measurements, compared either to high and low thresholds or templates. Here again the values of tolerances in seconds and the threshold levels are to be adapted, or at least validated, in an interactive way.

Third preparation and firing tests for MASCOTTE operations

To operate MASCOTTE (see Figure 6.2, 6.1), the firing tests must be prepared following three preparation phases. The preparations and safety tasks phases can be found in Appendix D.

Third Preparation

The third preparation comprises the torch ignition test to adjust the torch supply pressures. This test is performed with the torch removed from the housing which allows it to cool before mounting on the housing (see Figure 6.4). A cold test, under the same conditions as the fire test, is previously carried out with a neutral gas (He or N 2 ) to check if there is no leakage in the fuel circuit. After that, the heat exchanger is activated if needed. Depending on the case, the He pressure of the portholes is set to the desired value for firing or switch to the automatic position so that the pressure is controlled by the PM. Then the propellants circuits are pressurized.

Firing tests

For firing tests, a security check has to be performed. The acquisition systems have to be ready, the position of all non-automatic valves in the control panel synoptic have to be checked, the surveillance camera recording have to be started, the diagnostic material of the research teams have to be ready and the autopilot should be switch on, then audible warning should be on.

Some of these operations are integrated into the automatic sequence.

For an automatic firing sequence, the main engine control, the PM, software controls:

• the stopping of the circulation of liquid oxygen (closing valve),

• the synchronized sequence which includes the ignition, rise to nominal bearing and shutdown phases by acting on the spark plug, flare valves, injection valves, H 2 control valve, LOX or GOX pressurization.

At the same time, the display machine, AM, acquires 103 measurement channels at 1000 points per second and display on a screen some of them:

• the SM monitors critical parameters and possibly triggers an automatic emergency stop if a failure is detected, see Figure 6.6,

• the CELI machine starts archiving the measurements it acquires at high rate (16 channels) on a signal from PM,

• the PXI-CONFORTH machine starts the acquisition and archiving of data (256 channels) on a signal from AM,

• the diagnostic means of the research teams may be started by a PM signal or manually on a signal from the fire conductor.

Visual monitoring on screens is carried out by one of the operators who can, if necessary, initiate a manual emergency stop.

Implementation of the active fault-tolerant control system

For the implementation purpose a sub-VI had to be added in the SM monitoring VI using LabVIEW. We have chosen to use a C++ DLL.

To use an external code in LabVIEW, one can find the procedure in:

http://homepages.cae.wisc.edu/~ece468/documents/Using To write Win32 DLLs and calling them from LabVIEW follow the procedure given in the link:

https://m.eet.com/media/1089230/an087.pdf.

Dynamic link library and configuration files

Dynamic linking is a mechanism that links applications to libraries at run time. The libraries remain in their own files and are not copied into the executable files of the applications. DLLs link to an application when the application is executed, rather than when it is created. The DLL contains functions that perform the activities the DLL expects to accomplish. These functions are then exported. Different classes are defined in the DLL in order to create objects containing the different functions following their aims, see Table 6.1. The different functions except for the reading one are defined for each part of the system.

The Eigen library (see http://eigen.tuxfamily.org/index.php?title=Main_Page)

is used for mathematical operations, as for example matrix inversions. A configuration file has been created for each monitored part of the test stand system. This file allows to define the time step, the physical parameters of the different subsystems, the design (references, cost weights) and noise parameters for the different observers and controllers, and the detection parameters (minimum acceptable variation).

LabVIEW virtual instruments

Four VIs have been created for the AFTCS implementation. One is dedicated to the configuration file reading and initialisation of the system. The second is dedicated to the state estimation, the third one to the fault detection and the last one to the control law calculation. Those VIs are combined and communicate together in a global AFTCS VI which is integrated in parallel in the SM VI sending the monitored variables measured values.

Application

For the validation purpose, since no campaign was available to test our AFTCS we have replayed previous firing tests. The control law is calculated in case of reconfiguration but not sent to the bench actuators for application due to safety considerations.

The VIs on Figures 6.7 and 6.12 have been added to the acquisition machine at first for simplicity (it was easier for measurements transmission). To do so, different machines settings have been done as for a firing test and the bench replayed old acquired data. In this application case no false alarm has been triggered (see Figures 6.11 and 6.10) and it appears that the Extended Kalman filter gives a satisfactory estimation of the propellant feeding lines mass flow rates for a gas / gas operation. The input mass flow rate measurement is only used for validation purposes. It appears that the mass flow rates are well estimated and reconstructed, the deviation in the transients is due to the linearization of the nonlinear model around a steady state.

In this case, no fault has been detected during the transients for the chosen set of parameters (see Figures 6.18 and 6.19), which result can then be compared to a faulty case. Since the test bench was not available due to an industrial campaign (ending in December 2019), faulty simulation data generated with CARINS have been communicated to the developed VI as in a real implementation case in order to evaluate the controller part of the system from a computer (see Figures 6.20 and 6.22).

In this case, if a flag is triggered, a control law is calculated with a pole placement in order to compensate for an actuator additive fault using a fault compensation method (see Figures 6.21

Chapter synthesis

The description of preliminary implementation work, the MASCOTTE test bench operation procedures as well as its safety, display and acquisition means have been introduced in this chapter.

A LabVIEW Virtual Instrument has been developed in order to be included in the Safety Machine VI to perform FDIR. This LabVIEW VI call different sub-VIs with the following functions: configuration, estimation, detection and control law calculation. Those sub-VIs call a Dynamic Link Library composed of different classes corresponding to the observers / filters, the controllers, the detection methods. The definition of different classes has the advantage of adaptability, their parameters (system dimensions, algorithms parameters,...) can be initialized for a given subsystem, then the adequate function (observer or filter type) is called. So far, the developed tool contains the EKF, EUIO, ACUSUM, FE and a pole placement control method with direct fault compensation. Each algorithm has been tested by replaying a firing sequence with MASCOTTE test bench or by communicating CARINS simulated data to the principal VI executed on a computer. The implementation has then showed the feasability of the implementation for those algorithms taking into account the test bench limited availability. and at the same time to ensure the system stability and state estimation error convergence.

The developed estimation method also allows reconstructing this unknown information with a high-order filter or a direct inversion method. This method provide a efficient and fast generation of residuals taking advantage of the low dimensional subsystems. The generated residuals are then analyzed with an ACUSUM algorithm. This algorithm determines an adaptive threshold depending on the residual shift size. This statistical test method uses history and trend of the residuals over a sliding window as well as the minimum allowed shift size in order to estimate for a same set of parameters shifts amplitudes with different dynamics and sizes. Those methods give satisfactory results with high "Good Detection Rates" of faults with various amplitude and dynamics, and at the same time give low "False Detection Rates" which are useful to maintain the bench operation performances in the case of failures.

In the case of the cooling system where the lines are interdependent, a parity space-based fault isolation method has been proposed to isolate faults, using a projection matrix defined by fluid mechanics relations for the overall system. This method is simple since it does not require to solve an optimization problem to calculate the residuals. The efficiency of these methods have been illustrated on various simulations of the bench for different cases of failures, including simultaneous ones. This isolation method differentiates transients from failures and detects failures during those transients. It also detects sensors failures thanks to the non-respect of the fluid mechanics constraints.

The reconfiguration part presented in Chapter 5 is based on a second EUIO / UUIO where the unknown input is then considered to be the fault and a LQ or a MPC controller with error feedback is applied. The MPC scheme is based on the minimization of an infinite horizon cost function and a direct fault compensation under the resolution of LMIs. A method to design an anti-windup scheme has also been proposed in order to compute another steady point which may be reachable in the case where the previous nominal steady point cannot be reached because of the actuator failure and the effect of the saturation. This method is based on the resolution of LMIs and ensures the asymptotic stability in an ellipsoidal domain for a polyhedral set of admissible initial states.

Those controllers ensure the system stability around a chosen operating trajectory, to compensate for an additive actuator failure and prevent input saturation. Moreover, the error feedback takes into account the state estimation error directly in the control design in order to ensure the good monitoring of the system health. The reconfiguration method has been tested on a model proposed for the evolution of pressure and mass flow rates in the cooling system, the propellants feeding lines and injection of MASCOTTE test bench via simulations.

The AFTCS have started to be implemented on the bench, as explained in Chapter 6. The first results are encouraging. The cooling system ferrules pressure and the propellant feeding lines mass flow rates are estimated in real time, and ferrules mass flow rate is also reconstructed.

The ACUSUMs have been implemented and detect failures once it has been triggered. In the case of the cooling system ferrules, a control law is calculated by pole placement and fault compensation to proceed to a reconfiguration. A.1) we can see that the pressure and density are consistent as well as the temperature seems lower than the expected combustion temperature since the vaporization of droplets is endothermic and the heat exchanges with the cooling circuit are neglected. However even if the MR is closed to the one measured and the one calculated from the chamber pressure parameters, the mass concentrations especially for the water are unexpected. Further investigation should be done to solve this problem.

V 2 ∆P 5,2,k + ( ṁ5,k+1,e -ṁ5,k,e ) - c 2 V 1 √ ρ (P 1,k+1 -P 1,k ) - 2V 3 k p d t d t S 2 3 V 3 ∆P 6,3,k + ( ṁ6,k+1,e -ṁ6,k,e ) - c 2 V 3 √ ρ (P 3,k+1 -P 3,k ) 1 2S ∆P 4,1,n,k kp + 2V 1 ( ṁ4,k+1,e,n -ṁ4,k,e,n ) kpdt -1 (B.1) f r,2,k = ṁ0,k √ ρ - c 2 V 2 √ ρ (P 2,k+1 -P 2,k ) -(f r,1 + 1) 2S 2 1 ∆P 4,1,n,k k p + 2V 1 ( ṁ4,k+1,e,n -ṁ4,k,e,n ) k p d t - c 2 V 1 √ ρ (P 1,k+1 -P 1,k ) - 2V 3 k p d t d t S 2 3 V 3 ∆P 6,3,k + ( ṁ6,k+1,e -ṁ6,k,e ) - c 2 V 3 √ ρ (P 3,k+1 -P 3,k ) 1 2S ∆P 5,2,n,k kp + 2V 2 ( ṁ5,k+1,n,e -ṁ5,k,e,n ) kpdt -1 (B.2) f r,3,k = ṁ0,k √ ρ - c 2 V 2 √ ρ (P 2,k+1 -P 2,k ) -(f r,1 + 1) 2S 2 1 ∆P 4,1,n,k k p + 2V 1 ( ṁ4,k+1,e,n -ṁ4,k,e,n ) k p d t - c 2 V 1 √ ρ (P 1,k+1 -P 1,k ) - 2V 2 k p d t d t S 2 2 V 2 ∆P 5,2,k + ( ṁ5,k+1,e -ṁ5,k,e ) - c 2 V 3 √ ρ (P 3,k+1 -P 3,k ) 1 2S ∆P 6,3,n,k kp + 2V 3 ( ṁ6,k+1,e,n -ṁ6,k,e,n ) kpdt -1 (B.3)
In the case of 2 failures, for example in lines 1 and 2:

(f r,1,k + 1) 2S 2 1 ∆P 4,1,n,k k p + 2V 1 ( ṁ4,k+1,e,n -ṁ4,k,e,n ) k p d t + (f r,2,k + 1) 2S 2 2 ∆P 5,2,n,k k p + 2V 2 ( ṁ5,k+1,e,n -ṁ5,k,e,n ) k p d t = ṁ0,k √ ρ - c 2 V 2 √ ρ (P 2,k+1 -P 2,k ) - 2V 3 k p d t d t S 2 3 V 3 ∆P 6,3,k + ( ṁ6,k+1,e -ṁ6,k,e ) - c 2 V 1 √ ρ (P 1,k+1 -P 1,k ) - c 2 V 3 √ ρ (P 3,k+1 -P 3,k ) (B.4) f r,3,k = ṁ0,k √ ρ - c 2 V 2 √ ρ (P 2,k+1 -P 2,k ) -(f r,1,k + 1) 2S 2 1 ∆P 4,1,n,k k p + 2V 1 ( ṁ4,k+1,e,n -ṁ4,k,e,n ) k p d t - c 2 V 1 √ ρ (P 1,k+1 -P 1,k ) -(f r,2,k + 1) 2S 2 2 ∆P 5,2,n,k k p + 2V 2 ( ṁ5,k+1,e,n -ṁ5,k,e,n ) k p d t - c 2 V 3 √ ρ (P 3,k+1 -P 3,k ) 1 2S 2 3 ∆P 6,3,n,k kp + 2V 3 ( ṁ6,k+1,e,n -ṁ6,k,e,n ) kpdt -1 (B.5)
gain. The limitation of this method is that the global gain might be high and then cause overshoots in the case of failures of large amplitude. For example, the gain matrix has been calculated in the cooling system case presented in the section 5. • The level of the water sphere have to be checked and completed if needed and a water softener should be used.

There are three possibilities for filling the water sphere. The first two constitute the "normal path", which is quite slow, to be preferred during the test preparation phase if it is carried out well in advance. The third is the "fast path" to be used to make a plain complement between two shots. In all cases, the sphere must be depressurized before filling it. There is three way to proceed:

• Filling from the recovery tank. The level of the latter is indicated by a gauge visible from the top of the stairs. Operate (push button at the desk) the pump immersed in the tank to transfer the water from the tank to the sphere through the filter located between the two.

The pump stops automatically if the tank is empty.

• Additional filling. If the amount of water in the tarpaulin was not enough to fill the sphere, it can be supplemented with softened city water. To do this, open the manual valve located behind the H 2 exchanger (on the terrace) after the softener (valve located on the vertical pipe). Close this valve when the sphere (Figure D.2) is full.

• Quick filling, "upside down". To make a quick refueling supplement between two tests, the cooling system can be used. To do this, open the valves at the desk. The manual valves of the water circuit behind the exchanger must be open, except for the one that supplies the normal filling circuit in the previous paragraph. Then the level of liquid N 2 have to be checked and the reservoir filled if needed. This operation requires the opening of the cryogenic circuits and is partly controlled from the desk which therefore requires N 2 easements on all circuits. Depending on the quantity to be filled, the operation can take between 15 and 45 minutes. Without a more precise indication, the operators can rely on the ear: the jet noise changes completely when the tank overflows and liquid nitrogen begins to flow through the overflow. At this point, the manual and automatic valves should be returned to their firing positions.

The next step is the filling of the LOX High Pressure tank. This operation, which may present a risk and is controlled at the desk and therefore requires N 2 easements on all circuits. Letting the tank overflow should be avoided because liquid oxygen can fill the entire vent pipe, which not only constitutes a significant volume of lost fluid, but also presents a danger to a person in the area where liquid oxygen may fall.

At the end, if the filling operations were performed the day before the firing test, the Nitrogen easements should be closed, and the lines purged. If they were performed on the morning of the test day, the nitrogen servitudes should be let in service.

D.3 Second preparation

The first step of the second preparation is the System start-up. For the safety and security:

• If necessary, adjust the delay times of the time relays for the emergency stop.

• Complete the sheet presenting the bench configuration and fluid storage levels. This sheet must be completed at the beginning of the test day and completed at the end of the day. It must be archived with the measurement files acquired during the day.

• Verification of the configuration of the bench and engine in relation to the test request (neck diameters, available fluid pressures, etc.)

• Print a poster with the date and number of the test and position it so that it is visible to the surveillance camera.

• Start of video surveillance of the test cell (permanently powered).

• Check that there is enough space to record the surveillance while firing.

For the measurements:

• Start-up of the measurement conditioning devices (ANS amplifiers, Kistler load amplifiers, etc).

• Servicing fluids: Opening of all frames of the Nitrogen, Helium, Air service fluid circuits.

• Information technology: Start-up of computer systems.

• To avoid disruptions to the general network, it is recommended to disconnect the switch from the general network.

• Check on the PM that the shared folders of the AM and SM are accessible.

• Start of the test management software.

The start-up of operations such as the Nitrogen control, the LOX pressurization with Helium control, the Helium blowing and purge control, and the high pressurized air used for the water circuit control is done by piloting the valves from the control panel synoptic and setting pressures.

The next step is the sanitation. The pressure of LOX line have to be cleaned, if the pressure is to great, the operators have to depressurize the line. To check the LOX, LN 2 lines, a scanning is performed with helium. For special utilization with liquid Methane, the H 2 line is scanned including the heat exchanger. This sanitation allows the cooling phase.

During the cooling phase which is mandatory to cool the facility for a cryogenic use of the bench it is possible to acquire the different monitored parameters. On the PM the operators have to enter and check the necessary parameters for the cooling phase, then the three machines (PM, AM and SM) perform each programmed step until the cooling monitoring is completed.

Hence, the cryogenic circuits can be activated tolérantes aux défauts doivent être développées [START_REF] Shen Yin | A review on recent development of spacecraft attitude fault tolerant control system[END_REF], ceci, pour maintenir les performances du système global tout en préservant les conditions de stabilité en cas de pannes mineures affectant les composants ou l'instrumentation [START_REF] Bittner | An integrated process for FDIR design in aerospace[END_REF]. Les méthodes devant fonctionner en temps réel avec des contraintes de temps de réponse très courts, les algorithmes développés doivent être rapides [START_REF] Betta | Instrument fault detection and isolation: State of the art and new research trends[END_REF]. Pour mener à bien ces travaux, un banc d'essai dédié à l'étude des moteurs fusée à ergols liquides, Mascotte (CNES / ONERA), est utilisé pour valider les algorithmes hors-ligne à partir des données disponibles lors de simulations numériques mais aussi en ligne après implémentation en rejouant un essai.

Les trois objectifs de cette thèse sont donc:

1. La modélisation des différents principaux sous-systèmes d'un moteur fusée à ergols liquides :

Une première difficulté consiste à modéliser l'évolution des phénomènes physiques complexes mis en jeux dont les caractéristiques sont identifiables en temps réel et rendent possible la détection de changements de comportement [START_REF] Zhong | A survey on model-based fault diagnosis for linear discrete time-varying systems[END_REF]. Pour cela, des nouveaux modèles représentants le comportement du circuit de refroidissement, de l'injection des ergols dans la chambre de combustion et des lignes d'alimentations ont été développés.

Ces modèles permettent de comparer l'état de fonctionnement nominal prédit de notre système à sa sortie mesuré à l'aide d'observateurs dans le but de détecter un changement de comportement d'une partie du moteur [START_REF] Steven X Ding | Model-based fault diagnosis techniques: Design schemes, algorithms, and tools[END_REF]. De plus, dans le cas de mesures nonaccessibles (impossibilité de placer un capteur), l'état estimé de notre système permet, à partir de méthodes de reconstruction, de pallier ce manque d'information. Il est désormais possible de surveiller l'état de santé global du moteur.

2. Le développement d'algorithmes de détection et de localisation de défauts à partir des modèles obtenus :

Les précédentes méthodes de détection de défauts dans le domaine étaient soit basées sur des seuils fixes [START_REF] Wu | Liquid-propellant rocket engines health-monitoring: A survey[END_REF], soit sur des apprentissages hors-ligne ou des systèmes experts.

Or, il a été démontré que ces méthodes n'étaient pas robustes aux perturbations liées aux capteurs, actionneurs ou au processus et pouvaient causer un arrêt anticipé des opérations, voire à une mauvaise localisation de la panne et un échec de la mission [START_REF] Basseville | Detection of abrupt changes: theory and application[END_REF].

A la différence, la méthode développée reposant sur des seuils adaptatifs permet la bonne détection d'un défaut quelle que soit la partie du moteur affectée en prenant en compte ces contraintes [START_REF] Iannetti | Méthodes de diagnostic pour les moteurs de fusée à ergols liquides[END_REF]

1 S 2 ∂ ṁ ∂t + ∆P V pi = -0.316 4 ṁ πDµ -1 4 L D h ṁ2 2ρV pi S 2 (E.2)
avec ∆P := P s -P e , où e correspond à la cavité d'entrée et s pour la cavité de sortie.

Le modèle de cette partie du système de refroidissement est alors:

∂ ṁe ∂t = θ 1 ṁ 7 4 e -θ 2 ∆P ∂Ps ∂t = -θ 3 ∆ ṁ (E.3) with ∆ ṁ := ṁs -ṁe , θ 1 := -0.316( 4 πDµ ) -1 4 L D h 1 2ρV pi , θ 2 := S 2
V pi and θ 3 := c 2 V . L'emplacement des différents capteurs permet de subdiviser le circuit de refroidissement en différentes sections composées de cavités reliées par des conduites. Le paramètre θ 1 doit être identifié car la distance L est inconnue. On peut supposer ici que la densité et la viscosité restent constantes pour les pressions et les plages de température considérées. θ 1 est exprimé à l'aide de la formule de Hagen-Poiseuille.

Le bilan énergétique peut être écrit pour les cavités, le flux de chaleur étant donné par:

∆Q = h 1 1 + he wall k wall (T wall -T av )S exc (E.4)
où ∆T := T s -T e . Afin d'obtenir le coefficient de convection côté eau on utilise la corrélation de Colburn [START_REF] Frederick | Process heat transfer[END_REF]:

h = λ D 0.023 ṁL µ 0.8 µC v λ 1/3 (E.5)
Après intégration, le modèle de température est donné par:

∂T av ∂t = S exc θ 1 ṁ0.8 (1 + θ 1 ṁ0.8 θ 2 ) -1 ρC v V (T wall -T av ) - ṁ ρV ∆T (E.6)
with θ 1 := λ D 0.023( L µ ) 0.8 ( µCv λ ) 1/3 , θ 2 := e wall k wall and T av := 1 2 (T s + T e ). L'ensemble des paramètres est choisi en fonction des mesures réelles et des propriétés connues du banc d'essai. La partie refroidissement de la tuyère est modélisée par une succession de cavités et de conduites en parallèle.

La partie des lignes d'alimentation en oxygène gazeux (GOX) / hydrogène gazeux (GH 2 ) modélisée est située entre la sortie de l'échangeur thermique et le capteur de pression en amont du Venturi fixant les débits d'injection. En utilisant la conservation de la quantité de mouvement, en tenant compte des pertes de pression régulières pour des gaz parfaits et en supposant que la température reste constante le long de cette section de la ligne (la vitesse du son est également supposée constante) ; puis après intégration sur le volume de la conduite et la section de passage nous avons :

∂ ṁ ∂t = - c 2 λ f L γ2DV ∆P ṁ2 ln P (L) P (0) -S L ∆P -c 2 ṁ2 γV 1 P (L) -1 P (0) (E.7)
avec ∆P := P (L) -P (0), où L et 0 sont respectivement les mesures de pression à l'extrémité et au début de la conduite.

ṁinj = P c,div S th,div c (M R + 1) (E.9)
Ce qui donne après intégration, l'évolution de la pression d'injection dans le temps:

∂P inj ∂t = - c 2 V γP th S th,line c 2 γ + 1 γ+1 2(γ-1) - P c,div S th,div c (M R + 1) (E.

E.2 Système de détection et localisation de défauts

L'approche de détection et localisation de panne (FDI) la plus courante à base de modèles fait appel à des observateurs ou filtres pour générer des résidus [START_REF] Steven X Ding | Model-based fault diagnosis techniques: Design schemes, algorithms, and tools[END_REF], [START_REF] Hwang | A survey of fault detection, isolation, and reconfiguration methods[END_REF]. Les défauts sont alors détectés en réglant un seuil fixe ou variable sur chaque résidu généré comme dans [START_REF] Basseville | Detection of abrupt changes: theory and application[END_REF].

Ces méthodes de FDI supposent que le modèle mathématique utilisé est représentatif de la dynamique du système [START_REF] Paul | Handling modelling uncertainty in fault detection and isolation systems[END_REF][START_REF] Gertler | Fault detection and diagnosis[END_REF]. Les méthodes couramment utilisées de nos jours pour la gestion de l'état de santé des moteurs fusée à ergols liquides [START_REF] Gubanov | USSR main engines for heavy-lift launch vehicles-Status and direction[END_REF][START_REF] Huang | Key reliability drivers of liquid propulsion engines and a reliability model for sensitivity analysis[END_REF] utilisent des systèmes à base de seuils fixes ainsi que des capteurs et algorithmes avancés incluant de multiples paramètres moteur qui infèrent une anomalie à partir des données des capteurs et prennent des mesures de reconfiguration en conséquence. Les seuils fixes, aussi appelés redlines, sont simples en ce sens qu'ils agissent généralement sur une seule anomalie de paramètre de fonctionnement [START_REF] Feng | Research on health evaluation system of liquid-propellant rocket engine ground-testing bed based on fuzzy theory[END_REF]. Ces méthodes peuvent donc induire de fausses alarmes ou des pannes non détectées qui peuvent être critiques pour la sécurité et la fiabilité du système propulsif.

De plus, la conception de modèles mathématiques représentatifs représente un défi dans la pratique en raison de la présence d'incertitudes de modélisation et de perturbations inconnues [START_REF] Chen | Design of unknown input observers and robust fault detection filters[END_REF], [START_REF] Yang | Observers for linear systems with unknown inputs[END_REF], [START_REF] Bittner | An integrated process for FDIR design in aerospace[END_REF]

      C 1 A γ 1 +1 k Xk + C 1 A γ 1 -1 k BU k C 2 A γ 2 +1 k Xk + C 2 A γ 2 -1 k BU k . . . C p A γp+1 k Xk + C p A γp-1 k BU k       M k := C k E C k := (C 1 A γ 1 -1 k ) T (C 2 A γ 2 -1 k ) T . . . (C p A γp-1 k ) T T avec 1 ≤ γ i ≤ n i i = 1, .
.., p où n i est défini comme le plus petit entier tel que :

c i A γ i k E = 0 γ i = 0, 1, ..., n i -2 c i A n i -1 k E = 0 (E.14) et C i la i eme ligne de C.
Les techniques de linéarisation utilisées par l'EKF et l'EUIO impliquent la définition d'une référence en régime permanent et peuvent introduire d'importantes erreurs dans la vraie moyenne à posteriori et la covariance de la GRV transformée, ce qui peut conduire à des performances sous-optimales et parfois à la divergence du filtre, comme présenté dans [START_REF] Eric | The unscented Kalman filter for nonlinear estimation[END_REF].

Pour ces raisons, des observateurs sans parfum (UO) basés sur la transformation sans parfum ont été développés. Ils sont basés sur un paramétrage qui capture l'information de la moyenne et de covariance et permet en même temps la propagation directe de l'information à travers un ensemble arbitraire d'équations non linéaires qui permettent de dépasser les limitations précédentes des observateurs de type étendus, voir [START_REF] Józefowicz | Design of an unscented unknown input filter with interacting multiple model algorithm[END_REF]. Le système considéré est de la forme plus générale: Pour certains sous-systèmes du banc, l'isolation est immédiate puisque les différents soussystèmes ont des entrées / sorties "indépendantes" pour les parties surveillées, alors que ce n'est pas le cas pour d'autres sous-systèmes. Ainsi, dans les sous-systèmes interdépendants, une fois les défaillances détectées par l'algorithme ACUSUM, il est nécessaire de pouvoir localiser une ou plusieurs défaillances. L'objectif de cette partie est de localiser un défaut dans une ou deux branches (simultanément) du système de refroidissement. Nous considérons toujours une défaillance additive de l'actionneur sur le système. Une fois le défaut détecté par un premier mécanisme de FDI en ligne et en temps réel, l'objectif est de localiser le défaut à l'aide d'une projection dans un espace de parité. Cette projection permet de générer des résidus structurés afin de localiser les défaillances. Dans la plupart des travaux existants, la matrice de projection pour un contrôle de parité est choisie arbitrairement [START_REF] Gao | A survey of fault diagnosis and fault-tolerant techniques-Part I: Fault diagnosis with model-based and signal-based approaches[END_REF] ou en résolvant un problème de minimisation [START_REF] Zhong | Parity space-based fault detection for linear discrete time-varying systems with unknown input[END_REF], [START_REF] Schneider | Parity space based FDI-scheme for vehicle lateral dynamics[END_REF]. Une nouvelle approche de l'espace de parité est proposée dans [START_REF] Soo | A new parity space approach to fault detection for general systems[END_REF], elle suppose que le défaut est constant et inclut des méthodes de conception de la matrice de projection pour des situations réalistes considérant le système global avec à la fois les bruits liés au système, les bruits de mesure et les défauts des actionneurs et capteurs ) est caractérisé par un processus de FDI en ligne [START_REF] Zhang | Bibliographical review on reconfigurable fault-tolerant control systems[END_REF] qui détecte et estime l'amplitude du défaut, la deuxième étape consiste à réaliser un suivi en régime permanent de l'entrée de référence par compensation du défaut [START_REF] Theilliol | Actuator fault tolerant control design based on a reconfigurable reference input[END_REF].

X k+1 = f (X k , U k ) + ED k + w k Y k+1 = CX k+1 + v k+1 (E.
D k = H(Y k+1 -C(f (X k , U k ) + w k ) -v k+1 ) (E.16) χ i,k+1|k := f (χ i,k|k , U k+1 , k) + ĒY k+1 + wk (E.
Deux méthodes de contrôle de base sont disponibles : les systèmes de contrôle en boucle ouverte (sans rétroaction) et en boucle fermée (rétroaction). Tous deux ont trouvé une large application dans le cas des systèmes de propulsion de fusée à ergols liquides [START_REF] Pérez-Roca | A survey of automatic control methods for liquid-propellant rocket engines[END_REF]. Le modèle considéré est ici: matricielles linéaires dans le même esprit que [START_REF] Jm Gomes Da | Anti-windup design with guaranteed regions of stability for discrete-time linear systems[END_REF]. Dans cette approche, l'ensemble des états initiaux admissibles et le domaine de stabilité associé sont déterminés pour tenir compte de la compensation des défauts additifs de l'actionneur.

X k+1 = A c X k + B c U k + B c f k Y k+1 = CX k+1 (E.
Lorsque l'on suppose que l'entrée est saturée, le système considéré devient :

X k+1 = A c X k + B c sat(U k ) + B c f k Y k+1 = CX k+1 (E.27) avec sat(U k ) :=      U sat si U k > U sat U k si -U sat ≤ U k ≤ U sat -U sat si U k < -U sat     
où U k ∈ R l est la loi de commande et U sat ∈ R l + est la limite de saturation.

La dynamique de l'état de référence pour la stratégie anti-windup est choisie comme suit : Nous considérons alors le système suivant :

X k+1 := A c X k + B c U k + E c (sat(U k ) -U k ) U k := U k -B + c B c fk + W c ( Xc,k -X k ) (E.
X k+1 = AX k + BU k + f (X k , U k ) + Bf ak + wk Y k+1 = CX k+1 + v k (E.33)
où X k ∈ R 2 est le vecteur d'état, Y k ∈ R est la sortie mesurée, U k ∈ R est l'entrée connue et C T ∈ R 2 la matrice de distribution de la sortie, f ak ∈ R est le défaut additif de l'actionneur.

On considère alors l'état augmenté suivant:

ζ k+1 = A 0 0 K k+1 C ζ k + B 0 ∆U k + B 0 f ak + I 0 f (X k , U k ) -f (X k , U k ) (E.34)
avec ∆U k := U k -U k . On peut simplifier son expression par: On considère une loi de contrôle de la forme:

ζ k+1 = Aζ k + B(∆U k + f ak ) + CΦ k (X k , U k , X k , U k ) (E.
U k := U k + Gζ k -B + B fak
Nous considérons le problème de minimisation suivant par rapport à ∆U (•) de la fonction de coût à horizon infini:

E.5 Conclusion et perspectives

Ces travaux de thèse ont permis le développement de méthodes de détection, de localisation de panne et de reconfiguration pour les différents sous-systèmes du banc MASCOTTE.

Ces méthodes ont été développées sur la base de modèles. Ceux-ci ont été définis afin de représenter au mieux l'évolution de l'état de santé de chacun de ces sous-systèmes. Les méthodes développées ont été validées sur la base de données réelles du banc MASCOTTE et de données de simulations réalistes générées à l'aide du logiciel CARINS. Ces méthodes comprennent:

• des observateurs à entrée inconnue ou filtre de Kalman afin de générer des résidus et reconstruire des données manquates,

• un algorithm ACUSUM afin d'analyser les résidus à l'aide de seuils adaptatifs,

• une méthode de génération de résidus structurés à l'aide d'une projection, dans un espace de parité dans le cas de systèmes interdépendants, afin de localiser des défauts,

• un système de contrôle actif tolérant aux défauts additifs d'actionneurs avec une boucle anti-saturation afin d'assurer la stabilité du système et sa convergence vers un état de Abstract : Monitoring and improving the operating modes of launcher propulsion systems are major challenges in the aerospace industry. A failure or malfunction of the propulsion system can have a significant impact for institutional or private customers and results in environmental or human catastrophes. Health Management Systems (HMS) for liquid propellant rocket engines (LPREs), have been developed to take into account the current challenges by addressing safety and reliability issues. Their objective was initially to detect failures or malfunctions, isolate them and take a decision using Redlines and Expert Systems. However, those methods can induce false alarms or undetected failures that can be critical for the operation safety and reliability. Hence, current works aim at eliminating some catastrophic failures but also to mitigate benign shutdowns to non-shutdown actions. Since databases are not always sufficient to use efficiently data-based analysis methods, model-based methods are essentially used. The first task is to detect component and / or instrument failures with Fault Detection and Isolation (FDI) approaches. If the failure is minor, non-shutdown actions must be defined to maintain the overall system current performances close to the desirable ones and preserve stability conditions. For this reason, it is required to perform a robust (uncertainties, unknown disturbances) reconfiguration of the engine. Input saturation should also be considered in the control law design since unlimited control signals are not available due to physical actuators characteristics or performances. The three objectives of this thesis are therefore: the modeling of the different main subsystems of a LPRE, the development of FDI algorithms from the previously developed models and the definition of a real-time engine reconfiguration system to compensate for certain types of failures. The developed FDI and Reconfiguration (FDIR) scheme based on those three objectives has then been validated with the help of simulations with CARINS (CNES) and the MASCOTTE test bench (CNES/ONERA).

Universit é Paris-Saclay

Espace Technologique / Immeuble Discovery Route de l'Orme aux Merisiers RD 128 / 91190 Saint-Aubin, France

Acronyms

  ACU SU M Adaptive Cumulative SUM AF T CS Active Fault Tolerant Control System AM Acquisition Machine AN N Artificial Neural Networks AR Auto-Regressive ARL Average Running Length ARM A Auto-Regressive Moving Average AT AC Nozzle and rear-body aerodynamics CBM Condition-Based Maintenance CU SU M Cumulative SUM DDC Decoupled Disturbance Compensator DIO Digital Input Output DLL Dynamic Link Library DM Dislpay Machine DT M Digital Transient Model DV SC Discrete-time VSC EKF Extended Kalman Filter EU IO Extended Unknown Input Observer EW M A Exponentially Weighted Moving Average F D Fault Detection F DD Fault Detection and Diagnosis F DI Fault Detection and Isolation F E Fault Estimator F F T Fast Fourier Transforms F M EA Failure Modes and Effects Analysis F T CS Fault Tolerant Control System GLR Generalized Likelihood Ratio HCM Health Condition Monitoring HM S Health Management / Monitoring System

RP - 1 λ

 1 Refined Petroleum 1 -Kerosene Modeling variables Global heat transfer coefficient [W/m 2 /K] ṁ Mass flow rate [kg/s] Ẇ Reaction rate [mol/m 3 /s]

Definition 2 . 1 . 5 .Definition 2 . 1 . 6 .Definition 2 . 1 . 7 .Definition 2 . 1 . 8 .

 215216217218 FailuresA permanent interruption of a system's ability to perform a required function under specified operating conditions. Malfunctions An intermittent irregularity in the fulfilment of a system's desired function. Disturbances An unknown (and uncontrolled) input acting on a system. Perturbations

Figure 2 . 1 :

 21 Figure 2.1: FDD methods classification

  reliability of the neural network to generalize correct responses for the testing patterns that only broadly resemble the data in the training set. No additional learning or weight adjustments occur during this phase. An application phase: the neural network will produce almost instantaneous results of the output for the practical inputs provided. The predictions should be reliable provided the input values are within the range used in the training set. Then, the next stage involves gathering the data for use in training and testing the neural network [74]. This requires a data set of case records containing the input patterns and the expected (target output) solution. The training set must provide a representative sample of the data. A large training set reduces the risk of undersampling the nonlinear function but increases the training time [75]. Thus, for the application of those fault diagnosis and control methods, the number of measured variables is often very large, and most of the variables are highly correlated because their variation is due to a small number of underlying variations (latent variables), environmental factors or normal process variations introduced in combinations of variables by operating personnel. The development of a back-propagation neural network model essentially involves several stages. First, the variables

  They also present FDD methods for the Long March Main engine. Those methods make use of fault simulation and analysis because due to the cost and danger of failure tests, it is not realistic to acquire enough test data under many fault conditions solely through tests. The failure modes are divided into two general categories: fluid pipeline system failures and mechanical failures. The developed models include static nonlinear models, dynamic nonlinear models, and other models suitable for different purposes such as real-time simulating models, filter-designing models, and parameter-estimation models. The static nonlinear models are set up for static fault effect simulation, linear fault isolation methods study, and analysis of sensitivity of the parameters measured. A real-time fault simulation model is used for the real-time verification system. Then, they present an engine Failure Modes and Effects Analysis (FMEA) which includes the statistical analysis for the main failure types and the probability of occurrence. For that they use both test data statistics and numerical simulation methods. For this engine they include leakage at joints, rupture of turbine blades, damage of shaft and bearings, fracture of ducts, failure of seals, operating anomalies in valves, superfluous inclusion and ablation of components. They proposed three criteria for the selection and evaluation of monitored parameters in their study: the response of parameters to external and internal disturbances, the signal-to-noise ratio in engine environment, and transient features under faulty conditions. The average value and noise amplitude of the measured parameters of the engine are computed statistically for 30 seconds intervals during a normal main-stage test. The relation between the input and the output are described by the static character equation and they introduce a fault factor in the component character equation. All output parameters are calculated one by one in the order of component linkage which reveals a function formed in the parameter propagation. Although there are usually

  connection between the hypersphere nodes and the fault class codes are binary valued. If there is an overlap between the two hyperspheres representing different classes, it is necessary to eliminate it. Hence, they examined the proper adjustment of the maximum size of the hypersphere bounded by an user-defined value and discuss the fault detection demonstration with ground test data. Sensor data used for FD are derived with firing tests on a large LPRE, with a sampling interval time of 0.02s. The network structure parameters are selected as 14 input nodes determined by the engine survey parameters, hypersphere body nodes are formed to meet the demands of the real problem and one output node represent the normal operating point. For nominal tests, the outputs of neural network are shown to be normal. The fault detection time was 0.29s in advance of the emergency shutdown in the engine operation. For fault isolation purposes, the random simulation fault classes of the rocket engine include the abnormal opening of the main oxidizer valve, the abnormal opening of the main oxidizer valve, the abnormal opening of the main fuel valve and both abnormal openings at the same time. After the FHNN has been trained, random simulation data whose fault degrees are different from those of the training patterns are presented to the FHNN and fault isolation results are obtained.Finally, they present a real-time verification system for HMS of LPREs. Differential equations are still used to represent operational process in components such as the combustion chamber, gas generator, and turbo-pump, whereas static algebraic equations are used for pipe lines.Considering cost and performance, a real-time verification system was constructed, it is divided into two subsystems: a simulation system for the transient performances under fault conditions and a monitoring one to execute online operations of real-time fault diagnosis algorithms and output alarm signals and diagnosis results. This system was successfully validated and demonstrated a variety of failure detection and diagnosis algorithms.

  The Test Information Program (TIP88) is an SSME steady-state model consisting of three separate sections: Data Reduction, Base Balance, and Rated Programs. The Data Reduction Program examines measured test data to define the operating characteristics specific to that particular engine. The Base Balance Program calibrates the engine model by adjusting performance variables based upon the data reduction results. The Rated Program essentially serves as an engine specific PBM; the calibrated model provides steady-state simulation of the specific engine at different power levels.

Figure 2 . 2 :

 22 Figure 2.2: Model-based fault detection scheme

  They first describe an open-cycle LPRE composed of a turbine driving pumps and a gas generator. The considered engine operates with RP -1 and LOX. The components are combustion chamber, gas generator, nozzle, pipes and control valve. For the mathematical model they use Newton's second law and first law of thermodynamics derived to obtain a nonlinear model with heat transfer as a constant loss coefficient. They modeled the start-up process of the open-cycle LPRE because the aim is to shift to the steady-state as quick as possible without any harmful transition phenomena because more than 30% of the engine failures occurred during start-up

Figure 2 . 3 :

 23 Figure 2.3: Fault Tolerant Control structures classification

Figure 2 . 4 :

 24 Figure 2.4: Control algorithms classification

  LMI. They transform the minimization of the nominal objective function in a minimization of the worst-case objective function and show that the feasible receding horizon state-feedback control law robustly stabilizes the set of uncertain plants. The maximization is over the polytopic set and corresponds to choosing as a model for predictions the time-varying plant leading to the largest or worst-case value of the cost function among all the plants in this set. To address this problem, they first derive an upper bound on the robust performance objective. Hence, they minimize the upper bound with a constant state-feedback control law. To find this upper bound, they consider a quadratic function of the state following an inequality for all states and a control law giving conditions for the existence of the appropriate upper bound and the corresponding state feedback matrix. Thus, the goal of their robust MPC algorithm has been redefined to synthesize at each time step a constant state-feedback control law to minimize this upper bound. The proof is based on the results for quadratic stabilization of uncertain polytopic continuous-time systems

  system and lead to consideration of the worst-case value of the state constraint in the cost function. They show how limits on the control signal can be incorporated into their robust MPC algorithm as sufficient LMI constraints, considering a Euclidian norm constraint imposed on the present and the entire horizon of future manipulated variables. They proceed the same way for peak bounds on each component. The obtained inequalities represent sufficient LMI constraints that guarantee the specified constraints on the manipulated variables. They did the same for structured uncertainty, then for output constraints over the current and future horizon.They stated the main theorem for robust MPC synthesis with input and output constraints and established robust stability of the closed loop. The feasibility is given by the fact that if the optimization problem is feasible at the first timestep then it is feasible for all times given by the resolution of a LMI. The feasible receding horizon state feedback control law is showed to robustly asymptotically stabilize the closed-loop system by showing that the upper bound of the cost function is a Lyapunov function due to the convexity of the optimization. Then, they considered extensions to reference tracking (the cost function considers the reference trajectory error), constant set point tracking (the reference trajectory error and reference input error), disturbance rejection, time delay (Lyapunov Krasovskii function).

  Thrust control valve Controller PI (online), Q-ILC (offline) The proposed control system consists of a pressure control of the combustion chamber (for thrust control of LPRE), a MR control of propellants (for temperature control) of combustion chamber and a MR control of propellants (for temperature control) of gas generator. The thrust control valve is controlled by a PI control logic online and Quadratic criterion-based Iterative Learning Control (Q-ILC) as offline control logic for decreasing errors of online feedback control logic at each batch. MR in the gas generator (GG) is controlled with stabilizer operated by a proportional control logic online; the inlet pressure is compared to a set value. The controlled values are compared to set values using Propellant Utilization (PU) system for optimizing propellant consumption during flight. They consider a multi-input / multi-output linear discretetime state-space model whose parameters are identified by a subspace method. Q-ILC is developed for controlling a batch process in chemical processes as batch reactor, rapid thermal process of semiconductor, etc. It calculates the optimal input sequence with the data of control error at last batches and applies the calculated optimal input sequence to next batch. As batches are increased, the control errors between the set-values and the real data decrease asymptotically which compensates for the online controller error. Q-ILC is a model-based control logic using the linear impulse model from the state space model. To calculate the sequence of input variables for minimizing the control error at each batch and minimizing rapid drift of input sequence they propose an objective function corresponding to the control error and reference error energies. Then they give the solution of the unconstrained problem and simulated more than 20 batches to validate their method. For control simulation, the desired output sequence of the combustion chamber pressure is set up with three steady-state sections and two transient sections. The objective of the MR control is that the temperature of combustion chamber and GG should be kept within a nominal set during flight. LEC main purpose was to optimize the trade-off between dynamic performance and structural durability. In the case of expendable rocket engine, it is important to minimize risks as improving the engine performances in term of thrust and fuel consumption. The first methods were then based on PI or P controller, but as seen in part 5.1 those methods does not allow adaptability nor robustness to perturbations which are important tasks for the next generation of rocket engines. For those reasons control engine methods have been continuously improved with adaptive control and FTC methods.

  control input each time. Since those systems are technically running open-loop, the success of the control sequence depends on the accuracy of the model. Research implementations have used both a piece-wise linear model and nonlinear Component Level Model (CLM) linearized at each time step as the on-board model. One of the advantages of this technique is that the goals and constraints may be changed online. An example of this is that the controller can minimize temperature increase during transient operation while minimizing specific fuel consumption during launch. Some work has been done to improve the control modes for the SSME, such as advanced closed-loop control mode for turbo-pump preburner MR control. In the ICS developed by the NASA the main combustion chamber pressure and MR variables are controlled in the main stage, but also the MRs (and therefore turbine inlet temperatures) for

Actuators

  Propellant flow control valves Controller Open-loop operation mode (transfer function representation) The basic dynamic equations represent the evolution of the chamber pressure to total weight flow under the form of a transfer function depending on a proportionality constant (chemical parameters), the combustion delay and the chamber fill time. The feedline is represented in lumped parameter form (continuity and momentum equations) or distributed hyperbolic form (wave equation). The two inputs are the valve areas (positions) which control the individual propellant flows and hence the chamber pressure and MR. The chamber pressure responds to total weight flow. The two loops tend to be interactive and to minimize excursions of the error signals, one loop is tuned to be in a fast loop and the other slower. Experience shows that the mixture ratio should be fast. This minimizes excursions in MR away from the set point which in turn keeps the gas and metal temperatures within design constraints. The chamber pressure is the slower loop and its bandwidth is set by the thrust response requirements. The type of control shown here would normally require three measurements (combustion chamber pressure, and propellants weights) with two control inputs (valve areas). They explain how modern chemical rocket engines work and consider two representatives' cycles, gas generator cycle and expander cycle.In this paper they do not discuss about startup and shutdown. Startup is described to be a scheduled process based on empirical knowledge of initial ignition propellant arrival times and related parameters. Shutdown is also critical to realize the required mission velocity variation.

  valves to also be closed loop control valves. This actuator configuration is used in the multivariable control. They give a representation of measurement locations for ground tests. They use the discharge pressure and temperature of the low-pressure fuel turbo-pump and the volumetric fuel flow and the pressure chamber to estimate the mixture ratio in the existing SSME Baseline controller. Engine startup and shutdown are accomplished through open loop scheduling based on extensive computer simulation and test experience as for the closed loop control it is done via PI control. Set point control of the combustion chamber pressure provides throttling while set point control of MR maintains performance and temperature in the main combustion chamber.

  reconfiguration functionalities. They present a framework for an ICS, the hierarchy integrates functionalities at the execution level such as the high-speed, closed-loop multivariable controller, engine diagnostics and adaptive reconfiguration with a top-level coordination function. The top-level coordination function serves to interface the current engine capability with the other engines, the vehicle / mission requirements, and crew. It modifies controller input commands and selects various control reconfiguration modes to resolve any conflicts between objectives.The main objective of LEC is to minimize damage accumulation at critical points of the engine structure by managing how the control moves the system through transients (or by the choice of operating domain). The implicit method considers an objective function that maximizes dynamic performance and a damage measure which uses the best current material fatigue / fracture theory available. During the design process, two types of feedback variables are considered, the performance variables normally used to manage dynamic performance and nonlinear functions of the performance variables representative of the damage variables. Various control algorithms are then examined within this feedback structure and they present extension to nuclear propulsion.

FDD

  algorithms combining data-based and model-based methods have been used to diagnose failures to carry out control in time in order to minimize the engine's damage by reducing the fault propagation rate or proceed to a reconfiguration. Hence, there are different solutions, reconfigure the engine or emergency shutdown. This choice implies reliable and robust control method to work in real time and to prevent unnecessary shutdowns caused by an inefficient compensation of failures. The first developed methods for engine control were based on openloop, PI, PID or Proportional single-variable controllers. However, those methods do not take into account the optimization of multi-loop control nor to perform FTC or reconfigure the engine.

Figure 3 . 1 :

 31 Figure 3.1: Thrust chamber basic functional steps

Figure 3 . 2 :

 32 Figure3.2: Engine cycles for LPREs with a turbo-pump feed system -Extract from[START_REF] George P Sutton | History of liquid propellant rocket engines[END_REF]

Figure 3 . 3 :Figure 3 . 4 :

 3334 Figure 3.3: MASCOTTE test bench -Ferrules

Figure 3 . 5 :Figure 3 . 6 :

 3536 Figure 3.5: MASCOTTE test bench -Synoptic

Figure 3 . 7 :

 37 Figure 3.7: MASCOTTE test bench -Cooling system -ATAC + visualization configuration

Figure 3 . 8 :

 38 Figure 3.8: MASCOTTE test bench -Cooling system -Sensors and actuators locations

Figure 3 . 9 :

 39 Figure 3.9: MASCOTTE -Cooling system -Ferrules -Pressure model

  and 3.12, Table3.6). The relative errors values and the variations on the figures are due to measurement noises.

Figure 3 .

 3 Figure 3.11: MASCOTTE -GOX propellant feeding line -Mass flow rate model

Figure 3 .

 3 Figure 3.13: MASCOTTE -GH 2 propellant injection -Pressure model

  (3.50) Model (3.42) X := P inj X := [ ṁe P s ] T Y := P inj Y := P s U := [P th S th,line P c,div ] T U := P e D := 1/(c (M R + 1)) D := ṁs D := 1/(c (1/M R + 1))

Figure 4 . 3 :

 43 Figure 4.3: MASCOTTE -Cooling system -Ferrules -Mass flow rate reconstruction -∆t = 30ms

  3) than in the previous application part. The estimation period used on real measurements in this application is fixed to 1 milliseconds to have a better estimation of the transients for EUIO and UUIO comparison purposes. The state estimation error (e k = Y k -C Xk ) is taken as a residual. We then compare the UUIO to the EUIO (see Figure 4.4).

Figure 4 . 4 : 124 Figure 4 . 5 :

 4412445 Figure 4.4: MASCOTTE -Cooling system -Ferrules -Pressure residual -EUIO -∆t = 1ms

Figure 4 . 6 :

 46 Figure 4.6: CARINS simulations -Cooling system -Ferrules -Pressure residual -UUIO -∆t = 1ms

Figure 4 . 7 :

 47 Figure 4.7: MASCOTTE -Cooling system -Ferrules -Mass flow rate reconstruction -∆t = 1ms

Figure 4 . 8 :Figure 4 . 9 :

 4849 Figure 4.8: CARINS simulation -Cooling system -Ferrules -Fault 3 estimation

Figure 4 . 11 :

 411 Figure 4.11: CARINS simulation -Cooling system -Ferrules -Fault 3 residual

Figure 4 .

 4 Figure 4.13: CARINS -Cooling system -Visualization configuration -Upstream synoptic

2S 2 i

 2 ρ(P j,k -P i,k ) kp -2ρV i ( ṁj,k+1,e -ṁj,k,e ) kpdt for i = 1, ..., 3, j = 4, ..., 6.

Figure 4 . 14 :

 414 Figure 4.14: CARINS simulation -Visualization module -Fault reconstruction -Case 1

Figure 4 . 15 :Figure 4 . 16 :

 415416 Figure 4.15: CARINS simulation -Visualization module -Pressure residual -Fault

Figure 5 . 1 :

 51 Figure 5.1: Closed-loop FTCS diagram

Figure 5 . 4 :Figure 5 . 5 :

 5455 Figure 5.4: CARINS simulation -Ferrules -Input pressure fault compensation & reconfiguration -Case 5 -EUIO/LQ+AW

Figure 5 . 6 :

 56 Figure 5.6: CARINS simulation -GH 2 propellant feeding line -Mass flow rate control & estimation -LQ+EKF

. 66 )

 66 and applying the Lemma 2, the upper bound of g(ζ k , ∆U k , f ak ) becomesg(ζ k , ∆U k , f ak ) ≤ (1 + ) Aζ k + B(∆U k + f ak ) T P Aζ k + B(∆U k + f ak ) + (1 + -1 )(CΦ k ) T P (CΦ k ) (5.67) Consider P ≤ λ max I ≤ µI (5.68)

Figure 5 . 9 :

 59 Figure 5.9: CARINS simulation-Ferrules -Pressure and mass flow rate control -UUIO/MPC -Fault 1

Figure 5 . 10 :Figure 5 . 11 :

 510511 Figure 5.10: CARINS simulation -Ferrules -Pressure control -UUIO/MPC

92 )

 92 By multiplying from the left and from the right by T := ∆ -1 et P := W -1 we have:

Figure 5 .

 5 Figure 5.13: CARINS simulation -Ferrules -Input pressure fault compensation & reconfiguration -UUIO/MPC+AW

Figure 5 .

 5 Figure 5.14: CARINS simulation -Ferrules -Output pressure and mass flow rate fault compensation & reconfiguration -UUIO/MPC+AW

Figure 6 . 2 :

 62 Figure 6.2: MASCOTTE test bench -Desk / Synoptic

Figure 6 . 4 :

 64 Figure 6.4: MASCOTTE test bench -Torch and housing -1996 version

Figure 6 . 5 :

 65 Figure 6.5: MASCOTTE test bench -Safety Machine -Threshold selection

Figure 6 . 6 :

 66 Figure 6.6: MASCOTTE test bench -Safety Machine -Gabarit checking -Automatic firing sequence

Figure 6 . 7 :Figure 6 . 8 :

 6768 Figure 6.7: AFTCS -GH 2 feeding line

Figure 6 .

 6 Figure 6.10: AFTCS -GH 2 feeding line -Residual

Figure 6 .

 6 Figure 6.11: AFTCS -GH 2 feeding line -Flag

Figure 6 .

 6 Figure 6.12: AFTCS -Ferrules cooling system

  , 6.14, 6.15, 6.16 and 6.17.

Figure 6 .

 6 Figure 6.13: AFTCS -Ferrules -Measured pressure -MASCOTTE measurements Figure 6.14: AFTCS -Ferrules -Estimated pressure -MASCOTTE measurements

Figure 6

 6 Figure 6.18: AFTCS -Ferrules -Output pressure residual -MASCOTTE measurements

Figure 6 .Figure 6 . 21 :

 6621 Figure 6.19: AFTCS -Ferrules -Flag -MAS-COTTE measurements

and 6 .

 6 [START_REF] Karimi | Dynamic and nonlinear simulation of liquid-propellant engines[END_REF].

Figure 6 . 23 :

 623 Figure 6.22: AFTCS -Ferrules -Output pressure residual -CARINS data

Figure A. 2 :

 2 Figure A.2: MASCOTTE test bench -Combustion chamber gas mixture density model Figure A.3: MASCOTTE test bench -Combustion chamber temperature model

1 :

 1 W c = [-0.4119 0.1997] (see C.1).

Figure C. 1 :

 1 Figure C.1: CARINS simulation -Pressure control law -EUIO/LQ polytopes

Figure D. 2 :

 2 Figure D.2: MASCOTTE test bench -Water sphere

  . The operators open the LOX and LN 2 cryogenic circuits (Figure D.3) by a manual pressurization and withdrawal valves located on the storage tank, and the liquid nitrogen tank. The cooling of the LOX line last about 45 min at the same time, the cooling of the injection head is performed. It stills possible at this step to interrupt the cooling if needed. To avoid the frosting of the outer surfaces of the visualization windows (if used), a hot air gun can be used. In the special case of liquid Methane, the H 2 line can be cooled.

Figure D. 3 :

 3 Figure D.3: MASCOTTE test bench -LOX line -Cooling and sanitation

  3. d'une chambre de combustion composée de plusieurs viroles dont le nombre varie suivant sa configuration, 4. d'un circuit de refroidissement alimenté en eau régulé à l'aide d'une sphère et de vannes. 5. d'une tuyère.

Figure E. 1 :

 1 Figure E.1: Banc d'essai MASCOTTE -synoptique simplifié opération gaz / gaz

10 )

 10 Les modèles obtenus ont été validés à l'aide de données réelles du banc MASCOTTE et sont jugés suffisamment précis pour utiliser des méthodes de détection, localisation de panne et reconfiguration à base de modèles (Figure E.2). Cependant, les modèles établis pourront encore être améliorés en modélisant l'évolution de la température dans la chambre de combustion, en améliorant les concentrations massiques des différents modèles d'espèces et en modélisant les phases de démarrage et d'arrêt pour développer un système de contrôle actif tolérant aux défauts (AFTCS) pour une plus large gamme d'applications.

Figure E. 2 :

 2 Figure E.2: MASCOTTE -Système de refroidissement -Viroles -modèle de pression

17

 17

  ) où f = T f , T = I n -EHC, n est la dimension de l'état et wk = T w k -EHv k+1 . La nouvelle transformation obtenue permet de propager les Sigma points de façon à assurer la convergence de l'erreur d'estimation et la matrice de gain est calculée de façon à assurer la minimisation de sa matrice de covariance. Sur la base des données réelles du banc d'essai MASCOTTE, l'UUIO a été testé et comparé à l'EUIO dans le cas des modèles de pressions et débits du circuit de refroidissement possédant de fortes non-linéarités. La période d'estimation utilisée pour les mesures réelles dans cette application est fixée à 1 milliseconde afin d'avoir une meilleure estimation des transitoires pour les comparaisons EUIO et UUIO. L'erreur d'estimation de l'état (e k = Y k -C Xk ) est choisie comme résidu (voir Figure E.3). Le pic dans la partie transitoire dû à la variation brusque de l'évolution de la pression est réduit. Pour comparer les méthodes de reconstructions d'entrée inconnue, le résultat est comparé aux mesures du débit massique de la cavité de sortie des viroles disponibles pour cet essai. Les résultats sont présentés (Figure E.4) et montrent une convergence correcte après la phase transitoire.

Figure E. 3 :

 3 Figure E.3: MASCOTTE -Système de refroidissement -Viroles -Résidu de la pression -UUIO

G r,N := max 1≤i≤N sup µ 1 N

 1 k=i ln p(r k , µ 1 ) p(r k , µ 0 ) (E.18)L'hypothèse H 1 est choisie lorsque G r,N > Seuil (sinon H 0 ). G r,N est une fonction d'évaluation et peut être définie à chaque pas de temps. Il est alors possible d'utiliser un ACUSUM qui estime µ 1 comme dans[START_REF] Jiang | Adaptive CUSUM procedures with EWMAbased shift estimators[END_REF]. Pour estimer le changement de valeur moyenne inconnu décrit par une amplitude δ, une généralisation du graphique de contrôle EWMA (EWMA-C) a ensuite été proposée, permettant pour un même jeu de paramètres d'améliorer les performances en terme de détection des algorithmes en cas de défaillances de différentes amplitudes et dynamiques.Selon le choix du facteur de pondération, l'EWMA-C peut être sensible à une dérive faible ou progressive du système. Le facteur de pondération λ détermine le taux auquel les données "plus anciennes" entrent dans le calcul de la statistique EWMA. Une valeur de λ = 1 implique que seule la mesure la plus récente influence l'EWMA. Ainsi, une valeur élevée de λ (plus proche de 1) donne plus de poids aux données récentes et moins de poids aux données récentes ; une valeur faible de λ (plus proche de 0) donne plus de poids aux données anciennes. L'estimation de l'amplitude du décalage est définie comme suit :δk = δk-1 + Φ γ (e p,k ) (E.19) avec e p,k = r k -δk-1 l'erreur de prédiction, Φ γ est défini comme la dérivée d'une fonction de Huber. k + (1 -λ)γ , e p,k < -γ λe p,k , |e p,k | ≤ γ e p,k -(1 -λ)γ , e p,k > γ avec γ ≥ 0, habituellement fixe. γ est défini ici à chaque étape par γ :=| r k-1 -δk-1 | /2 pour améliorer l'efficacité de l'algorithme pour la détection de faibles écarts. Ceci conduit à l'algorithme ACUSUM suivant : augmentation ou une diminution de la valeur moyenne du résidu: δ+ := max (δ +,min , δk ), and δ-:= min (δ -,min , δk ). δ +,min et δ -,min sont ici les amplitudes minimales à détecter. Le seuil est choisi pour être un coefficient de sécurité multiplié par δ+ . Pour évaluer l'efficacité de l'algorithme conçu, les taux de bonne détection (GDR) et de fausse détection (FDR) ont été calculés pour une obstruction simulée dans le système de refroidissement à l'aide de CARINS. Pour choisir les valeurs des coefficients et évaluer les performances de l'algorithme, trois ensembles de défauts, composés de dix essais avec des bruits différents, ont été simulés à l'aide de CARINS. Chaque jeu a été simulé avec différents profils de fermeture et d'ouverture des vannes du système de refroidissement. Les réglages ont été choisis pour optimiser le GDR et minimiser le FDR dans le cas de changements brusques de la valeur moyenne des résidus. Les résultats pour un défaut à dynamique lente et de grande amplitude sont satisfaisants car il est nécessaire de ne pas détecter ce type de variations qui pourraient être confondues avec des transitoires. Le dernier cas d'étude permet d'évaluer la performance de l'algorithme pour des défauts successifs de tailles différentes. Dans de rares cas, le comportement nominal du système entre deux défauts peut être considéré comme défectueux si la transition est effectuée dans un court laps de temps (d'où le taux FDR), mais dans la plupart des cas, les deux défauts sont bien détectés séparément.

  simultanément. Dans notre cas, la défaillance a sa propre dynamique connue qui nous permet d'utiliser des contraintes directes de la mécanique des fluides basées sur les équations de bilan d'énergie, de quantité de mouvement et de masse.Les modèles de chaque ligne composant le système de refroidissement, sont complétés par des contraintes basées sur la continuité du débit massique et la conservation de l'énergie pour l'ensemble du système. Les retards temporels dans les transitoires sont pris en compte en considérant des équations récursives sur une fenêtre glissante. Cette méthode permet de fixer des seuils adaptatifs qui évitent les décisions pessimistes quant à la poursuite des tests tout en détectant et localisant les défauts dans les états transitoires et permanents du système.Y L,k = A L X k-L + B L U L + E L (D L + f L ) (E.21) en supposant que A L := C T (CA) T . . . (CA L ) . . . . . . CA L-1 B CA L-2 B . . . CB 0 . . . . . . CA L-1 E CA L-2 E . . . CE0 est de concevoir un résidu proche de zéro en cas d'absence de défaut et non nul en cas de défaut. Ensuite, pour le contrôle de parité, nous recherchons la matrice de projection H L de telle sorte que :H L (Y L -B L U L -E L D L ) = H L A L X k-L + H L E L f L = H L E L f L (E.22) La matrice de projection est obtenue directement en augmentant les équations pour chaque sous-système avec les contraintes sur le système global. Cette matrice permet de générer des résidus structurés dont les tableaux de signatures nous donnent les variations de la valeur moyenne des résidus en fonction du type de défaut. Cette méthode permet aussi d'obtenir l'expression exacte des défauts dans les lignes. Pour évaluer l'efficacité de l'algorithme développé, les GDR et FDR ont été calculés pour des cas d'obstructions simulés à l'aide de CARINS. Pour les défauts simultanés, nous considérons comme une bonne détection la détection et l'isolation simultanée des défauts dans les deux lignes affectées, si au moins une détection est fausse, nous considérons qu'il s'agit d'une fausse détection. Ces taux, qui sont satisfaisants pour l'application considérée, ont été calculés à partir de dix essais pour chaque simulation et les réglages ont été choisis pour optimiser le GDR (isolation) et minimiser le FDR (isolation) pour des changements brusques de la valeur moyenne des résidus.

E. 3

 3 Figure E.5: Schéma du FTCS en boucle fermée

••

  Les systèmes tels que MASCOTTE, reposent sur la variation du débit d'ergol principal et fonctionnent en boucle ouverte. Le contrôle est effectué par des moyens de contrôle préréglés, tels que des orifices, et des dispositifs de commande marche / arrêt, comme c'est le cas actuellement pour la plupart des systèmes de moteurs fusée existants. L'étendue de la correction à appliquer est déterminée à partir des données des essais de calibration. La régulation a l'avantage de la simplicité, mais elle est limitée à un ensemble spécifique de paramètres de fonctionnement et est incapable de prendre en compte des conditions variables pendant le fonctionnement.Le système de régulation en boucle fermée doit donc fonctionner selon le principe des résistances variables de fluide (régulateurs de pression à dôme) dans les conduites principales d'alimentation en ergols pour obtenir une modulation du débit ou dans les conduites du système de refroidissement pour compenser les pertes de performances. En pratique, les perturbations de la combustion ne sont pas entièrement évitables, mais peuvent être minimisées en maintenant un rapport de résistance donné entre les deux vannes principales de régulation des ergols. Une méthode plus fiable pour atteindre cet objectif consisterait à coupler mécaniquement les deux vannes d'alimentation en ergol. Les principales raisons du contrôle du rapport de mélange sont rappelées : Performance optimale du moteur (important) Utilisation complète des ergols, c.-à-d. utilisation résiduelle minimale (la plus importante). En se basant sur l'AMDEC du banc MASCOTTE, dans une première approche, on peut voir qu'une obstruction ou une fuite dans les lignes d'ergol peut être critique et impliquer un arrêt des opérations. Pour cette raison, nous allons valider notre système AFTC (voir Figure E.5) avec seulement les défauts simulés dans le système de refroidissement, nous considérons toujours dans cette partie une défaillance additive de l'actionneur sur le système, qui peut correspondre à un blocage ou une fuite. Nous étudions également la possibilité d'une reconfiguration des débits massiques des propergols afin de maintenir un rapport de mélange adapté. Dans le Chapitre 5, une fois qu'un défaut additif d'actionneur a été détecté par la méthode de FDI composée d'un premier observateur, le FTCS conçu sur la base d'un estimateur de défaut (FE) et d'un observateur à entrée inconnue (UIO) permet de compenser la défaillance et de converger si nécessaire, vers un état stable choisi. La méthode proposée ici consiste à concevoir un contrôleur basé sur un UIO en considérant le défaut comme une entrée inconnue similaire à [224] et à concevoir une stratégie anti-windup dans la même idée que [225] afin d'assurer la stabilité asymptotique du système saturé pour un ensemble donné de conditions initiales et déterminer le domaine de stabilité. Cette stratégie FTC permet de compenser le défaut et de maintenir les performances actuelles en présence d'une saturation de l'actionneur mais aussi de converger si nécessaire, vers un autre état de référence. La première approche développée considère un modèle linéarisé autour d'un point de référence en régime permanent et utilise un contrôleur linéaire quadratique (LQ) avec une partie de compensation de défaut. Ce contrôleur compense une défaillance additive d'actionneur en estimant l'amplitude du défaut avec un EUIO où le défaut est supposé être l'entrée inconnue. Ensuite, une stratégie anti-wind-up est proposée afin de prendre en compte les éventuelles saturations d'entrée dues aux contraintes thermomécaniques de l'actionneur. La seconde approche considère un système localement Lipschitz non linéaire et utilise une commande prédictive avec un compensateur de défaut basé sur un UUIO où une défaillance additive de l'actionneur est également supposée être l'entrée inconnue. Ensuite, un schéma anti-windup est également proposé pour prendre en compte les saturations d'entrée. Cet AFTCS dans la première section, dans le cas du modèle linéarisé, consiste donc en une commande LQ sur un système équivalent où l'entrée inconnue est exprimée en fonction de l'état connu et des vecteurs d'entrée connus afin de découpler uniquement l'effet de défaut sur le système. L'étape suivante consiste à concevoir une méthode permettant de calculer un autre point d'équilibre qui pourrait être atteint dans le cas où le point d'équilibre nominal précédent ne peut être atteint en raison de la défaillance de l'actionneur et des effets de la saturation en entrée du système. Etre capable de modifier le comportement nominal du système est utile pour considérer une possible saturation en entrée. Une méthode de conception d'une boucle anti-windup pour calculer un autre point d'équilibre a été proposée. Le premier système anti-windup est conçu pour les modèles linéarisés autour d'un point d'équilibre et à temps discret. Cette méthode est basée sur la résolution d'inégalités matricielles linéaires (LMIs) et assure une stabilité asymptotique exponentielle dans un domaine ellipsoïdal pour un ensemble polyédrique d'états initiaux admissibles. Il apparaît que l'anti-windup peut être amélioré en prenant en compte les fonctions de coût en fonction des objectifs de reconfiguration, par exemple, l'élargissement du domaine de stabilité. Ces méthodes ont été testées sur le modèle proposé pour l'évolution de la pression et des débits massiques dans le système de refroidissement du MASCOTTE pour les défauts additifs des actionneurs et sur le modèle de lignes pour la régulation du rapport de mélange (MR). Dans une deuxième section, un FTCS non linéaire a été proposé pour assurer la stabilité de la pression et des débits massiques dans le système de refroidissement du banc MASCOTTE ainsi que pour compenser une défaillance additive d'actionneur. Une fois le défaut actionneur détecté par la méthode de FDI composée d'un premier UUIO, le FTCS conçu sur la base d'un FE et d'un second UUIO permet de compenser la défaillance et de converger, si nécessaire, vers un état stable choisi. Ce FTCS actif (AFTCS) consiste en une commande prédictive basée sur la minimisation d'une fonction coût à horizon infini et une compensation directe des défauts à l'aide de la résolution de LMIs. Cette méthode a été comparée au FTCS dans le cas des modèles linéarisés composé d'un EUIO et d'un contrôleur LQ et montre de meilleures performances pour la compensation des défauts et le suivi de référence d'état dans les transitoires. Lorsqu'un défaut est détecté par la partie FDI, le système passe en boucle fermée afin de procéder à une reconfiguration dans le cas du système de refroidissement. Dans le cas de la commande d'injection d'ergols, le système passe en boucle fermée à un temps préfixé (après les transitoires puisque la dynamique est réglée afin de suivre des trajectoires prédéterminées). Le comportement transitoire souhaité dépend du choix du gain ; il faut limiter les dépassements pour maintenir les performances du système. Le but de ces simulations est de voir si le contrôleur est capable de stabiliser le système en boucle fermée après la détection de panne ou lorsque le temps auquel on passe en boucle fermée est imposé. Le modèle est dans un premier temps linéarisé autour d'un état d'équilibre, l'état nominal à atteindre, la matrice A est alors constante dans le temps. Cette méthode nécessite des inversions matricielles, qui peuvent être numériquement instables en raison d'un mauvais conditionnement possible. Dans les problèmes considérés, les matrices sont inversibles.

  [START_REF] Karimi | Dynamic and nonlinear simulation of liquid-propellant engines[END_REF] où X k ∈ R n est le vecteur d'état, Y k ∈ R m est la sortie mesurée, U k ∈ R l est une entrée connue, f k ∈ R l est une défaillance de l'actionneur inconnue, A c ∈ R n×n la matrice d'état, B c ∈ R n×l la matrice de distribution de l'entrée connue et C ∈ R m×n la matrice de distribution de la sortie, avec m ≤ n.Une défaillance additive d'un actionneur avec une loi de commande peut être modélisée comme:X k+1 = A c X k + B c U n,k + B c (f k + U c,k ) Y k+1 = CX k+1 (E.24)où nous supposons que l'entrée nominale U n,k est connue, U c,k est la loi de contrôle et f k est la partie défectueuse de l'entrée. Nous avons donc:U k =: U n,k + f k .L'objectif est alors d'assurer la bonne estimation de l'état de santé du sous-système ainsi que la convergence vers un état de référence X k . Considérant un état augmenté composé de l'erreur d'estimation e c,k = Xc,k -X k et de l'erreur de reconfiguration η k = X k -X k . La dynamique de l'état augmenté est exprimée comme suit :ζ k+1 = A c + B c W c B c W c 0 N c ζ k (E.25) où ζ k := η k e c,k T . Il est alors possible d'utiliser un deuxième EUIO pour la partie reconfiguration, où f k + U c,k est considéré comme l'entrée inconnue. N c est le gain de l'observateur à entrée inconnue assurant la convergence de l'erreur d'estimation. Pour le système nominal, le gain W c doit stabiliser (A c + B c W c ). Puisque la paire (A c , B c ) est supposée être contrôlable, une commande linéaire quadratique peut être adopté où W c est sélectionné afin de minimiserJ k := k ζ T k Sζ k + U T c,k OU c,k(E.26) où S et O sont des matrices de conception définies positives et symétriques. En raison des caractéristiques ou des performances des actionneurs physiques, des signaux de commande illimités ne sont pas disponibles, et les saturations doivent être prises en compte dans la conception de la loi de commande. De multiples solutions ont été étudiées pour compenser une diminution des performances du système causée par la saturation d'un ou plusieurs actionneurs, une façon est d'ajouter une commande dite anti-windup. L'idée de l'approche anti-windup est d'ajouter un retour d'état, de sortie ou d'erreur pour que l'actionneur ne sature pas. Il s'agit de négliger la saturation dans la première étape de la conception des lois de contrôles, puis d'ajouter quelques schémas spécifiques aux problèmes afin de traiter les effets de la saturation. Dans le cas des systèmes discrets, notre objectif est le développement de lois de contrôle qui fournissent une convergence semi-globale sur tout ensemble arbitrairement large de l'espace d'état. Ces méthodes ont généralement une structure plus simple et le contrôleur est moins sensible aux incertitudes de modélisation et aux perturbations. Les performances du système que l'on veut atteindre peuvent aller du problème classique de stabilisation du système à l'extension de la zone d'attraction, au rejet des perturbations et à la régulation de la sortie du système [237]. L'avantage de la méthode de contrôle présentée est qu'elle étudie la détermination des régions de stabilité d'un modèle linéaire discret dans le temps et permet de déterminer une loi de contrôle anti-windup qui assure la stabilité asymptotique du système saturé en entrée. Contrairement aux méthodes anti-windup conventionnelles basées sur la résolution d'inégalités matricielles bilinéaires, cette méthode est relativement simple et propose un algorithme itératif d'inégalités

28 ) 5 .∀i = 1 , 2 avecP

 28512 Nous voulons déterminer la matrice de gain anti-windup E c de telle sorte que pour un ensemble S d'états initiaux admissibles (ζ 0 ∈ S), la trajectoire correspondante converge asymptotiquement vers l'origine du sous-ensemble E ⊂ S. Alors, E est une région de stabilité asymptotique. Pour cela, nous voulons déterminer une nouvelle loi de contrôle de la forme U k + = U k -Gζ k lorsque la loi de contrôle U k atteint ses limites avec G ∈ R l×2n . L'ensemble des états initiaux admissibles S considéré sera défini comme un ensemble polyédrique et le domaine de stabilité E sera conçu comme une ellipsoïde. Ceux-ci étant déterminés par la résolution de deux inégalités matricielles linéaires faisant l'objet de deux théorèmes en considérant le nouvel état augmenté suivant:ζ k+1 = A c + B c W c B c W c 0 N c ζ k -(RE c )Ψ(Kζ k ) (E.29) en notant: A := A c + B c W c B c W c 0 N c . Z ∈ R n×l et ∆ ∈ R l×l une matrice diagonale positivedéfinie sont des paramètres qui seront choisis afin de maximiser la taille de l'ensemble des états initiaux admissibles et d'assurer la stabilité asymptotique exponentielle du système augmenté (E.29).TheoremDéfinissonsE(P ) = ζ k ∈ R 2n , ∀i = 1, . . . , l; ζ k T P ζ k ≤ 1 + ((B + c Bc fk ) i -U i,k ) 2 (B + c Bc fk ) i -U i,k 2 avec P ∈ R 2n×2nune matrice positive définie et W := P -1 . Si W satisfait (E.30) pour chaque entrée, alorsE(P ) ⊂ S.     W 0 2n,1 0 1,2n -1 WK T i -(GW) i T (B + c Bc fk ) i -U i,k K i W-(GW) i (B + c Bc fk ) i -U i,k U i,sat 2 (B + c Bc fk ) i -U i,k . . . , l En supposant que (B + c B c fk ) i -U i,k = 0. Theorem 6. L'ellipse E(P ) = ζ k ∈ R 2n , ∀i = 1, . . . , l; ζ k T P ζ k ≤ 1 + ((B + c Bc fk ) i -U i,k ) 2 (B + c Bc fk ) i -U i,k = W -1est une région de stabilité asymptotique exponentielle pour le système augmenté, si pour E c = Z∆ -1 : pour la fonction quadratique de Lyapunov candidate considérée :V (ζ k ) := ζ k T P ζ k , P = P T > 0, P ∈ R 2n×2n (E.32)V (ζ k ) est une fonction de Lyapunov car:1. δV (ζ k ) < 0, ∀ζ k ∈ E(P ), ζ k = 0 2. ∃α ∈ R + , δV (ζ k ) ≤ -αV (ζ k )Dans un second temps, une loi de commande pour les modèles non linéaires localement Lipschitz avec retour d'erreur et compensation des défauts est développée. Afin d'annihiler l'effet de défaut de l'actionneur sur le système, un autre UIO avec une transformation sans parfum est utilisé pour estimer l'état du système et reconstruire l'amplitude du défaut. Une loi de commande doit alors permettre de compenser le défaut et être calculée de telle sorte que le système défectueux soit le plus proche possible du système nominal.

  35) avec A := A 0 0 K k+1 C , B := B 0 and C := I 0 and Φk := f (X k , U k ) -f (X k , U k ). Φ k estlocalement Lipschitz pour l'application au système de refroidissement puisque f (X k , U k ) est localement Lipschitz sur un ensemble compact S X inf ,Xsup,U inf ,Usup . Les débits massiques et les pressions considérés sont limités par des contraintes thermomécaniques. X ∈ [X inf ; X sup ] and U ∈ [U inf ; U sup ].

Theorem 7 .

 7 Sζ k+i + ∆U k+i T O∆U k+i (E.36) sujet à ζ k+i ∈ ζ, ∆U k+i ∈ Ū avec i ≥ 0, ζ et Ū sous-ensembles compacts de R 4 et R; S et O des matrices de pondération définies positives. En considérant γ un scalaire positif comme limite supérieure de l'objectif (E.36), nous cherchons à minimiser la valeur de γ pour une certaine fonction de Lyapunov : Considérons le système à temps discret (E.35) pour chaque temps k. Nous définissons V k = ζ T k γX -1 ζ k une fonction de Lyapunov satisfaisant (E.37), où X > 0 et Y sont obtenus à partir de la solution du problème d'optimisation suivant dépendant des variables γ, α, X, Y et Z := X[H G]T . La matrice de retour d'état G de la loi de contrôle qui minimise la limite supérieure γ de la fonction objectif J k est alors donnée parG := Y X -1 . V k+1 -V k ≤ -(ζ k T Sζ k + ∆U k T O∆U k ) desaturation en entrée la méthode utilisée pour les modèles linéarisés a été étendue au cas des modèles localement Lipschitz non linéaires. Le système défectueux a été simulé avec CARINS, comme pour les applications précédentes, un profil de fermeture de vannes a été imposé à l'entrée du système de refroidissement. Le but de cette simulation est de voir si le contrôleur est capable de stabiliser le système en boucle fermée après la détection d'une panne mineure. Lorsque le défaut est détecté, le système passe en mode FTCS. Ce FTCS est composé : d'une partie FDI, d'un premier UIO pour la détection de défauts ainsi que d'algorithmes de reconstruction d'entrée inconnue et d'analyse de résidus; d'un compensateur de défauts, d'un deuxième UIO pour estimer et compenser le défaut ; d'un contrôleur LQ ou d'une commande prédictive afin d'assurer la stabilité du système et sa convergence vers une trajectoire de référence. Ce système a été testé sur trois ensembles de défaillances. Les défaillances ont été compensées et la loi de contrôle a permis de stabiliser le système autour d'une trajectoire de référence en régime permanent avec une précisionsuffisante. Les performances des méthodes développées pour les modèles linéarisés autour d'un point d'équilibre ou non linéaires ont été comparées (Figure E.6). Les performances de la loi de commande en termes de compensation des défauts et de stabilité sont augmentées avec la méthode de commande UUIO-MPC pour la régulation de la pression et du débit massique du circuit de refroidissement.

Figure E. 6 :E. 4

 64 Figure E.6: Simulation CARINS -Viroles -Contrôle de la pression et du débit massique -UUIO/MPC

Figure E. 7 :

 7 Figure E.7: Banc d'essai MASCOTTE -Panneau de contrôle / Synoptique

Titre:

  Am élioration des processus de surveillance et de reconfiguration pour les moteurs fus ée à ergols liquides Mots cl és : Diagnostic à base de mod èles, Contr ôle tol érant au d éfauts, Mod élisation de moteur fus ée, Adaptation en cas de d éfaut actionneur R ésum é : La surveillance et l'am élioration des modes de fonctionnement des syst èmes propulsifs des lanceurs repr ésentent des d éfis majeurs de l'industrie a érospatiale. En effet, une d éfaillance ou un dysfonctionnement du syst ème propulsif peut avoir un impact significatif pour les clients institutionnels ou priv és et entraîner des catastrophes environnementales ou humaines. Des syst èmes de gestion de la sant é (HMS) pour les moteurs fus ée à ergols liquides (LPREs), ont ét é mis au point pour tenir compte des d éfis actuels en abordant les questions de suret é et de fiabilit é. Leur objectif initial est de d étecter les pannes ou dysfonctionnements, de les localiser et de prendre une d écision à l'aide de Redlines et de syst èmes experts. Cependant, ces m éthodes peuvent induire de fausses alarmes ou des non-d étections de pannes pouvant être critiques pour la s écurit é et la fiabilit é des op érations. Ainsi, les travaux actuels visent à éliminer certaines pannes critiques, mais aussi diminuer les arr êts intempestifs. Les donn ées disponibles étant limit ées, des m éthodes à base de mod èles sont essentiellement utilis ées. La premi ère t âche consiste à d étecter les d éfaillances de com-posants et / ou d'instruments à l'aide de m éthodes de d étection et de localisation de fautes (FDI). Si la faute est consid ér ée comme mineure, des actions de non-arr êt sont d éfinies pour maintenir les performances de l'ensemble du syst ème à un niveau proche de celles souhait ées et pr éserver les conditions de stabilit é. Il est donc n écessaire d'effectuer une reconfiguration robuste (incertitudes, perturbations inconnues) du moteur. Les saturations en entr ée doivent également être prises en compte dans la conception de la loi de commande, les signaux de commande étant limit és en raison des caract éristiques ou performances des actionneurs physiques. Les trois objectifs de cette th èse sont donc : la mod élisation des diff érents sous-syst èmes principaux d'un LPRE, le d éveloppement d'algorithmes de FDI sur la base des mod èles établis et la d éfinition d'un syst ème de reconfiguration du moteur en temps r éel pour compenser certains types de pannes. Le syst ème de FDI et Reconfiguration (FDIR) d évelopp é sur la base de ces trois objectifs a ensuite ét é valid é à l'aide de simulations avec CARINS (CNES) et du banc d'essai MAS-COTTE (CNES/ONERA). Title : Improvement of monitoring and reconfiguration processes for liquid propellant rocket engine Keywords : Model-based diagnosis, Fault-tolerant control, Rocket engine modelling, Actuator fault accommodation

  , G. (2018, September). Fault Detection and Isolation with Fluid Mechanics Constraints For Cryogenic Combustion Sarotte, C., Marzat, J., Piet-Lahanier, H., Galeotta, M., Ordonneau, G. (August 2019). Cryogenic Liquid Rocket Engine Test Bench Fault-Tolerant Control System: Cooling System Application. 21st IFAC Symposium on Automatic Control in Aerospace (ACA).

Bench Cooling Circuit. In PHM Society Conference (Vol. 10, No. 1).

• Sarotte, C., Marzat, J., Piet-Lahanier, H., Galeotta, M., Ordonneau, G. (2019, July). Antiwindup Design for Linear Discrete-time Systems Subject to Actuator Additive Faults and Saturations. In 2019 American Control Conference (ACC) (pp. 3734-3739). IEEE.

•

Table 2 .

 2

		1: SSME expert HMS [2]
	System	Engine components
	Outputs/ State variable	Temperatures, pressures, vibrations
	Model	/
	Monitored parameters	Temperatures, pressures, vibrations
	Residual generation	/
	Residual / Data analysis Vibration analysis, Pattern recognition,
		Embedded Expert System (rule-based)

  Analysis has shown that SEES successfully extracts Signatures from SSME test data and displays status information to the domain expert. Signatures derived from the same SSME test stand at varying power levels and other SSME test sets were analyzed via the divergence. The signatures at different power levels from the SSME test sets showed measurable separability;

Table 2

 2

		.2.
	Table 2.2: SSME combined model and data-based HMS [3]
	System	Valve actuator outputs of the oxidizer/fuel preburner oxidizer
		valves rotary motion
	Outputs	Chamber inlet pressure, MR, high pressure fuel turbine speed,
	State variables	High pressure oxidizer turbine speed
	Model	Quasi-linear model generated from a points model
	Monitored parameters	MR, chamber pressure
	Residual generation	State variable filter
	Residual / Data analysis	Neural classifier (2 layers -back-propagation algorithm)

Table 2 .

 2

		3: SSME data-based HMS [4]
	System	Combustion chamber, gas generator, turbo-pump,
		pipe lines
	Outputs	Thrust, MR, turbo-pump rotation speed,
	State variables	and high pressure turbine temperature
	Model	Static and dynamics non-linear models
	Monitored parameters	23 parameters
	Residual generation	/
	Residual / Data analysis	ARMA + Pattern recognition + Expert systems
		+ Fuzzy Hypersphere Neural Network

Table 2 .

 2

		4: SSME data-based HMS [5]
	System	SSME
	Outputs	Oxidizer and fuel preburner oxidizer valves
	State variables	Thrust and MR
	Model	Empirical models and analytical design point values
	Monitored parameters	Complete sensor SSME set
	Residual generation	/
	Residual / Data analysis	Nonlinear regression algorithm
		+ time series and cluster analysis

The different test profiles are divided into three operational phases: startup, mainstage, and shutdown. During startup and shutdown, the SSME controller invokes open-loop while during mainstage operation, closed-loop feedback is provided. The SSME controller regulates engine thrust and oxidizer / fuel MR during mainstage operation by sensing the main combustion chamber pressure and the volumetric fuel flow rate. Control of these parameters is achieved by modulating the oxidizer and fuel preburner oxidizer valves. To understand the SSME behavior during normal or abnormal operation, the SSME simulation models are based on:

Table 2 .

 2

	5: MPID framework model for LPRE systems [6]
	System	LPRE components
	Outputs / State variables	Not furnished
	Model	Pattern recognition classification
	Monitored parameters	Expert or algorithm labelled database
	Residual generation	/
		Multi-algorithm detection information fuse:
	Residual / Data analysis adaptive correlation, radial basis function neural network,
		redline cutoff + Bayes' risk function
	This method as a special Health Condition Monitoring (HCM) model can be divided into three

layers (data, model and result). Sensor data is first measured, saved in real-time and formatted then transferred to the database which is used by several algorithms to carry out online detection giving final results submitted to the view layer for display. The most important link in the three layers is the model layer and the key issue is how to set up a rational and effective judgment method model. This method goal is to fuse the multi-algorithm detection information to judge whether the LPRE condition is normal or faulty by making a global judgment. Here are the different steps:

Table 2

 2

	.6.
	Table 2.6: SSME unsupervised detection algorithms [7]
	System	SSME components -LOX/LH 2 engine
	Outputs / State variables	Not furnished
	Model	Nominal historical data comparison model (SSME + test stand)
	Monitored parameters	90 sensors (with redundancy)
	Residual generation	/
	Residual / Data analysis	4 algorithms: Nearest-neighbour approach
		(Euclidian and Hamming distances weighted average),
		point, subsets and clusters (bounding hyperbox) approaches
	From the data consisting of a set of examples of anomalies and nominal behavior, an
	algorithm learns a model that distinguishes between the nominal and the anomalous data.
	This, method requires tens or hundreds of labeled anomalies and nominal data points to obtain
	adequate performance. In their work, each data point is a vector of all the sensor values and
	commands at one

point in time. For the SSME test stands, the number of examples of anomalies available in historical data is fairly small. The number of examples of anomalies available in real launch systems is also too low for effective use of supervised anomaly detection algorithms. So they choose to use unsupervised anomaly detection algorithms since they do not need data with

	anomalies but only nominal data. They present nine anomalies detected by four unsupervised
	anomaly detection algorithms:
	• Orca [78] uses a nearest-neighbor approach for unsupervised anomaly detection with a
	weighted average of the Euclidean distance for the numerical variables and the Hamming
	distance for the discrete variables. It does not assume that all of the training data are
	nominal, and can be used to find anomalies in the training data as well as in other data
	sets. It uses a novel pruning rule to obtain near-linear-time performance, allowing it to
	scale to very large data sets.

  seeks to describe the range of normal training data in such a way as to enable the resulting model to distinguish normal data from abnormal data in the future.

	Like Orca and GritBot, it assumes that the training data may contain a small number of
	anomalies, and learn a model that covers the vast majority of the training data. The name
	"one-class SVM" is due to the possibility that only one class of data (normal data) may
	be available during training (if abnormal training data are available, they can be used).

Table 2 .

 2 7: Jet engine FDI system[START_REF] Patton | Robustness issues in fault-tolerant control[END_REF]

	System	Jet engine
	Outputs	Main burner fuel flow and propelling exhaust nozzle control
	State variables	17 variables
	Model	Fully nonlinear jet engine model + linearization
	Monitored parameters	90 sensors (with redundancy)
	Residual generation	Parity space and observer-based approaches
		+ disturbance decoupling or performance index
	Residual / Data analysis	Fixed threshold method

continuous time-variant system with additive unknown uncertainties and use a fixed threshold method on residuals to detect faults. They give a general form of the residual generator and then propose parity space approaches and observer-based approaches. A disturbance decoupling principle is introduced to differentiate faults and the impact of uncertainties on residuals. If this method cannot be used, they propose to use a performance index to minimize the disturbance impact on the residual. The proposed method has been proven to have good results for soft or incipient faults.

Table 2 .

 2

		8: VHM system for RLV [9]
	System	Engine sensors, valves, turbo-pumps, injectors,
		combustion chamber (components)
	Outputs	Main burner fuel flow and propelling exhaust nozzle control
	State variables	17 variables
	Model	37 Nonlinear ordinary differential equations
		(7 types of dynamics equations) + linearization
	Monitored parameters	90 sensors (with redundancy)
	Residual generation	Kalman filters
	Residual / Data analysis	GLRT + MM methods

Table 2 .

 2

		9: Turbo-pump FDI system [10]
	System	Engine turbo-pump
	Outputs / State variables	Pump speed
	Model	Simplified linearized model with uncertainties
	Monitored parameters	Pump flow and MR
	Residual generation	2 H ∞ filters + law pass filter to reduce noise
	Residual / Data analysis	Parameter analysis, regression approach

Table 2 .

 2 10: Open-cycle LPRE model-based HMS[START_REF] Cha | Fault detection and diagnosis algorithms for transient state of an open-cycle liquid rocket engine using nonlinear Kalman filter methods[END_REF]

	System	Engine combustion chamber, gas generator, nozzle,
		Pipes and control valves
	Outputs	/
	State variables	/
	Model	Nonlinear model with constant loss coefficient
		Heat transfer + linearization and lumped parameter modeling
		Turbine starter power profile,
	Monitored parameters	Combustion chamber ignition time, gas generator ignition time,
		Turbo-pump head and efficiency,
		Rotational turbo-pump momentum inertia
	Residual generation	EKF and UKF
	Residual / Data analysis	Redlines with Neyman-Pearson theorem

Table 2 .

 2

	System	Engine combustion chamber, gas generator, nozzle,
		pipes and control valves
	Outputs/State variables	Valve positions, field conditions
	Model	Physical and empirical relations
		4 engine inlet condition measurements
	Monitored parameters	and 21 internal engine measurements:
		14 pressures, 7 temperatures, 2 flows, 1 turbo-pump
		shaft speed, and 1 engine thrust + 17 Hardware parameters
	Residual generation	Generalized Data Reduction
	Residual / Data analysis	/
	Preliminary work has also been done to improve the HMS of the MASCOTTE test bench, a

[START_REF] Cha | Fault detection and diagnosis algorithms for transient state of an open-cycle liquid rocket engine using nonlinear Kalman filter methods[END_REF]

: Rocket engine performance analysis -MC-1 engine

[START_REF] Butas | Rocket engine health monitoring using a model-based approach[END_REF]

Table 2 .

 2 [START_REF] Butas | Rocket engine health monitoring using a model-based approach[END_REF]: MASCOTTE test bench HMS[START_REF] Iannetti | Fault diagnosis benchmark for a rocket engine demonstrator[END_REF]

	System	Cooling system
	Outputs / State variables	Pressure and temperature
	Model	Friction forces and heat exchanges linearized models
	Monitored parameters	Mass flow rates, pressures, temperatures
	Residual generation	EKF + RLS
	Residual / Data analysis	ACUSUM

Table 2 .

 2 13: Life Extending Controller[START_REF] Jung | Thrust and propellant mixture ratio control of open type LPRE using Q-ILC[END_REF]

		Main combustor and gas generator
		Injectors
	Systems	Pipe and cooling channel
		Turbo-pump
		Thrust control valve and mixture control valve
	Controlled variables	Combustion chamber pressure (thrust) and
		Gas Generator MR (temperature)
	Models	Ideal gas flow, orifice static equations,
		pipe momentum equation, body of revolution equations,
		valves static equation and position description
	Actuators

Table 2 .

 2 14: Cryogenic rocket engine classical controller[START_REF] Carl | Overview of rocket engine control[END_REF]

	Systems	Combustion chamber pressure,
		Propellants weights
	Controlled variables	Propellants flow valve areas (positions)
	Models	Chamber pressure to total weight flow,
		chemical parameters,
		combustion delay and chamber fill time,
		feeding line lumped parameter model or wave equation

Table 2 .

 2 [START_REF] Carl | Overview of rocket engine control[END_REF]: SSME main engine control system[START_REF] Carl | Overview of rocket engine control[END_REF]

	Systems	Whole engine system
	Controlled variables	Combustion chamber pressure
		MR
		LOX flow in LOX and fuel preburners
	Models	Engine dynamics linearized state-space model,
		perturbation model
	Actuators	Oxidizer valve
		6 valves (Main oxidizer, main fuel, coolant control,
		oxidizer preburner, oxidizer, fuel preburner oxidizer)
	Controller	PI controller
		Open-loop scheduling
		Set point control

control, oxidizer preburner, oxidizer, fuel preburner oxidizer). In the SSME baseline control, only oxidizer valves are used as closed loop control valves. To analytically explore the benefits of enhanced controllability added the fuel oxidizer preburner valve and considered the remaining

Table 2 .

 2

		16: Multi-engine optimal control [16]
	Systems	2 LPRE
	Controlled variables	Effective exhaust velocity
		MR
	Models	Single-fuel rocket model,
		characteristic velocity,
		switch function behavior,
		velocity approximation via parabolic relation
	Actuators	/
	Controller

Table 3 .

 3

	1: Liquid di-oxygen properties
	Boiling temperature at ambient pressure	T b = 90K
	Formation	Fractional distillation of liquid air
	Flame color	White and yellow
	Cons	Requires insulation (evaporation losses)
		Sensitive to pressure variations (transport, storage)
		Burn spontaneously in contact with
		organic materials
		Non-corrosive
	Pros	Non-toxic
	Table 3.2: Liquid di-hydrogen properties
	Boiling temperature at ambient pressure	T b = 20K
	Formation	Compression, successive cooling, relaxation
	Flame color	Colorless in the visible spectrum (with oxygen)
		Requires insulation (evaporation losses)
		Bulky tank
		Limited usable materials (temperature sensitive)
	Cons	Vacuum (solidification of particles)
		Risk of explosion if in contact with oxygen, air
		Toxic exhaust emissions
		Flammable
		Low density
	Pros	High combustion efficiency (with oxygen)

Table 3 .

 3 3: MASCOTTE test bench -FMEA Extract -Failure mode and effects

	Bench part	Failure mode
	Lines	Leakage
	Injection	Leakage
	Measuring housing	Leakage / No water cooling (complete obstruction) / obstuction
	Viewing housing	Leakage / No water cooling (complete obstruction) / obstuction
	ATAC Nozzle	Leakage / nozzle break / deformation
	Water feeding	Leakage / valves incidents (partial obstruction or leakage) / obstuction
	Bench part	Effects
	Lines	Mixture ratio decreasing (OX), increasing (H 2 )
	Injection	Mixture ratio decreasing (OX) / increasing (H 2 )
		Fuel mixture
	Measuring housing	Mass flow rate loss / combustion gas and water
		Mixture / freezing / cooling performances decrease
	Viewing housing	Mass flow rate loss / combustion gas and water
		Mixture / freezing / cooling performances decrease
	ATAC Nozzle	Mass flow rate loss / pressure loss, water leakage
		/ uncontrolled mass flow and Mach
	Water feeding	Mass flow rate loss / decrease cooling performances
		/ pressure surges, losses

Table 3 .

 3 4: MASCOTTE -Cooling system -Deviations of the ferrules pressure models 1 and 2

		Model	Total	Transient Permanent
			(%)	(%)	(%)
	Pressure (1)	10.58	13.35	5.04
	Pressure (2)	5.44	8.01	0.31
	Input mass flow rate (2) 3.31e-5 4.97e-5	6.17e-8
	Table 3.5: MASCOTTE -Cooling system -Deviations of the ferrules models -2016 campaign
		Pressure (2) (%) Input mass flow rate (2) (%)
	Run 1	3,606e-2		9,726e-3
	Run 2	2,458e-2		5,607e-3
	Run 3	4,732e-2		6,738e-3
	Run 4	3,100e-2		4,880e-3
	Run 5	3,110e-2		5,451e-3
	Run 6	3,996e-2		6,237e-3
	Run 7	2,572e-2		6,689e-3
	Run 8	2,576e-2		6,752e-3
	Run 9	2,556e-2		1,052e-2
	Run 10	2,190e-2		9,258e-3
	Run 11	7,119e-2		8,466e-3
	TOTAL	3.456e-2		7.302e-3

Table 3 .

 3 6: MASCOTTE -Deviations of the propellants feeding lines mass flow rate models GOX Mass flow rate (%) GH 2 Mass flow rate (%)

	Run 1	3,694	10,801
	Run 2	3,528	9,868
	Run 3	3,680	22,344
	Run 4	3,804	22,087
	Run 5	3,734	11,278
	Run 6	3,440	15,073
	Run 7	3,382	16,238
	Run 8	3,658	11,909
	Run 9	3,703	15,978
	Run 10	3,689	10,474
	Run 11	3,804	6,597
	TOTAL	3.647	13.877

Table 3 . 7

 37

	Run 1	8,563	7,855
	Run 2	5,843	13,768
	Run 3	6,343	15,497
	Run 4	10,297	16,101
	Run 5	8,445	8,863
	Run 6	6,215	9,790
	Run 7	6,623	12,312
	Run 8	7,154	9,584
	Run 9	6,988	8,314
	Run 10	7,793	15,288
	Run 11	9,373	14,830
	TOTAL	7.603	12.018

: MASCOTTE -Deviations of the propellants injection pressures models GOX Pressure (%) GH 2 Pressure (%)

Table 4 .

 4

	1: EKF state, measurement and input vectors
	Propellant feeding lines	Cooling system
	Model (3.47)	Model (3.46)
	X := ṁinj	X := T av

Table 4 .

 4

	2: EUIO state, measurement and input vectors
	Propellant injection	Cooling system
	Model

Table 4 . 4

 44

	Model		Total	Transient steady-state
			(%)	(%)	(%)
	Pressure	UUIO 8.02e-3 1.24e-2	5.07e-3
	(Pa)	EUIO 6.71e-3 1.85e-2	2.87e-3
	Mass flow rate UUIO	1.51	2.46	0.10
	(kg/s)	EUIO	2.15	6.42	0.41

: MASCOTTE -Deviations of the ferrules pressure and input mass flow rate estimations

Table 4 .

 4

	Model	Total Transient steady-state
		(%)	(%)	(%)
	Output mass flow UUIO 1.44	3.14	4.94e-2
	rate (kg/s)	EUIO 2.16	4.98	0.41

5: MASCOTTE -Deviations of the ferrules output mass flow rate reconstruction

Table 4 .

 4

	Fault	Type	GDR F DR N begin N end
			(%)	(%)
	Fault 1	Abrupt	98.8	0.0	1367 1540
		large mean shift
	Fault 2	Slow	27.4	0.0	1032 1252
		large mean shift
	Fault 3	Slow			1310 1368
	(1)	small mean shift
		abrupt recovery 98.5	14.5
	Fault 3	Abrupt			1532 2000
	(2)

6: CARINS -Ferrules -Failure cases -GDR and FDR

Table 4 .

 4

	8: Parity space -Residuals variations -Double failures cases
	Residuals	Case 4 fault in lines 1 and 2
	r 1

Table 4 .

 4 9: CARINS -Visualization module -Failures isolation rates

	Faults Fault 1 Fault 2 Fault 3 Fault 4 Fault 5 Fault 6
	GDR 96.06% 91.07% 90.40% 80.29% 93.06% 90.21%
	FDR	0.00%	4.51%	4.51%	4.51%	3.75%	3.75%

Table 5 .

 5 1: CARINS -Ferrules -LQ controller and pole placement -Gain matrix choice

	Pressure Mass flow Damping	Natural
	part	rate part	ratio	frequency
	-0.3668	-0.9956	2	1e-1

Figure 5.2: CARINS simulation -Ferrules -pressure and mass flow rate control -LQ controller

Table 5 .

 5 2: CARINS -Ferrules pressure and input mass flow rate deviations -LQ controller

	Control simulation	Permanent (from detection time)
		(%)
	Pressure (Pa)	1.6e-1
	Input mass flow rate (kg/s)	7e-2

Table 5 .

 5

	3: CARINS -Ferrules pressure and input mass flow rate control deviations -
	EUIO/LQ+AW
	Control simulation	Case 1 Case 2 Case 3 Case 4
		(%)	(%)	(%)	(%)
	Pressure, Pa	3.02	2.67	2.67	3.94
	Input mass flow rate, kg/s	2.57	1.91	2.14	2.75

Table 5 .

 5 4: CARINS -GH 2 injection pressure and mass flow rate control deviations-LQ+EKF

	Control simulation Propellant Case 1	Case 2
			(%)	(%)
	Pressure, Pa	GH 2	1.39e -4 2.68e -6
		GOX	7.31e -4 6.84e -4
	Mass flow rate, kg/s	GH 2	9.47e -3 2.375e -3
		GOX	2.28e -2 1.18e -3

Table 5 .

 5 5: CARINS -Ferrules pressure and input mass flow rate control deviations -UUIO/MPC

	Control simulation	Pressure Input mass
		(%)	flow rate (%)
	Fault 1 abrupt shift high amplitude	0.17	2.82e-3
	Fault 2 slow shift high amplitude	8.77e-2	8.51e-3
	Fault 3 abrupt shift flow amplitude and slow	0.14	3.54e-3
	shift high amplitude

Table 5 .

 5

	6: CARINS -Control deviations comparison -EUIO+LQ / UUIO+MPC
	Control simulation	Fault 1	Deviations
		in the transient	(%)
	Pressure	UUIO -MPC	6.9e-3
		EUIO -LQ	1.08
	Input mass flow rate	UUIO -MPC	0.056
		EUIO -LQ	0.35
	Input pressure reference	UUIO -MPC	1.75e-2
		EUIO -LQ	1.23

Table 5 .

 5

	7: CARINS -Ferrules pressure and input mass flow rate control deviations -EUIO/LQ &
	EUIO/LQ+AW
	Control simulation	No anti-windup Anti-windup
		(%)	(%)
	Input mass flow rate, kg/s	3.33e -4	7.16e -4
	Output pressure, Pa	2.40e -3	8.72e -4
	Input pressure, Pa	2.24e -2	2.07e -2

Table 6 .

 6 Set reference state/input, Set input, Set system dimension, Get gain, Get control law, Pole placement, Control law calculation Then, the main functions which will be used while calling the DLL are defined, see Table6.2:

	1: DLL Classes

Table 6 .

 6

		2: DLL Functions
	Functions	Steps
	Configuration	Load and read the configuration file to get values
		+ warning if a parameter is missing
	Reading	Acquisition of the safety machine
		received system states, inputs and time step
	Initialisation	Initialisation of the different
		classes parameters and matrices
	Filter	Updating of the filter classes variables
		and filters/observers call
	Detection	Residual calculation and storage,
		ACUSUM call and flag setting
	Control	Reference setting, Control classes parameters setting,
		gain calculation, control law calculation

1 Modélisation des sous-systèmes d'une chambre de poussée: application au banc MASCOTTE

  ainsi que l'adaptation à différents modes de fonctionnement pour un même réglage. Des méthodes de localisation de défauts ont été développées afin d'être capable Les méthodes usuelles de contrôle des moteurs fusée basées sur des réglages de consignes en boucle ouverte ou des lois de commandes non-optimisées et non robustes aux défauts, ne permettent pas d'assurer la stabilité du système en cas de panne mineure ou le changement de point de fonctionnement. Pour cela, un système de contrôle en temps réel tolérant aux défauts a été développé[START_REF] Zhang | Bibliographical review on reconfigurable fault-tolerant control systems[END_REF]. Pour ce type d'application comprenant une reconfiguration il est nécessaire d'adapter et de combiner les méthodes de commandes récentes aux contraintes de temps de réponse et d'embarquabilité des moteurs fusée quel que soit le mode de fonctionnement. Les algorithmes développés permettent donc d'assurer la stabilité du système autour d'une trajectoire nominale modifiable et de compenser des défauts additifs impactant les actionneurs lorsque ceux-ci sont détectés puis localisés[START_REF] Huang | Key reliability drivers of liquid propulsion engines and a reliability model for sensitivity analysis[END_REF]. Les actionneurs du système devant respecter des contraintes thermomécaniques, la loi de commande comprend aussi une boucle anti-windup pour respecter celles-ci par modification de la dynamique de l'état de référence. De plus, ces nouvelles méthodes permettent de prendre en compte l'erreur d'estimation de l'état global du système directement dans l'élaboration de la loi de contrôle assurant la bonne surveillance de son état de santé. type Vulcain 2. Cinq versions successives de cette installation d'essai ont été construites. Le projet MASCOTTE a démarré en 1991. Les équipes de recherche de différents laboratoires appartenant au CNRS et à l'ONERA, regroupées dans un programme de recherche commun géré par le CNES, peuvent mener des expériences sur MASCOTTE, avec les objectifs suivants : améliorer la connaissance et la modélisation des phénomènes physiques, fournir des

	résultats expérimentaux pour la validation de programmes informatiques, améliorer et évaluer
	les techniques de diagnostic.
	Le banc d'essai MASCOTTE est composé (Figure E.1):
	1. de lignes de distribution actionnées à l'aide de régulateurs de pression à dôme et de
	Venturis permettant de fixer les débits,
	2. d'un injecteur coaxial,
	Dans le Chapitre 3, des modèles ont été établis pour les différents sous-systèmes du banc
	d'essai MASCOTTE et les sous-systèmes principaux d'un moteur fusée à ergols liquides. Ces
	modèles ne tiennent pas compte des phases de démarrage et d'arrêt. Ils décrivent l'évolution
	des paramètres critiques du banc MASCOTTE après analyse de l'analyse des modes de
	de situer un défaut dans une partie composée de systèmes interdépendants, notamment le défaillance, de leurs effets et de leur criticité (AMDEC): les débits massiques des lignes et les
	circuit de refroidissement du moteur où il est actuellement impossible (coûteux, limitation pressions d'injection des ergols, les pressions, débits massiques et températures du circuit de
	technologique) d'obtenir une mesure des débits circulant. Ces méthodes ont aussi refroidissement.
	l'avantage de permettre un gain de temps lors de la localisation des défauts en utilisant Le banc d'essai MASCOTTE a été développé par l'ONERA pour étudier les processus
	élémentaires (atomisation, vaporisation de gouttelettes, combustion turbulente...) impliqués dans

des contraintes directes de la mécanique des fluides. Le système de détection / localisation développé permet donc d'obtenir l'emplacement et la dynamique des défauts nécessaires à la prise de décision rapide et automatisée : arrêt ou correction. 3. La définition d'un système de contrôle en temps réel du moteur compensant certains types de pannes : Une méthode plus générique et plus précise pour signaler les pannes sur un moteur fusée à ergols liquides a donc été développée ainsi qu'un système de contrôle afin d'adapter en ligne le fonctionnement d'un moteur pour éviter l'arrêt des opérations ou sa destruction. Une synthèse et analyse de l'état de l'art est réalisée dans le Chapitre 2, tout d'abord en abordant les méthodes de détections et localisation de panne à base de modèles et de données, ensuite en s'intéressant aux méthodes de reconfiguration et de contrôle ainsi que leurs applications aux moteurs fusée à ergols liquides. Le choix des méthodes utilisées est basé sur cette synthèse et analyse de l'état de l'art.

E.

la combustion d'ergols cryogéniques

[START_REF] Ordonneau | PLIF investigation of reactive flows in the separation region of an over-expanded twodimensional nozzle[END_REF][START_REF] Ordonneau | First results of heat transfer measurements in a new water-cooled combustor on the Mascotte facility[END_REF]

. Ces études dans des conditions d'exploitation bien contrôlées et représentatives sont nécessaires pour optimiser les modes de fonctionnement des moteurs fusée à ergols liquides à haut rendement. Pour ce faire, MASCOTTE vise à alimenter une chambre de combustion avec des ergols

[START_REF] Vingert | Evolution of the MASCOTTE test bench to high pressure operation and related 234 combustor technology issues[END_REF]

dans les même conditions qu'un moteur de

  Le modèle a été testé sur des données réelles hors ligne et a été validé par rapport au modèle incompressible de CARINS (Mach faible).Le débit après le Venturi des lignes est donné par l'équation d'expansion isentropique. La vitesse caractéristique est supposée être donnée pour un fonctionnement nominal, le rapport de mélange peut être calculé à partir des mesures de débit ou être supposé constant en

	fonctionnement nominal (ces valeurs sont prédéterminées avant un essai et doivent rester
	constantes afin de maintenir les performances du moteur). L'équation de continuité des débits à
	l'injection plus l'expression du débit massique pour un blocage sonique est donnée par :
				γ+1
	ṁline =	γP th S th,line c	2 γ + 1	2(γ-1)	(E.8)
	Le débit d'ergol injecté approximatif pour le carburant est donné par (pour l'oxydant on remplace
	M R par 1/M R):

  auxquelles la méthode employée devra être robuste. La méthode choisie est alors une approche à base de modèles faisant appel à des observateurs afin d'estimer l'état du système et générer des résidus à des fins de détection. Le mécanisme de diagnostic de défauts (FD) est censé détecter toute défaillance qui pourrait entraîner une dégradation des performances du moteur. Cela doit être fait suffisamment tôt pour mettre en place une

	En effet, ces modèles ont été linéarisés autour d'un point de fonctionnement afin de générer
	des résidus. Dans une seconde section le cas des modèles à fortes non-linéarités avec des
	entrées inconnues est considéré.
	La boucle de FD est donc composée d'un observateur à entrée inconnue de type étendu
	(EUIO) ou d'un filtre de Kalman étendu (EKF) dans le cas de modèles linéarisés autour d'un
	point d'équilibre et d'un observateur à entrée inconnue sans parfum (UUIO) dans le cas de
	modèles non linéaires. Un algorithme CUSUM adaptatif avec une moyenne mobile pondérée

reconfiguration sûre et en temps utile. Une façon de procéder pour détecter les défauts est d'évaluer le résidu correspondant à l'écart entre la valeur estimée de l'état du système et la valeur mesurée. L'objectif est de concevoir un filtre ou un observateur sur la base des modèles développés dans le Chapitre 3 [143], [140] afin de pouvoir détecter une variation de l'amplitude de la valeur moyenne du résidu par rapport à un comportement nominal à l'aide de méthodes de seuil adaptatifs. L'objectif du Chapitre 4 est donc de concevoir un système de FDI afin d'améliorer la fiabilité des modes de fonctionnement du banc MASCOTTE en adoptant une stratégie de contrôle tolérant aux défauts (FTC) en cas de défaillance additive d'actionneurs. Une méthode de génération de résidus à l'aide d'observateurs ou filtres est utilisée. Les résidus sont ensuite analysés au moyen d'un algorithme des sommes cumulatives adaptatif (ACUSUM). Les modèles définis dans la partie précédente présentent des non-linéarités et certains d'entre eux ont des paramètres inconnus ou des informations non mesurées. Dans la première section, une approche linéaire a été envisagée dans le cas de modèles à faible non-linéarités. de manière exponentielle (EWMA) sont utilisés et développés afin d'évaluer les résidus dans une troisème section. L'application et sa validation ont porté spécifiquement sur le système de refroidissement qui est un sous-système critique du banc dont le modèle comporte de fortes non-linéarités.

avec ξk+1 :=

  Si la distribution initiale a une moyenne de X, ajouter X à chacun des points donne un ensemble symétrique de 2n + 1 Sigma points ayant la moyenne et la covariance désirées. On peut utiliser cette méthodologie pour dériver un algorithme de filtrage. Le vecteur d'état augmenté composé de l'état et du bruit du procédé est défini comme suit: est la covariance de w k et R k est la covariance de v k . La transformation précédente est alors utilisée sur les Sigma points χ i,k|k avec i = 1, . . . , 2n + 1 de X a,k|k .Dans le cas d'un observateur à entrée inconnue, la transformation est réécrite en réinjectant l'entrée inconnue exprimée en fonction des données mesurées et de notre modèle non linéaire.

	où Q k
	X a,k|k := [X k	T w k	T ] T
	ce vecteur augmenté a une matrice de covariance:
	P a,k|k =	P k|k P w,x,k|k	P x,w,k|k Q k
	206

[START_REF] Carl | Overview of rocket engine control[END_REF]

Une distribution discrète ayant les mêmes premier et second moments est générée, où chaque point de l'approximation discrète peut être directement transformé (voir

[START_REF] Eric | The unscented Kalman filter for nonlinear estimation[END_REF]

). Étant donné une distribution gaussienne de dimension n ayant une covariance P , nous pouvons générer un ensemble de points O(n) ayant la même variance d'échantillon à partir des colonnes des matrices ± √ P .

  comportement nominal. Cependant, dans ce cas, les défauts de petite taille deviennent indétectables. Un moyen de résoudre ce problème est d'évaluer le résidu, comme dans[START_REF] Paul | Survey of robust residual generation and evaluation methods in observer-based fault detection systems[END_REF].Par conséquent, pour compléter le système de détection, localisation de panne et reconfiguration (FDIR), il faut définir des algorithmes d'analyse de résidus. L'objectif est de pouvoir détecter un changement de la valeur moyenne des résidus par rapport à un comportement nominal, voir[START_REF] Basseville | Detection of abrupt changes: theory and application[END_REF]. Les observateurs de la sous-section précédente permettent d'estimer les sorties et de générer le résidu défini comme l'erreur d'estimation d'état définie par r k := Y k -C Xk . Les deux hypothèses retenues sont : H 0 : La valeur moyenne du résidu est nominale. µ = µ 0 . H 1 : La valeur moyenne du résidu a été modifiée µ = µ 1 .Dans le cas de distributions différentes, un test statistique du rapport de vraisemblance généralisé (GLR) peut être utilisé. Pour la plupart des cas pratiques, µ 1 est inconnue. Une façon de procéder est d'utiliser le test GLR pour rechercher la taille optimale de la fenêtre glissante permettant de maximiser le rapport de vraisemblance et de le comparer à un certain seuil.

Une façon de procéder pour détecter les défauts est d'estimer et de comparer directement la sortie du système avec un seuil donné. Si le seuil est défini comme une limite supérieure des entrées du système et des écarts des erreurs de la dynamique du système, dans le cas où aucune fausse alarme n'est tolérée, il est possible de définir le seuil comme le double du maximum de la norme de sortie pour un

Acknowledgments

certain test configurations. The same applies to fuel (hydrogen or methane) whose distribution is then ensured by the sleeve. An additional interface is created in the sleeve to supply a helium film to cool the walls of the combustion chamber. In addition, a set of 14 thermocouples allows to rise to the temperature field over the entire injection plane.

The thermal measurement chamber consists of two ferrules equipped with thermocouples.

Interface constraints required the design of sleeves of different lengths. These shells are watercooled structures. The inner wall is clamped upstream in a steel body and free to expand towards downstream. A set of parts, placed between the core and the body, forms the cooling and allows the installation of thermocouples as well as their routing and sealing to the sockets located on the periphery of the cuffs. The ground water supplies are provided by four tubes connected to a torus. Inside, a distribution grid composed of 36 holes distributes water in the cooling system. The cooled axisymmetric nozzle is designed for an operating pressure of 60 bar maximum and has therefore been redesigned to check its resistance to the significantly more severe test conditions of this high mixture ratio operation.

ATAC configuration

As part of the joint CNES-ONERA research program on nozzle and rear-body aerodynamics (ATAC) program [START_REF] Vingert | Campagne d'essais Mascotte réception de la tuyère ATAC-HRM[END_REF], it was decided to make a number of tests on MASCOTTE test bench (CNES/ ONERA) to study the detach flow in a nozzle more or less over-expanded under hydrogen / oxygen combustion operating conditions representative of the conditions of a Vulcain 2 engine.

The objective of those tests is the constitution of a database necessary for the validation of computational fluid dynamics codes.

Under certain operating conditions, in particular for nozzle tests ATAC, it is desirable to have an operating time of about 60 seconds. This objective cannot be reached with only a cooled sleeve whose structure quickly reaches thermal equilibrium. As the ATAC nozzle has a rectangular inlet cross-section, it is necessary to manufacture an interface part to switch from this shape to the cylindrical section of the chamber of thermal ferrules. The nozzle is essentially equipped with wall temperature measurements. Only the whole ensemble "convergent-divergent" is concerned by this equipment. For heat flux estimation, thermocouples are used, located near the gas-side wall and the cooling-side wall. The convergent-divergent assembly is thus equipped with 14 sets of two thermocouples. No thermocouple is placed at the throat because the local wall thickness is too small to receive thermocouples. Similarly, thermocouples directly upstream and downstream of the nozzle are located at the same thickness. The "instrumented divergent" is equipped with six sets of two thermocouples.

For ATAC, the two-dimensional nozzle can also be used. It consists of five main elements: three flat walls (left, right and floor), the main nozzle (convergent-divergent) and the helium throat which includes the instrumented divergent and upstream of it, the injection of parietal film simulating the re-injection of turbine gases into the Vulcain 2 nozzle extension.

The nozzle cooling part is designed as follow, see Figure 3.7:

• The total pressure at the outlet of the spherical tank, called "sphere" is of 39 bars,

• The part before the visualization window composed of three lines, Chapter 4

Fault detection and isolation system

The FD mechanism is supposed to detect any relevant failure that could lead to engine performance degradation. This shall be done sufficiently early to set up timely safe recovery as explained in the State-of-the-art, section 2.1. One way to proceed to detect faults is to evaluate the residual corresponding to our state estimate error, see section 2.3. The objective is to design a FD filter based on the previous modeling of the engine test stand [START_REF] Emami-Naeini | Effect of model uncertainty on failure detection: The threshold selector[END_REF], [140] in order to be able to detect a residual mean shift from a nominal behavior with the help of adaptive threshold methods see The FD method proposed here is based on the physical models designed in the previous section 3.5. Those models present non-linearity and some of them unknown parameters or unmeasured information. In the first section a linear approach have been considered. To generate residuals the state is estimated with the help of an EKF or an (Extended Unknown Input Observer) EUIO in the case of models with unknown inputs. Then an extension to the • X(X 0 , t 0 ; t; U ) the solution at time t of (4.1) with input U and acting on X 0 at time t 0 . Most of the time, t 0 is the initial time 0 and X 0 the initial condition. In that case, we simply write X(X 0 ; t; U ).

• Y (X 0 , t 0 ; t; U ) the output at time t of (4.1) with input U acting on X 0 at time t 0 i.e.:

Y (X 0 , t 0 ; t; U ) = h(X(X 0 , t 0 ; t; U ), U (t)). To alleviate the notations when t 0 = 0, we simply note Y X 0 ,U , i.e. Y X 0 ,U (t) = h(X(X 0 , t; U ), U (t)) . Those notations are used to highlight the dependency of the output on the initial condition (and the input). When this is unnecessary, we simply write Y (t).

• X 0 a subset of R n containing the initial conditions that we consider for system (4.1). For any X 0 in X 0 , we denote σ + (X 0 ; U ) (resp σ + X (X 0 ; U )) the maximal interval of existence of X(X 0 ; ;U ) in R n (resp in a set X ).

• U the set of all sufficiently many times differentiable inputs U : [0, +∞) → R nu which the system can be submitted to.

• U a subset of R nu containing all the values taken by the inputs U ∈ U, i.e. U ∈U U ([0, +∞)) ⊂

U.

An observer for the system (4.1) initialized in X 0 is a couple (F,T ) where:

• T is a family of continuous functions T u : R nz × [0, +∞) → R n , indexed by U in U, which respect the causality condition:

• For any U in U, any Z 0 in R nz and any X 0 in X 0 such that σ + (X 0 ; U ), any solution

initialized at Z 0 at time 0, with input U and Y X 0 , exists on [0, +∞) and is such that

In other words, X((X 0 , Z 0 ); t; U ) is an estimate of the current state of system (4.1) and the error made with this estimation asymptotically converges to 0 as time goes to infinity. If T u is the same for any U in U and is defined on R nu instead of R nu × R, i.e. is time independent, T is said stationary. In this case, T directly refers to this unique function and we may simply say that

is an observer for system 4.1 initialized in X 0 . In particular, we say that the observer is in the given coordinates if T is stationary and is a projection function from R nz to R n , namely

Application to MASCOTTE test bench

The estimation cadence used on real measurements of the project CONFORTH describes in section 3.3, is fixed at 0.03 second. The standard deviation is denoted σ. The state estimation error (4.26) is taken as a residual. • If the variation is of the same sign (+/-) for two pipes and the residual of the third pipe is under the threshold fixed by the sum of the other pipes fault variations (↓/↑), the fault occurs in the first two pipes: an obstruction in two lines implies their mass flow rate decrease so that the mass flow rates continuity allow us to conclude that the mass flow rate increases in the last line. To differentiate the single fault case from the two faults case we can set a threshold based on the sum of the faults variations in the faulty lines (see equations (B.4) and (B.5)).

• If the variation is negative for two pipes (↓/↑) then the fault occurs in the other pipe (+/-, single fault case): an obstruction implies a mass flow rate decrease in the impacted line so that the mass flow rate continuity for the overall system allow us to conclude that the mass flow rate increases in the other lines.

• As long as the sign of variations remains the same, faults are persisting (+/-).

This analysis is summarized in Tables 4.

Performance evaluation

The model structure and the estimation method were validated on the real MASCOTTE test bench data. The FDI scheme was validated in realistic simulations. To evaluate the effectiveness of the designed algorithm, the good detection and false detection rates (GDR, FDR) have been calculated for ten runs. For simultaneous faults we consider to be a good detection the simultaneous detection and isolation of the faults in the two impacted lines, if at least one detection is false then we consider it to be a false detection. Those rates, which are satisfying for the considered application, have been calculated from ten runs for each simulation and the settings have been chosen to optimize the good isolation rate and minimize the false isolation rate of abrupt mean shifts, see Table 4.9.

The EUIO from the previous subsection permits to estimate outputs and generate the residual as the state estimation error defined by Chapter 5

Reconfiguration Algorithms for Non-Shutdown Actions

Once the fault has been detected and isolated by an online and real-time FDI mechanism, in the case of non-shutdown actions, the goal is to maintain the overall system stability and an acceptable performance despite the occurrence of faults and saturations by reconfiguring the nominal control law as introduced in Chapter section 2.4. The main objective of a FTCS is to maintain, with a control reconfiguration mechanism, current performances close to the desirable ones and preserve stability conditions in the presence of component and / or instrument faults.

An active FTCS (see Figure 5.1) is characterized by an online FDI process [START_REF] Zhang | Bibliographical review on reconfigurable fault-tolerant control systems[END_REF] which detects and estimates the fault, the second step is to achieve a steady-state tracking of the reference input by compensating the fault [START_REF] Theilliol | Actuator fault tolerant control design based on a reconfigurable reference input[END_REF].

Two basic control methods are available: open-loop (no feedback) and closed-loop (feedback) control systems. Both have found wide application in liquid propellant rocket propulsion systems [START_REF] Pérez-Roca | A survey of automatic control methods for liquid-propellant rocket engines[END_REF], see section 2.4.

In this chapter a closed-loop AFTCS is developed. The first approach considers a linearized system around a steady-state trajectory and make use of a LQ controller with a fault compensation part. This controller compensates an additive actuator failure by estimating the fault amplitude with an EUIO where the fault is assumed to be the unknown input. Then an anti-windup strategy is proposed in order to take into account the possible input saturations due to the actuator thermomechanical constraints. The second approach considers a nonlinear Lipschitz system and makes use of a MPC controller with a fault compensator based on an UUIO where an actuator additive failure is also assumed to be the unknown input. Then an anti-windup scheme is also proposed to take into account input saturations.

MASCOTTE test bench open-loop control system

With an open-loop control system, the control is accomplished by preset control means, such as orifices, and on / off command devices as it is currently done for most existing rocket engine systems. The extent of correction is determined from calibration test data. Open-loop control has the advantage of simplicity, however, it is limited to a specific set of operating parameters, and is unable to compensate for variable conditions during operation.

compensate the fault and maintain current performances in the presence of actuator saturation but also to converge if necessary, to another state reference.

Actuator additive faults

When a fault is detected the system switches to the FTCS in the case of the cooling system.

In the case of the propellant injection control, the system switches to the FTCS at a prefixed switch-time (after the transients since the dynamics is set in order to follow predetermined templates). The desired transient behavior depends on the gain choice; we have to limit the overshoots to maintain the system performances. The aim of those simulations is to see if the controller is able to stabilize the closed-loop system after the detection or when the switch-time is imposed, see (Tables 5.3

System description

Now that the unknown input expression is available (see section 4.1), we can rewrite the cooling system linear model without the mass flow rate as an unknown input. Then, in order to annihilate the actuator fault effect on the system, another EUIO than the FDI one is used to estimate the fault magnitude. A control law has then to compensate the fault such that the faulty system is as close as possible to the nominal one. We use the previous result (4.32) from the unknown input reconstruction part to rewrite the system under a second form only depending on known inputs for control purposes:

2)

The system is linearized around a steady state equilibrium, the nominal state to reach, the matrix A is then constant in time. This method requires matrix inversions, which may be numerically unstable due to possible ill-conditioning. In the problems considered, the matrices were invertible.

The system considered is now:

is the unknown actuator failure, A c ∈ R n×n the state matrix, B c ∈ R n×l the known input distribution matrix and C ∈ R m×n the output distribution matrix, with m ≤ n.

The new distribution matrices are given by:

Reconfiguration mechanism design

The estimate of the state is given by: Xc,k+1 = η k+1 + e c,k+1 + X k+1 (5.6)

An additive actuator failure with a control law can be modeled as:

where we assume that the nominal input U n,k is known, U c,k is the control law and f k is the faulty part of the input. We have:

It is then possible to design a second EUIO for the reconfiguration part, where f k + U c,k is considered to be the unknown input, with the following structure [START_REF] Tariq Hamayun | A fault tolerant control allocation scheme with output integral sliding modes[END_REF]:

The above matrices are designed in such a way as to ensure unknown input decoupling from the estimation error dynamic as well as the minimization of the state estimate error variance as previously.

To reduce this expression to a homogeneous equation we impose:

To give the state estimate error the minimum variance, the gain matrix should be determined to minimize the covariance matrix:

The EUIO stability is addressed in [211].

We also have to ensure the convergence of the regulation error η k .

In the unsaturated case, we can then use a control law of the form:

where B + c is the pseudo-inverse of B c , -B + c B c fk is the fault compensation part and W c ( Xc,k -X k ) is the reconfiguration part. The fault magnitude estimation fk is assumed to be estimated U sat ∈ R l + is the actuator limit.

Design of the anti-windup control law

The method proposed here consists in the design of a controller based on an UIO by considering the fault to be the unknown input similar to [START_REF] Tariq Hamayun | A fault tolerant control allocation scheme with output integral sliding modes[END_REF] and the design an anti-windup control law in order to ensure the asymptotic stability of the system with a saturated input for a given set of initial conditions and determine the associated stability domain. This FTC strategy permits to compensate the fault and maintain current performances in the presence of actuator saturations but also to converge if necessary, to another reference state.

We want to determine the anti-windup gain matrix E c such that for a set S of admissible initial states (ζ 0 ∈ S), the corresponding trajectory converges asymptotically to the origin of the subset E ⊂ S. Then, E is a region of asymptotic stability. For that, we want to determine a new control law of the form

The reference state dynamics for the anti-windup strategy is chosen as:

If the control law is saturated, then U k = ±U sat :

We can then write:

which gives

we then have:

with

where

The set of admissible initial states S considered will be defined as a polyhedral set and the domain of stability E will be designed as an ellipsoid.

Determination of the set of admissible initial states

Lemma 1. Consider a matrix G ∈ R l×2n and define the following polyhedral set:

For the function Ψ(u) defined in (5.27), if ζ k ∈ S then:

for any matrix T ∈ R l×l diagonal and positive definite.

This property will be used in the proof of Theorem 2 (5.47) to find the gain E c depending on the choice of G to ensure the exponential asymptotic stability of the system.

Proof.

(1) We consider the case where:

We have:

for T diagonal and positive definite.

(2) We consider the case where:

We have:

for T diagonal and positive definite.

(3) Ψ(Kζ k ) = 0, then:

for T diagonal and positive definite.

By multiplying from the left and from the right by P 0 0 T , with T := ∆ -1 et P := W -1 we have:

Then we have δV

) is strictly decreasing along the system trajectories. Then E(P ) is a stability region for the system. We can see that there always exists a positive scalar γ such that:

which ensures the exponential convergence with γ := δ λmax(P ) and λ max (P ) the maximum eigenvalue of P .

Application

The results of the reconfiguration control law was validated on CARINS realistic simulations based on the established models (3.42) and (3.47). The water cooling system is regulated with a pressure dome-loaded regulator (sphere) and valves. The actuator is saturated since the pressure is limited by thermo-mechanical constraints. An obstruction at the input of the ferrules part has been simulated by computing a closure profile of the valves. The closure profile is computed as a modification of the cross-sectional area of the actuator. The faults were implemented as in the previous section (see Figure 5.3). The simulated cases for the cooling system are the following:

• Case 1: constant valve closing profile, no actuator saturations.

System description

The new system for control purposes is thus:

We consider then following system:

Where X k ∈ R 2 is the state vector, Y k ∈ R is the measured output, U k ∈ R is the known input and C T ∈ R 2 the output distribution matrix, f ak ∈ R is the actuator additive fault.

Reconfiguration mechanism design

We define

reconfiguration error and X k the state reference.

The reference state dynamics can be generated as:

with U k a user-defined reference input, which can be for example a reference trial sequence.

We then have:

We can simplify the notation as:

Φ k is locally Lipschitz for the cooling system application since f (X k , U k ) is locally Lipschitz on a compact set S X inf ,Xsup,U inf ,Usup . The considered mass flow rates and pressures are bounded by thermomechanical constraints, X ∈ [X inf ; X sup ] and U ∈ [U inf ; U sup ].

We consider a control law of the following form:

The fault fak is estimated from the following unknown input reconstruction scheme:

with H = ((CB) T (CB)) -1 (CB) T .

We consider the following minimization problem with respect to ∆U (•) of the infinite horizon cost function:

subject to: We choose the following Lyapunov candidate function:

If V k is a Lyapunov function ensuring the stability of the resulting closed-loop, then (see [START_REF] Poursafar | Model predictive control of non-linear discrete time systems: a linear matrix inequality approach[END_REF]):

with γ a positive scalar and regarded as an upper bound of the objective (5.58).

Lemma 2. [START_REF] Poursafar | Model predictive control of non-linear discrete time systems: a linear matrix inequality approach[END_REF] Let M , N be real constant matrices and P be a positive matrix of compatible dimensions. Then:

holds for any > 0.

γ subjects to

Application

The faulty system was simulated with CARINS, as for the previous applications, a closing valves profile was imposed at the input of the simulated cooling system. The aim of this simulation is to see if the controller is able to stabilize the closed-loop system after the detection. When the fault is detected the system switches to the FTCS. This FTCS is composed of: a FDI part, a first UUIO for fault detection purposes as well as unknown input reconstruction and residual analysis algorithms; a fault compensator, a second UUIO for the rewritten system to estimate and compensate for the fault; a MPC to ensure the system stability and convergence to a reference trajectory. This system has been tested on three sets of failures, see Table 5.5. Failures have been compensated and the control law for the rewritten system allowed to stabilize the system around the reference steady-state trajectory with sufficient precision (see Figures 5.7, 5.8, 5.9).

The deviations values depend mainly on the fault compensation error in the steady-state.

Algorithms implementation on MASCOTTE test facility

The developed AFTCS has started to be implemented for validation on MASCOTTE test bench (Figure 6.1). The first implemented algorithms are the estimation of the propellant line mass flow rates (EKF), the estimation of the cooling system mass flow rates and pressures (EUIO), the fault detection in the cooling system (ACUSUM) and the calculation of a reconfiguration law based at first on poles placement and active fault compensation (EUIO). Those algorithms have been integrated in a Win32 Dynamic Link Library (DLL). This DLL is called in a LabVIEW Virtual Instrument (VI) that has been integrated in the Acquisition VI of MASCOTTE. In this chapter, the implementation of those algorithms is introduced. In a first section the actual monitoring system

Risk and monitoring prevision

The FMEA (section 3.3) of MASCOTTE test bench made it possible to identify the risks related to operation of the bench for all kind of tests prior to the CONFORTH project. Since the bench have not fundamentally changed after the integration of the new CONFORTH combustion chamber, all these risks are still relevant and all the measures to reduce risks taken in this context remain in service. Description and validation of monitoring programmed on the SM are the essential part of it. At the SM programming level, this means taking into account the following points:

• cooling water: flow rates, pressures and inlet and outlet temperatures of the various circuits supplying the injection head, the rings, the nozzle;

• wall temperatures of the rings on the hot gas sides;

• wall temperatures of the shells on the sides of the water channels;

• instrumented sleeve temperatures;

• nozzle wall temperatures;

• water temperatures in the orifices.

Conclusion

The approach developed in this thesis aims at detecting catastrophic failures to prevent severe breakdowns but also at mitigating benign shutdowns to non-shutdown actions in order to improve a LPRE reliability and mission success probability. A new model for FDIR is designed for the evolution of pressures, temperatures and mass flow rates in the cooling system of a cryogenic test bench, the evolution of mass flow rates in the propellants feeding lines, and injection pressures for gas / gas or liquid / gas operations. The methods used were initially developed for linear systems and then extended to nonlinear systems to account for the large variations of the system dynamics.

In Chapter 3, models are designed to describe the nominal dynamics of each thrust chamber subsystem's critical characteristics (pressures, mass flow rates and temperatures). Those models are elaborated under the assumption of an ideal engine operating with LOX and This last point ensures the adaptability of the models for different ranges of operations.

Then, an Active Fault Tolerant Control System (AFTCS) has been designed based on a FDI system which allows compensating for an additive actuator failure and to converge if necessary to a chosen steady state even in the case of actuator saturation.

The FDI method described in Chapter 4 consists in a detection part with an observer-based residual generation, using either an Extended Kalman Filter (EKF) or an Extended Unknown Input Observer (EUIO) / Unscented Unknown Input Observer (UUIO) in the case of systems with non-measurable information (unknown inputs). The UIOs are used to decouple the effects of unmeasurable mass flow rates (cooling system, propellant feeding lines) on the system dynamics Chapter 8

Perspectives

Further development in the different fields addressed in this thesis can be foreseen.

Regarding the modeling part, the models can be improved in order to consider the startup and shutdown phases of the operations [START_REF] Di | Start-up transient simulation of a liquid rocket engine[END_REF] especially for the mass fraction evolutions. Moreover, a more accurate modeling of the interactions between the combustion chamber and the cooling system may be useful to obtain a better description of the chamber temperature evolution [START_REF] Chen | Multiphysics simulations of rocket engine combustion[END_REF].

For example the use of another correlation than Bartz correlation can be investigated. The models also have to be extended to liquid / liquid operations to cover a larger family (or variety) of real LPRE. For a real application case:

• The turbo-pumps pressure dynamics needs to be modeled and integrated in the set of equations [START_REF] Wei | Modeling and simulation of liquid propellant rocket engine transient performance using modelica[END_REF]. This pressure will be in this case the input pressure of the feeding propellant lines model.

• In the case of a gas-generator cycle, the same models can be used for the gas generator itself.

• The actuators dynamics also have to be modeled to take into account the response time, it can be done by translating the pressure commands in a closing or opening profile.

As for the residual generation method for fault detection, it is not able to detect sensor faults, it might then be interesting to develop the existing multi-objective observers [START_REF] Aouaouda | Discrete-time H-/ H∞ sensor fault detection observer design for nonlinear systems with parameter uncertainty[END_REF][START_REF] Zhang | Adjustable parameter-based multiobjective fault estimation observer design for continuous-time/discrete-time dynamic systems[END_REF][START_REF] Yang | Mixed H-/H∞ fault detection observer design for multi model systems via nonsmooth optimization approach[END_REF][START_REF] Tang | Fault detection and isolation for discretetime descriptor systems based on H-/L∞ observer and zonotopic residual evaluation[END_REF][START_REF] Fr López Estrada | Robust H-/H∞ fault detection observer design for descriptor-LPV systems with unmeasurable gain scheduling functions[END_REF][START_REF] Henry | Design of fault diagnosis filters: A multi-objective approach[END_REF]. Those observers are used to estimate jointly the unknown inputs, states, and faults signals based on the solving of an optimization problem formulated by means of performance criterion. The design of such observers can be more complex and limited by the implementation constraints since it often results in the resolution of LMIs. Nevertheless, since the global system is subdivided in several low-dimensional subsystems it might be possible to apply an adaption of those observers to each subsystem.

Concerning the fault isolation part and its application to sensor faults cases, the validation of the projection matrix design also requires more investigations. For a real application case, the global closed-loop system have to take into account the interactions between the different subsystems. It might then be difficult with the developed method to isolate a failure or directly trigger the control in a part of the system. In this case coupling the residual analysis methods with data-based methods might be promising for determining the best triggering location of the reconfiguration in terms of recovery performance and reaction time [START_REF] Decastro | Analysis of decentralization and fault-tolerance concepts for distributed engine control[END_REF][START_REF] Khelassi | Reconfiguration of control inputs for overactuated systems based on actuators health[END_REF][START_REF] Berdjag | Fault detection and isolation for redundant aircraft sensors[END_REF]. To do so, it seems interesting to couple the developed FDIs for each subsystem with a multi-algorithm detection [START_REF] Nie | Liquid-propellant rocket engine online health condition monitoring base on multi-algorithm parallel integrated decision-making[END_REF][START_REF] Wang | An embedded intelligent system for on-line anomaly detection of unmanned aerial vehicle[END_REF] method.

Regarding the reconfiguration part, to consider the global system with startup and shutdown phases it might be interesting to use MM methods or VSC methods (see for example [START_REF] Sami | Active fault tolerant control for nonlinear systems with simultaneous actuator and sensor faults[END_REF][START_REF] Kim | Robust discrete-time variable structure control methods[END_REF]) with anti-windup to limit the chattering effects. The anti-windup scheme might also be used to control the propellant injection pressure by regulating the injection mass flow rate and then ensuring a better specific impulse. The injection mass flow rates can be regulated in order to remain within performance bounds using bounding methods as for example the methods developed in [START_REF] Witczak | Predictive actuator faulttolerant control under ellipsoidal bounding[END_REF][START_REF] Efimov | Estimation and control of discrete-time LPV systems using interval observers[END_REF]. For this application, the anti-windup scheme can also be improved by taking into account cost functions depending on the reconfiguration objectives, as for example, enlarging the stability domain.

The implementation part has also to be further developed. Some limitations have appeared as the coding solvers for the LMIs in C++ need further investigations on existing mathematical toolboxes. The control law implementation should take into account the actuators dynamics.

Some of the bench actuators have to be adapted in order to perform a closed-loop reconfiguration.

The cavitating Venturis, which fix the line mass flow rates, should be replaced by valves since the pressure dome-loaded regulators have a slow dynamics. The combination of valves and pressure-dome-loaded regulators may then be used to operate each part of the bench. If the pressure dome-loaded regulators become faulty, the reconfiguration can be ensured by the valves under the form of closing and opening profiles. Those profiles can be obtained from the actual operating system of the bench following the pressure command.

Appendix A

Chamber pressure model

No convective nor conductive heat transfers, nor the combustion delay are taken into account in this model. To start the combustion, we assume that hot helium is injected in the chamber at the beginning of the simulation.

Faults dynamics expressions

In the case of an obstruction in the line 1:

Appendix C

Gain determination with polytopic sets

In the case where the full state is of large dimension it may not be possible to solve the Riccati equation in real time. In this case it is possible to use results on polytopes in order to compute a global gain.

We consider a polytope A(α) so that:

where A is bounded and closed with Ā the upper limit, A the lower limit and

All A can be written as a convex combination of Ā and A we want to show that the Lyapunov function P assuring the Lyapunov stability of the system is the same convex combination of the corresponding limits Lyapunov functions.

We denote P the Lyapunov function so that we have ĀT P + P Ā -P BR -1 B T P < -Q and P the Lyapunov function so that we have A T P + P A -P BR -1 B T P < -Q. Where Q and R are symmetric positive definite matrices. We then have:

A(α) T P (α) + P (α)A(α) -P (α)BR -1 B T P (α) = (ᾱ Ā + αA) T (ᾱ P + αP ) + ( ᾱ P + αP )(ᾱ Ā + αA) -(ᾱ P + αP )BR -1 B T (ᾱ P + αP ) = ᾱ2 ( ĀT P + P Ā -P BR -1 B T P ) + α 2 (A T P + P A -P BR -1 B T P ) + α ᾱ(A T P + P A -P BR -1 B T P + ĀT P + P Ā -P BR -1 B T P )

with A(α) = ᾱ Ā + αA and P (α) = ᾱ P + αP .

If we assume that (A T P + P A -P BR -1 B T P + ĀT P + P Ā -P BR -1 B T P ) < 2Q then A(α) T P (α) + P (α)A(α) -P (α)BR -1 B T P (α) = ᾱ2 ( ĀT P + P Ā -P BR -1 B T P ) + α 2 (A T P + P A -P BR -1 B T P ) + α ᾱ(A T P + P A -P BR -1 B T P + ĀT P + P Ā -P BR -1 B T P ) < -( ᾱ2 + α 2 -2α ᾱ)Q < 0 which ensure the asymptotic stability.

We can then use the following Lyapunov function: P = ᾱ P + αP in order to compute the Appendix D

First and second preparations for MASCOTTE operations D.1 Propellants

A First prevention must be taken in order to prepare the firing test and ensure the operation safety. Since a propellant leakage is a major risk, a particular attention is paid to leakage. In

D.2 First preparation

First preparations have to be done to ensure the well going of operations;

• The operators have to check the level of the water tank of the diluter, refill if needed and switch it on (manual or autonomous function).

Appendix E

Résumé

La surveillance et l'optimisation des modes de fonctionnement des systèmes propulsifs des lanceurs sont des enjeux majeurs du domaine de l'aérospatial. L'objectif de ces lanceurs étant de faciliter l'accès à l'Espace, il est nécessaire d'assurer la fiabilité, la sûreté et le rendement économique des vols spatiaux [START_REF] Fekih | Fault diagnosis and fault tolerant control design for aerospace systems: A bibliographical review[END_REF], [START_REF] Figueroa | Rocket testing and integrated system health management[END_REF]. En effet, une panne ou un dysfonctionnement du système propulsif peut avoir un impact environnemental ou humain ainsi qu'un impact conséquent pour les clients institutionnels ou privés (perte de satellites). De plus, le 21ème siècle a vu la montée en puissance de nouvelles nations sur le marché du lancement des satellites (Chine, Inde, Japon) et l'émergence de sociétés privées aux États-Unis (Space X, Blue Origin).

L'émergence de ces nouveaux concurrents a notamment mis en avant l'intérêt économique de la réutilisation [START_REF] Wu | Liquid-propellant rocket engines health-monitoring: A survey[END_REF]. Les états considérés sont :

• Les pressions de sortie, les températures et les débits massiques d'entrée de chaque ligne du système de refroidissement. Pour la détection, seules les pressions et les débits massiques sont pris en compte.

• Les débits massiques dans les conduites d'alimentation en ergol.

• La pression d'injection des ergols dans la chambre de combustion.

Dans un EKF ou un EUIO, la distribution des états est approchée par une variable aléatoire gaussienne (GRV) qui est ensuite propagée analytiquement par une linéarisation "du premier ordre" du modèle non linéaire. Ensuite, le modèle peut être transformé en représentation d'état à temps discret équivalent :

Les matrices ci-dessus sont conçues de manière à assurer le découplage des entrées inconnues ainsi que la convergence de l'erreur d'estimation d'état et la minimisation de sa matrice de covariance.

Pour la reconfiguration, une loi de contrôle doit être conçue. Il est donc utile de disposer de toutes les informations du système en estimant l'état complet de celui-ci. Dans [START_REF] Zhu | State estimation and unknown input reconstruction via both reduced-order and high-order sliding mode observers[END_REF] et [START_REF] Kalsi | Sliding-mode observers for systems with unknown inputs: A high-gain approach[END_REF],

un vecteur de sortie auxiliaire est introduit et est utilisé comme nouvelle sortie du système pour estimer asymptotiquement l'état de celui-ci sans subir l'influence des entrées inconnues. À partir de ce résultat, il est possible de développer une méthode de reconstruction d'entrée inconnue basée à la fois sur l'état et sur les estimations de la dérivée de la sortie auxiliaire.

Une estimation de l'entrée inconnue est alors donnée par:

thermo-mécaniques des actionneurs.

Sur la base de ces travaux des méthodes de détection de défauts capteurs dans des parties interdépendantes pourront être développées. La dynamique des actionneurs pourra être étudiée et modélisée afin d'être prise en compte dans l'élaboration des lois de commande.

Des méthodes de contrôle à l'aide d'actionneurs virtuels pourront aussi être envisagées dans le cas où l'on considère non plus différents sous-systèmes mais le système global (avec leurs différentes intéractions).