A Fault-Tolerant Steering Prototype for X-Rudder Underwater Vehicles.

The X-rudder concept has been applied to more and more autonomous underwater vehicles (AUVs) in recent years, since it shows better maneuverability and robustness against rudder failure compared to the traditional cruciform rudder. Aiming at the fault-tolerant control of the X-rudder AUV (hereinafter abbreviated as xAUV), a fault-tolerant steering prototype system which can realize dynamics control, autonomous rudder fault detection and fault-tolerant control is presented in this paper. The steering prototype system is deployed on a verification platform, an xAUV, in which the monitor software is developed based on the factory method and the onboard software is developed based on the finite state machine (FSM). Dual-loop increment feedback control (DIFC) is first introduced to obtain smooth virtual rudder commands considering actuator's limitations. Then the virtual rudder commands are transformed into X-rudder commands based on the mapping theory. In rudder fault diagnosis, an optimized particle filter is proposed for estimating rudder effect deduction, with proposal distribution derived from unscented Kalman filter (UKF). Then the fault type can be determined by analyzing indicators related to the deduction. Fault-tolerant control is addressed by dealing with nonlinear programming (NLP) problem, where minimization of allocation errors and control efforts are set as the optimization objectives, and rudder failure, saturation and actuators limitations are considered as constraints. The fixed-point iteration method is utilized to solve this optimization problem. Many field tests have been conducted in towing tank. The experimental results demonstrate that the proposed steering prototype system is able to detect rudder faults and is robust against rudder failure.


Introduction
In recent years, a great diversity of autonomous underwater vehicles (AUVs) has been brought into reality, ranging in size from man-portable lightweight ones to large sized vehicles over 10 m in length, with commercial, research, military and other applications. In the pursuit of better maneuverability, X-rudder autonomous underwater vehicles (hereinafter abbreviated as xAUVs) were developed. The first X-rudder underwater vehicle was a research submarine, on which the US Navy carried out numerous maneuver experiments and concluded that the maneuverability is superior to that of all other submarines [1]. Dubbioso, et al. [2] confirmed the superior turning abilities of the X-rudder underwater vehicles by conducting numerical simulations and compared the results to available experimental by nonlinear programming (NLP) in the control allocation process, which releases the complexity of designing the dynamics controller.
Motivated by the aforementioned considerations, a fault-tolerant steering prototype system will be developed in this paper, where a particle filter will be improved for fault detection and NLP will be introduced for fault-tolerant control. The main contributions of this work are summarized as follows: (1) In order to validate the fault-tolerant steering prototype system, an xAUV will be developed for experimental tests. With modularity and expansibility taken into consideration, monitor software is designed based on factory method, while onboard software is based on finite state machine (FSM). Compared to the existing research, the proposed steering prototype system is unprecedented for xAUVs because of the integration of dynamics control, fault detection and fault-tolerant control. Besides, field tests are conducted firstly for validation. (2) As for rudder faults detection, the standard particle filter is modified to estimate rudder effect deduction due to faults, where UKF is adopted for providing proposal distribution. Based on the estimation, fault detection can be achieved by analyzing related indicators. To the best of the authors' knowledge, there is no previous literature about rudder fault detection of the xAUVs. (3) In the case of rudder failure, fault-tolerant control of xAUVs is addressed by solving multi-objective optimization in this paper. In this optimization problem, minimization of allocation errors and control efforts are considered as optimization objectives, whereas saturation, actuators limitations, and rudder faults are considered as constraints. Compared to previous literatures, this problem is addressed in the control allocation process, rather than in the design of dynamics controller dealing with disturbance.
The remainder of this paper is organized as follows: Section 2 presents the development of the xAUV in terms of hardware composing and software design pattern. Section 3 proposes the scheme of the fault-tolerant control algorithm and presents a detailed process of fault detection. Section 4 presents the simulations of DIFC comparing to other common dynamics controllers. Section 5 validates the previous analysis and design through field tests in a towing tank. Section 6 concludes the work in this paper.

Hardware Components
The developed xAUV in this work is a scaled physical model. From the point of view of operation, this xAUV is designed to work autonomously or under remote control. As illustrated in Figure 1, an operator can control the xAUV remotely to complete many maneuvers by WIFI integrated into the portable surface monitor. When underwater voyages are required, the operator needs to assign the autonomous tasks to the xAUV firstly, and command the xAUV to switch into the autonomous mode next, then the xAUV will dive into the water and carry out the assigned tasks. After underwater tasks completed, it will float up to the surface and stay there waiting for the next command.
The xAUV in this paper is 3 m long and the diameter of the outer contour is 300 mm. A modular construction pattern is introduced in the platform design and the xAUV is divided into five segments: bow segment, electronic cabin, payload segment, actuators segment, and fairwater segment (see Figure 2). There are four electric steering actuators driving the control surfaces, one tunnel thruster in the actuators segment and one steering actuator driving the fairwater rudder in the fairwater segment. This comprises the actuator configuration of the xAUV.
As for the navigation system, an Inertial Navigation System (INS) is utilized to provide position, velocity and attitude with auxiliary data from Doppler velocity log (DVL) and global navigation frame sensor, i.e. GPS. A lithium battery is the only power source for this platform. For safety, a Battery Management System (BMS) is adopted to monitor the health of battery cells, discharging voltage, current, temperature, and state of charge (SOC) of the battery. The surface monitor is integrated into a portable case along with a computer, a KVM (abbreviation of keyboard, video, mouse) switch and communication instruments (see Figure 3). It can display the status of the xAUV, such as position, velocity, etc. through UDP communication with an onboard computer and send remote commands or task info to the vehicle.
Sensors 2020, 20, x FOR PEER REVIEW 4 of 28 tunnel thruster in the actuators segment and one steering actuator driving the fairwater rudder in the fairwater segment. This comprises the actuator configuration of the xAUV. As for the navigation system, an Inertial Navigation System (INS) is utilized to provide position, velocity and attitude with auxiliary data from Doppler velocity log (DVL) and global navigation frame sensor, i.e. GPS. A lithium battery is the only power source for this platform. For safety, a Battery Management System (BMS) is adopted to monitor the health of battery cells, discharging voltage, current, temperature, and state of charge (SOC) of the battery.
The surface monitor is integrated into a portable case along with a computer, a KVM (abbreviation of keyboard, video, mouse) switch and communication instruments (see Figure 3). It can display the status of the xAUV, such as position, velocity, etc. through UDP communication with an onboard computer and send remote commands or task info to the vehicle.  tunnel thruster in the actuators segment and one steering actuator driving the fairwater rudder in the fairwater segment. This comprises the actuator configuration of the xAUV. As for the navigation system, an Inertial Navigation System (INS) is utilized to provide position, velocity and attitude with auxiliary data from Doppler velocity log (DVL) and global navigation frame sensor, i.e. GPS. A lithium battery is the only power source for this platform. For safety, a Battery Management System (BMS) is adopted to monitor the health of battery cells, discharging voltage, current, temperature, and state of charge (SOC) of the battery.
The surface monitor is integrated into a portable case along with a computer, a KVM (abbreviation of keyboard, video, mouse) switch and communication instruments (see Figure 3). It can display the status of the xAUV, such as position, velocity, etc. through UDP communication with an onboard computer and send remote commands or task info to the vehicle.   The monitor software is a supervisory control and data acquisition (SCADA) system [16] and was developed based on the factory method [17], which is a widely used software design pattern concluding the experience in coding, making the code easier to understand, and ensuring the  The monitor software is a supervisory control and data acquisition (SCADA) system [16] and was developed based on the factory method [17], which is a widely used software design pattern concluding the experience in coding, making the code easier to understand, and ensuring the program reliability [18]. As is shown in Figure 4, the monitoring software is developed with three functional layers: display layer, schedule layer, and infrastructure layer. Screens listed in the display layer are designed for human-computer interaction, including state monitoring, sending commands, path planning, etc. The schedule engine in schedule layer takes charge of coordinating the function blocks according to the predefined time sequence and determining the program execution cycle by timers. There are many basic function blocks and data warehouses in infrastructure layer, where a function block can be abstracted into a proprietary factory and a data block can be compared to materials in the factory. With this software construction, the monitor software is highly integrated.

Onboard Software Based on Finite State Machine
In early aquatic vehicle research, the limited hardware capability was a significant challenge for the development of custom software for underwater vehicles [19]. However, with the development of computer science, more and more powerful hardware has become available for researchers and end users. Moreover, open-source middlewares for developing applications for robotic systems come into public eye in recent years. Robot Operating System (ROS) is a popular open-source middleware in the robotics research community because there are already many free function packages and this

Onboard Software Based on Finite State Machine
In early aquatic vehicle research, the limited hardware capability was a significant challenge for the development of custom software for underwater vehicles [19]. However, with the development Sensors 2020, 20, 1816 6 of 26 of computer science, more and more powerful hardware has become available for researchers and end users. Moreover, open-source middlewares for developing applications for robotic systems come into public eye in recent years. Robot Operating System (ROS) is a popular open-source middleware in the robotics research community because there are already many free function packages and this number is increasing greatly year after year [20]. However, for underwater vehicles, the use of the Mission Oriented Operating Suite (MOOS) maintained by the working group at MIT has been widespread [21]. This is also an open-source middleware that includes many modules specially designed for aquatic vehicles.
However, ROS and MOOS are inapplicable for onboard software development of the xAUV, because the controller running Linux is the required platform rather than the Windows CE-based controller from Beckhoff adopted by this xAUV. Therefore, the FSM-based onboard software was customized for the xAUV. FSM is an efficient coding solution for complicated state transitions without nested if-else branches [22] and ensures the xAUV can switch between different working modes correctly and quickly. As shown in Figure 5, the onboard software consists of four layers: perception, communication, decision, and control. Communication layer realizes data exchange with the surface monitor by WIFI. Sensor data is collected in the perception layer and filtered before output. In the decision layer, FSM will determine the working mode of the xAUV considering commands from surface monitor and fault information diagnosed by fault detection block. Motion control algorithms and drive control of the actuators are achieved in the control layer.   The state transition diagram of FSM is shown in Figure 6. Six states for different purposes are designed:  The state transition diagram of FSM is shown in Figure 6. Six states for different purposes are designed: • Ready: Ready to work and feedback states periodically;  The state transition diagram of FSM is shown in Figure 6. Six states for different purposes are designed:

Steering Under Normal Condition
The xAUV in this paper adjusts its heading or depth usually by X-rudder and the fairwater rudder is used for depth control when necessary. Various control methods for cruciform rudder AUVs have been derived by researchers related to aquatic vehicles. However, there is little literature directly referring to X-rudder control yet. Therefore, it is significant to develop an X-rudder steering method and make good use of its advantages. To achieve this, the four individual control surfaces need to coordinate well since every control surface contributes its own effect to the pitch and heading control. Actually, this manner is quite similar to dynamic positioning systems for ocean surface vessels in [23,24], motion control systems for over-actuated underwater vehicles in [25,26], flight control systems for tailless aircraft with strong interactions between control effectors as described in [27,28].
For designing the coordination method, the deflection sign is explained in Figure 7. Upward deflection is defined as positive for stern rudders and the definition of fairwater rudder follows the right-hand rule with the thumb pointing to the starboard side.

Steering Under Normal Condition
The xAUV in this paper adjusts its heading or depth usually by X-rudder and the fairwater rudder is used for depth control when necessary. Various control methods for cruciform rudder AUVs have been derived by researchers related to aquatic vehicles. However, there is little literature directly referring to X-rudder control yet. Therefore, it is significant to develop an X-rudder steering method and make good use of its advantages. To achieve this, the four individual control surfaces need to coordinate well since every control surface contributes its own effect to the pitch and heading control. Actually, this manner is quite similar to dynamic positioning systems for ocean surface vessels in [23,24], motion control systems for over-actuated underwater vehicles in [25,26], flight control systems for tailless aircraft with strong interactions between control effectors as described in [27,28].
For designing the coordination method, the deflection sign is explained in Figure 7. Upward deflection is defined as positive for stern rudders and the definition of fairwater rudder follows the right-hand rule with the thumb pointing to the starboard side. According to the survey in [29], there is a great diversity of control algorithms for underactuated or over-actuated underwater vehicles, including PID control, fuzzy control, sliding mode control, adaptive control, backstepping control, optimal control, and many combinations of the above

Dual-Loop Increment Feedback Control
According to the survey in [29], there is a great diversity of control algorithms for under-actuated or over-actuated underwater vehicles, including PID control, fuzzy control, sliding mode control, adaptive control, backstepping control, optimal control, and many combinations of the above algorithms. These methods have been proved to deal with the uncertainty, environmental disturbances and actuator saturation well that marine vehicles need to consider necessarily. However, this xAUV is designed to sail in a towing tank for debugging in early stage, then carry out some experiments in inland lakes where environmental disturbances, such as winds and currents, are too weak to affect the dynamics. Therefore, it is unnecessary to design a dynamics controller with consideration of disturbance observer [30] and drift compensation [31]. From a practical point of view, the dual-loop increment feedback control (DIFC) is proposed to handle the dynamics control problem and the normal command transformation is developed for control allocation, i.e. the coordination of the four control surfaces.
The principle diagram of DIFC is presented in Figure 8. There is a heading controller and a depth controller that each controller has multiple stages forming different control loops. The DIFC will produce the increment of virtual rudder commands (∆δ s , ∆δ r ), then the integrator sums up the increments and gives out the virtual rudder commands which will be transformed into the actuator's control inputs (δ i , i = 1, 2, 3, 4) by normal command transformation later.
is the actuator's control input. * e represents the error.  is the heading angle, r is the yaw rate, r is the yaw acceleration, z is the depth,  is the pitch angle, q is the pitch rate, and q is the pitch acceleration.
where the heading  is usually described as In practice, heading error needs to be modified to deal with heading discontinuity, and the modified expression is presented as: Based on the above error definitions, the increment heading control law is given as:  Figure 8. Principle diagram of DIFC. δ r and δ s are virtual vertical and horizontal rudder commands respectively. ∆δ is the increment, δ i (i = 1, 2, 3, 4) is the actuator's control input. e * represents the error. ψ is the heading angle, r is the yaw rate, . r is the yaw acceleration, z is the depth, θ is the pitch angle, q is the pitch rate, and . q is the pitch acceleration.
Let ψ d denotes the desired heading, then the heading error e ψ , the yaw rate error e r and the yaw acceleration error e . r are defined as: where the heading ψ is usually described as ψ ∈ [0, 2π]. In practice, heading error needs to be modified to deal with heading discontinuity, and the modified expression is presented as: Sensors 2020, 20, 1816 9 of 26 Based on the above error definitions, the increment heading control law is given as: where k i is the gain and ∆ i (i = 1, 2, 3) is the scale factor in every loop. k i should be determined according to the characteristics of the xAUV, i.e. k 1 is determined by max yaw rate, k 2 is determined by max yaw acceleration, and k 3 is determined by max rudder deflection speed. ∆ i is used to set the critical error that will produce the maximal outputs. In other words, ∆ i has great effect on the response speed of the control system. The tanh function is a continuous, symmetrical, smooth and saturated function (see Figure 9), and it is introduced to limit the desired yaw rate, the desired yaw acceleration etc. what's more, the tanh function is helpful to parameter adaptability since the slop becomes greater when the input approaches to zero. This is a usually adopted manner that a higher gain is preferred when the error comes to the origin, and vice versa.
Sensors 2020, 20, x FOR PEER REVIEW 10 of 28 Finally, the virtual vertical rudder command t r  at time t can be derived as: By adopting the virtual vertical rudder command derived from Equation (4), the errors defined in Equation (1) are guaranteed to converge to the origin.
Proof: The proof process is illustrated in the following three steps: Step 1: Proof of the convergence of r e . Consider the following Lyapunov function candidate: Differentiating Equation (5), utilizing Equation (3)  Step 2: Proof of the convergence of r e . Consider the following Lyapunov function candidate: Finally, the virtual vertical rudder command δ t r at time t can be derived as: where δ t−1 r is the last virtual command. By adopting the virtual vertical rudder command derived from Equation (4), the errors defined in Equation (1) are guaranteed to converge to the origin.
Proof. The proof process is illustrated in the following three steps: Step 1: Proof of the convergence of e . r . Consider the following Lyapunov function candidate: Differentiating Equation (5), utilizing Equation (3) and (4), one can obtain: V 1 = 0 can only be obtained when e . r = 0. Therefore, the convergence of e . r is proved.
Step 2: Proof of the convergence of e r . Consider the following Lyapunov function candidate: Sensors 2020, 20, 1816 10 of 26 Differentiating Equation (7), and let . r = k 2 tanh(e r /∆ 2 ) since the convergence of e . r is guaranteed, one can obtain: e r ≈ e r ∂e r ∂r ∂r ∂t ≈ e r ∂e r ∂r .
r ≈ e r ∂e r ∂r k 2 tanh(e r /∆ 2 ) (8) Due to the fact ∂e r ∂r = V 2 = 0 can only be obtained when e r = 0. Therefore, the convergence of e r is proved.
Step 3: Proof of the convergence of e ψ . Consider the following Lyapunov function candidate: Differentiating Equation (9), and let r = k 1 tanh(e ψ /∆ 1 ) since the convergence of e r is guaranteed, one can obtain: Due to the fact V 3 = 0 can only be obtained when e ψ = 0. Therefore, the convergence of e ψ is proved.
End proof.
Similarly, let z d denotes the desired depth, then the depth error e z , the pitch error e θ , the pitch rate error e q and pitch acceleration error e . q are defined as: and the increment of vertical rudder is derived as: where k j and ∆ j ( j = 4, 5, 6, 7) can be chosen in the same way with heading control law. Then, the actual vertical rudder command is given as: The stability analysis of depth control can refer to the heading control discussion.

Remark 1.
Since the increment feedback control presented in Equation (4) and Equation (13) is utilized, the static error in heading or depth control due to currents or dead zone of steering actuators can also be eliminated though there is no corresponding compensator in the DIFC scheme, because there is the integration process of the rudder increments and it has been proved that the integration can eliminate the static errors.

Normal Command Transformation
In Section 3.1.1, control laws for heading and depth control are derived. However, the obtained rudder commands δ r and δ s are virtual and need to be transformed into X-rudder commands described as δ i (i = 1, 2, 3, 4). A fixed mapping formula for transformation is designed as: where κ is the maximum rudder deflection and the diagonal rudders are set the same on purpose so that undesirable roll torque can be avoided. Equation (14) is applicable to most cases except that the calculated δ i is over the limitation, for instance, δ r = 25 • and δ s = −10 • . This problem was addressed by limiting δ i within normal range regarding control effort deduction in [7]. For a better solution, Equation (14) should be revised as follows: where λ ∈ [0, 1] is a weight factor representing the importance of depth control, and ε 1 and ε 2 are the deduction fractions that are defined as: Utilizing Equation (15) and Equation (16), virtual rudder commands δ r and δ s calculated by DIFC can be transformed into the individual command δ i (i = 1, 2, 3, 4). Usually, we are supposed to admit a fact that the depth control is prior to heading control for underwater vehicles, thus λ = 1 is selected.

Rudder Faults Detection
Rudder faults are inevitable during experimental operations of AUVs. If this happens, AUVs may lose control, hit a submerged mountain or suffer structural damage due to the extreme depth. Therefore, it is meaningful to detect the faults in time and then take effective measures to maintain maneuverability. In terms of the xAUV developed in this paper, the steering actuators are electrical ball screws that can feed back many states by RS485 communication, such as voltage, current, absolute position, etc. Therefore, communication failure and jam can be considered as two common faults. Worse, the control surfaces may get damaged when hitting an obstacle and this is another typical fault. Typical rudder faults are summarized in Table 1.

Fault Type Description
Communication failure The steering actuator can't communicate with onboard software normally.

Rudder Jam
Rudder gets stuck at a fixed position and affects maneuverability.
Control surface damage Control surfaces get damaged due to strike or scratch and rudder effect degraded.

Misalignment
The neutral position changed due to mechanical looseness or structural deformation.
Communication failure can be easily detected by monitoring the responses after transmitting a request message [32], since a responsive data acquisition method [33] is utilized for communication between the onboard software and steering actuators. In terms of rudder jam, feedback states are useful to diagnose whether rudder jams happen. The feedback absolute position would remain the same and the feedback current would be nearly equal to the rated value if the electrical ball screw got stuck.
Control surface damage is difficult to detect directly due to the lack of observable characteristic indicators. Aiming at this fault detection problem, a model-based diagnosis is proposed in this paper. Let f (t, x, u) represents the xAUV's dynamics, and h(t, x) represents the sates measured by sensors, then the nonlinear dynamic system can be described as: .
where f (t, x, u) is the state transition function in relation to the 6DOF dynamic equations, h(t, x) is the measurement function, x = (p, q, r) is the angular accelerations and y is the measurements, u = (δ di f , δ r , δ s ) is the virtual rudder commands. According to the dynamic equations of underwater vehicles based on the Newton-Euler method as presented in [34], the detailed expressions of f (t, x, u) and h(t, x) can be derived as: r is the added inertial matrix. C(x) accounts for the Coriolis and centripetal matrix, which is presented as: where: and: D(x) = diag K p + K p|p| p , M q + M q|q| q , N r + N r|r| |r| is the hydrodynamic damping matrix including the linear and quadratic drag. g(s) represents the restoring moments due to gravity and buoyancy and s = [φ, θ, ψ] T . The expression of g(s) is given as: K is the control effectiveness matrix, which is expressed as: The symbols used above are defined as follows: I x , I y and I z are the moments of inertial; F B is the buoyancy; x B , y B and z B are the coordinates of the center of the buoyancy in the body-fixed frame; In order to derive a diagnostic model, the rudder effect deduction ∆u due to specific rudder faults is introduced and Equation (17) is discretized for update in real time, then the discrete model at time k is derived as: x In normal conditions, ∆u is supposed to be around zero. In order to estimate ∆u, the sate variable x needs to be augmented as χ = (p, q, r, ∆δ di f , ∆δ r , ∆δ s ) and a diagnostic model should be derived. Let χ k is the estimation χ k andŷ k is the estimation of y k , then the diagnostic model is obtained as: where ν k is the covariant of process noise and n k is the covariant of measurement noise at time k.
The Kalman filter is a common state filter that has been widely used in underwater vehicles [35], but it requires that process noise ν and measurement noise n are Gaussian and independent whereas real systems are not. For nonlinear and non-Gaussian estimation problems, the particle filter is preferred [9].
As described in [36], a standard particle filter is presented as: where n is the number of total particles, χ i k ∼ q(χ k y 1:k ) is the particle set, ω i k is the weight factor determined by the posterior probability p(χ i k y 1:k ) and q(χ k y 1:k ) is the customized proposal distribution to be selected later. Weight factor ω i k yields: where p(y k χ i k ) is the likelihood probability similar to measurement noise and p(χ i k y 1:k−1 ) is the prior probability. Usually, resampling is necessary for standard particle filters to avoid the degeneracy problem [37], but over resampling will result in particle diversity degradation [38]. Therefore, the unscented Kalman filter (UKF) is introduced into the standard particle filter for providing the proposal distribution q(χ k y 1:k ) .
The detailed process of fault diagnosis is illustrated as follows: Step 1: Initialization.
Generate the proposal distribution q(χ i k y 1:k ) using UKF, and calculate the likelihood probability with the following formula: Then, normalized weight factor ω i k can be calculated by Equation (27) and the estimationχ k can be obtained by Equation (26).
Let ∆u is the mean value of actual rudder effect deduction ∆u and it yields to ∆u = 0 in normal condition. Otherwise, ∆u 0 when faults happened. Let ∆û is the estimation of ∆u and its mean value ∆û is defined as: where L 1 is selected time slice for diagnosis. Then, the fault indicator d ∆u at time k is designed as: where S 1 (k) and S 2 (k) are given as: Finally, a fault is supposed to be present if d ∆u (k) > β, otherwise, there is no fault. β is a positive constant determined by past experience.

Fault-Tolerant Control Based on Nonlinear Programming
In order to extend the working duration, fault-tolerant control is necessary for the xAUVs to carry out tasks without interruption when rudder failure happens. Thus, a fault-tolerant control scheme including fault detection is presented in Figure 10, where the DIFC, the normal command transformation, the fault detection and the fault-tolerant command transformation are integrated together. In addition, a selector switch is used for selection of transformation methods depending on the rudder health.
Distinguished from traditional fault-tolerant control, modification of dynamics controller is avoided since the fault-tolerant control problem is addressed in command transformation by using the non-linear programming (NLP). Before formulating the programming problem, one can assume that δ r and δ s are the actual control efforts derived as: where the configuration matrix B is given as: Then the objective function J of the programming problem can be defined as: where minimization of allocation errors and control inputs are considered as criterions. In Equation (33), τ d = δ r δ s T is the virtual rudder commands produced by DIFC, τ = δ r δ s T is the actual control efforts derived from Equation (32), u = δ 1 δ 2 δ 3 δ 4 T is the actuator's control inputs to be solved, W is the weight matrix for balancing horizontal and vertical control, and ξ is a parameter for balancing criterion components. When J is optimized to its minimum, control allocation error (τ d − τ) is minimum and rudder deflection u yields: whereirepresents the index of faulty rudder (34) where γ is the max deflection rate depending on the actuator's characteristics, and D is determined according to the fault type and the actuator states. By formulating Equation (34), actuator limitations and rudder faults are considered as constraints.
Sensors 2020, 20, x FOR PEER REVIEW 16 of 28 scheme including fault detection is presented in Figure 10, where the DIFC, the normal command transformation, the fault detection and the fault-tolerant command transformation are integrated together. In addition, a selector switch is used for selection of transformation methods depending on the rudder health. Distinguished from traditional fault-tolerant control, modification of dynamics controller is avoided since the fault-tolerant control problem is addressed in command transformation by using the non-linear programming (NLP). Before formulating the programming problem, one can assume that r  and s  are the actual control efforts derived as: where the configuration matrix B is given as: where minimization of allocation errors and control inputs are considered as criterions. In Equation  The optimization problem formulated by Equation (33) and Equation (34) is a common constrained non-linear programming problem and there exist many reliable iterative algorithms [39]. Taking the calculation performance of the onboard system into consideration, the fixed-point iteration method is applied. According to the contraction mapping theorem presented in [40], an iteration formula for calculating the actuator's control inputs u at time t is designed as: where H = (1 − ξ)B T WB + ξI 4×4 , ω = 1/ H 2 , and the definition of sat is given as: The iteration is terminated when where J end is an adjustable threshold. By utilizing iteration formula in Equation (35) to solve the NLP presented by Equation (33) and Equation (34), a feasible set of commands for functional rudders can be obtained and its effect can yield to δ r and δ s as close as possible. In other words, fault-tolerant control is realized.

Remark 2.
Though the xAUV with rudder faults can maintain the maneuverability by NLP-based fault-tolerant command transformation, its ability to turn or pitch is degraded and limited in fact.

Numerical Simulation
In this subsection, numerical simulations will be conducted to compare the proposed DIFC to PID and Linear Quadratic Regulator (LQR) in terms of accuracy and adaptation to the surge velocity.
In the simulation, the simulated vehicle is required to approach the desired heading and depth under four different surge velocity respectively and the results will be used for performance analysis. During all the simulation scenarios, the initial heading and depth are ψ 0 = 0, z 0 = 0, and the desired states are ψ d = 90 • , z d = 5m. Control parameters of the three control methods are presented in Table 2. For LQR, G 1 is defined as the input gain, and G 2 is the feedback gain. For PID, k p is the proportional gain, k i is the integration gain, and k d is the differential gain.

DIFC
Heading Control The first scenario contains a heading and depth tracking situation under a cruising speed of 3 kn and the results are shown in Figure 11. The heading control results are nearly the same. The actual course is approaching to 90 • gradually and tends to stabilize after 20 s, which indicates that the heading control is satisfactory for DIFC, LQR and PID. However, the depth control results are different. Depth control by DIFC is smoother than with the others, while LQR behaves more rapidly but with slight fluctuations, and PID is accompanied by small overshoot. Therefore, it can be concluded that the DIFC helps to achieve smooth control of heading and depth, which is consistent with the functionality of tanh function. Simulation results under lower velocity (2 kn) and higher velocity (4 kn, 6 kn) are presented in Figure 12. According to the left three figures, it can be seen that the results under different velocities are nearly the same, which indicates that the surge velocity has little effect on the heading control for any of the methods. Depth control behaves differently under different velocity and this can be found in right three figures. It is obvious that the surge velocity has an effect on depth approaching speed. The slower the velocity is, the slower the depth approaches. In addition, overshoot varies obviously with the velocity in LQR and PID, while there is nearly no overshoot in DIFC and the depth control remain steady all the time. This demonstrates that DIFC has better adaptation to surge velocity comparing to LQR and PID in depth control.

Depth Control
By conducting the simulations, it can be concluded that DIFC can achieve more smooth heading and depth control than LQR and PID, and has better adaptation to surge velocity, which means parameter tuning for different velocity may be avoided.
In addition, overshoot varies obviously with the velocity in LQR and PID, while there is nearly no overshoot in DIFC and the depth control remain steady all the time. This demonstrates that DIFC has better adaptation to surge velocity comparing to LQR and PID in depth control.
By conducting the simulations, it can be concluded that DIFC can achieve more smooth heading and depth control than LQR and PID, and has better adaptation to surge velocity, which means parameter tuning for different velocity may be avoided.

Dynamics Control Performance Test
In this subsection, the performance of the proposed DIFC is verified by conducting heading and depth keeping trials in a towing tank which is 170 m × 7 m × 4 m (length × width × depth). The assigned task for this xAUV is to keep sailing from west to east at a depth of 2 m. The whole test voyage can be divided into three stages. In the first stage, the xAUV needs to dive with constant stern rudder angles until the depth approaches 1 m for a smooth dive and safety. At the second stage, the DIFC depth controller will be put into use and the xAUV keeps sailing at a depth of 2 m. In the third stage, the xAUV will float up with constant stern rudder angles when the preset time condition is

Dynamics Control Performance Test
In this subsection, the performance of the proposed DIFC is verified by conducting heading and depth keeping trials in a towing tank which is 170 m × 7 m × 4 m (length × width × depth). The assigned task for this xAUV is to keep sailing from west to east at a depth of 2 m. The whole test voyage can be divided into three stages. In the first stage, the xAUV needs to dive with constant stern rudder angles until the depth approaches 1 m for a smooth dive and safety. At the second stage, the DIFC depth controller will be put into use and the xAUV keeps sailing at a depth of 2 m. In the third stage, the xAUV will float up with constant stern rudder angles when the preset time condition is satisfied. During the whole voyage, the DIFC heading controller is operating all the time. The experimental scene is shown in Figure 13, where the xAUV is sailing at 2 m.
Sensors 2020, 20, x FOR PEER REVIEW 20 of 28 migrates to the second dive stage where depth control by DIFC is activated, and this ends at 6445 s. After that, the xAUV begins to float up with stern rudder deflection of -5° until it comes to the surface. An obvious change of virtual rudder angles can be found only when stage transition occurs. Except that, the variance is a slow-moving thing which reveals the advantage of increment control. The actuator's control inputs after command transformation are presented in Figure 18. It can be seen that the actuator's control inputs    and 4  . Thus, a meaningful find can be obtained that the diagonal rudders are always supposed to deflect in the same direction in normal condition. In this way, the resultant rolling torque can be reduced to its minimum which is necessary for precise heading and depth control, since roll motion will make this control problem more difficult.    The heading and depth tracking results are shown in Figures 14 and 15. It can be seen that the proposed DIFC controller can regulate the xAUV to the desired heading and depth, but there is minor fluctuation in the process. Basing on the results, it is unjust to conclude that the control performance of DIFC is awkward, because the surge velocity is 2 kn and the rudder effect is too weak to stabilize both heading and depth for the xAUV weighed over 235 kg. Therefore, it is reasonable that the xAUV can't track the desired depth and heading with high accuracy at this relatively low velocity. Unfortunately, tests at higher velocity are prohibited in this towing tank for safety, but according to the simulation results, it should be supposed that a better control performance can be expected if the velocity is increased. Errors in every loop of DIFC are shown in Figure 16. Since the DIFC only operates at the second stage, errors between 6400 s and 6445 s should be used for analysis. In this period, the errors are fluctuating around zero which verifies the convergence of every control loop.
Sensors 2020, 20, x FOR PEER REVIEW 20 of 28 migrates to the second dive stage where depth control by DIFC is activated, and this ends at 6445 s. After that, the xAUV begins to float up with stern rudder deflection of -5° until it comes to the surface. An obvious change of virtual rudder angles can be found only when stage transition occurs. Except that, the variance is a slow-moving thing which reveals the advantage of increment control. The actuator's control inputs after command transformation are presented in Figure 18. It can be seen that the actuator's control inputs    and 4  . Thus, a meaningful find can be obtained that the diagonal rudders are always supposed to deflect in the same direction in normal condition. In this way, the resultant rolling torque can be reduced to its minimum which is necessary for precise heading and depth control, since roll motion will make this control problem more difficult.        The virtual rudder commands produced by DIFC are shown in Figure 17. Between 6375 s and 6400 s, the xAUV is in the first dive stage and the stern rudder's deflection δ s is 5 • . Then the xAUV migrates to the second dive stage where depth control by DIFC is activated, and this ends at 6445 s. After that, the xAUV begins to float up with stern rudder deflection of -5 • until it comes to the surface. An obvious change of virtual rudder angles can be found only when stage transition occurs. Except that, the variance is a slow-moving thing which reveals the advantage of increment control. The actuator's control inputs after command transformation are presented in Figure 18. It can be seen that the actuator's control inputs δ i (i = 1, 2, 3, 4) are changing with δ s simultaneously. By further analyzing the command transformation results, it can be obtained that δ 1 and δ 3 are always the same, so dose δ 2 and δ 4 . Thus, a meaningful find can be obtained that the diagonal rudders are always supposed to deflect in the same direction in normal condition. In this way, the resultant rolling torque can be reduced to its minimum which is necessary for precise heading and depth control, since roll motion will make this control problem more difficult.

Fault Detection Test
In this subsection, three cases relating to different faults are carried out in order to verify the proposed fault detection method, and the simulated fault is control surface damage which will result in rudder effect deduction. For modelling this fault, the effectiveness factor  is introduced to characterize the fault degree. Since it is improper to destroy the control surface intentionally for conducting the tests, a simulated method is adopted that the real control inputs  to the actuators

Fault Detection Test
In this subsection, three cases relating to different faults are carried out in order to verify the proposed fault detection method, and the simulated fault is control surface damage which will result in rudder effect deduction. For modelling this fault, the effectiveness factor  is introduced to characterize the fault degree. Since it is improper to destroy the control surface intentionally for conducting the tests, a simulated method is adopted that the real control inputs  to the actuators Figure 18. The actuator's control inputs derived from normal command transformation.

Fault Detection Test
In this subsection, three cases relating to different faults are carried out in order to verify the proposed fault detection method, and the simulated fault is control surface damage which will result in rudder effect deduction. For modelling this fault, the effectiveness factor η is introduced to characterize the fault degree. Since it is improper to destroy the control surface intentionally for conducting the tests, a simulated method is adopted that the real control inputsδ to the actuators are obtained by multiplying the commands δ = δ 1 δ 2 δ 3 δ 4 T calculated by normal command transformation and the effectiveness factor η, but the onboard control system and fault detection program still take δ as the executed commands deliberately. The detailed cases are as follows: where • means the Hadamard product. The fault detection results and the estimation of rudder effect deduction ∆û are presented in Figures 19-21. In all figures, the moment of fault being triggered can be captured when the actual deduction begins to deviate from zero. In addition, changes of actual deduction mean changes of virtual rudder angles. If the actual deduction keeps constant, one can determine that the virtual rudder angles are also fixed. As is shown in these figures, the estimated deductions are following the actual deductions properly when the virtual rudder angles are changing, for instance, 6375-6450 s in Figure 19, 5890-5920 s in Figure 20, and 5790-5860 s in Figure 21. After the virtual rudder angles stabilize, the actual and estimated deductions approach to the same constant value finally, for example 6450-6500 s in Figure 19, 5920-5939 s in Figure 20, and 5860-5900 s in Figure 21. In summary, the results indicate that the proposed fault detection method can achieve a good estimation of rudder effect deduction with reasonable errors. However, time lag and estimation errors are existent. This is a common phenomenon in the state estimation process and it can be improved by increasing the gains in the filters. In practice, this is a trade-off problem between update rate and system robustness. Usually, the greater the gains are, the faster the update rate is, but the worse the robustness becomes, or vice versa. In terms of this xAUV, slow update rate has no effect on the fault detection results, because the faults are usually irreversible once it happened and it is certain that the faults can be detected finally.
constant, one can determine that the virtual rudder angles are also fixed. As is shown in these figures, the estimated deductions are following the actual deductions properly when the virtual rudder angles are changing, for instance, 6375-6450 s in Figure 19, 5890-5920 s in Figure 20, and 5790-5860 s in Figure 21. After the virtual rudder angles stabilize, the actual and estimated deductions approach to the same constant value finally, for example 6450-6500 s in Figure 19, 5920-5939 s in Figure 20, and 5860-5900 s in Figure 21. In summary, the results indicate that the proposed fault detection method can achieve a good estimation of rudder effect deduction with reasonable errors. However, time lag and estimation errors are existent. This is a common phenomenon in the state estimation process and it can be improved by increasing the gains in the filters. In practice, this is a trade-off problem between update rate and system robustness. Usually, the greater the gains are, the faster the update rate is, but the worse the robustness becomes, or vice versa. In terms of this xAUV, slow update rate has no effect on the fault detection results, because the faults are usually irreversible once it happened and it is certain that the faults can be detected finally.    Besides, poor estimation accuracy is also acceptable because a threshold is adopted over which the fault can be determined then. In other words, minor estimation errors won't reverse the fault detection results. From the point view of robustness, smaller gains are beneficial to decrease the misdiagnoses. Based on the above analysis, it can be concluded that the proposed detection method has acceptable observation ability of rudder effect deduction, thus leading to the accomplishment of diagnosis of rudder faults.  Besides, poor estimation accuracy is also acceptable because a threshold is adopted over which the fault can be determined then. In other words, minor estimation errors won't reverse the fault detection results. From the point view of robustness, smaller gains are beneficial to decrease the misdiagnoses. Based on the above analysis, it can be concluded that the proposed detection method has acceptable observation ability of rudder effect deduction, thus leading to the accomplishment of diagnosis of rudder faults.

Fault-Tolerant Control Test
Rudder jam is another type of fault which directly affects maneuverability and may bring great danger to the xAUV. In order to verify the robustness of the NLP-based fault-tolerant control proposed in this paper, tests against rudder jam will be carried out in this subsection. The rudder jam settings are listed in Table 3. As for cases 4-6, the tasks assigned to the xAUV are the same as described in Section 5.1.

Fault-Tolerant Control Test
Rudder jam is another type of fault which directly affects maneuverability and may bring great danger to the xAUV. In order to verify the robustness of the NLP-based fault-tolerant control proposed in this paper, tests against rudder jam will be carried out in this subsection. The rudder jam settings are listed in Table 3. As for cases 4-6, the tasks assigned to the xAUV are the same as described in Section 5.1. The depth and heading control results are shown in Figure 22. It can be seen in general that the NLP-based fault-tolerant control method can regulate the xAUV to the desired depth and heading no matter what the stuck angle is. However, there are also oscillations as shown in Section 5.1 and the reasons are the same. What's more, the oscillations become more violent as the stuck angle increases. In other words, the tracking performance tends to degenerate with the stuck angle increases for the reason that the stuck rudder is likely to produce undesirable roll torque and have negative effects on the control process. Results of NLP-based command transformation are presented in Figure 23. By analyzing the relationship of every rudder's command, a new rudder transformation pattern can be found in which δ 1 ≈ δ 2 and δ 3 ≈ δ 4 , and this is distinguished from the pattern in Section 5.1. After further analyses, the essence of NLP-based fault tolerant control can be found and it can be summarized that δ 2 is used for compensation of negative effects produced by δ 1 , and depth adjustment is achieved by δ 3 and δ 4 if rudder 1 gets stuck. The roll angle of the xAUV during the tests is presented in Figure 24. It shows that the roll is relatively small and will not make negative effect on the dynamics control. This verifies that the NLP-based rudder transformation method has minimized the negative effect due to rudder jam by coordinating other operational rudders properly. Basing on the above analyses, the proposed NLP-based command transformation has been demonstrated valid in realizing fault-tolerant control with rudder faults.
it can be summarized that 2  is used for compensation of negative effects produced by 1  , and depth adjustment is achieved by 3  and 4  if rudder 1 gets stuck. The roll angle of the xAUV during the tests is presented in Figure 24. It shows that the roll is relatively small and will not make negative effect on the dynamics control. This verifies that the NLP-based rudder transformation method has minimized the negative effect due to rudder jam by coordinating other operational rudders properly. Basing on the above analyses, the proposed NLP-based command transformation has been demonstrated valid in realizing fault-tolerant control with rudder faults.

Conclusions
This paper addressed the fault-tolerant control problem of X-rudder underwater vehicles under circumstances such as rudder jams, control surface damage, etc. Aiming at solving this problem, a fault-tolerant steering prototype system is designed and its performance is validated by many simulations and field tests. In this prototype system, the monitoring software is developed based on

Conclusions
This paper addressed the fault-tolerant control problem of X-rudder underwater vehicles under circumstances such as rudder jams, control surface damage, etc. Aiming at solving this problem, a fault-tolerant steering prototype system is designed and its performance is validated by many simulations and field tests. In this prototype system, the monitoring software is developed based on Figure 24. Roll angle during heading and depth control with rudder jam. Roll angle in case 4 (top), roll angle in case 5 (middle), and roll angle in case 6 (bottom).

Conclusions
This paper addressed the fault-tolerant control problem of X-rudder underwater vehicles under circumstances such as rudder jams, control surface damage, etc. Aiming at solving this problem, a fault-tolerant steering prototype system is designed and its performance is validated by many simulations and field tests. In this prototype system, the monitoring software is developed based on the factory method, while the onboard software is designed based on FSM. Moreover, dynamics control, command transformation, fault detection and fault-tolerant control are all integrated. DIFC is proposed for dynamics control where actuator limitations are considered and smooth virtual rudder commands are obtained. A normal command transformation is designed based on mapping theory to obtain X-rudder commands from virtual rudder commands. The standard particle filter is optimized by proposal distribution derived from UKF and is used to estimate rudder effect deduction. Then the fault can be determined by analyzing the deduction. As to fault-tolerant control, NLP is utilized for fault-tolerant command transformation. Field tests demonstrated that the proposed fault-tolerant steering prototype system is valid and reliable for X-rudder underwater vehicles both in normal condition and rudder failure condition.
However, sensor noise in reality may have negative effects on the performance of dynamic control by DIFC. Thus, the DIFC method will require smooth estimations and its derivatives of those measurements, such as heading angle, pitch angle, etc. so the performance can be guaranteed. As this paper currently focus on the response of the xAUV to the dynamics control under ideal conditions, a study of sensor uncertainties is beyond the scope. An extension of the work to include such filtering method is highly relevant for future work.
Estimations of the rudder effect deduction are highly relevant to the environmental disturbances. In order to obtain a more precise estimation, we have also described a signal separation method based on Fourier analysis that can extract the deduction caused by rudder faults and the effect of disturbances from the original estimations. A detailed analysis is, however, beyond the scope of this paper and remains a topic for future work.
The achievements related to fault detection and fault tolerant control in this study can also be applied to other vehicles, such as over-actuated underwater vehicles, quadrotors, electric vehicles, etc. Since these vehicles also have many independent actuators, fault tolerant control is feasible. In addition, the mathematic models of onshore vehicles are usually more precise than surface vehicles and underwater vehicles. Therefore, it is likely that the accuracy of fault detection implemented on such onshore vehicles are more satisfactory.
Funding: This research received no external funding.