A liquid engine thrust regulation and safety protection method

Abstract

This invention relates to the field of liquid engine control technology and discloses a method for thrust regulation and safety protection of a liquid engine. The process includes acquiring the actual measured value vector of the engine, calculating the posterior state estimation vector using an extended Kalman filter algorithm, obtaining the theoretical predicted output vector through a linear time-varying model predictive control model, calculating the optimal control increment, and outputting the solution state of the model. Next, the dynamic safety threshold is adaptively updated based on the noise standard deviation and standardized residuals to generate tiered protection commands. Finally, based on the solution state and tiered protection commands, the final effective control command is generated according to the safety priority principle. This invention can adjust the valve opening in advance based on future target commands, solving the technical defects of existing liquid engines such as insufficient stability and unsuitable protection strategies during large-range thrust regulation, and achieving highly robust large-range thrust regulation and predictive safety protection.

Description

Technical Field

[0001] This invention belongs to the field of engine control technology, specifically relating to a method for thrust regulation and safety protection of a liquid engine. Background Technology

[0002] Liquid engines (such as aero gas turbine engines and liquid-fueled internal combustion engines) are core components of various transportation and power systems, and their thrust regulation performance directly affects the system's operating efficiency, power response, and mission adaptability. With the increasing demands of modern power systems for variable operating conditions, high dynamic response, and complex operating envelopes, higher thrust control requirements are being placed on engines, including: a wider thrust regulation range, faster response speed, higher stability, and stronger environmental adaptability.

[0003] Current liquid engines generally employ throttle valve or turbopump speed control to achieve thrust regulation. These control methods are mostly based on traditional proportional-integral-derivative (PID) control or feedback control strategies using fixed-parameter linear models. While these methods can meet basic requirements for narrow-range thrust regulation, they are prone to problems such as regulation lag, large overshoot, and insufficient stability when facing wide-range thrust variations, rapid dynamic responses, and highly nonlinear operating conditions. Furthermore, the thrust regulation process is influenced by multiple factors, including combustion chamber pressure, medium ratio, valve opening characteristics, propellant temperature, and flow rate coupling. The nonlinearity, time-varying nature, and multivariable coupling characteristics of the controlled object are significant, making it difficult for traditional control methods to maintain stability and effectiveness in large-range thrust regulation scenarios.

[0004] On the other hand, during a wide range of thrust adjustments, the operating states of various sub-components (including valves, pumps, injectors, etc.) change rapidly, and pressure and temperature distributions fluctuate dramatically. This makes the system more susceptible to disturbances, vibrations, thermal coupling changes, and sensor errors. In extreme cases, risks such as excessive thrust deviation, unstable combustion, and operational drift may occur. Existing fault detection and protection mechanisms typically rely on fixed thresholds. When the engine is in different thrust ranges or flight phases, these fixed thresholds cannot accurately reflect the system's instantaneous safety boundaries, potentially leading to overly conservative protection strategies or even misjudgments or missed detections.

[0005] Although some studies have attempted to improve thrust regulation performance using advanced methods such as model predictive control, fuzzy control, and neural network control, they are often limited to fixed operating conditions or small-range thrust regulation, and do not adequately consider the dynamic characteristics of the engine's full thrust envelope. At the same time, existing studies generally lack a unified design and coordinated optimization of thrust regulation control and safety protection mechanisms, and cannot achieve simultaneous enhancement of thrust control and safety protection. Summary of the Invention

[0006] The technical problem to be solved by the present invention is to provide a method for thrust regulation and safety protection of liquid engines, which can realize dynamic adjustment of engine thrust by introducing linear time-varying model predictive control (LTV-MPC) algorithm and multi-source signal fusion technology.

[0007] To address the aforementioned technical problems, this invention provides a method for thrust control and safety protection of a liquid engine, comprising repeatedly executing the following steps within a preset sampling period during engine operation:

[0008] S1. Collect the raw multi-source signal data of the engine, and use the preprocessed data as the vector of actual measurement values;

[0009] S2. Calculate the posterior state estimation vector based on the extended Kalman filter algorithm and the actual measurement value vector;

[0010] S3. Based on the posterior state estimation vector, the theoretical predicted output vector is obtained through the linear time-varying model predictive control model, and then the optimal control increment is calculated, and the solution state of the linear time-varying model predictive control model is output.

[0011] S4. Calculate the noise standard deviation based on the actual measured value vector, calculate the standardized residual based on the theoretical predicted output vector, and then adaptively update the dynamic safety threshold based on the noise standard deviation and the standardized residual.

[0012] S5. Based on standardized residuals and dynamic safety thresholds, anomaly detection is performed, and graded protection instructions are generated.

[0013] S6. Based on the solution status and hierarchical protection instructions, generate the final effective control instructions with the safety priority principle to drive the actuator to adjust the fuel medium flow.

[0014] As an improvement to the liquid engine thrust control and safety protection method of the present invention:

[0015] The preprocessing includes: low-pass and band-stop filtering for noise reduction, calibration compensation, outlier removal, timing synchronization, analog-to-digital conversion, and dimensionless normalization to obtain a vector of actual measured values ​​with consistent timing.

[0016] As a further improvement to the liquid engine thrust control and safety protection method of the present invention:

[0017] The linear time-varying model predictive control model in step S3 includes:

[0018] Linearized state equations:

[0019] Linearized output equation:

[0020] in, Indicates the current time; i is the prediction step size; Let be the discrete state transition matrix at time k. This is the discrete control input matrix at time k. Let be the discrete output matrix at time k. Represents the posterior state estimation vector; This represents the theoretically predicted output vector.

[0021] As a further improvement to the liquid engine thrust control and safety protection method of the present invention:

[0022] The calculation process of the optimal control increment, theoretical predicted output vector, and solution state in step S3 includes:

[0023] The theoretically predicted output vector within the control horizon is used as the optimal control sequence. Then, based on the constraints, a fast quadratic programming solver is used to find the optimal control increment sequence that minimizes the objective function. If the optimal solution is found within a preset second time window threshold, the solution status is output as "successful" and the solution time is recorded. The first component of the optimal control increment sequence is extracted as the optimal control increment. If the computation time exceeds the second time window threshold or there is no mathematical solution under the current constraints, the output solution status is "failed".

[0024] As a further improvement to the liquid engine thrust control and safety protection method of the present invention:

[0025] The objective function is:

[0026]

[0027] in, The desired target instruction is given; Q is the error weighting matrix. Indicates a control sequence. ; To control the amount of change in instructions, R is the control weighting matrix; is the quadratic norm / squared; Nc is the control horizon; Np is the predicted horizon;

[0028] The objective function is constrained based on constraints, including control amplitude constraints corresponding to the physical travel limit of the actuator and rate constraints corresponding to the physical response speed limit.

[0029] As a further improvement to the liquid engine thrust control and safety protection method of the present invention:

[0030] The dynamic security threshold update operation in step S4 includes: calculating the first dynamic threshold and the second dynamic threshold respectively, and taking the first dynamic threshold. Second dynamic threshold The maximum value in is used as the dynamic security threshold. ;

[0031] The formula for the first dynamic threshold is:

[0032] when hour,

[0033] when hour,

[0034] in, This is the trend sensitivity coefficient. Based on the basic security threshold, The standardized residual of the s-th sensor The rate of change;

[0035] The formula for the second dynamic threshold is:

[0036]

[0037] in, Let be the noise standard deviation of the s-th sensor. Let be the normal noise standard deviation of the s-th sensor. This is for adjusting the coefficient.

[0038] As a further improvement to the liquid engine thrust control and safety protection method of the present invention:

[0039] The dimensions for anomaly determination in step S5 include the comprehensive anomaly index. and standardized residuals Among them, the comprehensive anomaly index The standardized residuals of each physical quantity are multiplied by their corresponding preset weighting coefficients and then summed.

[0040] The method for generating the hierarchical protection instructions is as follows:

[0041] (1) If ,and The generated graded protection instruction is "normal", among which, This indicates the preset overall system risk warning threshold;

[0042] (2) If And the duration exceeds the third time window threshold. ,or The generated hierarchical protection instruction is "Level 1 Protection";

[0043] (3) If And the duration exceeds the third time window threshold. ,or The generated hierarchical protection instruction is "Level 2 Protection";

[0044] (4) If And the duration exceeds the third time window threshold. If the combustion chamber pressure measurement exceeds the overpressure limit for structural rupture, or the pump / motor speed measurement exceeds the overspeed limit for rotor disintegration, or the temperature measurement of a critical component exceeds the overtemperature limit for material melting, the generated protection instruction will be "Level 3 Protection".

[0045] As a further improvement to the liquid engine thrust control and safety protection method of the present invention:

[0046] The final method for generating effective control commands is as follows:

[0047] (1) If the hierarchical protection instruction is "normal" and the solution status is "successful", the effective control instruction is:

[0048]

[0049] (2) If the hierarchical protection instruction is "Level 1 protection", and the solution status is "successful", and the solution time is... If the first time window threshold is reached, then the diagonal elements of the control weighting matrix R in the objective function are increased, and the optimal control increment is recalculated. Then generate valid control commands:

[0050]

[0051] (3) If the hierarchical protection instruction is "Level 1 protection", and the solution status is "successful", and the first time window threshold is less than the solution time. Then, for the second time window threshold:

[0052]

[0053] (4) If the graded protection instruction is "Level 2 protection", then:

[0054]

[0055] in, This represents the upper limit of the absolute opening of the valve.

[0056] (5) If the graded protection instruction is "level three protection", the power supply to the servo valve shall be cut off immediately, and the valve closing sequence of the pyrotechnic product shall be triggered to perform a safety cut-off.

[0057] (6) If the solution status is "failed", then switch to the proportional-integral-differential method.

[0058] The beneficial effects of this invention are mainly reflected in:

[0059] 1. This invention introduces the Linear Time-Varying Model Predictive Control (LTV-MPC) algorithm into the thrust regulation system of a liquid engine, establishing a predictive control framework centered on a real-time linearized model. The system integrates multi-source information such as combustion chamber pressure, fuel flow rate, and valve opening to update the linearized model parameters in real time. It then uses rolling optimization to solve for the optimal control sequence, achieving high-precision thrust prediction and dynamic regulation. Compared to traditional PID or fixed model control methods, the LTV-MPC model control framework of this invention maintains closed-loop stability under complex, nonlinear, and highly dynamic operating conditions; it can adjust valve opening in advance based on future target reference commands before thrust errors occur; and through a fast quadratic programming (QP) solver and a timeout backoff strategy, it ensures real-time operation within a 5 ms sampling period.

[0060] 2. This invention proposes a dynamic threshold adaptive and hierarchical predictive protection mechanism outside the control layer, realizing the integration of thrust regulation control and safety protection. The system calculates the control prediction residual and its changing trend, judges potential abnormal trends in real time, and dynamically adjusts the protection threshold. When the prediction residual exceeds the dynamic threshold, the system automatically triggers hierarchical protection logic (such as amplitude limiting control, degraded operation, or safe shutdown), intervening in advance before the control layer becomes unstable. Compared with the passive protection method using fixed protection limits in existing technologies, the dynamic threshold mechanism of this invention has adaptive and predictive characteristics, enabling automatic adjustment of the protection threshold under different operating conditions, realizing the transformation from "passive protection" to "active predictive protection."

[0061] 3. This invention addresses the technical shortcomings of existing liquid engines during wide-range thrust adjustment, such as large overshoot, insufficient stability, and inadequate protection strategies. By introducing linear time-varying model predictive control, multi-source state fusion, dynamic threshold adaptation, and a hierarchical protection mechanism, this invention achieves high-precision, highly robust wide-range thrust control and predictive safety protection. Attached Figure Description

[0062] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0063] Figure 1 This is a schematic flowchart of a method for thrust control and safety protection of a liquid engine according to the present invention. Detailed Implementation

[0064] The present invention will be further described below with reference to specific embodiments, but the scope of protection of the present invention is not limited thereto:

[0065] Example 1: A method for thrust control and safety protection of a liquid engine, the process is as follows: Figure 1 As shown, specifically:

[0066] Step 1: Multi-source signal acquisition and preprocessing

[0067] Real-time raw physical quantity signals are collected by a distributed sensor array deployed at key parts of the engine as the raw multi-source signal data processed by this invention. These include physical quantity data such as thrust, combustion chamber pressure, first medium flow rate, second medium flow rate, control valve opening / displacement, key component temperature, servo motor current, servo motor voltage, and pump / motor speed. In this embodiment, the first medium is preferably liquid fuel, and the second medium is preferably an oxidizer, diluent, or a second fuel source. In addition, engine control timing signals (such as ignition timing T0, emergency shutdown command, preset thrust variation time point, etc.) are also collected synchronously to determine the operating point reference of the linear time-varying model predictive control (LTV-MPC) model. High-frequency, real-time synchronous acquisition ensures coverage of the dynamic response characteristics of the engine under all operating conditions.

[0068] The acquired raw multi-source signal data is then preprocessed as follows to obtain high-quality engine operating data and eliminate environmental noise interference. Preprocessing includes denoising (low-pass and band-stop filtering), calibration compensation, and outlier removal for each sensor channel signal:

[0069] (1) Noise reduction (filtering) processing

[0070] Low-pass filters were used to suppress high-frequency noise in the raw multi-source signal data from each sensor channel. Given that the rate of change of signals in each channel inside the engine is typically on the order of milliseconds, while interference components such as mechanical vibration are mostly concentrated in the higher frequency band, low-pass filtering can effectively preserve the true dynamic trend and eliminate irrelevant high-frequency disturbances.

[0071] By applying band-stop filters, periodic interference in specific frequency bands, such as 50 Hz power frequency interference or narrowband noise caused by structural resonance, can be eliminated, achieving precise suppression of known interference sources.

[0072] (2) Calibration compensation

[0073] Considering the potential zero-point drift or sensitivity shift that may occur in sensors under non-standard operating conditions such as high or low temperatures, error correction is performed on the multi-source signals of each channel after noise reduction to restore their measurement accuracy. For example, based on the current temperature environment parameters, a preset sensor calibration curve or lookup table is invoked to compensate for the zero-point drift caused by temperature changes, thereby correcting the measurement error.

[0074] (3) Outlier detection and removal

[0075] The amplitude logic is used to judge the multi-source signals after calibration and compensation. When the signal value is detected to exceed the preset physical limit range (such as the pressure becoming negative instantly, or exceeding the range to infinity, etc.), the value is determined to be a fault glitch or invalid data and is removed from the data stream to prevent instantaneous faults or communication glitch from misleading the control system.

[0076] (4) Timing synchronization

[0077] After outlier removal, multi-source signals undergo time-axis alignment to eliminate delay errors caused by differences in transmission paths or processing speeds between different signal channels. Each frame of data is precisely time-stamped using timestamps or soft-time alignment algorithms, ensuring that different physical quantities (such as fuel flow rate and combustion chamber pressure) correspond to the same physical moment, thus guaranteeing the temporal consistency of multi-source data in causal logic.

[0078] (5) Modular-to-digital conversion processing

[0079] The time-synchronized analog signal (such as 0–5 V voltage) is converted into a discrete digital signal (such as 0–4096) by an analog-to-digital converter (ADC) to form a standardized digital output, which is convenient for subsequent computing units to process.

[0080] (6) Data normalization processing

[0081] The digital signal after analog-to-digital conversion is processed to remove dimensions, mapping each dimension of data to the [0, 1] interval to eliminate the dimensional differences between different physical quantities. For example, the unit of pressure is MPa (megapascal), the unit of flow rate is kg / s (kilograms per second), and the valve position is % (percentage). These three physical quantities need to be normalized before further calculation and comparison.

[0082] After preprocessing, the original physical quantity signals are used to construct a vector of actual measured values ​​of a set of time-consistent, noise-controllable, and physically reliable multi-source synchronous digital signals. Actual measured value vector The actual measurement components of each sensor are set as follows: 's' represents the sensor channel index, which in this embodiment includes the thrust measurement value F and the combustion chamber pressure measurement value. First medium flow measurement value Second medium flow measurement value First medium valve opening / displacement feedback measurement value Second medium valve opening / displacement feedback measurement value The temperature measurement value T of key components, the current measurement value I of servo motor, the voltage measurement value V of servo motor, and the speed measurement value n of pump / motor are used as inputs for subsequent operations.

[0083] Step 2: System State Estimation Based on Extended Kalman Filter (EKF)

[0084] 2.1 Operating Condition Identification

[0085] Based on engine control timing signals (such as ignition timing T0, emergency shutdown command, preset thrust change timing, etc.) and multi-source synchronous digital signals, the current operating condition of the engine is determined: the starting phase is after the engine control system receives the ignition command, the combustion chamber pressure measurement value... The process from zero pressure to the preset primary stage operating threshold (e.g., 90% of rated pressure); the steady-state operation phase is when the combustion chamber pressure measurement value... During the period when the system is stable above the main operating threshold and no shutdown command is received, the controller dynamically adjusts the valve opening according to the thrust adjustment command. The shutdown phase is determined when the system receives a normal shutdown command or an emergency cutoff signal.

[0086] 2.2 System State Estimation

[0087] Using actual measured value vectors Combining the system state estimation vector from the previous moment with the input vector of the control command, the system state at the current moment is estimated based on the Extended Kalman Filter (EKF). The EKF execution flow is as follows:

[0088] (a) Forecast (time update):

[0089] Nonlinear state equations: (1)

[0090] in, Represented as the current control command input vector, the function It is a nonlinear state transition function. This represents the current state estimate vector before correction, indicated by the superscript minus sign. This represents the prediction before correction, and is called the prior state estimation vector. The corrected state estimate vector at the current time is called the posterior state estimate vector at the current time.

[0091] The state equation is used to estimate the posterior state vector from the previous time step. and the control commands from the previous moment Based on nonlinear state transition function Calculate the prior state estimation vector at the current time. .

[0092] (b) Calculation of theoretical observations

[0093] Observation equation: (2)

[0094] Using the observation equation, the prior state estimation vector at the current time is obtained. Through observation function Mapped to the theoretically predicted output vector at the current time step .

[0095] (c) Calibration (measurement update):

[0096] Calculate the theoretical prediction output vector at the current time. vector of actual measured values The residuals between them, and at the same time, using the preset measurement noise covariance matrix (this matrix characterizes the random observation noise in the observation equation) The Kalman gain is calculated using the inherent statistical properties of the vector, and then this gain is used to estimate the prior state vector at the current time. After weighted correction, the posterior state estimation vector at the current time is finally obtained. , used as the initial operating point for linear time-varying model predictive control (LTV-MPC).

[0097] Step 3: Linear Time-Varied Model Predictive Control (LTV-MPC) Model

[0098] Traditional PID control adjusts based on the current error, while the linear time-varying model predictive control (LTV-MPC) model used in this invention has predictive performance and adaptability for the future (real-time model update). Within a millisecond sampling period, it calculates the optimal control command sequence that minimizes the thrust tracking error of the engine in the future prediction time domain and ensures smooth valve action, thereby overcoming nonlinearity and large lag, and achieving accurate thrust prediction and rolling optimization.

[0099] Because liquid engines exhibit strong nonlinearity, their dynamic characteristics change drastically with thrust conditions (for example, valve sensitivity at 30% thrust is completely different from that at 100%). To achieve full envelope control, the system, within each sampling period (Ts=5ms), converts the posterior state estimation vector obtained in step two at the current moment... and the desired target instructions issued by the host computer (master computer) Within the input linear time-varying model predictive control (LTV-MPC) model, iterative predictive control operations are performed to obtain the current control command. .

[0100] 3.1 Constructing a linear time-varying predictive control model

[0101] At the current work point (with the posterior state estimation vector at the current time) and the control command input vector of the previous moment As a benchmark, for nonlinear state transition functions and observation function A first-order Taylor expansion is performed to obtain three Jacobian matrices. These three Jacobian matrices are then used to construct a linear time-varying model predictive control model, linearizing the complex nonlinear engine model at the current operating point. The linear time-varying model predictive control model of this invention is implemented using the idea of ​​a discrete-time linear state-space model, and its form is as follows:

[0102] Linearized state equations: (3)

[0103] Linearized output equation: (4)

[0104] in, This indicates the current time and represents the current system sampling step number (e.g., the 1st, 2nd, etc.).

[0105] i represents the prediction step size, relative to the time step. In the iterative calculation, i takes values ​​ranging from... (Np is the predicted horizon, which is 20 steps in this embodiment);

[0106] The discrete state transition matrix at time k. Derived from the nonlinear state transition function. The Jacobian matrix of the state variables is obtained by discretization, which characterizes the evolution and coupling characteristics of the internal state of the system (such as the influence of flow on pressure) over time step.

[0107] The discrete control input matrix at time k. Derived by the nonlinear state transition function. The Jacobian matrix of the control variables is obtained by discretization and characterizes the influence of the control input (such as valve action) on the system state at the next moment.

[0108] The discrete output matrix at time k. Derived from the observation function. The Jacobian matrix is ​​obtained by taking the state variables and discretizing it, which characterizes how internal state variables (such as flow rate and pressure) are mapped to measurable sensor output values ​​(such as thrust).

[0109] : This indicates that the model extrapolates the future starting from time k. The posterior state estimate vector at time t;

[0110] : This indicates that the model extrapolates the future starting from time k. The theoretical predicted output vector at time step.

[0111] The linear time-varying predictive control model ensures that the control model always fits the current physical characteristics of the engine, solving the problem that traditional fixed-parameter models cannot adapt to a wide range of thrust adjustments.

[0112] 3.2 Prediction and Rolling Mechanism

[0113] Within each independent sampling period (e.g., Ts = 5ms), the system estimates the state based on the latest posterior state vector. Initiate a forward-looking predictive simulation.

[0114] First, the linearized state equations constructed in step 3.1 are used. Fast iterative computation of the internal predicted states (i.e., posterior state estimation vectors) for the next Np time steps (predicting horizon Np=20) Then, the linearized output equation from step 3.1 is used. Map these internal predicted states to a sequence of predicted outputs for the next Np time steps. Then only the predicted output sequence The theoretically predicted output vector within the control horizon (Nc=5) is used as the optimal control sequence. Output. Although this invention predicts the output for the next 20 steps, it only optimizes the degrees of freedom for the control increment sequence within the control horizon. For steps after the control horizon (i.e., steps 6 to 20), the control increment is assumed to be zero. That is, the control instructions in steps 6 to 20 are consistent with the control instructions in step 5. By setting Nc < Np, the dimensionality of the quadratic programming (QP) problem can be significantly reduced while ensuring control performance, thereby ensuring that the 5ms real-time requirement is met on a main control computer with limited computing power.

[0115] 3.3 Constructing the objective function for optimizing the control sequence

[0116] A quadratic performance index J(U) is established as the objective function for optimizing the control sequence. Minimizing the value of J(U) minimizes the prediction error (thrust tracking) and smooths control variable changes (oscillation suppression). The formula for the objective function is:

[0117] (5)

[0118] in,

[0119] This refers to the desired target instruction issued by the host computer.

[0120] The objective function for optimizing the control sequence is: the lower the function value, the better the control effect.

[0121] The control sequence refers to the decision variables for which the objective function is to be solved. It contains a series of future control commands within the control horizon. ;

[0122] ∑: The summation symbol indicates that the error of each future time step is summed up.

[0123] Q: Error weighting matrix, a preset parameter tuning matrix for the controller (pre-set based on engine operating conditions). A larger Q indicates a greater emphasis on error elimination and a faster response from the controller, but may cause overshoot. The aim is to make the predicted thrust as close as possible to the target thrust.

[0124] : Control the amount of change in the command. This indicates the degree of drastic change in valve opening.

[0125] R: Control weighting matrix, which is also a preset parameter tuning matrix for the controller (pre-set according to engine operating conditions). The larger R is, the less the controller will allow the valve to vibrate violently, and the smoother the control process will be, but the response may be slower.

[0126] The quadratic norm / squared represents the square of the value, ensuring that both positive and negative errors are converted into a penalty term on the objective function. It aims to penalize changes in control commands. Dramatic changes. The larger the weight of the R matrix, the smoother the valve action, preventing high-frequency oscillations and protecting the actuator.

[0127] 3.4 Constraint Handling

[0128] The pre-defined constraints for the objective function J(U) of optimizing the control sequence mainly include:

[0129] Control amplitude constraints: This is used to set the upper and lower boundaries of the control commands, corresponding to the physical travel limits of the actuator. In a specific embodiment of the present invention, the lower limit value corresponding to the servo valve opening of a large-range variable thrust engine is preferably set as follows: (Used to reserve a physical dead zone and ensure minimum engine operating and cooling flow), the upper limit value is set to... (Valve fully open);

[0130] Rate constraints: This is used to set the maximum allowable range of change in the control command, corresponding to the physical response speed limit of the actuator. Combined with the 5ms sampling period preset in this invention and the dynamic response characteristics of the servo actuator, this sets the upper limit of the absolute value of the valve action increment within a single period. The preferred setting is 2% to 5% of the full range of the valve (i.e., limiting the maximum swing rate of the valve to 400% / s to 1000% / s).

[0131] This ensures that the optimized control sequence output by the controller strictly meets the physical safety boundaries of the system.

[0132] 3.5 Real-time solution and fault-tolerant mechanism

[0133] First, a Fast Quadratic Programming (Fast QP) solver based on the Active-Set method is used to compute the optimal solution that minimizes the objective function J(U) of the optimized control sequence within a time window shorter than the system's preset second time window threshold (5ms): the optimal control increment sequence. Then, the optimal control increment sequence is extracted. The first component in the equation is used as the optimal control increment. Calculate the current control command .

[0134] To ensure system security, a solver status monitoring module is set up to output the model solution status and solution time for the current period in real time. The solution status includes two states: "success" and "failure".

[0135] Success: The solver finds the optimal solution within the preset second time window threshold (5ms), i.e., the solution time is ≤5ms. The system extracts the first component of the optimal sequence as the optimal control increment. .

[0136] The solution status "failure" is further divided into two cases: timeout and infeasible, specifically defined as follows:

[0137] Timeout: The solver failed to output a result if the calculation time exceeded the preset second time window threshold (5ms). The solution time was >5ms.

[0138] Infeasible: The optimization problem has no mathematical solution under the current constraints. In this case, the solution time is set to infinity.

[0139] The two states of "success" and "failure" and the solution time are set as parameters "input prefix A" and passed to step six. The specific degradation and safety fault tolerance mechanisms will be uniformly handled by step six for logical arbitration and execution.

[0140] Step 4: Adaptive Update of Dynamic Threshold

[0141] Traditional engine protection typically uses fixed threshold values ​​for judgment, such as triggering an alarm when the pressure exceeds 5 MPa. However, during a wide range of thrust variations, the engine's operating conditions change drastically (e.g., from 100% thrust to 20% thrust), and the vibration and noise levels also differ significantly. Using a fixed threshold can easily lead to false alarms during startup or missed alarms in steady-state conditions. Therefore, this invention employs an adaptively updated dynamic threshold method, enabling the protection mechanism to adapt to a wide range of operating conditions and avoiding false alarms.

[0142] The process of dynamic threshold adaptive update is as follows:

[0143] 4.1 Calculate the current noise standard deviation

[0144] Calculate the current noise standard deviation for each sensor based on the actual measurements taken within the most recent sliding window (e.g., the past 50ms). This characterizes the current level of vibration environment. The value can keenly capture the changes in vibration energy of the engine during the variable thrust process, and serve as the reference width for the dynamic threshold.

[0145] (6)

[0146] in, This represents the actual measurement components of each sensor, extracted from the actual measurement value vector in step one. The first in The actual measured values ​​of each sensor; The actual measured components of each sensor within the current window The arithmetic mean. This represents the total number of sampling points, i.e., the total number of sensors. The index is used to backtrack the time steps of the sliding window.

[0147] 4.2 Calculate the standardized residuals

[0148] To allow physical quantities with different units (such as pressure in MPa and flow rate in kg / s) to be evaluated together, it is necessary to calculate the standardized residual between the predicted and measured values ​​of the s-th sensor. Eliminate dimensional differences.

[0149] (7)

[0150] in, The normal noise standard deviation of the s-th sensor measured during the system calibration phase (such as ground testing, bench testing, or factory calibration steady-state conditions). This represents the theoretical predicted output component of the s-th sensor in the linear time-varying model predictive control model. The normal noise standard deviation of each sensor channel is obtained by collecting and statistically calculating data under steady-state conditions during engine ground testing or pre-launch calibration.

[0151] 4.3 Dynamic safety threshold adaptive adjustment:

[0152] The system sets a dimensionless basic safety threshold. (Usually, the pure number 3 to 5 is chosen, corresponding to the allowable occurrence of 3 real physical quantities) ~5 (Standard deviation confidence interval fluctuation). Based on this, this invention achieves fusion by parallel computing of transient trend correction (dynamic strategy A) and steady-state environment adaptation (dynamic strategy B), and finally taking the maximum value of the envelope of the two to obtain the final dynamic safety threshold. .

[0153] The dynamic safety threshold adaptive adjustment method of the present invention first obtains a first dynamic threshold based on the transient trend correction of residual changes (dynamic strategy A). The second dynamic threshold is obtained by steady-state relaxation based on environmental statistical characteristics (dynamic strategy B). Then The final dynamic security threshold is obtained by fusion. .

[0154] (1) Dynamic Strategy A:

[0155] Calculate the rate of change of the standardized residuals: (8)

[0156] when Time (residual convergence): The system is considered to be in a stable or regressing state, and the first dynamic threshold remains at the baseline value.

[0157] (9-1)

[0158] in, The basic safety threshold is set to 3 in this embodiment.

[0159] when When the current standard residual continues to increase compared to the previous moment and the deviation shows a divergent trend, it is considered that the system is in a state of rapid residual change. In order to prevent false triggering of protection due to instantaneous impact during the variable thrust process, the first dynamic threshold is finely adjusted by using the update formula A to follow the residual trend.

[0160] Update Formula A: (9-2)

[0161] Trend sensitivity coefficient It is usually taken as 0.1~0.5.

[0162] By using dynamic strategy A, it is possible to address situations where the error suddenly increases ( In the event of a sudden increase, the safety threshold is temporarily relaxed appropriately to determine whether the system is affected by a transient disturbance or a real fault; if the residual falls back, the safety threshold is quickly restored to the basic value.

[0163] (2) Dynamic Strategy B:

[0164] Based on noise environment adaptation, when the engine is under high vibration conditions (such as during startup or early signs of high-frequency combustion instability), the ambient noise increases. This dynamic strategy does not rely on external operating condition commands for identification, but rather relies purely on the current noise standard deviation calculated in real time in step 4.1. Relax the threshold for data-driven approaches.

[0165] Update Formula B: (10)

[0166] : Adjustment coefficient, with a value range of 0.1~1, and a priority range of 0.2~0.5.

[0167] Relative noise intensity index. The ratio when the current ambient noise does not exceed the baseline. , Maintain as When environmental noise is significantly amplified (ratio) The threshold is linearly and adaptively amplified with the noise ratio, effectively filtering random high-frequency maneuvers.

[0168] (3) Logical integration:

[0169] To ensure that the system does not generate false alarms under any operating conditions, the dynamic safety threshold at the current moment will ultimately take effect. Employing a maximum envelope fusion strategy:

[0170] (11)

[0171] The fusion mechanism clarifies the conditions for use: when faced with high-frequency and drastic changes (dynamic strategy A is dominant) or continuous and strong vibrations (dynamic strategy B is dominant), the system automatically adopts a more lenient safety boundary.

[0172] This design ensures that the system can respond whenever any single strategy deems it necessary to relax the threshold, thereby greatly improving robustness during variable thrust processes.

[0173] Step 5: Multidimensional Anomaly Detection and Hierarchical Predictive Protection

[0174] This step, based on the final dynamic safety threshold and standardized residuals generated in step four, combined with the comprehensive anomaly index, assesses the system's health status in real time. This step is only responsible for defining anomaly boundaries and generating tiered protection instructions; it does not perform any physical control output.

[0175] 5.1 Dimensions of Multidimensional Anomaly Detection

[0176] To avoid false triggering caused by single-point noise, the system's multi-dimensional anomaly detection includes the following two dimensions:

[0177] (1) Judgment Dimension 1: Comprehensive Anomaly Index (for Systemic Gradual Changes)

[0178] Calculate the comprehensive anomaly index Standardized residuals of each physical quantity With the corresponding weights Multiply and sum:

[0179] (12)

[0180] in, The preset weighting coefficients for each sensor are used. For example, in this embodiment, the combustion chamber pressure weight can be set to 0.4, the first medium flow weight to 0.3, and the second medium flow weight to 0.3.

[0181] Set the system's comprehensive risk warning threshold (For example =5.0). If Even if a single sensor does not exceed the limit, the system still faces the risk of systemic deviation.

[0182] (2) Judgment Dimension Two: Standardized Residuals

[0183] Based on any sensor parameter (such as combustion chamber pressure measurement value) in the actual measurement value vector of multi-source synchronous digital signals. Standardized residuals Through standardized residuals Is it greater than the dynamic security threshold? It enables the determination of sudden failures of individual sensors.

[0184] 5.2 Hierarchical Determination and Instruction Generation

[0185] (a) Normal state

[0186] Triggering condition: Standardized residuals of each sensor parameter None exceeded And the comprehensive abnormal index .

[0187] Output status: The system generates a graded protection instruction with the "normal" flag and sends it to step six.

[0188] (ii) Based on the severity of the anomaly, the system generates a corresponding graded protection instruction (this instruction will be sent as a protection flag to step six as a condition input for subsequent logical arbitration):

[0189] (1) Level 1 protection instruction (minor anomaly, early warning / soft intervention):

[0190] The triggering condition is:

[0191] And the duration exceeds the third time window threshold. (e.g., 20ms), or

[0192] Output status: The system generates a "Level 1 Protection" flag as the value of the parameter "Input Prefix B" and sends it to step six.

[0193] (2) Level 2 protection instruction (moderate anomaly, limiting / degrading):

[0194] The triggering condition is:

[0195] And the duration exceeds the third time window threshold. ,or

[0196] Output status: The system generates a "Level 2 Protection" flag as the value of the parameter "Input Prefix B" and sends it to step six.

[0197] (3) Level 3 protection command (severe abnormality, emergency shutdown):

[0198] The triggering condition is:

[0199] And the duration exceeds the third time window threshold. Or the combustion chamber pressure measurement value in the actual measurement vector y(k) If any one of the following indicators exceeds a preset hard physical safety limit threshold: pump / motor speed measurement value n, or critical component temperature measurement value T, the protection boundary is defined. This hard physical safety limit threshold is an absolute red line determined by the engine's physical damage boundary, specifically including the vector of actual measured values ​​from step one. The following three core destructive physical quantity limits were selected:

[0200] ① The measured pressure value in the combustion chamber exceeds the overpressure limit for structural rupture ( ;

[0201] ② The pump / motor speed measurement value exceeds the rotor disassembly overspeed limit value ( );

[0202] ③ The temperature measurement value of the key component exceeds the material melting overheat limit value ( .

[0203] Anomalies in other physical quantities (such as flow rate, valve position, and electrical parameters) in step one are all covered and protected by the aforementioned comparison mechanism between standardized residuals and dynamic safety thresholds. For example, in a specific embodiment with a rated thrust of 100 tons, the rated combustion chamber pressure of the engine is 18 MPa, and the rated turbopump speed is 20,000 rpm. To prevent catastrophic physical failures, the preferred setting for the preset hard physical safety limit threshold in the control system is as follows:

[0204] ① Overpressure limit of combustion chamber pressure structure rupture Set to 25 MPa (usually 1.25 to 1.4 times the rated room pressure);

[0205] ② Pump / motor speed, rotor disassembly overspeed limit Set to 23,000 rpm (usually 1.15 times the rated speed);

[0206] ③ Overheating limit of key component materials The temperature is set to 850 °C (based on the melting point of the turbine end face material).

[0207] When the actual measured value of the sensor reaches any of the above specific limit thresholds, the system immediately generates a "Level 3 Protection" flag. Output status: The system generates the "Level 3 Protection" flag as the value of the parameter "Input Prefix B" and sends it to step six.

[0208] Step Six: Arbitration, Verification, and Final Execution of Control Commands

[0209] This step, as the final output stage of the control system, is responsible for logical arbitration and validity verification of various instructions generated in the preceding steps, ensuring that the signals sent to the engine's physical actuators are absolutely safe and reliable.

[0210] Objective: To ensure system fallback safety in the event of controller failure.

[0211] Input prefix A (conventional control): Solution status of the linear time-varying predictive control (LTV-MPC) model (success / failure and solution time from the Fast Quadratic Programming (Fast QP) solver in step three), and the current control command. The calculation results from step three.

[0212] Input prefix B (security protection): from the abnormal judgment status in step five (i.e., "Level 1 protection", "Level 2 protection" or "Level 3 protection" flag).

[0213] The controller generates the final effective control commands based on the "Safety First" principle.

[0214] (1) Case 1 (Normal Mode):

[0215] If the input prefix B is "normal" and the input prefix A is "success", then the final effective control command calculated based on the optimal control increment in step three is directly adopted:

[0216] (13)

[0217] (2) Case 2 (soft intervention / damping enhancement):

[0218] If the input prefix B is marked as "Level 1 Protection", then according to the input prefix A (solver status) returned in step three, either the internal algorithm damping strategy or the external command attenuation strategy will be executed to actively increase control damping to suppress potential oscillations.

[0219] A. Internal algorithm damping strategy:

[0220] The input prefix A (solver status) is "successful," and the solution time for the current step three is within the safety margin. (In this embodiment, the judgment index is set as) The system prioritizes internal algorithm-based damping control, ensuring continuous thrust adjustment by smoothly increasing penalty weights from within the algorithm. The specific operation is as follows:

[0221] Through an online feedback mechanism, the diagonal elements of the control weighting matrix R in the objective function of the optimized control sequence in step three are dynamically increased (for example, increased to twice the original value), thereby internally increasing the penalty for the control increment during the objective function optimization stage. Then, this step no longer performs additional attenuation, and directly adopts the optimal control increment calculated based on the new R matrix as shown in formula (13) to calculate the final effective control command.

[0222] B. External command attenuation strategy:

[0223] The input prefix A represents "success," but the current solution time is approaching the real-time limit, meaning the first time window threshold is less than the solution time. The second time window threshold indicates that significant system state fluctuations increase the difficulty of optimization. The first time window threshold is 3ms, and the second time window threshold is 5ms, meaning the solution time ∈ (3ms, 5ms). To avoid potential timeouts in the next cycle, the system directly performs an external instruction attenuation operation at the physical output, sacrificing some control smoothness for minimal latency hard safety intervention. The specific operation is as follows:

[0224] Keeping the weight parameters of LTV-MPC unchanged in step three, the currently obtained optimal control increment is directly subjected to a fixed-proportion hard decay at the physical output:

[0225] (14)

[0226] To avoid excessive system response delay and thrust loss due to double penalty for control increment, the aforementioned internal algorithm damping strategy or external command attenuation strategy are mutually exclusive independent control paths.

[0227] (3) Scenario 3 (Forced downgrade / limiting):

[0228] If the input prefix B is the "Level 2 Protection" flag, it actively limits the thrust reference command to no more than 80% of the current rated value and forces physical clamping on the control command, limiting the upper limit of the valve opening:

[0229] (15)

[0230] in, This represents the upper limit of the absolute valve opening in the system under degraded safety conditions. This physical quantity is obtained as follows:

[0231] Based on the thrust reduction target set when the "secondary protection" is triggered in step five (i.e., limiting the target thrust to 80% of the current rated value), the engine steady-state operating characteristic data (thrust-valve position mapping lookup table or piecewise fitting curve) pre-stored in the control system is called up. The theoretical servo valve opening value matching the reduced thrust is obtained in real time through back lookup and interpolation, and this value is used as the current... Send to the output end.

[0232] (4) Situation 4 (Emergency Takeover / Shutdown):

[0233] When the system faces extreme physical hazards or the core control algorithm fails for an extended period, the LTV-MPC calculation results should be completely discarded, and safety actions should be strictly performed according to the following priority:

[0234] Protection Measure 1: Input prefix B as the "Level 3 Protection" flag (regardless of the current state of input prefix A), indicating that the engine is facing physical limit risks (such as overpressure, over-speed, etc.). The system immediately cuts off the power supply to the servo valve and triggers the safety shut-off device (such as the pyrotechnic valve) to perform a safety cut-off in the closing sequence.

[0235] Protection Measure Two: If input prefix A is in a "failure" state and input prefix B does not trigger the "Level 3 Protection" flag, it indicates that the failure is only at the prediction algorithm level, and the physical system still has margin. The system does not shut down but smoothly switches to the backup proportional-integral-derivative (PID) control logic, i.e., the target reference command issued by the host computer. Compared with the actual measurement value vector obtained in step one As input, the backup PID controller directly calculates and outputs the final effective control command. To maintain the minimum safe operation of the engine.

[0236] The above arbitration results This is the final, legal, and valid control command. The controller converts it into a drive voltage / current signal for the servo valve via a D / A converter module, driving the physical actuator to regulate the fuel medium flow.

[0237] Step 7: Online self-learning and closed-loop iteration of model parameters

[0238] To overcome the model nonlinear mismatch problem that exists during engine thrust variation, the system introduces an online parameter identification mechanism (System Identification) after completing the current control execution. It uses the operating data of the current cycle to fine-tune the internal mathematical model, thereby achieving the "self-evolution" of the algorithm.

[0239] 7.1 Online fine-tuning of model parameters

[0240] Using the actual measurement vector of this period Compared with the theoretically predicted output vector The residual sequences between them are used to estimate the core matrix parameters (i.e., the state transition matrix) of the linear time-varying model predictive control (LTV-MPC) in step 3.1 using the recursive least squares (RLS) or Kalman filter parameter estimator. and control input matrix Online identification and correction of time-varying elements in the data.

[0241] Objective: To minimize model prediction error so that the corrected model can more accurately describe the dynamic characteristics of the engine near the current operating point, and to ensure that the linear time-varying model predicts the trajectory of the linear time-varying model predictive control (LTV-MPC) model generated at the next time step (k+1) is more accurate.

[0242] 7.2 Closed-loop iteration to the next sampling period

[0243] After completing all the above calculations and executions, the system clock advances to the next sampling time:

[0244]

[0245] The system returns to step one and begins a new round of signal acquisition and processing. The entire control cycle is strictly controlled within a preset time step (e.g., 5ms), repeating continuously until a shutdown command is received.

[0246] experiment:

[0247] 1. Mathematical proof of no lag and overshoot prevention under a wide range of varying operating conditions (analytical comparison of LTV-MPC and PID)

[0248] (1) The lag and overshoot mechanism of traditional PID (causal analysis based on time domain equation)

[0249] The discrete-time analytical expression of a traditional PID control law is:

[0250] (17)

[0251] Wherein, the tracking error e(k) at the current moment = For easier comparison, its single-step control increment is extracted.

[0252] The control output (such as the valve opening command) calculated by a traditional PID controller at the current time k.

[0253] : Proportional coefficient.

[0254] Integral coefficient.

[0255] : Differential coefficient.

[0256] : The desired target instruction issued from outside the host computer.

[0257] y(k): Vector of actual measured values.

[0258] Lag Inevitability: As can be seen from the above equation, PID is a strictly causal system. Controller Output The calculation depends entirely on the errors at the current and historical moments. When a liquid engine experiences large thrust fluctuations, the thrust response always lags behind valve action due to the inherent inertia of the physical system. PID control must wait for the thrust error. Only after the error has occurred and been captured by the sensor can an adjustment command be issued. This "deviation-driven" nature, coupled with physical inertia, inevitably leads to severe phase lag in the system during high-speed thrust changes. The inevitability of overshoot: During large transitions (such as from 100% to 20%), to overcome physical inertia, the integral term of the PID controller... The deviation, if it persists for a long time, will produce a huge cumulative effect (integral saturation). When the actual thrust approaches the target value, the huge integral value will cause the valve to fail to return to its original position in time, which will mathematically inevitably lead to overshoot and oscillation.

[0259] (2) Derivation of the analytical solution for LTV-MPC with no hysteresis and anti-overshoot in this invention

[0260] The quadratic objective function J(U) constructed in this invention is:

[0261] (18)

[0262] Assuming the system is currently operating within a linear region where the valve has not reached its hard physical boundary (i.e., when control constraints are not activated), the objective function can be transformed into an unconstrained quadratic programming problem. Let the partial derivative of the objective function with respect to the control increment sequence be... When the value equals 0, the analytical solution for the optimal control increment sequence can be obtained:

[0263] (19)

[0264] Where H is the dynamic response control matrix of the system. For predicting the free response of the system under zero control increment, A reference trajectory matrix for future targets within the horizon.

[0265] Mathematical proof of no lag: In the above analytical solution, the valve action at the current moment... Directly proportional to the feedforward term This means that as long as the host computer issues the future thrust target trajectory in advance... The controller can calculate the required valve movement amplitude in advance through the prediction matrix before the error occurs, thus completely eliminating the phase lag of traditional feedback control from a mathematical perspective.

[0266] When faced with extreme operating conditions that cause the valve to reach its physical boundary limits, the fast QP solver in step three will force the optimization within the boundary through the effective set method. At this time, the action of the actuator is physically clamped, and the anti-overshoot and anti-runaway characteristics are more stringent.

[0267] Mathematical proof of overshoot prevention:

[0268] The analytical solution contains a penalty term for the inverse matrix. This invention, by reasonably diagonalizing the control increment weight matrix R, and based on the matrix norm inequality, stipulates that as the eigenvalues ​​of R increase, the following holds true. This is a restricted upper bound. This theoretically and strictly guarantees that during the system's convergence towards the target state, the valve's action rate is physically clamped, preventing over-regulation and overshoot oscillations.

[0269] Mathematical proof of significant suppression of hysteresis (phase lead compensation): at each sampling time The controller only extracts The first component As the actual action to be performed. From the analytical solution (19), it can be seen that... Directly proportional to the feedforward term This means that as long as the host computer sends out the future target reference trajectory in advance... LTV-MPC can then use the prediction matrix Sensing future changes in operating conditions. In thrust error... Before the event actually occurs, the controller has already calculated the required action amplitude of the valve to align with the future target, providing phase lead compensation at the control algorithm level. Although it cannot eliminate the inherent physical response time of the mechanism, it compensates for the time lost due to "waiting error," fundamentally suppressing phase lag in the dynamic adjustment process.

[0270] Mathematical proof of overshoot prevention (mathematical damping clamp): The analytical solution contains an inverse matrix penalty term. This invention addresses the issue by adjusting the control increment weight matrix. Assigning appropriate values ​​is equivalent to introducing "mathematical damping" into the control closed loop. According to the matrix norm inequality, when... When the eigenvalue increases, the optimal action amplitude It will be strictly limited. This theoretically ensures that during the convergence to the target state, the valve action will be slowed down in advance due to weight penalty, and there will be no over-adjustment like PID, thus effectively preventing overshoot and high-frequency oscillation across the entire operating range.

[0271] 2. Probabilistic proof of anti-false alarm under transient high vibration conditions (comparison of CFAR between dynamic threshold and fixed threshold)

[0272] During engine start-up or sudden thrust changes, water hammer or structural resonance can easily occur. Assuming this transient condition, the actual observation noise of the sensor... v(k) follows a Gaussian normal distribution. Among them, the true transient noise standard deviation is drastically amplified, satisfying... (Assume instantaneous magnification C = 5).

[0273] Derivation of the high false alarm rate of traditional fixed threshold:

[0274] Existing technologies typically use test steady-state data to set a fixed, one-size-fits-all safety red line, i.e. .(Note: This represents the standard deviation of normal noise. Taking three times the standard deviation is based on statistical principles. The criterion is that, under normally distributed noise, the signal falls within... The probability within the confidence interval is 99.73%, at which point the theoretical natural false alarm rate of the system is only 0.27%, which is considered a safe steady-state alarm boundary in traditional engineering. To intuitively quantify the limitations of a fixed threshold, a typical transient high-vibration condition assumption is introduced here: When the engine is in the start-up or drastic thrust change phase, water hammer or structural resonance is highly likely to occur, leading to an increase in the standard deviation of the actual observed noise under transient conditions. Drastic amplification. Assuming the transient amplification factor is 5x, the actual noise level deteriorates significantly. = 5 .

[0275] At this point, the probability of a false alarm caused by normal transient noise exceeding the alarm threshold (i.e., the false alarm rate) is... (), can be obtained through the error function of the normal distribution. calculate:

[0276] (20)

[0277] Consulting the error function table reveals that at this time... .

[0278] Conclusion 1: This means that when faced with a normal hydraulic disturbance that is amplified by 5 times instantaneously, the fixed threshold system has more than a 50% probability of misjudging and triggering an emergency shutdown, and the system has an extremely low fault tolerance.

[0279] The "Constant False Alarm Rate (CFAR)" characteristic of the dynamic threshold of this invention is demonstrated as follows:

[0280] Before proceeding with the probabilistic derivation, we first declare the threshold physical mapping logic of this invention: the core output of the algorithm layer of this invention... Essentially, it is a dimensionless dynamic threshold multiple. In the actual comparison logic at the algorithm's underlying level (see step five), the system directly uses the dimensionless standardized residual. and Performing threshold discrimination is mathematically equivalent to multiplying the dimensionless multiple by the physical environment benchmark (such as...). This maps an "equivalent physical alarm red line" in the physical world that dynamically fluctuates with the intensity of vibration under the working conditions.

[0281] To derive the theoretical constant false alarm rate (CFAR) limiting characteristic of this invention, we consider the boundary condition that the system is fully adaptive to the noise environment, i.e., we take an environmental adjustment factor. Furthermore, the offset of the basic constant term is ignored. At this point, the dynamic safety threshold multiple of strategy B is exactly proportional to the amplification of the actual noise level.

[0282] Meanwhile, the system extracts the standard deviation of the sliding window over the most recent 50ms in real time. Its dynamic updates follow the physical reality, and the mathematical expectation can quickly approximate the actual transient noise level, that is... Under these boundary conditions, the system's equivalent physical alarm red line is strictly aligned to 3. Substituting it into the false alarm rate probability formula

[0283] (twenty one)

[0284] Consulting the error function table reveals that at this time... (i.e., 0.27%).

[0285] Proof Conclusion 2: This invention rigorously proves from a probabilistic perspective that, regardless of the actual noise caused by external physical conditions... No matter how drastically the scale is increased (even by 10 times or 100 times), the variation terms in the formula are perfectly canceled out by the dynamic threshold, and the false alarm rate of the system remains constant at the standard level. Outside the confidence interval (0.27%). This "constant false alarm rate (CFAR)" characteristic in the radar field theoretically completely eliminates false shutdowns under high vibration conditions.

[0286] In practical engineering applications, the adjustment coefficient in step four is used... Setting it to a value less than 1 (such as 0.5) allows for a human-controlled trade-off between "absolute constant false alarm" and "high fault sensitivity," demonstrating the flexibility of the mechanism.

[0287] Finally, it should be noted that the above examples are merely some specific embodiments of the present invention. Obviously, the present invention is not limited to the above embodiments and many variations are possible. All variations that can be directly derived or conceived by those skilled in the art from the disclosure of the present invention should be considered within the scope of protection of the present invention.

Claims

1. A method for thrust regulation and safety protection of a liquid engine, characterized in that: This includes repeatedly executing the following steps within a preset sampling period during engine operation: S1. Collect the raw multi-source signal data of the engine, and use the preprocessed data as the vector of actual measurement values; S2. Calculate the posterior state estimation vector based on the extended Kalman filter algorithm and the actual measurement value vector; S3. Based on the posterior state estimation vector, the theoretical predicted output vector is obtained through the linear time-varying model predictive control model, and then the optimal control increment is calculated, and the solution state of the linear time-varying model predictive control model is output. S4. Calculate the noise standard deviation based on the actual measured value vector, calculate the standardized residual based on the theoretical predicted output vector, and then adaptively update the dynamic safety threshold based on the noise standard deviation and the standardized residual. S5. Based on standardized residuals and dynamic safety thresholds, anomaly detection is performed, and graded protection instructions are generated. S6. Based on the solution status and hierarchical protection instructions, generate the final effective control instructions with the safety priority principle to drive the actuator to adjust the fuel medium flow.

2. The method for thrust regulation and safety protection of a liquid engine according to claim 1, characterized in that: The preprocessing includes: low-pass and band-stop filtering for noise reduction, calibration compensation, outlier removal, timing synchronization, analog-to-digital conversion, and dimensionless normalization to obtain a vector of actual measured values ​​with consistent timing.

3. The method for thrust regulation and safety protection of a liquid engine according to claim 2, characterized in that: The linear time-varying model predictive control model in step S3 includes: Linearized state equations: Linearized output equation: wherein, denotes the current time instant; i is the prediction step; is the discrete state transition matrix at the current k time instant; is the discrete control input matrix at the current k time instant; is the discrete output matrix at the current k time instant; denotes the a posteriori state estimation vector; denotes the theoretical prediction output vector.

4. The method for thrust regulation and safety protection of a liquid engine according to claim 3, characterized in that: The calculation process of the optimal control increment, theoretical predicted output vector, and solution state in step S3 includes: The theoretically predicted output vector within the control horizon is used as the optimal control sequence. Then, based on the constraints, a fast quadratic programming solver is used to find the optimal control increment sequence that minimizes the objective function. If the optimal solution is found within a preset second time window threshold, the solution status is output as "successful" and the solution time is recorded. The first component of the optimal control increment sequence is extracted as the optimal control increment. If the computation time exceeds the second time window threshold or there is no mathematical solution under the current constraints, the output solution status is "failed".

5. The method for thrust regulation and safety protection of a liquid engine according to claim 4, characterized in that: The objective function is: in, The desired target instruction is given; Q is the error weighting matrix. Indicates a control sequence. ; To control the amount of change in instructions, R is the control weighting matrix; is the quadratic norm / squared; Nc is the control horizon; Np is the predicted horizon; The objective function is constrained based on constraints, including control amplitude constraints corresponding to the physical travel limit of the actuator and rate constraints corresponding to the physical response speed limit.

6. The method for thrust regulation and safety protection of a liquid engine according to claim 5, characterized in that: The dynamic security threshold update operation in step S4 includes: calculating the first dynamic threshold and the second dynamic threshold respectively, and taking the first dynamic threshold. Second dynamic threshold The maximum value in is used as the dynamic security threshold. ; The formula for the first dynamic threshold is: when hour, when hour, in, This is the trend sensitivity coefficient. Based on the basic security threshold, The standardized residual of the s-th sensor The rate of change; The formula for the second dynamic threshold is: in, Let be the noise standard deviation of the s-th sensor. Let be the normal noise standard deviation of the s-th sensor. This is for adjusting the coefficient.

7. The method for thrust regulation and safety protection of a liquid engine according to claim 6, characterized in that: The dimensions for anomaly determination in step S5 include the comprehensive anomaly index. and standardized residuals Among them, the comprehensive anomaly index The standardized residuals of each physical quantity are multiplied by their corresponding preset weighting coefficients and then summed. The method for generating the hierarchical protection instructions is as follows: (1) If ,and The generated graded protection instruction is "normal", where, This indicates the preset overall system risk warning threshold; (2) If And the duration exceeds the third time window threshold ,or The generated hierarchical protection instruction is "Level 1 Protection"; (3) If And the duration exceeds the third time window threshold ,or The generated hierarchical protection instruction is "Level 2 Protection"; (4) If And the duration exceeds the third time window threshold If the combustion chamber pressure measurement exceeds the overpressure limit for structural rupture, or the pump / motor speed measurement exceeds the overspeed limit for rotor disintegration, or the temperature measurement of a critical component exceeds the overtemperature limit for material melting, the generated protection instruction will be "Level 3 Protection".

8. The method for thrust regulation and safety protection of a liquid engine according to claim 7, characterized in that: The final method for generating effective control commands is as follows: (1) If the hierarchical protection instruction is "normal" and the solution status is "successful", the effective control instruction is: (2) If the hierarchical protection instruction is "Level 1 protection", and the solution status is "successful", and the solution time is... If the first time window threshold is reached, then the diagonal elements of the control weighting matrix R in the objective function are increased, and the optimal control increment is recalculated. Then generate valid control commands: (3) If the hierarchical protection instruction is "Level 1 protection", and the solution status is "successful", and the first time window threshold is less than the solution time. Then, for the second time window threshold: (4) If the graded protection instruction is "Level 2 protection", then: in, This represents the upper limit of the absolute opening of the valve. (5) If the graded protection instruction is "level three protection", the power supply to the servo valve shall be cut off immediately, and the valve closing sequence of the pyrotechnic product shall be triggered to perform a safety cut-off. (6) If the solution status is "failed", then switch to the proportional-integral-differential method.

Images