ATV: technology for managing malfunctions
“The ATV has two major innovative objectives compared to previous European spacecraft,” explains Mr Clervoy. “It must be able to manage its own failures at all levels – electronic, hardware, software, equipment, etc – and it must also be able to ensure safety according to criteria that are mandatory for all human spaceflight – to be safe in any circumstances after any combination of two malfunctions.”
The ATV has a lot of intelligence devoted to first detect and then recover from malfunctions, known as Failure Detection Identification and Recovery (FDIR). It has been given the functionality to manage the malfunction by itself, with all critical systems possessing either double or triple redundancy.
“So the approach to the Station is like an aircraft being flown with two robotic pilots,” Mr Clervoy added. “The captain flies the vehicle while the co-pilot checks he is perfectly aligned with the ISS. If the trajectory monitoring system decides the trajectory is not satisfactory it can then take ATV into a parking orbit.
“The redundancy here is not total however as the systems reside partially on the same hardware. Therefore, another set of computers with a different suite of software is included, which employs a separate array of sensors to assess the vehicle’s trajectory on an independent basis.
“This is the equivalent in manned flight of having a flying instructor sitting behind the captain and co-pilot, not just looking at the trajectory flown by the captain but also the performance of the co-pilot monitoring the captain.
“If it decides what it sees is not satisfactory then it can go around the Station. With a different computer and software, different sensors, different batteries and different thrusters it's almost as if you have a completely independent satellite inside the ATV which shares only the base structure and propellant with the prime spacecraft.”
As an additional safeguard, the ATV Toulouse control centre (ATV-CC) is required to give a positive ‘go’ before the spacecraft progresses from one flight phase to the next, particularly during the ISS rendezvous stage. The ATV-CC’s 60-strong staff is also able to suspend or veto the docking, as can the watching ISS crew themselves – a simple four-line user interface has been designed to enable astronaut intervention.
During the first ATV rendezvous with the Station, the crewmembers monitoring the final approach pronounced themselves impressed with the ATV's steady alignment as it closed on the Zvezda docking port, remaining dead centre all the time, by contrast to some jittery Soyuz or Progress spacecraft.
