4.3.4 MECHANICAL/ELECTRICAL INTERFACE

For mechanical components having an electrical Interface, the mechanical FMEA will consider only the effects of 'black box' functional failure (e.g., 10SS Where i t becomes necessary t o conduct an of o u t p u t , premature signal. etc.). FMEA wlthin the 'black box" because of the assigned c r l t i c a l i t y (1 or 2). the MEA will be conducted by Avionics Reliability who w i l l be provided w i t h the following Infonnation i n the mechanical FMEA regarding t h e failure effects on the mechanical system:

a. En& under "CAUSE" (5380). each applicable failure mode of t h e electro- mechanical device reflecting the avionics ma1 function causing the failure mode; i .e.. loss o f electrical power, premature;electrical signal, etc. I

b. Identify under "REFERENCE OOCUMENTS" (Cll-141, the specific mechanical/ avlonics Interface.

¶0246j/24

DI NO. 100-26 Page 2 5 of 34 The electrical interface FMEA will be included in the appropriate section of the avionics FMEA. For c r i t i c a l i t y 1. lR,²² Rogers Commission Report, Volume I, p. 199. o bid., Chart SRB-4. 2 1 Larry Mulloy, NASA, Marshall Space Fli ht Center, "STS-51L Level I1 Flight Readiness Review,'' January 14,1986. See Appendix VIII-g. 2 2 Discussion with Allan McDonald, September 4, 1986. Z3 Rogers Commission Report, Volume 11. See Chart 15 (p. H-10) and Chart 19 (p. H-12). s Ibid., Chart 30 (p. H-18). or 2R f a i l u r e mpdes. the mechanical FMEA, which considers the e f f e c t of 'black box" l o s s of function. wfll indicate i n the R 'EM ARKS" section t h e avioiics FMEA number o f the "black box". The avionics FMu\ of the 'black box' w i l l contain a similar reference t o the appropriate mechanical FMEA. A t t h e e a r l i e s t point i n time when the mechanical analyst can ascertain t h a t the "black box" is c r i t i c a l i t y 1. 1R.²² Rogers Commission Report, Volume I, p. 199. o bid., Chart SRB-4. 2 1 Larry Mulloy, NASA, Marshall Space Fli ht Center, "STS-51L Level I1 Flight Readiness Review,'' January 14,1986. See Appendix VIII-g. 2 2 Discussion with Allan McDonald, September 4, 1986. Z3 Rogers Commission Report, Volume 11. See Chart 15 (p. H-10) and Chart 19 (p. H-12). s Ibid., Chart 30 (p. H-18). "or 2R. I t shall be h i s responsibility t o convey t o the Avionics Reliability group copies o f h i s worksheets t o f a c f l i t a t e i n i t i a t i o n o f detafled avionics analysis effort.

4.3.5 INSTRUMENTATION -MF

Instrumentation (e.g.. sensors, signal conditioners, etc.) may be provided by e i t h e r Avionics Instrumentation or by a specific Design group. In e i t h e r case, instrumentation FMFA's will be included i n the FFlEA f o r t h e using subsystem. C r l ti cal f t y 3 f nstrumentation may be 1 f sted on one FMEA form by family o r type. FMEA's f o r c r i t i c a l i t y 1 o r 2 and c r i t i c a l i t y 1 R and 2R i n s t r m n t a t i o n t h a t f a i l a redundancy screen o r t h e screen i s 'HA". will be caapleted i n t h e i r entltety and included i n t h e using subsystem CIL. Avionics Reliabflity will provide support a s required t o identify faflure modes, retention rationale, etc.

A copy of each instrumentation F M d cmpleted by a Mechanical Reliability group wfll be provided t o Avionics Reliability.

4.4 SUPPLIER FMEA UTILIZATION

¶4.4.1 GENERAL

In many instances, depending on the cost, complexity, and s t a t e of development of the design, suppliers will be required t o develop and submft FMEA's reflecting t h e i r area of design responsibility. The submissions w i l l precede the j o i n t supplier/Rockwell POR o r CDR. (See the applicable PORD f o r content requf remennts and submf t t a l schedules. ) FIGURE 9 shows the overall supplier FMEA f l o w a s related t o the in-house effort.

352

01 NO. 100-26 Page 26 of 34

4.4.2 FMEA UTILIZATION

Upon receipt of a supplier FMEA, the responsible RSA will ccmpare the identified failure modes w i t h those called o u t on his corresponding subsystem FMEA and update h l s FMEA a s required (see section 4.2) t o include any failure nodes not already identifled relating t o subsystem effect. Supplier FMEA'S w l l l be reviewed f o r single failure points below t h e black box level by Rockwell and analyzed f o r corrective action directly w i t h the supplier as part of t h e i r design review. Where Rockwell does not concur w i t h portions o f the supplier analysis, telephone contact w i t h the supplier Reliability Engineer normally should suffice t o resolve any differences. If not. the matter shall be resolved through normal Rockwell data handling procedures. Supplier black boxes w i l l be identified i n the subsystem FMEA based on the supplier schematic o r drawing part identification number. For c r i t i c a l i t y 1 or 2 and 1R or 2R (CIL only) electronic black boxes, the piece parts ( o r if a l l o r many circuits, so s t a t e ) identified by the supplier FMEA which are single point failures t h a t have a d i r e c t c r i t i c a l e f f e c t on the vehicle will be described w i t h reference t o the supplier FMEA I n the "CAUSE" section Of the applicable failure node identified a t the subsystem level. Parts w i l l be l i s t e d only i n those cases where l e s s than five parts are involved.

4.5 ELEMENT CONTRACTOR FMEA CORRELATI

¶O N

¶Requirements and procedures f o r conducting interfacing analyses and for element integration tasks are contained in Reliability Desk Instruction 100-12 (Shuttle Element Interface).

¶4.6

¶For items identified as GFE hardware, NASA will identify those which require FMEA's and w i l l perform FMEA's on the hardware identified t o the level defined by t h e i r ground rules. Upon ccinpletion of the FMEA, MASA w i l l provide Rockwell w i t h a copy. In addition t o the completed copy. a preliminary copy may b6 transmitted. Upon receipt of the GFE FMEA, Rockwell will evaluate t h e interface effects on the Orbiter defined by the'GFE F M U. 02463 I26

353

01 NO. 100-26 . - Page 27 '34 of

¶Appropriate conrments shall be included t o insure t h a t t h i s area i s correct an'd complete. Rockwell will conduct FMEA'S f o r a l l interfaces between CFE and GFE. The Rockwell FMEA will consider a l l f a i l u r e modes consistent'with t h i s desk instruction. The analysis is t o consider a s a "RUSE" any f a i l u r e mode identified by the GFE FMEA which could produce a failure i n the CFE interface. Where G FE failures are identified a s a ' CA

US' E. the appropriate G FE FUEA and document number

¶shall be identified a s a part of the "CAUSE" section. In addition, those vehicle failures which could cause M U failure modes w i ll be identified t o NASA In the corrments t o t h e GFE FMEA. Uhere structural failures a r e identified, appropriate hazards analyses shall be 1ncl uded 1n avai 1abl e.

¶The accountabllity of CIL items f o r W E will be NASA. Those CIL items resultfng from interface failure modes will be a part of the Rockwll CIL.

¶Exceptions t o t h i s instruction w i l l be identified and concurred i n jointly by Rockwell and NASA and documented a s a part of l e t t e r s of agreement.

¶-_________.I___C . ._.

-___-...-.. .--.--.. ----------------.----- I I : I

¶I

I --- o DESIGN o SAFETY o FLT TEST 6 CRD op o QA o RELIABILITY o PRODUCTION OPS I

SINGLE FAILURE POINT

¶CRIT 1 R 6 2 R

I- 2 FIGURE 1 - F k R PROCESS

355

DI NO. 100-26 Page 29 o f 34

356

DI NO. 100-26 Page 30 o f 34

ms ..--. = -................. yY . n

PILYI

¶Jm

m u - 0 , . m,, ...................... ..................... -0 , ...................... -.. .............. Y

0 Y

*I..."¹¹ For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. g8 mid., July 24, 1986, p. 11. 1 9 9 Ibid., June 25, 1986, p. 52. ..................... . . Y - ., .................. ...................... " ................. p1&

.. Q . C . . . . ..............- a,... . p. ry

Figure 4. Data Sheet No. 1 ...

¶.. .._. -.-- ...

. -.
- Figure 5. Data Sheet No. 2 t .. .

Figure S . Data Printout, Component-Related Data

Figure 7 . Data Printout, Failure Mode-Related Data

Crlt.²² Rogers Commission Report, Volume I, p. 199. o bid., Chart SRB-4. 2 1 Larry Mulloy, NASA, Marshall Space Fli ht Center, "STS-51L Level I1 Flight Readiness Review,'' January 14,1986. See Appendix VIII-g. 2 2 Discussion with Allan McDonald, September 4, 1986. Z3 Rogers Commission Report, Volume 11. See Chart 15 (p. H-10) and Chart 19 (p. H-12). s Ibid., Chart 30 (p. H-18). Reliability Engr. Detcrminntlnn Crit. IR . I --- Crit. 2R .

Passive hit. 2'5 Crit . 1R o r 2R L

¶Fracture Can Redundancy Control be Checked Out Crit.lR,ZR

During Ground Turnaround OR . - Is Redundancy Screens

¶MPA Rcq'd Status Availablr (ldentlfy During F l i g h t Potent 101

OR Are Redundant 7- Elements Un- Not Included i n susceptible t o , Crltical Itear List Loss from a Single Credible Event

¶FIGURE 8 - RtEA SCnEENINC

360

01 NO. 100-2F CW IT I CALITY CATEGORY Page 2 of2

CROSS GEFEGENCE TAGLE

¶_-

I CRITICALITY ' CATEGORY I

¶FlGURE 10

361

¶DI NO. 100-26

APPENDIX A

¶Page 1of 2

'FAILURE EFFECTS

¶(A) ON FUNCTION OR SUBSYSTEM:

No Effect Loss o f Redundancy Functional Degradation Subsystem Degradation Loss of Function Loss of Subsystem

¶(8) ON INTERFACE FUNCTIONS OR SUBSYSTEMS:

No Effect Loss o f Interface Redundancy Degradation of Interface Function Degradation of Interface Subsystem Loss of Interface Function Loss of Subsystem

¶(C) ON MISSION:

¶NO E f f e c t

: See Note Below f o r C r i t i c a l i t y 2 Modes Mission Modification Loss of E n t r y Capability -Rescue

¶(0) ON CREW/VEHICLE:

NO tttect Possible Loss of Crew/Vehicle (Specify) Probable Loss of Crew/Vehicle (Conditfons) Loss o f Crew/Vehicle *

NOTE: The following instruction i s intended t o c l a r i f y what should be entered i n the FMEAKIL under "EFFECTS ON MISSION" (item C under e n t r y 5240) f o r i d e n t i f i e d c r i t i c a l i t y 2 f a i l u r e modes.

¶C r i t i c a l i t y 2 f a i l u r e (modes) a r e defined as: ( 1 ) s i n g l e f a i l u r e s which would cause 'loss of mission", and ( 2 ) f a i l u r e s wherein the next associated f a i l u r e would cause 10% Of crew/vehicle (Appendix B. Section 3.1.1, Ground Rules, subparagraph 1).

¶The following c h a r t (Mission Effects - C r i t i c a l i t y 2 F a i l u r e Modes) i s included a s a guideline f o r e n t r i e s under "EFFECTS ON MISSION". The term "abort decision" should only be used where there r e a l l y i s a decision.¹¹ For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. g8 mid., July 24, 1986, p. 11. 1 9 9 Ibid., June 25, 1986, p. 52. NO. 100-Zd

APPENDIX A

¶Page 2 2 of

MISSION EFFECTS - CRITICALITY 2 FAILURE MODES

¶LOSS OF C A P A B I L I T Y TO FAILURE MODE AFFECTS ACCOMPLISIMENT OF M I S S I O N 1. ---

(ADD SPECIFICS OF CAPABILITY LOST DUE TO ODJECTIVE(S) ONLY EXRMPLE: JWJEO 6EAR BOX ( S F P I YIIICH PRECLUOES RELEASE

IOEIITIF IEO FAILURE). OR OEPLOYMENT OF A PAYLOAD.

ABORT DECISION I F FAILURE OCCURS PRIOR TO ENTRY LOSS OF REOUNDANCY WHEREIN NEXT ASSOCIATED FAILURE U l L L

CONMITMEIIT. CAUSE LOSS OF CREW/VEtlICLE. EXAMPLES: APU/IIYO, ECLSS FUNCTIONS, POUER GENERATION.

NONE - REDUNDANT SIMULTANEOUS MEANS AVAILABLE SIRULTANEOUS USAGE OF REOUNOANT MEANS TO PERFORM A TIME

¶TO - - - (SPECIFY FUIICTION TO BE PERFORMED.) CRITICAL FUtlCTlON

EXAMPLE: FAILURE'OF ONE OF TWO REOUNOANT PYROTECIINIC

DEVICES I N THE SEPARATION SYSTEM. Q, h3

CONTINUE M I S S I O N - OUTY CYCLE SANE AS ABORT.

¶tlOTE: YllEN DECISION IS TIME DEPENDENT: I

ABORT AOA OR A T 0 I F FAILURE OCCURS DURING LOSS OF ONE OMS ENGINE PRECLUOES H I S S I O N COMPLETION.

¶ASCENT PIIASE.

ABORT UNLESS M l S S l O l l CAI4 B E COMPLETED Y!TII ONE MISSION 1 CAN BE COMPLETE0 I F ONE SSME SHUTS OOWN

SSME OUT. . BETUEEN 347.3 AllD 401.5 SECONDS OF ASCENT. MISSION 2 HAS NO ENGIIIE OUT M I S S I O N COMPLETION CAPABILITY.¹¹ For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. g8 mid., July 24, 1986, p. 11. 1 9 9 Ibid., June 25, 1986, p. 52. NO. 100-26

APPENDIX B '

¶Page 16 of

¶3.0 GROUND RULES AND CRITERIA ..

¶The following ground r u l e s and c r i t e r i a a r e of a general category f o r guidance, a s applicable, i n conducting and i n t e r p r e t i n g an FMEA. The applicable ground r u l e s and crlterla w i l l be a p a r t of t h e informatton which prefaces each FMEA. (See section 3.2. FMEA Content.)

3.1 GENERAL GROUND RULES AND CRITERIA 3.1.1 GROUND RULES

C r i t i c a l i t y d e f i n i t i o n s a r e those delineated i n NHB 5300.4 (10-1). a s i l l u s t r a t e d i n FIGURE 10 ( C r i t i c a l i t y Category Cross Reference Table). For the purpose of t h i s analysis, hardware c r i t i c a l i t y 2 is f u r t h e r defined; i.e., dual redundancy where: a. The f i r s t f a i l u r e would result i n l o s s of mission. b. The next r e l a t e d f a i l u r e would r e s u l t i n l o s s of l i f e / v e h i c l e .

2- CritlCality 1R and 2R assumes f a i l u r e of a l l like and unlike redundancy: A backup item. i f when i t i s c a l l e d upon t o work, performs a function d i f f e r e n t frm the i t e m i t is backing up, i t should be c l a s s i f i e d based upon t h e e f f e c t i f i t . d o e s not work when operated. I f t h e backup item performs t h e same functfon a s t h e Item I t is backing up. t h e backup should be c l a s s i f i e d a s an u n l i k e redundant Item.

Loss of mission is defined a s follows: a. Operation payload i n t e r f a c e hardware f a i l u r e as I t would r e s u l t i n l o s s of payload primary performance. b. . ..Orbiter subsystem f a i l u r e a s i t would r e s u l t i n unplanned mission termination f o r non-safety of f l i g h t reasons.

Categorization of a hardware item by t h e worst case p o t i n t i a l e f f e c t of f a i l u r e of t h a t item w i l l define c r i t i c a l i t y . .. 5. Failure modes t h a t could propagate t o interfacing subsystems Or experiments will be Identified.

¶0246j/30

¶01: NO. 100-26,