Reports that Matter

Investigation of the Challenger Accident

APPENDIX

Section 47 of 55

APPENDIX

Page 2of 6

  1. Uhen defining FMEA's/CIL for a particular subsystem. iniedacing subsystems will be considered t o be operattng d t h i n t h e i r specified tolerances.
  1. GTr FMEA data w i l l be utilized i n evaluating t h e MIRockwell International interfaces f o r the vehicle FMEA and CIL.
  1. Failure detectability assumes t h e availablity of telemetry o r a creman respond1ng t o monitored displays. Fai 1ure detectabi 1i t y a1 so assumes other means of failure detection, where feasible. such as a crew response t o physical stimuli; i.e.. smell. sound, etc.
  1. Specific FMEA c r i t e r i a and assumptions w i l l be defined f o r each subsystem.

. 10. - Identifalcomponents -. used f o r different functions w i l l be treated separately i n the FMEA.

  1. Simultaneous failure of redundant ccinponents i s identified where t h e failure cause encompasses both components.
  1. Subsystem analysis dl1 include an evaluation of the effects of instrumentation failure u p o n h i t h i n the subsystem.
  1. External Leakage: a. The external leakage mode 3f functional hardware items from any source (except matlng of two surfaces by welding, brazing, o r pennaswage) will be considered. If t h i s mode raises the - . - c r i t i c a l i t y of the items i n question, i t will be documented and the potentlal leak source identifjed under "aU.SE(S)". * Otherwise. t h e external leakage w i l l be treated generically by media. However, in those instances where external leakage results i n hardware c r i t i c a l i t y 1 effect, the f a i l u r e mode will be documented regardless of the basic c r l t i c a l i t y o f the item being considered. Uhere applicable, seal failure should be l i s t e d as a cause and worst case (comlete seal f a i l u r e ) shall be assumed. considering

0246j /31

DI NO. 100-26 APPEllOIX 6 Page of 6 also any restrictive protection provided by barrier design, where such data are available from Oesign. Hazards associated w i t h t h e loss of fluid i n excess of requirements d l 1 be documented and covered by Hazard Analysis, but w i l l not affect c r i t i c a l i t y (see section 3.3. paragraph 4.)

' b. The internal leak mode of functional hardware items will be

considered. In those Instances where internal leakage could r e s u l t in a hardware c r i t i c a l i t y 1 o r 2 failure mode e f f e c t ( f a i l open o r f a i l closed due t o pressure lockup). 'internal leakage" shall be entered i n t h e 'CAUSE" section of the most appropriate identified failure mode entry i n l i e u of *cause" i s acceptable.

C. Where external o r internal leak paths are protected by s t a t i c o r dynamic redundant (veriffable) seals, the leak path effect will be reduced by one c r i t i c a l i t y level.

d. Pressure carriers (lines, pressure vessels) will be classified by Worst case mode including external leakage. Lines will be entered generically for each independent media. Special l i n e s (i.e., mechanical bellows, flex lines, etc.) w i l l be entered individually. Tanks w i l l be entered individually.

  1. The failure o f any tank containing f l u i d media which, due t o its

location i n an enclosed vehicle compartment, could cause cwpartment overpressurization leading t o structural failure (vehicle loss) w i l l be classified hardware c r i t i c a l i t y 1 f o r tank rupture mode.

  1. Al1,Jines will be designated the c r i t i c a l i t y applicable t o t h e

functional loss effect resulting from loss of medium w i t h notation i n t h e "REMARKS" section of the FMEA as t o the potential hazard due t o compartment overpressurization resulting from l i n e ruptire. The main engine cryogenic feedlines wilt b e treated a s fluid tanks.

366

DI No. 100-26

APPENDIX B

Page 4 of 6

3.1.2 CRITERIA

  1. The FMEA and CIL will consider f a i l u r e s beginning with preflight/pre- launch operations through post landing safings a t Edwards Air Force BaseKennedy Space Center ( WeKSC). a. Prelaunch operations a t KSC/VAFB are defined as beginning with propellant loading f o r each specific propulsion subsystem. For a l l other subsystems. prelaunch operations c m e n c e wfth s t a r t of main engi ne condi ti oni ng.

b . Post landing safing operations Include those a c t i v i t i e s performed a f t e r landing t o prepare t h e o r b i t e r f o r hangar operations and a r e defined a s follows: (1) Deservice and draining of hazardous fluids. ( 2 ) Safing of unused ordnance. ( 3 ) Application of ground power and cooling. ( 4 ) Removal of potentially hazardous components. ( 5 ) Removal of pods and payloads. ( 6 ) Purging and venting of gases. (71 Installation o f protective covers.

  1. Redundancy 1 s defined 'as the use of more than one means of accomplishing a given task o r function where a l l must f a l l before there is an overall failure of t h e function. a. - Operational Redundancy redundant elements, a l l of which are f u l l y energized during t h e subsystem operating cycle. Operational redundancy includes load sharing redundancy wherein redundant elements are connected i n such a manner that, upon f a i l u r e of one ---unit, t h e remaining redundant elements w i l l continue t o perfom t h e subsystem function. I t i s not necessary t o switch'out the fa'lled element nor t o switch i n the redundant element. . b. - Standby Redundancy redundant elements t h a t a r e non-operative (i.e., have no power applied) u n t i l they are switched into the subsystem upon failuare o f the primary element. I n these cases, as well a s pyrotechnic devices, mechanical linkage and inoperative
367

OX NO. 100-26

APPENDIX B

Page 5 of 6 functional paths of any subsystem. redundancy screen B is considered not applicable and so maded. This app&ach i s based on the f a c t t h a t these areas a r e subject t o ground checkout; they a r e redundant and therefore provide a degree o f protection I n f l i g h t ; I t i s confinned t h a t when c a l l e d upon t o operate, the i n a b i l i t y t o operate would be detected i n f l i g h t f o r appropriate c o r r e c t i v e action.

  1. Where redundancy e x i s t s i n the subsystem. t h e redundancy is considered during t h e analysis of a f a i l u r e of t h e component.
  1. 'Alternate means of operation" refers t o accomplishment of a function and not necessarily t o redundancy or r e s t o r a t i o n of a f a i l e d function.
  1. When f i r e hazards r e s u l t i n g from s h o r t c i r c u i t s o r o t h e r hardware f a i l u r e modes a r e identified. consideration will be given t o t h e e f f e c t of fire propagation t o adjacent redundant equipment a s a potential loss of t h e function.

Potential safety concerns created by cmponent f a i l u r e modes will be i d e n t i f i e d and handled through Hazards Analyses a s required by EOM 70 1-4.2.5 and by NHB 5300.4 (1D-1).

  1. Reference documents i n t h e M U include released and controlled engineering drawings or specifications, when available.
  1. The following a r e used a s a i d s i n determining the f a i l u r e modes and causes of subsystem hardware f a i l u r e s : :--

a. Generic f a i l u r e modes and causes. b. Released and controlled cmponent. assembly, and d e t a i l engineering drawings and specifications. c. Training a i d s , a s available; e.g., cross section drawings, photographs, exploded drawings ( n o t referenced I n FMEA). d. Actual hardware. i f available. e. Use experience, including f a i l u r e hlstory and- s i m i l a r components.

02463 134

01 NO. 100-26

APPENDIX B

Page 6 of 6 f. Controlled and released operational procedures. . g. Component FMEA's prepared by component suppliers.

  1. Failure of structural items (primary and secondary) w i l l not b e considered a s a part of this ananysis. (Structural items are assumed t o be designed t o preclude failure by use of adequate design Safety factors.1 For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. g8 mid., July 24, 1986, p. 11. 1 9 9 Ibid., June 25, 1986, p. 52.

  2. mu's of c r i t i c a l i t y 1 o r 2 "black boxes' providing electrical Signal

interface t o mechanical components are included i n the applicable avionics FMEA package w i t h appropriate cross-referencing i n the 'REFERENCE DOWMENTS' sectlon of both the appropriate avionics and mechanical FMEA r e p o r t . where available.

  1. The failure mode "Fails t o Operate' w l l l not be addressed f o r fuses.

Use o f a fuse uith a higher current capacity then specified (wrong size Installed or rating misidentified) i s not considered a fuse f a i l u r e mode.

369

VII-A

4!Ib Designation:D 395 - 85

A M E R I C A N SOCIETV F O R TESTING A N 0 M A T E R I A L S 1916 Race St., Philadelphia. Pa. ,19103 Reprinted from the Annual Book of A S M Standards, Copyright ASTM If not listad io the currant cmbirmd index. will a p m fin the next edition

Standard Test Methods for