Investigation of the Challenger Accident
S HAN D LI
S HAN D LI
¶N G OR ABUSE ELEtTROMAGNETIC FIELDS PIECE-PART STRUCTURAL FAILURE '
¶4.1.16 (5240) EFFECT(S1: Enter the l e t t e r s ( A ) . ( 8 ) . ( C ) o r ( D ) as defined i n t h e
headings of Appendix A, together w i t h the words under each heading describing the effects on the subsystem, interfaces, mission, and crew/vehicle. respectively. and explain. If the identified e f f e c t i s not l i s t e d , describe briefly. Where the effect i s the same f o r two o r more of the above, consolidate entries. Specify i f there i s no effect on a specific category or categories and provide a brief explanation. In those instances when t i n e t o
¶. abort requires
.. - automatic operation o r imnediate dependence on a parallel subsystem and such i s provided, the effect on mission i s "lone" with explanation for each mission phase as appropriate. See section 4.1.21d. f o r screening of functional c r i t i c a l i t y 3 f a i l u r e modes. For thqse items identified as abort c r i t i c a l (see paragraph 4.1.14) enter. sibsequent t o the ( A ) . ( 8 ) . ( C ) and ( D ) entries. the c r i t i c a l i t y and effects per the following example:
¶0246j/14
34101 NO. 100-26' Page 1 5o f 3 4 "Crit 1 for RTLS - Loss o f additional engine-vehicle loss" or - 'Crit 1 f o r RTLS Incomplete propellant dump, s t a b i l i t y problem. probable vehicle loss." Where functional c r i t i c a l i t y f s 1 R o r 2R per paragraph 4.3.2 and hardware c r i t i c a l i t y i s 3. t h e appropriate entry f o r "FUNCTIONAL" ~, effects should be included. The "FUNCTONAL" effects entry relative t o t h e loss of a l l functional redundancy will b e entered per the following example: (El FUNCTIONAL CRITICALITY EFFECT: Possible loss of crewhehicle (specify) op probable loss o f crew/ vehicle (describe) or loss o f crew/vehicle.
¶4.1.17 (C39) TIME TO EFFECT:
Imediate - l e s s than 1 second Seconds - 1 t o 50 seconds Minutes - 50 seconds t o 50 minutes Hours - 50 minutes t o 20 hours Days - 20 hours t o mission completion Enter the descriptor which indicates shortest credible time o r t i n e range available t o correct the situation before the effect i s manifested.
¶4.1.18 (C40-45) FAILURE DETECTABLE: Enter "YES" o r "NO" i n the block following "IN
FLIGHT" and "GROUND TURIUROUNO". If either answer 1s "YES". indicate how i t can be detectable -- symptoms, instrunentation, etc. Include measurement number fran MML (Master Measurements List) where applicable and available. (See section 4.3.5, Instrumentation FMEA's.1 Development f l i g h t instrumcn- tation (DFII measurements w i l l not be used a s a means of detectability.
¶4.1.19 (5490)-60RRECTING ACTION: Describe any action, automatlc o r manual, which
may be taken t o circumvent the specified failure. Also identify any alternate means (utilizing *unlike" hardware) of acconplishing the function performed by the item o r its assembly. If none. so indicate: For instruments (sensors, transducers, etc. ) t h a t provide measurements assessed
¶0246jA 5
342DI NO. 100-26 Page 16of 34 as critical t o v e h i c l e k r e w s a f e t y o r mission continuation. t h e FMEA s h a l l i d e n t i f y the redundant o r a l t e r n a t e measurements by Measummyt Lf st . i d e n t i f i c a t i o n nmber
¶4.1.20 (C77) NUMBER 3F SUCCESS PATHS REMAINING AFTER FIRST FAILURE: With r e s p e c t
to t h e item being evaluated, i n d i c a t e t h e number o f ways remaining t o p e r f o m the f u n c t i o n a f t e r t h e f i r s t failure. You may leave t h e block blank f o r n o n - c r i t i c a l functions.
¶4-1.21 (C53. C55-57) REDUNOANCY SCREEN: F o r a l l c r i t i c a l i t y 1R.2 Rogers Commission Report, Volume I, p. 199. o bid., Chart SRB-4. 2 1 Larry Mulloy, NASA, Marshall Space Fli ht Center, "STS-51L Level I1 Flight Readiness Review,'' January 14,1986. See Appendix VIII-g. 2 2 Discussion with Allan McDonald, September 4, 1986. Z3 Rogers Commission Report, Volume 11. See Chart 15 (p. H-10) and Chart 19 (p. H-12). s Ibid., Chart 30 (p. H-18). and ZR f a i l u r e
modes (see FIGURE 8 and paragraphs 4.3.1 and 4.3.2) circle 'P" (PASS). 'F' (FAIL]. o r "A" (NOT APPLICABLE) f o r each o f t h e following t e s t s : a. Redundant elements are capable of checkout during normal ground turnaround with no v e h i c l e design modification. Where a subsystem i s I c h a r a c t e r i z e d by redundant s t r i n g s and t h e s t a t u s o f each s t r i n g can be v e r i f i e d during ground turnaround, no i n d i v i d u a l canponent(s) i n any One s t r i n g should be shown as f a i l i n g this screen. - NOTE: T h i s screen i s not a p p l i c a b l e under t h e following conditions: ( 1 Pyrotechnic devices, excluding electrical c o n t r o l C i r c u i t r y . ( 2 ) Non-redundant ftem. b. LOSS of a redundant element is r e a d i l y d e t e c t a b l e during f l i g h t . Yhere a subsystem i s c h a r a c t e r i z e d by redundant s t r i n g s and t h e status Of each S d n g can be v e r i f i e d i n f l i g h t , no i n d i v i d u a l component(s) i n any one s t r i n g should be shown as f a i l i n g t h i s screen. - N O T : This screen is not a p p l i c a b l e under t h e following conditions: ( 1 ) Standby redundancy (redundant p a t h s were only one path i s operational a t any given time). (2) A l l functional p a t h s o f any subsystem which is i n o p e r a t i v e ( d u r i n g such i n o p e r a t i v e periods). This groundrule does n o t apply i f t h e - - r e d u n d a n t elements a r e o p e r a t i v e d u r i n g any nonnal mission phase; I&., t h e screen i s considered a p p l i c a b l e i f t h e element i s o p e r a t i v e during any normal mission phase. ( 3 ) Pyrotechnic devices. ( 4 ) Mechanical linkage. ( 5) Won-redundant Item. . ( 6 ) S u b t i e r l e v e l redundant functional path( s) (power/control c i r c u i t s , etc.. f a i l u r e s where t h e primary f u n c t i o n a l path (LRU. etc.) 1s
¶0246jf l 6
34301 NO. 100-26 Page 1 7 34 of
Criticality 1R3 o r 2R3 and the primary redundancy would not be degraded (i.e.. loss of two of the subtier functiooal paths would not result i n an abort decision). C. Failure of an element t o pass t h i s screen should be i n d i r e c t relation t o the noted failure mode under n o n a l l y expected environmental conditions. Consideration of environmental extremes a s caused which could induce 'multiple order failure" is limited t o abnormal conditions generally resulting from some other failure. Where multiple f a t l u r e s must f i r s t occur t o result i n environmental extremes, such events may be considered non-credible. A s a ground rule, i t may be assmed t h a t hardware Items will be qualified and properly installed t o withstand the 'design-to" environmental envelope. The following are typical questions t o be answered i n t h i s phase o f the analysis: (1) Contamination: ( a ) A r e t h e items being evaluated susceptible to contamination? ( b ) IS contamination a credible event o r does t h e design (fK1Uding f i l t e r s ) r e s u l t i n t h i s failure mode being categorized a s non-credible? ( 2 ) Explosion: ( a ) 1s there a credible source? ( b ) Must other multiple failures occur f i r s t t o result i n the explosion? (C) IS the explosfon catastrophic t o crew or vehicle? (d) Is the container frangible? (el A r e the Items being considered susceptible t o t h i s type of damage i n view of t h e i r physical characteristics and location; i.e.. shielding? 3. Temperature: ( a ) A r e cwponents susceptible t o damage o r failure from h i g h - .I temperature? (b) Other than a s a result of multiple failures, i s such exposure credible? T h i s implies temperature peaks or sustained levels sufficient t o cause catastrophic effects on 6 e component in a short time. For example, temperature Increases t o certain - levels merely increase electronic parts f a f l u r e rates the actual failure and time o f occurrexe a r e stlll probabfl Istic.
¶0246jA 7
344DI NO. 100-26 Page 18of 34 ( 4 ) Vibration, Shock. Acceleration. Acoustics. e t C . : ( a ) Assuming t h a t ccmponents a r e q u a l i f i e d and pr?perly i n s t a l l e d t o withstand design environments. can a c r e d i b l e cause be i d e n t i f i e d which would cause t h e s e l e v e l s t o be exceeded? ( b ) Are vibration/shock/acceleratlon-sensitive redundant u n i t s physically oriented o r separated t o reduce t h e chance of multiple f a i l u r e from the same cause(s1 and i s t h e r e s u f f i c i e n t analysis and test data t o verify the f a i l u r e as non-credi ble? (51 Fire: DO not consider f i r e a s one of t h e s i n g l e events or causes i n f a i l i n g screen "C". one of the events (NB/83-L 216). NASA has edicted t h a t f i r e not be considered I I f none of t h e redundancy screens a r e applicable, enter 'NA" i n t h e C53 f i e l d and b r i e f l y explain reason f o r RDIIARKS/HAU\ROS.
d. Screening of Functional C r i t i c a l i t y 3 F a i l u r e Modes ( '1 For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. g8 mid., July 24, 1986, p. 11. 1 9 9 Ibid., June 25, 1986, p. 52. ) Where t h e f a i l u r e modes have been i d e n t i f i e d a s non-critical f o r loss of a l l redundancy ( C r i t i c a l i t y 3 ) . e n t e r 'NA" i n t h e C53 f i e l d . Enter under RE MARKS^ t h e notation, 'Critfcalfty 3 f a i l u r e - mode loss o f a l l redundancy would have no e f f e c t o n ' t h e mission o r c r e w h e h i c l e safety'. In such cases, minimum e n t r i e s on Data I Sheet No. 2 c o n s i s t of bI, LVl , LV2, LV3, C31, C53 and 5240. For functional C r i t i c a l i t y 3 items, 5240 m ust contain a brief explanation regardi ng t h e assigned c r i t i c a l i t y .
( 2 ) Where a component has an i d e n t i f i e d failitre mode i n t h e C r i t i c a l i t y 1 of 2 Category, and additional functional C r i t i c a l i t y 3 f a i l u r e modes are i d e n t i f i e d , these C r i t i c a l i t y 3 modes will be t r e a t e d a s -.-described i n para. (11 above.
¶4.1.22 CRITICALITY:
a. - - (C54 HARDUARE) Enter 1,2 Rogers Commission Report, Volume I, p. 199. o bid., Chart SRB-4. 2 1 Larry Mulloy, NASA, Marshall Space Fli ht Center, "STS-51L Level I1 Flight Readiness Review,'' January 14,1986. See Appendix VIII-g. 2 2 Discussion with Allan McDonald, September 4, 1986. Z3 Rogers Commission Report, Volume 11. See Chart 15 (p. H-10) and Chart 19 (p. H-12). s Ibid., Chart 30 (p. H-18). or 3 based on the definitions i n section 2.0 and t h e ground r u l e s contained i n section 4.3.1 and Appendix 8 . paragraph 3.1.1, sub-paragraph 1. b. (C67 - - FUNCTIONAL) Enter 1. 2,1 For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. g8 mid., July 24, 1986, p. 11. 1 9 9 Ibid., June 25, 1986, p. 52. R , 2R or 3 based on the d e f i n i t i o n s i n section 2.0 and t h e ground r u l e s contained i n section 4.3.2 and Appendix 6, paragraph 3 .1 .I, sub-paragraph 1.
¶nlALlf7R .
345DI NO. 100-26 - Page 19 of 34
¶4.1.23 (5500) REMARKS/H~U\ROS: Identify potential hazards resulting from the
specified failure. Enter t h e words "Hazard Potential' folloyed by approprlate explanation and any other comnents o r reconmendations t h a t might prove useful i n evaluating the system. Indicate requirements for additional instrumentation. and any other special consideration.
¶4.1.24 (5600) DISPOSITION AND RATIONALE: For c r i t i c a l i t y 1 and 2 items. and/or lR,
2R items t h a t f a i l a redundancy screen and/or hardware c r f t i c a l i t y 2 items where the screen i s NA. i n a l l of the following categories t o describe the retention c ri t e ri a. Each category must r e f l e c t a description of rationale for retention of the item: a. - Design Identification of design features which minimize the occurrence o f the fa i l ure mode and causes. b. - Test identification o f specific t e s t s accomplished t o detect f a i l u r e mode and causes during acceptance te s ts . c e rtific a tion te s ts . and checkout tests. c. - Inspection Statement tha t specific inspection points are included t o determine t h a t specific fa ilure mode causes a re not inadvertently manufactured into the hardware. - d. Failure History Provide an Indication t h a t the hardware or similar hardware has been used successfully and t h a t a history of generic failUtes does not exist. If t h e hardware i s new t o t h i s program, so state.
¶4.1.25 ( C 9 , Clo) APPROVAL: Responsible Reliability and Design approval signatures as follows:
a. Subsystem FMEA package: Oesign/Reliabili ty Manager b . - Figure 2 (FMEA) PREPARED BY: Design Responsl ble Reli abil i ty Analyst's Name . 7-
APPROVED BY: Design Signature Reliability (Analyst) Signature c. Figure 3 (CILI - APPROVED BY: Design (Supervisor) ;Signature Reliability (Supervisor) Slgnature
- NOTE: The I n l t f a l IsSue of a CIL sheet will be signed by t h e Reliability SupeMsor. Signatures W i l l not be required on subsequent Issues unless the CIL sheet Is fevlsed.
¶64-420 0 - 86 - I?
346DI NO. 100-26 Page 2 0 of 34