4.2 REVISIONS & SUBMITTALS

Revisions t o the FMEA w i l l be made a s follows: a. New Data: ( 1 ) To identify new components or f a i l u r e modes. use the data entry sheets and follow the instruction given in section 4.1. (2) To add information t o a component o r f a i l u r e mode record. e i t h e r a blank data sheet o r the appropriate page of the data p r i n t o u t working copy nay be used. - ( a ) Data Entry Sheets Usfng a blank data sheet, c i r c l e "R' [Revise) on the "Data Identifier" line (01. FIGURE 4 o r 5 ) and enter the correct subsystem/canponent/(failure mode) ID number t o identify t h e record t o which the information is t o be added. F i l l i n complete blocks of information t o be added (e.g., Disposition b l o c k ) . and s u b m i t f o r keypunching.

(b) Data P r i n t o u t - Circle "R' (Revise) on t h e "Data Identifier" l i n e (01, FIGURES 6 and 7) of the record t o which new information is t o be added. Using a colored pen or pencil, enter t h e information i n t h e appropriate blocks and submit f o r keypunch.

b. Data Entry Change: Circle t h e "R" (Revise) on the "Data Idenifier" line (01. FIGURE 4 or 5 ) and e i t h e r "red-llne" the appropriate sheet of the data printout o r re-enter t h e data a s i t should appear, u s i n g the appropriate data entry sheet a s described i n section 4.2, paragraph ( a ) Data Entry Sheets. To clear the "3" f i e l d of any remaining unwanted Information, asterisk (*) the blank l i n e s w i t h i n t h e -.- block on the master record and supporting record work sheets.

C. Data Deletion: (1) To delete data, c i r c l e the 'R" on the "Data Identifier" l i n e (01. FIGURE 6 or 7 ) of the appropriate data p r i n t o u t sheet. cross O u t the entry t o be deleted w i t h a colored pen Or pencil

¶0246j/2D

347

DI NO. 100-26 Page of 34 and submit f o r keypunching. If a blank data sheet is used. enter an asterisk (*) f n the block which corresponds t o the entry t o be deleted.

( 2 ) To delete the entire record (i.e.. a l l data pertaining t o a particular failure mode o r component) and a l l related entries, circle the "D" (Delete) on the appropriate sheets of the data p r i n t o u t . Again, f i l l i n g out the data i d e n t i f i e r t i n e of a blank data sheet will accomplish the same purpose. A l l information pertaining t o a particular component o r f a i l u r e mode will be deleted.

d. :- To change a data identifier ( L V l ,²² Rogers Commission Report, Volume I, p. 199. o r 3). i t is necessary t o delete the entire record under the old number and re-entrer (add) under a new number. The B999/revision data on computer reports is autmated and p r i n t s the date of the l a t e s t update or revision.

e. Identification of Revisions/Changes: Identify each line changed w i t h a vertical black bar on the l e f t - hand margin of the page.

FMEAKIL Submittal

a. Critical Items List (CIL) Updates will include the following: (1 ) Any new CIL Itens ( 2 ) Updates t o existing items having technical changes affecting the following sections: -- - ( a ) function ( b ) f a i l u r e mode ( c ) f a i l u r e effects (d) c r i t i c a l i t y ( e ) abort c r i t i c a l cmponents ( f ) f a f l u r e detectability (redundancy screen) .' Other changes w i l l be incorporated when pages are s u h i t t e d f o r the above reasons.

¶02463 /21

348

01 NO. 100-26 Page 22 of 34

b. FMEA's Updates o f the FMEA's will be a t six month intervals linked t o nearest scheduled CIL FRR publication. Only those changes related t o the CIL submittals (5 above) and other technical changes wtll be submitted.

¶4.3 IMPLEMENTATION GROUND RULES (See a ls o Appendix B - Ground Rules and Criteria)

4.3.1 HARDWARE CRITICALITY DETERMINATION

Hardware c r i t i c a l i t y will be determined by t h e categorization o f the singular effect of the identified fa ilure mode on the subsystern/vehicle (See FIGURE 10). FIGURE 8 i l l u s t r a t e s the analytical logic f o r c r i t i c a l i t y detennination I o f a l l functional hardware.

Rellability Engineering ide ntifie s hardware where i f redundancy f a i l s the effect would be c r i t i c a l . -

Reliability and Design Engineering jointly identify those equipments '

w i t h (single point) c r i t i c a l i t y 1 or 2 fa ilure modes. Those equipments that. are not c r l t i c a l i t y 1 because they incorporate redundancy are then screened further, a s described i n paragraph 4.1.n. and appropriate entries made i n the FMEA d a d sheet.

NOTE: The C ri t i ca lity of instrumentation and t e s t ports will be assessed according t o the ir function. Test ports, when capped, shall be treated as a structural part of the ccmponent and not be considered further. Where i n s t m e n t a t i o n (e.g., pressure transducer) penetrates the wall of a component or l i n e and structural f a i l u r e of the j o i n t would result i n gross leakage, the fa ilure mode shall be considered a s a fai l ure of t h e component or line. The c r i t i c a l i t y of the instrument- ation. therefore. would not be affected i n such instances.

The c r i t i c a l i t y of those systems which are t o be used only i n the event of an emergency shall be established s t r i c t l y on the basis of dire c t fai l ure effect on crew. vehicle, o r mission, regardless of t h e number of prior fai l ures which must occur before the use of t h e system i s required.

¶02461/22 -~ .. .

349

DI NO. 100-26 Page 23 of 34

A l l other backup or standby equipment (e.g.. re lie f valves. cross-feed valves, etc.) shall 'assigned c r l t i c a l i t y In the n o m l manner.

4.3.2 FUNCTIONAL CRITICALITY DEERMINATION

Functional c r l t l c a l i t y will be determined by the categorlzation o f the e f f e c t on the subsystemlvehlcle o f los s o f a l l redundancy ( l l k e o r unlike) f o r the identified fal l ure mode (See FIGURE 10). FIGURE 8 Illus tra te s t h e analytical ' logic f o r c r l t i c a l l t y determinatlon o f a l l functlonal hardware.

Reliability Engineering ide ntifie s hardware i f a l l l i k e or unlike redundancy f a l l s the e ffe c t vould be c r l t i c a l .

Reliability and Design Englneering jointly identify those equipments with c r i t i c a l l t y 1 R or 2R f a l l u r e modes.

4.3.3 CIL CONTENT CRITERIA

The following classification of fa llure modes will be entered In the CIL: a. All functlonalhardware c r i t i c a l i t y category I l l ' s . 212's. and . 1R2's. b. A11 c r i t i c a l i t y category 1R3's and ZR3's t h a t f a i l one or more redundancy screens. c. All faflure modes t h a t +ccine c r i t i c a l i t y category 1/1 durlng Intact abort.

CIL Se6tion 12.0 - Critical Items List orbite r modifications t o support speclal m i sslons :

This sectlon of the Critical Items List contains those c r i t i c a l Items asscciated with Orbiter subsystems t h a t have been added t o or modified by Orbiter Mlssion Klts t o support special missions. These CIL items will only apply t o specific vehicle missions as noted i h t h i s speclfic CIL subsectlon.

T h i s CIL section contains the single fa ilure paints and c r l t l c a l i t y 1~ and 2R CIL items identifled by the Failure Mode Effects Analysis IFMEA) conducted on t h e Orbiter subsystems tha t have been added t o or modified

¶02463123

350

01 NO. 100-26 Page 24 of 34

t o support 'special mission application. These vehicle changes are Identlfied by individual Mission Klts which are Installed specifically f o r these special missions and wuld be removed when t h C mission objectives have been achieved. Each vehicle change is identifled by a Master Change Record (MCR) and I s referenced i n the applicable FMU.

¶Each c r i t i c a l f a i l u r e mode identified in the vehicle modification ,. section is categorized on a separate Critical Items List form which

Includes the f a i l u r e causes, effects, and rationale f o r retentlon. CIL dispositions and rationale are contained on individual CIL sheets and those t h a t are generally applicable t o a l l components are contained i n Section 3.0.

A c r i t l c a l Items l i s t suinnary I s Included for each maor vehicle modification. Additions w i l l be made t o t h i s CIL section t o maintain t h i s document current with t h e vehicle f l i g h t configuration. CIL page revisions are Indicated by revision date.

NOTE: Prfor t o each CIL submittal, notify t h e CIL coordinator of any input t o CIL Section 12.0.

4.3.4 MECHANICAL/ELECTRICAL INTERFACE

For mechanical components having an electrical Interface, the mechanical FMEA will consider only the effects of 'black box' functional failure (e.g., 10SS Where i t becomes necessary t o conduct an of o u t p u t , premature signal. etc.). FMEA wlthin the 'black box" because of the assigned c r l t i c a l i t y (1 or 2). the MEA will be conducted by Avionics Reliability who w i l l be provided w i t h the following Infonnation i n the mechanical FMEA regarding t h e failure effects on the mechanical system:

a. En& under "CAUSE" (5380). each applicable failure mode of t h e electro- mechanical device reflecting the avionics ma1 function causing the failure mode; i .e.. loss o f electrical power, premature;electrical signal, etc. I

b. Identify under "REFERENCE OOCUMENTS" (Cll-141, the specific mechanical/ avlonics Interface.

¶0246j/24

¶DI NO. 100-26

Page 25 of — 34

The electrical interface FMEA will be included in the appropriate section of the avionics FMEA. For c r i t i c a l i t y 1. lR,²² Rogers Commission Report, Volume I, p. 199. or 2R f a i l u r e mpdes. the mechanical FMEA, which considers the e f f e c t of 'black box" l o s s of function. wfll indicate i n the 'REMARKS" section t h e avioiics FMEA number o f the "black box". The avionics FMu\ of the 'black box' w i l l contain a similar reference t o the appropriate mechanical FMEA. A t t h e e a r l i e s t point i n time when the mechanical analyst can ascertain t h a t the "black box" is c r i t i c a l i t y 1. 1R.²² Rogers Commission Report, Volume I, p. 199. "or 2R. I t shall be h i s responsibility t o convey t o the Avionics Reliability group copies o f h i s worksheets t o f a c f l i t a t e i n i t i a t i o n o f detafled avionics analysis effort.

4.3.5 INSTRUMENTATION -MF

Instrumentation (e.g.. sensors, signal conditioners, etc.) may be provided by e i t h e r Avionics Instrumentation or by a specific Design group. In e i t h e r case, instrumentation FMFA's will be included i n the FFlEA f o r t h e using subsystem. C r l ti cal f t y 3 f nstrumentation may be 1 f sted on one FMEA form by family o r type. FMEA's f o r c r i t i c a l i t y 1 o r 2 and c r i t i c a l i t y 1 R and 2R i n s t r m n t a t i o n t h a t f a i l a redundancy screen o r t h e screen i s 'HA". will be caapleted i n t h e i r entltety and included i n t h e using subsystem CIL. Avionics Reliabflity will provide support a s required t o identify faflure modes, retention rationale, etc.

A copy of each instrumentation F M d cmpleted by a Mechanical Reliability group wfll be provided t o Avionics Reliability.

4.4 SUPPLIER FMEA UTILIZATION

¶4.4.1 GENERAL

In many instances, depending on the cost, complexity, and s t a t e of development of the design, suppliers will be required t o develop and submft FMEA's reflecting t h e i r area of design responsibility. The submissions w i l l precede the j o i n t supplier/Rockwell POR o r CDR. (See the applicable PORD f o r content requf remennts and submf t t a l schedules. ) FIGURE 9 shows the overall supplier FMEA f l o w a s related t o the in-house effort.

352

01 NO. 100-26 Page 26 of 34

4.4.2 FMEA UTILIZATION

Upon receipt of a supplier FMEA, the responsible RSA will ccmpare the identified failure modes w i t h those called o u t on his corresponding subsystem FMEA and update h l s FMEA a s required (see section 4.2) t o include any failure nodes not already identifled relating t o subsystem effect. Supplier FMEA'S w l l l be reviewed f o r single failure points below t h e black box level by Rockwell and analyzed f o r corrective action directly w i t h the supplier as part of t h e i r design review. Where Rockwell does not concur w i t h portions o f the supplier analysis, telephone contact w i t h the supplier Reliability Engineer normally should suffice t o resolve any differences. If not. the matter shall be resolved through normal Rockwell data handling procedures. Supplier black boxes w i l l be identified i n the subsystem FMEA based on the supplier schematic o r drawing part identification number. For c r i t i c a l i t y 1 or 2 and 1R or 2R (CIL only) electronic black boxes, the piece parts ( o r if a l l o r many circuits, so s t a t e ) identified by the supplier FMEA which are single point failures t h a t have a d i r e c t c r i t i c a l e f f e c t on the vehicle will be described w i t h reference t o the supplier FMEA I n the "CAUSE" section Of the applicable failure node identified a t the subsystem level. Parts w i l l be l i s t e d only i n those cases where l e s s than five parts are involved.

4.5 ELEMENT CONTRACTOR FMEA CORRELATION

¶Requirements and procedures f o r conducting interfacing analyses and for element integration tasks are contained in Reliability Desk Instruction 100-12 (Shuttle Element Interface).

¶4.6

¶For items identified as GFE hardware, NASA will identify those which require FMEA's and w i l l perform FMEA's on the hardware identified t o the level defined by t h e i r ground rules. Upon ccinpletion of the FMEA, MASA w i l l provide Rockwell w i t h a copy. In addition t o the completed copy. a preliminary copy may b6 transmitted. Upon receipt of the GFE FMEA, Rockwell will evaluate t h e interface effects on the Orbiter defined by the'GFE FMU.

¶02463 I26

353

01 NO. 100-26 . - Page 27 '34 of

¶Appropriate conrments shall be included t o insure t h a t t h i s area i s correct an'd complete. Rockwell will conduct FMEA'S f o r a l l interfaces between CFE and GFE. The Rockwell FMEA will consider a l l f a i l u r e modes consistent'with t h i s desk instruction. The analysis is t o consider a s a "RUSE" any f a i l u r e mode identified by the GFE FMEA which could produce a failure i n the CFE interface. Where GFE failures are identified a s a 'CAUSE'. the appropriate GFE FUEA and document number shall be identified a s a part of the "CAUSE" section. In addition, those vehicle failures which could cause M U failure modes will be identified t o NASA In the corrments t o t h e GFE FMEA. Uhere structural failures a r e identified, appropriate hazards analyses shall be 1ncl uded 1n avai 1abl e.

¶The accountabllity of CIL items f o r W E will be NASA. Those CIL items resultfng from interface failure modes will be a part of the Rockwll CIL.

¶Exceptions t o t h i s instruction w i l l be identified and concurred i n jointly by Rockwell and NASA and documented a s a part of l e t t e r s of agreement.

¶-___________.I___C ._. .-...--.--.. ----------------.-----

.-_-. I I : I

¶I

I --- o DESIGN o SAFETY o FLT TEST 6 CRD op o QA o RELIABILITY o PRODUCTION OPS I

SINGLE FAILURE POINT

¶CRIT 1 R 6 2 R

I- — 2

¶FIGURE 1 - F k R PROCESS

355

DI NO. 100-26 Page 29 o f 34

356

DI NO. 100-26 Page 30 o f 34

ms ..--. = -................. yY . n

PILYI

¶Jm

m u - 0 , . m,, ...................... ..................... -0 , ...................... -.. .............. Y

0 Y

*I..."¹¹ For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. g8 mid., July 24, 1986, p. 11. ..................... . . Y -., .................. ...................... " ................. p1&

.. Q . C . . . . ..............- a,... . p. ry

Figure 4. Data Sheet No. 1 ...

¶. . .._. -.-- ...

. -.

¶-- Figure 5. Data Sheet No. 2 t .. .

¶Figure 7. Data Printout, Failure Mode-Related Data

Crlt.²² Rogers Commission Report, Volume I, p. 199. Reliability Engr. Detcrminntlnn Crit. IR . I --- Crit. 2R .

Passive hit. 2'5 Crit . 1R o r 2R L

¶Fracture Can Redundancy Control be Checked Out Crit.lR,ZR

During Ground Turnaround OR . - Is Redundancy Screens

¶MPA Rcq'd Status Availablr (ldentlfy During F l i g h t Potent 101

OR Are Redundant 7- Elements Un- Not Included i n susceptible t o , Crltical Itear List Loss from a Single Credible Event

¶FIGURE 8 - RtEA SCnEENINC

360

01 NO. 100-2F CW IT I CALITY CATEGORY Page 2 of2

CROSS GEFEGENCE TAGLE

¶_-

I CRITICALITY ' CATEGORY I

¶FlGURE 10

361

¶DI NO. 100-26

APPENDIX A

¶Page 1of 2

'FAILURE EFFECTS

¶(A) ON FUNCTION OR SUBSYSTEM:

No Effect Loss o f Redundancy Functional Degradation Subsystem Degradation Loss of Function Loss of Subsystem

¶(8) ON INTERFACE FUNCTIONS OR SUBSYSTEMS:

No Effect Loss o f Interface Redundancy Degradation of Interface Function Degradation of Interface Subsystem Loss of Interface Function Loss of Subsystem

¶(C) ON MISSION:

¶NO E f f e c t

: See Note Below f o r C r i t i c a l i t y 2 Modes Mission Modification Loss of E n t r y Capability -Rescue

¶(0) ON CREW/VEHICLE:

NO t t t e c t Possible Loss of Crew/Vehicle (Specify) Probable Loss of Crew/Vehicle (Conditfons) Loss o f Crew/Vehicle *

NOTE: The following instruction i s intended t o c l a r i f y what should be entered i n the FMEAKIL under "EFFECTS ON MISSION" (item C under e n t r y 5240) f o r i d e n t i f i e d c r i t i c a l i t y 2 f a i l u r e modes.

¶C r i t i c a l i t y 2 f a i l u r e (modes) a r e defined as: ( 1 ) s i n g l e f a i l u r e s which would cause 'loss of mission", and ( 2 ) f a i l u r e s wherein the next associated f a i l u r e would cause 10% Of crew/vehicle (Appendix B. Section 3.1.1, Ground Rules, subparagraph 1).

¶The following c h a r t (Mission Effects - C r i t i c a l i t y 2 F a i l u r e Modes) i s included a s a guideline f o r e n t r i e s under "EFFECTS ON MISSION". The term "abort decision" should only be used where there r e a l l y i s a decision.¹¹ For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. g8 mid., July 24, 1986, p. 11. NO. 100-Zd

APPENDIX A

¶Page 2 2 of

¶MISSION EFFECTS - C R I T I C A L I T Y 2 FAILURE MODES

¶LOSS OF C A P A B I L I T Y TO FAILURE MODE AFFECTS ACCOMPLISIMENT OF M I S S I O N 1. ---

(ADD SPECIFICS OF CAPABILITY LOST DUE TO ODJECTIVE(S) ONLY EXRMPLE: JWJEO 6EAR BOX ( S F P I YIIICH PRECLUOES RELEASE

IOEIITIF IEO FAILURE). OR OEPLOYMENT OF A PAYLOAD.

ABORT DECISION I F FAILURE OCCURS PRIOR TO ENTRY LOSS OF REOUNDANCY WHEREIN NEXT ASSOCIATED FAILURE U l L L

CONMITMEIIT. CAUSE LOSS OF CREW/VEtlICLE. EXAMPLES: APU/IIYO, ECLSS FUNCTIONS, POUER GENERATION.

NONE - REDUNDANT SIMULTANEOUS MEANS AVAILABLE SIRULTANEOUS USAGE OF REOUNOANT MEANS TO PERFORM A TIME

¶TO - - - (SPECIFY FUIICTION TO BE PERFORMED.) CRITICAL FUtlCTlON

EXAMPLE: FAILURE'OF ONE OF TWO REOUNOANT PYROTECINIC — 0

DEVICES I N THE SEPARATION SYSTEM. Q, h3

CONTINUE M I S S I O N - OUTY CYCLE SANE AS ABORT.

¶tlOTE: YllEN DECISION IS TIME DEPENDENT: I

ABORT AOA OR A T 0 I F FAILURE OCCURS DURING LOSS OF ONE OMS ENGINE PRECLUOES H I S S I O N COMPLETION.

¶ASCENT PIIASE.

ABORT UNLESS M l S S l O l l CAI4 B E COMPLETED Y!TII ONE MISSION 1 CAN BE COMPLETE0 I F ONE SSME SHUTS OOWN

SSME OUT. . BETUEEN 347.3 AllD 401.5 SECONDS OF ASCENT. MISSION 2 HAS NO ENGIIIE OUT M I S S I O N COMPLETION CAPABILITY.¹¹ For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. g8 mid., July 24, 1986, p. 11. NO. 100-26

APPENDIX B '

¶Page 1 of 6

¶3.0 GROUND RULES AND CRITERIA ..

¶The following ground r u l e s and c r i t e r i a a r e of a general category f o r guidance, a s applicable, i n conducting and i n t e r p r e t i n g an FMEA. The applicable ground r u l e s and crlterla w i l l be a p a r t of t h e informatton which prefaces each FMEA. (See section 3.2. FMEA Content.)

3.1 GENERAL GROUND RULES AND CRITERIA 3.1.1 GROUND RULES

C r i t i c a l i t y d e f i n i t i o n s a r e those delineated i n NHB 5300.4 (10-1). a s i l l u s t r a t e d i n FIGURE 10 ( C r i t i c a l i t y Category Cross Reference Table). For the purpose of t h i s analysis, hardware c r i t i c a l i t y 2 is f u r t h e r defined; i.e., dual redundancy where: a. The f i r s t f a i l u r e would result i n l o s s of mission. b. The next r e l a t e d f a i l u r e would r e s u l t i n l o s s of l i f e / v e h i c l e .

2- CritlCality 1R and 2R assumes f a i l u r e of a l l like and unlike redundancy: A backup item. i f when i t i s c a l l e d upon t o work, performs a function d i f f e r e n t frm the i t e m i t is backing up, i t should be c l a s s i f i e d based upon t h e e f f e c t i f i t . d o e s not work when operated. I f t h e backup item performs t h e same functfon a s t h e Item I t is backing up. t h e backup should be c l a s s i f i e d a s an u n l i k e redundant Item.

Loss of mission is defined a s follows: a. Operation payload i n t e r f a c e hardware f a i l u r e as I t would r e s u l t i n l o s s of payload primary performance. Orbiter subsystem f a i l u r e a s i t would r e s u l t i n unplanned mission b. .. . termination f o r non-safety of f l i g h t reasons.

Categorization of a hardware item by t h e worst case p o t i n t i a l e f f e c t of f a i l u r e of t h a t item w i l l define c r i t i c a l i t y . .. 5. Failure modes t h a t could propagate t o interfacing subsystems Or experiments will be Identified.

¶0246j/30

¶01: NO. 100-26,