MCDONNELL DOUGLAS ASTRONAUTICS COMPANY HOUSTON …€¦ · remote locations. Each MDM_has internal...

MCDONNELL DOUGLAS ASTRONAUTICS COMPANY

HOUSTON DIVISION

SPACE TRANSPORTATION SYSTEMS ENGINEERING AND OPERATIONS SUPPORT

WORKING PAPER NO. 1.0-WP-VA86001-02

INDEPENDENT ORBITER ASSESSMENT

ANALYSIS OF THE DPS SUBSYSTEM

L_

24 OCTOBER 1986

This Working Paper is Submitted to NASA under

Task Order No. VA86001, Contract NAS 9-17650

i

HJ ULowery

PREPARED BY : / --

K.C. Pietz //

PREPARED BY: __

W.A. Haufler/

w

APPROVED

Independent OrbiterAssessment

i i/,;APPROVED BY:._(_- /_ _- ,:_

G.W. EFnori

Technical Manager

Independent Orbiter

Assessment

W.F. Huning

Deputy Program ManagerSTSEOS

/

w

https://ntrs.nasa.gov/search.jsp?R=19900001608 2020-05-16T10:24:53+00:00Z

i

i

i

i

i

i

m

i

Zl

i

aim

if

i

i

ii

il,

w

u

m

u

CONTENTS

1.0 EXECUTIVE SUMMARY

Page

1

2.0 INTRODUCTION 4

2.1 Purpose 4

2.2 Scope 4

2.5 Analysis Approach 4

2.4 DPS Ground Rules and Assumptions 5

3.0 SUBSYSTEM DESCRIPTION

3.1 Design and Function 63.2 Interfaces and Locations 7

3.5 Hierarchy 7

4.0 ANALYSIS RESULTS 18

4.! Analysis Results MDM 19

4.2 Analysis Results GPC 19

4.3 Analysis Results MCDS 19

4.4 Analysis Results DBC 19

4.5 Analysis Results DBIA 19

4.6 Analysis Results MMU 20

4.7 Analysis Results EIU 20

5.0 REPERENCES 21

APPENDIX A ACRONYMS A-I

APPENDIX B DEFINITIONS, GROUND RULES, AND ASSUMPTIONS B-I

B.I

B.2

B.3

Definitions B-2

Project Level Ground Rules and Assumptions B-4

Subsystem Specific Ground Rules and Assumptions B-7

APPENDIX C DETAILED ANALYSIS

APPENDIX D POTENTIAL CRITICAL ITEMS

C-I

D-I

w

z

h..

List of Figures

Figure

Figure

Figure

Figure

Figure

Figure

Figure

Figure

Figure

1 - DPS OVERVIEW ANALYSIS SUMMARY

2 - DPS SUBSYSTEM OVERVIEW

3 - DPS MULTIPLEXER/DEMULTIPLEXER (MDM)

4 - DPS GPC CENTRAL PROCESSING UNIT (CPU)

5 - DPS GPC INPUT/OUTPUT PROCESSOR (IOP)

6 - DPS MCDS FUNCTIONAL BLOCK DIAGRAM

7 - DPS MCDS8 - DPS DATA BUS COUPLERS

9 - DPS MASS MEMORY UNIT (MMU)

Figure I0 - DPS ENGINE INTERFACE UNIT (EIU)

Figure ll - DATA PROCESSING SUBSYSTEM (DPS)

List of Tables

Table

Table

I - SUMMARY OF POSSIBLE FAILURE MODES

AND CRITICALITIES

II - SUMMARY OF POTENTIAL CRITICAL ITEMS

3

8

9

I0

ll

12

13

14

15

16

17

Page

18

18

Page

i

i

mm

l

i

|

m

i iI ]

ms

mm

I

i

i

ii

u

L

=

w

Independent Orbiter Assessment

Analysis of the DPS Subsystem

1.0 EXECUTIVE SUMMARY

The McDonnell Douglas Astronautics Company (MDAC) was selected in

June 1986 to perform an Independent Orbiter Assessment (IOA) of

the Failure Mode and Effects Analysis / Critical Items List

(FMEA/CIL). Direction was given by the STS Orbiter and GFE

Projects Office to perform the hardware analysis using the

instructions and ground rules defined in the Rockwell Desk

Instructions 100-2G. The IOA approach features a top-down

analysis of the hardware to independently determine failure

modes, criticality, and potential critical items. This report

documents the independent analysis results corresponding to the

Orbiter Data Processing System (DPS) hardware.

The DPS hardware is required for performing critical functions of

data acquisition, data manipulation, data display, and data

transfer throughout the Orbiter. Specifically, the DPS hardware

consists of the following components:

o Multiplexer/Demultiplexer (MDM)

o General Purpose Computer (GPC)

o Multifunction CRT Display System (MCDS)

o Data Buses and Data Bus Couplers (DBC)

o Data Bus Isolation Amplifiers (DBIA)

o Mass Memory Unit (MMU)

o Engine Interface Unit (EIU)

W

The IOA analysis process utilized available DPS hardware drawings

and schematics for defining hardware assemblies, components, andhardware items. Each level of hardware was evaluated and

analyzed for possible failure modes and effects. Criticality was

assigned based upon the severity of the effect for each failuremode.

Figure 1 presents a summary of the failure criticalities for each

of the seven major subdivisions of the DPS. A summary of the

number of failure modes, by criticality, is also presented below

with hardware criticality first and functional criticalitysecond.

I Summary of Failure Modes By Criticality (HW/F) I

I...... Jn_ me mmm_m_mm_m.

I Criticality: i/i 2/IR i 2/2 [ 3/IRI 3/2RI 3/3 I TOTAL I

I J i I J I JI Number : 0 2 I 0 [ 56 1 22 I 5 1 85 I4

i

w 1

m

m

m

Figure 1 - DPS OVERVIEW ANALYSIS SUMMARY

2

m

m

For each failure mode identified, the criticality and redundancy

screens were examined to identify critical items. A summary of

potential critical items is presented as follows:

IIIIIIIIIIImIIIIIIII "IIIIIII_

I Summary of Potential Critical Items (HWIF) II ........................... I.I criticality: I Zll I 21ZRI 212 i 31IRI 312RI 313 I TOTAL II I I I I I I I II Number : I 0 I 2 I 0 I 0 I 0 I 0 I 2 I+ +

u

Due to the extensive redundancy built into the DPS the number of

critical items are few. Those identified resulted from premature

operation and erroneous output of the GPCs.

i

w

I

I

I

I

=

wii

w

i

I

2.0 INTRODUCTION

2.1 Purpose

The 51-L Challenger accident prompted the NASA to readdress

safety policies, concepts, and rationale being used in the

National Space Transportation System (NSTS). The Space

Transportation System (STS) Systems office has undertaken the

task of reevaluating the FMEA/CIL for the Space Shuttle design.

The MDAC is providing an independent assessment of the Orbiter

FMEA/CIL reevaluation results for completeness and technical

accuracy.

2.2 Scope

The scope of the independent FMEA/CIL assessment activity _.......

encompasses those Shuttle orbiter subsystems and GFE hardware

identified in the Space Shuttle Independent FMEA/CIL Assessment

Contractor Statement of Work. Each subsystem analysis addresses

hardware, functions, internal and external interfaces, and

operational requirements for all mission phases.

2.3 Analysis Approach

The independen£ anilysis approach is a top-down analysis

utilizing as-built drawings to breakdown the respective subsystem

into components and low-level hardware items. Each hardware item

is evaluated for failure mode, effects, and criticality. These

data are documented in the respective subsystem analysis report,

and are used to assess the NASA and Prime Contractor FMEA/CIL

reevaluation results. The IOA analysis approach is summarized in

the following Steps 1.0 through 3.0. Step 4.0 summarizes the

assessment of the NASA and Prime Contractor FMEAs/CILs that is

performed and documented at a later date.

Step 1.0 Subsystem Familiarization

1.1 Define subsystem functions

1.2 Define subsystem components

1.3 Define subsystem specific ground rules and

assumptions

Step 2.0 Define subsystem analysis diagram

2.1 Define subsystem

2.2 Define major assemblies

2.3 Develop detailed subsystem representations

Step 3.0 Failure events definition3.1 Construct matrix of failure modes

3.2 Document IOA analysis results

m

R

m

l

mi

I

l

[]mm

g

Eimm

i

w

i

U

I

m

I

D

4mi

w

=

N

Step 4.0 Compare IOA analysis data to Rockwell/NASA FMEA/CIL4.1 Resolve differences

4.2 Review in-house

4.3 Document assessment issues

4.4 Forward findings to Project Manager

2.4 DPS Ground Rules and Assumptions

The DPS ground rules and assumptions used in the IOA are defined

in Appendix B. The subsystem specific ground rules were defined

to limit the analysis to single-failed-parts for each failure

mode. A subset of the failure mode keywords were identified for

the DPS team. This allowed for commonality in the analysis

results.

i

w

w

u

3.0 SUBSYSTEM DESCRIPTION

3.1 Design and Function

The DPS consists of that hardware required for data acquisition,

data manipulation, data display, and data transfer on the

Orbiter, and includes the five onboard computers and their

interfaces. Reference Figure 2. More specifically, the DPS

consists of the following components:

m

B

M

mm

m

i. Twelve MDM units which convert and format data at the

remote locations. Each MDM_has internal redundancy and

consists of a Multiplexer Interface Adapter (MIA),

Sequential Control Unit (SCU), Input/Output Module,

Analog To Digital Converter, and Power Supply. They

convert and format serial digital GPC commands into

parallel discrete, digital, and analog data for transfer

to vehicle subsystem hardware. They also convert and

format parallel discrete, digital, and analog data from

vehicle subsystems into serial digital data for

transmission to the GPCs. Reference Figure 3.

2. Five GPCs each consisting of a Central Processing Unit

(CPU) and Input/Output Processor (IOP). The CPU

functionally consists of an Arithmetic Logic Unit, Local

Store, Master Bus Control Unit, Data Flow Multiplexer,

Micro-code control r unit, CPU Timer, Interrupt Logic, Main

Memory Timing Page, Timers, Address Bus Control, Main

Memory, and Power Supply. The IOP contains Control

Monitor, IOP Main Memory, Channel Control, Direct Memory

Access Queue, Arithmetic Logic Units, Local Store, Micro-

code store and Decode, MIAs, and Time-slice and

Multiplexing. One of the functions of the GPCs is to

support guidance, navigation, and control requirements of

the vehicle. They provide for the monitoring and control

of vehicle subsystems. They also check for data

transmission errors and crew input error. Vehicle system

failures and out-of-tolerance conditions are annunciated

by the GPCs. Reference Figure 4 and Figure 5.

3. The MCDS consisting of three Keyboard Units (KU), four

Display Units (DU) and four Display Electronics Units

(DEU). Each KU has a Key, Switch and Light. The DU

consists of X/Y Deflection Amplifiers, Video Amplifiers,

Cathode-Ray Tube, BITE and Power Supplies. The DEU has

an Oscillator, Memory, Key-board Adapter, Symbol

Generator, MIA, Control Logic, BITE, Load Switch, and

Power Supplies. The subsystem provides for crew/vehicle

interface via a keyboard and CRT display. The crew can

interact with the subsystems with keyboard entries and

executions. Reference Figure 6 and Figure 7.

|

mI

I

l

m

n

mm

mm

[]

mm

m

mm

D

m

m

D

D

6 B

zm

w

m

=

4. Thirty serial digital data buses are connected to the Bus

Terminal Units (BTUs) via 227 DBCs. The DBCs are shown

in Figure 8.

5. Two DBIAs provide the amplification necessary to drive

the stubs and provide isolation when the stubs are opened

or shorted at the umbilicals.

6. Two MMUs containing MIAs, Read Electronics, Write

Electronics, Mass Memory Control Logic, Power Supply with

Switch, Tape Transport Mechanism with a motor, tape and

heads. The mass memory unit stores programs for loading

into the GPCs and the MCDS. Reference Figure 9.

7. Three EIUs which provide status and command capability of

the main engines. The EIU contains an MIA, BITE, Status

Buffer, Controller Interface Adapter, Operational

Interface Element, Data Status and Power Supply. The EIU

transfers main engine control commands from the GPC and

main engine status for use by the GPC, the GSE launch

processing system, and the operational instrumentation

system. Reference Figure 10.

The DPS interfaces with many onboard Orbiter systems including

the Main Propulsion System, Solid Rocket Boosters, Reaction

Control System (RCS), Orbital Maneuvering System (OMS), Air

Surface Controls used for guidance and control, Nose-wheel

Steering, and the Master Timing Units.

3.2 Interfaces and Locations

The DPS hardware is located throughout the Orbiter. The

composite data bus network provides the hardware interfaces

between the GPCs and all other avionics subsystems that

communicate via a digital data format. Reference Figure ll.

GPCs 1 and 4 are located in Avionics Bay 1 while GPCs 2 and 5 are

located in Avionics Bay 2, to provide separation of redundancy.

GPC 3 is located in Avionics Bay 3. Each GPC interfaces to all

Flight Critical MDMs, however only one GPC normally communicates

to only one FF and one FA MDM during ascent and entry dynamic

flight.

3.3 Hierarchy

Figure 2 illustrates the hierarchy of the DPS hardware and the

corresponding subcomponents. Figures 3 through i0 comprise the

detailed system representations.

i

>O

%J

Figure

_d

i__iiiiiiiiiiiiiiiiiiiiiii!_iiiiiiiiiiiiiiiiiiiiiiiiii!iii_iZiiiiiiilililiiii_iiiii_iiiiiii_iii_i_i!i_iii_i_illi_i_

_!i!i!!i?!_['_!!_!!!{{_{i!i!i!i[:??_{_::

=========================

;:._ ili}}iiii;iiiiiiii!!i!:;i)!iiiiii:-!i!i!2!il;!;;}iii i

i_,N!iiiiii!iii!i;:?i::i!ililiiii',ii!_i_,;!:!ii;iil;iil::,:

m Z 0

<

t,_Z "-"

.1 0[-, ,..,

m _ v

r_©

°ZU_

_ili!_ :iiii!i!_i!!!i!i!ili!i!iii!i!iii!iii!i!iiiiiiiiiiiii!ii:_!iiii_iii!i_i!_ii!iiiiiiiiiii

i!ii!i_i!iiiii_iiiiiiii,i!ii!iiiii_iiiiiii

!!i!i!_i!!ii!i!_i_i_ii!iiii_iiiiiiiiii!iiiii!i!iii!iliiiiiiiii

:::::::::::::::::::::::::::::::::::

::i::iigi!ij:!i_,_::!_!!ii:J,i!ii!ii!i!i!i!ii!i!i!!ilili!iliiili

:,iii!i_,ii'_i!iiii}iiiii_i!',i::iiiiiiii',ilili',__!i[ii_ii_i!i!i!:!i!i!i_i!i!_!i!:.-'i!iS:.-'._!_!_i:gi_ii!_!_[i:_!:!i:!:!i

¢)

o_,-i

0

o

,o ,-_

t,<

U_

m%-,

< o

z

2 - DPS SUBSYSTEM OVERVIEW

H

g

i

mm

mm

m

mm

I

m

mEm

J

m

mm

mm

I

mm

m

m

8 m

m

w

h

m

-=_

i

m

i

m

Figure 3 - DPS MULTIPLEXER/DEMULTIPLEXER (MDM)

=_

mm

Z

Z

O J

E-Z

r_

1 =- i

0

= I iZ I _

eD t--

Z

rj

rD©

Z

I

i

0

b-

<

_z__

!

I

©

,..1 I< I

o,I

m_

_ _,_1 ml

r/l b-_ i

<Zl<_l

| . | .

II

II

[]

iI

I

II

i

[]

II

II

m

m

m

II

!

m

Figure 4 - DPS GPC CENTRAL PROCESSING UNIT (CPU)

i0

zm

n

i

T m

i

w_

u

i

g

Or_

O

[-

Z

r,,,)

II

II

r,_©

Z

_t

e4i

Z

,I z

i i | i J

I

_T3

--" z_ _1

-'-'l z- b_l"=' "" '<Z

-II .

' I II " ;

i

Figure 5 - DPS GPC INPUT/OUTPUT PROCESSOR (IOP)

ll

Figure 6 - DPS MCDS FUNCTIONAL BLOCK DIAGRAM i

12

I

i

zT :

i

,i.

L

w

b

J

,i.i

, !E-

Z

i <tO• i

I _ _ I _"

81 °ii'I _i _ "

<1 _ I'_ _

_ _I I _ _

" 0 OI= _ _, I_-

_ I c i:_ _' _- i:,

re-- l_

, !

i

i|

IIii

.,.J

Z

ii

EI

LI n ,--i..

_ . iii iiw _ _i: :::1:i: [: :::] :

(iI >"l i"II I ":_iI I :::':

- _.1 ....-" [" _:1 = ..............x>-,,, i"" _ _, [-- ilxl

.i_ _ _._I

" _ I ,-, iFI _al _,Dl

z _" _I Zl <

ELI ,i..] i :

-r--r--_T T _-r __-r _

©

.I

ix-_.l.l

f

-1-

-t-I im

!_l i ,.._1 i _,_

'_l I_

'_i

r--

D

.z.l

i.- C

Ie¢ _i

, 1-

!i!i_i

_.)I_ '_I

T"

i!_iiiii

>:c >:<|

i3_8> i

F:Ii__

7-

i

-T

i--

-F

_ | :.::o _

ill ..... lili:i__!_

_:i:!i::':_{!':ii'!i_'_:

......., _--' 2:

>

-"-" -T "-", I

w

F _

w

Figure 7 - DPS MCDS

13

I

Oo

" t.

_o _ 77_

_Oo

¢I1<[.-,<

V-.Z

O'

<F-,

O099f..v.lLU[..,_ZZ

ZZZZZZZm_ <<

<<<<<<0000_

__000

__ZZ_

I

II

I

I

eII

Im

m

g

I

I

iI

ilII

mm

o

Z

Z >.b-

x

CY

D

I

mg

I

Figure 8 - DPS DATA BUS

14

COUPLERS (DBC) I

I

u

i

_ms

L

w

u

w

Z

I.O_|

>-

, i

m

I< _m i rv_

iw-4 u__

!tz; _'j

I

I<£1

-m

Figure 9 - DPS MASS MEMORY UNIT (MMU)

15

I

2:

pr-

Z ;1.)

<

[-Z

Z

Z

u •

ii-,_

v i

Ii

U;

i_i_i__-

I _ i

i

i

<m_

<

ii.

<

=_

v

m

[]

I

H

I

il

[]

|

-< il

_n m

I

I

iI

"I'-"

II

m

uII

i

II

Figure i0 - DPS ENGINE

16

INTERFACE UNIT (EIU) m

m

u

,wo

i

w

u

m

I

UL

IgG.

_ I -,-_

,,,. _1_"m"i

_,,ll

g::ll

i

11_,iil

I_l I---

Figure ll - DATA PROCESSING SUBSYSTEM (DPS)

17

4.0 ANALYSIS RESULTS

Detail analysis results for each of the identified failure modes

are presented in Appendix C. Table I presents a summary of thefailure criticalities for each of the seven major subdivisions of

the DPS. Further discussion of each of these subdivisions and

the applicable failure modes is provided in subsequent

paragraphs.

OlillllOllliilililii/llilillOOI ililOll

TABLE I Summary of Possible Failure Modes and Criticalities

Criticality:

MDM

GPC

MCDS

DBC

DBIA

MMU

EIU

i/i

!

i

e

i

2/IR

2I

a

w

I

.IIIIIlliiJl

2/2 3/1R 3/2R

- 27 9

- 9 -

- 14 -

-- 1 --

- - I

- - 12

-- 5 --

TOTAL 0 2 0 56 22

3/3 TOTAL

- 36

2 13

1 15

- 1

- 1

1 13

1 6

5 85

Of the 85 failure modes analyzed, no'single faiiures were

determined to result in loss of crew or vehicle, and two were

determined to result in loss of mission. A summary of the ....

potential critical items is presen£ed in Table II. Appendix D

presents a cross reference between each potential critical item

(PCI) and a specific worksheet in Appendix C.

I TABLE II Summary of Potential Critical Items I

I .......... iI Criticality: i i/I l 2/IR I 2/2 1 3/IR I 3/2R I 3/3 1 TOTAL i

I i I I I i I I II GPC l - I 2 i - [ - I - I - [ 2 i

I

I

i

=

m

ms

=

i

=

mm

=

i

m

=.

i

mR

mi

im

mmi

mm

l

I

mmm

m

mmw

18 =

m

m

I

w

w

4.1 Analysis Results MDM

The MDM analysis considered nine failure modes for four groups of

MDMs; namely FF, FA, PF, LF/LA as illustrated in Figure 3. Most

of the criticalities were 3/IR. No PCIs were found.

4.2 Analysis Results GPC

The GPC analysis was subdivided into IOP and CPU failures.

Generic black box failures were analyzed with causes stemming

from failures of the subcomponents such as the MIA, as shown in

Figure 4 and Figure 5. Two PCIs were identified and are listed

in Appendix D.

4.3 Analysis Results MCDS

The MCDS consists of the KU, DU, and DEU. Functional failures of

components were analyzed. These components are shown

functionally in Figure 6 and Figure 7. Nine failure modes were

identified and fifteen worksheets were generated. No PCIs were

identified.

w

m

i

4.4 Analysis Results DBC

Thirty serial digital data buses connect the GPC IOPs to the BTUs

via 227 DBCs. The DBCs functional components are shown in

Figure 8. Two failure modes were identified and one worksheet

was generated. No PCIs were identified.

4.5 Analysis Results DBIA

The DBIAs consist of components required to provide isolation

between the Orbiter Launch/Boost Data Buses and the SRBs and

associated GSE for each. Four failure modes were identified and

one worksheet was generated. No PCIs were identified.

h

D19

r

4.6 Analysis Results MMU

The MMU analysis investigatedfailures in the individual

components of power supply, read and write electronics, tape

transport mechanism, MIA and control logic. These are shown

functionally in Figure 9. The power switch and RPC were also

investigated. Most of the failures were criticality 3/2R. No

PCIs were identified.

4.7 Analysis Results EIU

The EIU provides commands to and status of the Main Engines.

There were no failure modes analyzed that resulted in a PCI being

defined. The EIU is shown functionally in Figure 10.

I

l

=_

n

mmm

z

Bl

mB

m

i

I

m

|

j

D

m

I

_ i

m

m

i

2O mi

I

5.0 REFERENCES

Reference documentation available from NASA and Rockwell was used

in the analysis. The documentation used included the following:

u

N

1. ICD 13M15000, Vehicle/Main Engine Interface Control

Document, Rev. U, 6-18-85

2. JSC-18819, DPS Console Handbook, 8-1-84

3. JSC-19041, MPS System Briefs, 10-1-84

4. JSC-18820, DPS System Briefs, 4-20-85

5. VS70-971102, Integrated System Schematic Rev. D, 9-28-85

6. JSC-17239, Booster Console Handbook, 10-17-85

7. JSC-12770, Shuttle Flight Operations Manual, Volume 5,

Data Processing System, 3-24-84

8. JSC 12820, STS Operational Flight Rules, Final PCN-3,

6-28-85

9. JSC 11174, Space Shuttle Systems Handbook, Rev. C, DCN-5,

9-13-85

i0. 100-2G, Rockwell International Reliability Desk

Instruction Flight Hardware FMEA and CIL, 1-31-84

ii. V72 Vol III, Operations and Maintenance Requirements and

Specification Document - Orbiter OMRSD - DPS, 6-13-86

m

21

i

i

n

I

in

i

m

[]

l

inN

i

|

i

i

i

m

w

m

w

m

m

A/DAIDAIS

ALU

AOA

AOD

ATOBFC

BFS

BITE

BSSBTU

CIL

CPU

CRITCRT

C&W

DBCDBIA

DDU

DEU

DIHDIL

DMA

DOH

DOLDPS

DU

EIUEVA

FA

FCOS

FFFM

FMEAGPC

GSE

IMU

IOAIOM

IOPIPL

KU

LF

LL

LPS

LRLRU

MC

MCDS

MCIU

APPENDIX AACRONYMS

- Analog to Digital- Analog Input Differential

- Analog Input Single-ended

- Arithmetic Logic Unit- Abort Once Around

- Analog Output Differential- Abort To Orbit

- Backup Flight Controller

- Backup Flight System- Built-In Test Equipment

- Backup System Services- Bus Terminal Unit

- Critical Items List

- Central Processing Unit

- Criticality

- Cathode Ray Tube

- Caution and Warning System

- Data Bus Coupler- Data Bus Isolation Amplifier

- Display Driver Unit

- Display Electronics Unit- Discrete Input High

- Discrete Input Low

- Direct Memory Access- Discrete Output High

- Discrete Output Low °

- Data Processing System

- Display Unit- Engine Interface Unit

- Extra Vehicular Activity

- Flight Aft

- Flight Control Operating System- Flight Forward- Failure Mode

- Failure Mode and Effects Analysis

- General Purpose Computer

- Ground Support Equipment- Inertial Measurement Unit

- Independent Orbiter Assessment

- Input/Output Module

- Input/Output Processor- Initial Program Load

- Keyboard Unit- Launch Forward

- Launch Left

- Launch Processing System

- Launch Right

- Line Replaceable Unit

- Memory Configuration- Multifunction CRT Display System

- Manipulator Controller Interface Unit

A-I

MDACMDMMECMIAMMMMUMTUNA

NASA

NSTSOA

OF

OMRS D

OMS

OPSPCI

PCM

PF

RCSRHC

RI

RM

RMSRPC

RS

RTLSSCU

SIO

SMSRB

SSME

STS

SW

TACTAL

TD

THCVDC

- McDonnell Douglas Astronautics Company

- Multiplexer/Demultiplexer- Main Engine Controller

- Multiplexer Interface Adapter

- Major Mode

- Mass Memory Unit- Master Timing Unit

- Not Applicable- National Aeronautics and Space Administration

- National Space Transportation System

- Operational Aft

- Operational Forward- Operational Maintenance Requirements and

Document

- Orbital Maneuvering System

- Operational Sequence- Potential Critical Item

- Pulse Code Modulation

- Payload Forward- Reaction Control System- Rotational Hand Controller

- Rockwell International

- Redundancy Management

- Remote Manipulator System- Remote Power Controller

- Redundant Set

- Return To Landing site

- Sequential Control Unit

- Serial Input / Output- Systems Management- Solid Rocket Booster

- Space Shuttle Main Engine- Space Transportation System-- Software

- Tacan

- Transatlantic .Abort Landing- Touch Down- Translational Hand Controller

- Volts Direct Current

Specifications

I

I

mm

m

[]

m

m

I

I

I

l

z

mm

mm

m

mR

i

mm

i

i

A-2

m

I

z

I

APPENDIX B

m

DEFINITIONS, GROUND RULES, AND ASSUMPTIONS

B.1

B.2

B.3

Definitions

Project Level Ground Rules and Assumptions

Subsystem-Specific Ground Rules and Assumptions

w

u

u

w

B-I

APPENDIX B


B.I Definitions

Definitions contained in Reliability Desk Instruction, 100-2GRockwell International, 31 January 1984, were used with the

following amplifications and additions.

ABORT DEFINITIONS:

RTLS - begins at transition to OPS 6 and ends at transition to

OPS 9, post-flight.

TA___L- begins at declaration of the abort and ends at transition

to OPS 9, post-flight.

AO__AA- begins at declaration of the abort and ends at transition

to OPS 9, post-flight.

AT___O- begins at declaration of the Abort To Orbit (ATO) and endsupon transition out of OPS i.

CREDIBLE (CAUSE) - an event that can be predicted or expected inanticipated operational environmental conditions. Excludes an

event where multiple failures must first occur to result inenvironmental extremes.

EFFECTS/RATIONALE - Description of the case which generated thehlghest criticaiity.

HIGHEST CRITICALITY - The highest criticalities determined in thephase-by-phase analysis.

MAJOR MODE _ - major sub-mode of software operational sequence(oPs).

__MC - Memory Configuration of Primary Avionics Software System(PASS).

MISSION - assigned performance of a specific orbiter flight withpayload/objective accomplishments such as launch window, orbitphasing, and altitude.

MULTIPLE ORDER FAILURE - describes the failure due to a singlecause or event of all units which perform a necessary (critical)function.

NORMAL GROUND TURNAROUND - begins at end of post-landing safingoperations and ends at beginning of prelaunch operations.

OP___SS- software operational sequence.

m

EE

[]

w

m

[]

i

m

m

R

[]

[]

B

mm

g

I

J

m

mm

B-2m

J

u

=

r

PHASE DEFINTIONS:

PRELAUNCH PHASE - begins at Orbiter launch count-down

power-up and ends at moding to OPS Major Mode 102 (liftoff).

LIFTOFF MISSION PHASE - begins with SRB ignition (MM 102) and

ends at transition out of OPS i. (Synonymous with ASCENT).

ONORBIT PHASE - begins at transition to oPs 2 or oPs 8 and

ends upon transition out of OPS 2 or OPS 8.

DEORBIT PHASE - begins at transition to OPS Major Mode301 and ends at first main landing gear touchdown at landing

site.

LANDING/SAFING PHASE - begins at first main geartouchdown at the landing site and ends with the completion of

post-landing safing operations.

READILY DETECTABLE - easily and obviously observable and

comprehensable by flight and/or ground personnel. Readilydetectable requires the capability of getting a crewmember to

respond to a problem notification via real-time monitored

displays, on-board alerts, visual indications, or groundnotification. (Ground notification must not be considered unlesssufficient time is available to perform corrective action to

preclude the critical consequences of the failure, using worst-

case telemetry and data.)

w

w

B-3

APPENDIX BDEFINITIONS, GROUNDRULES, AND ASSUMPTIONS

B.2 IOA Project Level Ground Rules and Assumptions

The philosophy embodied in Reliability Desk Instruction, 100-2GRockwell International, 31 January 1984, was employed with the

following amplifications and additions•

I• The operational flight software is an accurate

implementation of the Flight System Software Requirements

(FSSRs).

RATIONALE: Software verification is out-of-scope ofthis task.

• After Lift-Off, any parameter which is monitored by systemmanagement (SM) or which drives any part of the Caution and

Warning System (C&W) will support passage of Redundancy

Screen B for its corresponding hardware item.

RATIONALE: Analysis of on-board parameter availibility

and/or the actual monitoring by on-board

personnel is beyond the scope of this task.

1 Any data employed with flight software is assumed to be

functional for the specific vehicle and specific mission

being flown•

RATIONALE: Mission data verification is out-of-scope ofthis task.

i

I

w

U

i

i

i

mm

u

i

mm

me

mm

•

•

All hardware (including firmware) is manufactured and

assembled to the design specifications/drawings.

RATIONALE: Acceptance and verification testing is

designed to detect and identify problemsbefore the item is approved for use.

All Flight Data File crew procedures will be assumedperformed as written, and will not include human error in

their performance.

RATIONALE: Failures caused by human operational error

are out-of-scope of this task.

mm

mum

i

u

B-4

i

m

g All hardware analyses will, as a minimum, be performed at

the level of analysis existent within NASA/prime contractor

Orbiter FMEA/CILs, and will be permitted to go to greater

hardware detail levels but not lesser•

RATIONALE: Comparison of MDAC IOA analysis results with

other analyses requires that both analyses

be performed to a comparable level of detail.

w

_ r

--4

m

u

m

u

•

•

•

The presence of a failure detectability parameter in

telemetry is sufficient justification for passing Redundancy

Screen B. Verification that the parameter is actually

monitored by ground based personnel is not required.

RATIONALE: Analysis of mission-dependent telemetryavailability and/or the actual monitoring of

applicable data by ground-based personnel is

beyond the scope of this task.

For the purpose of passing Redundancy Screen A, the term

"normal ground turnaround" shall include the pre!aunch

mission phase.

RATIONALE: Some items cannot be checked out until after

propellant loading or main engine

conditioning begins although the vehicle is

still on the ground• This philosophy was

adopted by the Level II PRCB.

At a minimum, loss of mission is declared when a failure

results in a launch delay beyond the pre-planned launch

window.

RATIONALE: Subsystem failures can occur near thenominal launch time. When these failures

result in a launch delay, a loss of mission

occurs even though the vehicle never enters

into any in-flight mode.

=__

n

i0. The determination of criticalities per phase is based on the

worst case effect of a failure for the phase being analyzed.

The failure can occur in the phase being analyzed or in

any previous phase, whatever produces the worst case effects

for the phase of interest.

RATIONALE: Assigning phase criticalities ensures a

thorough and complete analysis.

B-5

u

_A

ii. The "Next Related Failure" when used in determining hardware

criticality 2 (one failure away from loss of crew/vehicle)is defined as the worst case failure of next redundant item.

This definiton applies only to dual redundancy by definition.

RATIONALE: The RI Desk Instruction Appendix B, 3.1.1.1states the definiton of criticality 2. For

the purpose of this analysis "Next relatedFailure" is clearly defined to ensure

project consistancy.

m

==_

mi

i

m

mm

mim

i

M

mm

i

m

II

g

[]

[]

[]

z

l

I

mI

m

mm i

B-6

m

i

z

=

u

l

w

APPENDIX B


B.3 DPS-Specific Ground Rules and Assumptions

The IOA analysis was performed to the component or assembly level

of the DPS subsystem. The analysis considered the worst caseeffects of the hardware or functional failure on the subsystem,

mission, and crew and vehicle safety.

¥

w

F_i

i

l. Electronics were considered to have the following

credible failure modes.

a. Premature operation

b. Erroneous/erratic output

c. No output

RATIONALE: These failure mode keywords were the

most applicable for the DPS electronics

hardware.

F

w

w

B-7

m

!i

z

Im

ii

m

muii

i

W

IR

m

m _u

II

m 2

B i

um

i

mmm

I

w

l

IB

APPENDIX C

DETAILED ANALYSIS

This section contains the IOA analysis worksheets employed during

the analysis of the DPS subsystem. The information on theseworksheets is intentionally similar to the FMEA's written byRockwell and the NASA. Each of these sheets identifies the item

being analyzed, and parent assembly, as well as the function. Foreach failure mode, the possible causes are outlined, and theassessed hardware and functional criticality for each mission

phase is listed, as described in the Rockwell Desk Instructions100-2G. Finally, effects are entered at the bottom of each

sheet, and the worst case criticality is entered at the top.

LEGEND FOR IOA ANALYSIS WORKSHEETS

w

Hardware Criticalities :

1 = Loss of life or vehicle2 = Loss of mission

3 = Non loss of life or vehicle or mission

Functional Criticalities :

IR = Redundant identical hardware components or redundant

functional paths all of which, if failed, could causeloss of life or vehicle.

2R = Redundant identical hardware components or redundant

functional paths all of which, if failed, could causeloss of mission.

Redundancy Screen A :

1 = Is Checked Out PreFlight2 = Is Capable of Check Out PreFlight

3 s Not Capable of Check Out PreFlight4 = Do Not Know

Redundancy Screens B and C :P = Passed Screen

F = Failed Screen

NA = Not Applicable

w

m

C-I

INDEPENDENTORBITER ASSESSMENT

ORBITER SUBSYSTEM ANALYSIS WORKSHEET

DATE:

SUBSYSTEM:MDAC ID:

10/03/86 HIGHEST CRITICALITYDPS FLIGHT:

100 ABORT:

HDW/FUNC3/IR

3/IR

ITEM:

FAILURE MODE:

MDM FFI,FF2,FF3,FF4LOSS OF OUTPUT TO GPC

LEAD ANALYST: W. A. HAUFLER SUBSYS LEAD: B. ROBB

BREAKDOWN HIERARCHY:

i) DPS2) MULTIPLEXER-DEMULTIPLEXERS (MDM)

3) FLIGHT CRITICAL FORWARD MDM (FFI..4)

4)s)6)v)s)9)

C i TiCALITIESFLIGHT PHASE HDW/FUNC ABORT HDW/FUNC

PRELAUNCH: 3/ 2R RTLS : 3/ IRLIFTOFF: 3/IR TAL: 3/IR

ONORBIT: 3/2R AOA: 3/IR

DEORBIT: 3/IR ATO: 3/IR

LANDING/SAFING: 3/IR

REDUNDANCY SCREENS: A [ 1 ]

LOCATION: AV BAY 1,2,3,2PART NUMBER: MC615-0004-6110,5110

B [ P ] C [ P ]

CAUSES: VIBRATION, CORROSION, CONTAMINATION

EFFECTS/RATIONALE:FCOS SETS COMMFAULT FLAG FOR THAT DATA. APPLICATION SW IGNORES

THAT DATA. FCOS BYPASSES MDM AFTER 2ND CONSECUTIVE COMMFAULT,

AND DISPLAYS FAULT MSG ON CRTS. PORT MODING MAY RECOVER MDM,BUT NOT ALLOWED DURING ASCENT UNTIL AFTER 2ND MDM FAILURE. IF

ALL REDUNDANCY FAILS, LOSE USE OF IMU TORQUING, FORWARD RCS JETS,

HAND CONTROLS (THC,RHC), MOST SWITCHES AND INDICATORS.

REFERENCES:

i

m

I

i

mm

li

mm

R

I

m

E

m

II!B

m

z

I

w

B

C-2

B

n

m

i



DATE: 10/03/86 HIGHEST CRITICALITY

SUBSYSTEM: DPS FLIGHT:

MDAC ID: i01 ABORT:

HDW/FUNC3/IR3/IR

ITEM:

FAILURE MODE:

MDM FFI,FF2,FF3,FF4

LOSS OF OUTPUT TO LRU



l)

2)

3)

4)

S)

6)

V)

8)

9)

DPS

MULTIPLEXER-DEMULTIPLEXERS (MDM)

FLIGHT CRITICAL FORWARD MDM (FFI..4)

CRITICALITIES

FLIGHT PHASE HDW/FUNC ABORT HDW/FUNC

PRELAUNCH: 3/2R RTLS: 3/1R

LIFTOFF: 3/IR TAL: 3/IR




REDUNDANCY SCREENS: A [ 1 ] B [ P ] C [ P ]

LOCATION: AV BAY 1,2,3,2

PART NUMBER: MC615-0004-6110,5110


EFFECTS/RATIONALE:FCOS DOES NOT DIRECTLY DETECT THIS ERROR VIA MDM RETURN WORD

PROCESSING. FAULT TOLERANCE DEPENDS ON REDUNDANT STRINGS TO

VOTING LRUS. DETECTION DEPENDS ON SEPARATE, REDUNDANT FEEDBACK

SIGNALS. IF ALL REDUNDANCY FAILS, LOSE USE OF IMU TORQUING,

FORWARD RCS JETS, HAND CONTROLS (THC,RHC), MOST SWITCHES AND

INDICATORS.

REFERENCES:

C-3



DATE: 10/03/86 HIGHEST CRITICALITY HDW/FUNCSUBSYSTEM: DPS FLIGHT: 3/IR

MDAC ID: 102 ABORT: 3/IR

ITEM: MDM FFI,FF2,FF3,FF4FAILURE MODE: ERRONEOUS OUTPUT TO GPC



I) DPS2) MULTIPLEXER-DEMULTIPLEXERS (MDM)

3) FLIGHT CRITICAL FORW_D MDM (FFI..4) _4)s)6)

8)9)

CRITICALITIES


PRELAUNCH: 3/2R RTLS: 3/IR _LIFTOFF: 3/1R TAL: 3/1R



LANDING/SAFING: 3/iR


LOCATION: AV BAY 1,2,3,2PART NUMBER: MC615-0004-6110,5110



THAT DATA. FCOS BYPASSES MDMAFTER 2ND CONSECUTIVE COMMFAULT,

AND DISPLAYS FAULT MSG ON CRTS. PORT MODING MAY RECOVER MDM, BUTNOT ALLOWED DURING ASCENT UNTIL AFTER 2ND MDM FAILURE. IF ALL

REDUNDANCY FAILS, LOSE USE OF IMU TORQUING, FORWARD RCS JETS,


REFERENCES:

i

i

i

ms

i

i

i

i

|

l

i

d

m

i

z

i

im

C-4 mme

i

m

=

i

m

M





MDAC ID: 103 ABORT:

HDW/FUNC

3/iR

3/IR

ITEM:

FAILURE MODE:

MDM FFI,FF2,FF3,FF4ERRONEOUS OUTPUT TO LRU



i)

2)3)4)s)6)v)s)9)

DPS



CRITICALITIES


PRELAUNCH: 3/2R RTLS: 3/IR



DEORBIT: 3/IR ATO: 3/1R



LOCATION:

PART NUMBER:

AV BAY 1,2,3,2

MC615-0004-6110,5110







INDICATORS.

REFERENCES:

C-5





MDAC ID: 104 ABORT:

HDW/FUNC3/IR3/IR

ITEM:

FAILURE MODE:

MDM FFI,FF2,FF3,FF4PREMATURE OPERATION TO GPC



l)2)3)4)s)6)v)8)9)

DPS


FLIGHT CRITICAL FORWARD MDM (FF1..4)

CRITICALITIES








LOCATION:

PART NUMBER:

AV BAY 1,2,3,2

MC615-0004-6110,5110


EFFECTS/RATIONALE:THIS FAILURE ON EITHER PORT CAN INTERFERE WITH FCOS RETURNING

DATA FROM OTHER BTU(S) AND CAUSE HEALTHY BTU(S) TO BE BYPASSED.

PORT MODING WILL NOT FIX A BLABBING MDM. POWER CYCLING MAY RESET

ELECTRONICS, BUT CANNOT BE PERFORMED DURING ASCENT (POWER

SWITCHES CANNOT BE REACHED), AND WILL NOT ALWAYS STOP PREMATURE

OPERATIONS. IF ALL REDUNDANCY FAILS, LOSE USE OF IMU TORQUING,


INDICATORS.

REFERENCES:

m

[]

m

mm

I

[]

mm

mm

m

i

M

mm

m

m

B

i

I

mm

mm

mm

C-6m

m

m

w

W

w

w

m_

i

w





MDAC ID: 105 ABORT:

HDW/FUNC

3/IR

3/1R

ITEM: MDM FFI,FF2,FF3,FF4

FAILURE MODE: PREMATURE OPERATION TO LRU



l)2)3)4)s)6)v)8)9)

DPS


FLIGHT CRITICAL FORWARD MDM (FF1..4)

CRiTiCALITIES



LIFTOFF: 3/1R TAL: 3/1R


DEORBIT: 3/1R ATO: 3/IR

LANDING/SAFING: 3/1R


LOCATION:

PART NUMBER:AV BAY 1,2,3,2

MC615-0004-6110,5110







INDICATORS.

REFERENCES:

C-7

=

w



DATE: 10/03/86suBSYSTEM: DPS

MDAC ID: 106

ITEM: MDM FFI,FF2,FF3,FF4

FAILURE MODE: SELECTED ALL CHANNELS WRONG

LEAD ANALYST: W. A. HAUFLER

HIGHEST CRITICALITY

FLIGHT:

ABORT:

SUBSYS LEAD: B. ROBB

HDW/FUNC

3/1R3/1


I)2)3)4)s)

8)9)

DPS



CRITICALITIES








LOCATION:

PART _BER:

AV BAY 1,2,3,2

MC615-0004-6110,5110


EFFECTS/RATIONALE:

THE GP¢'S FCOS AND THE _LR_$ WOULD REJE_T_A_L_L_DATA FROM T HA_TMDM

EXCEPT ANY DATA THAT HAPPENED TO BE IN THE SAME FORMAT AS THE

EXPECTED DATA. REDUNDANCY MGT. SOON DETECTS AND BYPASSES THAT

MDM, AND THE EFFECTS OF WRONG DATA INPUT OR OUTPUT IS MINIMIZED.

IF ALL REDUNDANCY FAILS, LOSE USE OF IMU TORQUING, FORWARD RCS

JETS, HAND CONTROLS (THC,RHC), MOST SWITCHES AND INDICATORS.

REFERENCES:

E

m

m

m

m

m

I

mm

|

!

mm

mm

l

l

mm

W

z

m

g

z

mm

C-8gD

mm

i

u

L

w

w





MDAC ID: 107 ABORT:

HDW/FUNC

3/IR

3/IR

ITEM:

FAILURE MODE:MDM FFI,FF2,FF3,FF4STUCK ON A CONSTANT OUTPUT TO LRU



1)

2)

3)

4)s)6)v)8)9)

DPS



CRITICALITIES








LOCATION:


MC615-0004-6110,5110


EFFECTS/RATIONALE:

FCOS DOES NOT DIRECTLY DETECT THIS ERROR VIA MDM RETURN WORD





INDICATORS.

REFERENCES:

m

C-9

INDEPENDENTORBITER ASSESSMENT


DATE: 10/03/86 HIGHEST CRITICALITYSUBSYSTEM: DPS FLIGHT:

MDAC ID: 108 ABORT:

HDW/FUNC

3/IR

3/IR

ITEM:

FAILURE MODE:MDM FFI,FF2,FF3,FF4FALSELY STUCK ON BUSY MODE



1)2)3)4)S)6)7)8)9)

DPS



CRITICALITIES








LOCATION:


MC615-0004-6110,5110

CAUSES: VIBRATION, CORROSION, CONTAMINATION, SCU BUSY CROSS-

STRAP STUCK HIGH



AND DISPLAYS FAULT MSG ON CRTS. PORT MODING MAY RECOVER MDM, BUT

NOT ALLOWED DURING ASCENT UNTIL AFTER 2ND MDM FAILURE. IF ALL

REDUNDANCY FAILS, LOSE USE OF IMU TORQUING, FORWARD RCS JETS,


REFERENCES:

g

I

mR

mm

i

B

EI

m

m

U

Ei

I

I

g

J

m

m

l

m

C-IO

I

I

L

u

m

w

w

k_

u

u

w




MDAC ID: 120 ABORT:

HDW/FUNC3/IR3/IR

ITEM:

FAILURE MODE:

MDM FA1,FA2,FA3,FA4

LOSS OF OUTPUT TO GPC



i)

2)

3)

4)

5)6)v)8)9)

DPS


FLIGHT CRITICAL AFT MDM (FAI..4)

CRITICALITIES







REDUNDANCY SCREENS: A [ 1 ] B[P] C[P]

LOCATION:


MC615-0004-6110,5110






REDUNDANCY FAILS, LOSE USE OF AFT RCS, BODY FLAP, AILERONS,

RUDDER, SPEEDBRAKE, AND ABILITY TO PURGE SSMES AND TANKS.

REFERENCES:

C-ll

INDEPENDENT ORBITER ASSESSMENTORBITER SUBSYSTEM ANALYSIS WORKSHEET


MDAC ID: 121 ABORT:

HDW/FUNC

3/IR

ITEM:FAILURE MODE:

MDM FA1,FA2,FA3,FA4LOSS OF OUTPUT TO LRU



i)2)3)4)S)6)V)S)9)

DPSMULTIPLEXER-DEMULTIPLEXERS

FLIGHT CRITICAL AFT MDM

L

CRITICALITIES

FLIGHT PHASE HDW/FUNC ABORT

PRELAUNCH: 3/2R RTLS:

LIFTOFF: 3/1R TAL:

ONORBIT: 3/2R AOA:DEORBIT: 3/IR ATO:


HDW/FUNO3/IR _3/ZR3/IR3/ZR

REDUNDANCY SCREENS: A [ 1 ] B [ P ] c[P]


PART NUMBER: MC615-0004-6110,5110


EFFECTS/RATIONALE:FCOS DOES NOT DIRECTLY DETECT THIS ERROR VIA MDM RETURN WORDPROCESSING. FAULT TOLERANCE DEPENDS ON REDUNDANT STRINGS TO


SIGNALS. IF ALL REDUNDANCY FAILS, LOSE USE OF AFT RCS, BODYFLAP, AILERONS, RUDDER, SPEEDBRAKE, AND ABILITY TO PURGE SSMES

AND TANKS.

REFERENCES:

I

mm

m

m

I

mm

mm

mm

mm

l

D

i

I

l

I

C-12

g

I

mm

z

w

u

w

I

w

W

w

w





MDAC ID: 122 ABORT:

HDW/FUNC3/IR3/IR

ITEM:

FAILURE MODE:

MDM FA1,FA2,FA3,FA4

ERRONEOUS OUTPUT TO GPC



i)2)3)4)s)6)7)8)9)

DPS


FLIGHT CRITICAL AFT MDM (FA1..4)

CRITICALITIES









PART NUMBER: MC615-0004-6110,5110








REFERENCES:

mmm

C-13



DATE:

SUBSYSTEM:

MDAC ID:


123 ABORT:

HDW/FUNC

3/IR

3/IR

ITEM:

FAILURE MODE:

MDM FA1,FA2,FA3,FA4

ERRONEOUS OUTPUT TO LRU



I)

2)3)4)5)6)T)8)9)

DPS



C_ICALITIES








LOCATION:

PART NUMBER:

AV BAY 4,5,6,6

MC615-0004-6110,5110

CAUSES: VIBRATION, CORROSION, CONTAMINATION _ _




SIGNALS. IF ALL REDUNDANCY FAILS, LOSE USE OF AFT RCS, BODY

FLAP, AILERONS, RUDDER, SPEEDBRAKE, AND ABILITY TO PURGE SSMES

AND TANKS.

REFERENCES:

z

I

mm

mm

mm

m

l

m

l

mm

m

mmm

mmwI

mm

mm

I

mI

i

I

Bi

C-14 mm

g

m

w

=



DATE:

SUBSYSTEM:

MDAC ID:


124 ABORT:

HDW/FUNC

3/1R

311R

ITEM:

FAILURE MODE:

MDM FA1,FA2,FA3,FA4PREMATURE OPERATION TO GPC



l)

2)

3)

4)

5)

6)

V)

s)9)

DPS



CRITICALITIES




ONORBIT: .3/2R AOA: 3/IR




LOCATION:

PART NUMBER:

AV BAY 4,5,6,6

MC615-0004-6110,5110



DATA FROM OTHER BTU(S) AND CAUSE GOOD BTU(S) TO BE BYPASSED.

PORT MODING WILL NOT FIX A BLABBI_GMDM. POWER CYCLING MAY RESET

ELECTRONICS, BUT CANNOT BE PERFORMED DURING ASCENT (POWER

SWITCHES CANNOT BE REACHED), AND WILL NOT ALWAYS STOP PREMATURE

OPERATIONS. IF ALL REDUNDANCY FAILS, LOSE USE OF AFT RCS, BODY


AND TANKS.

REFERENCES:

w

C-15

=





MDAC ID: 125 ABORT:

HDW/FUNC3/IR3/IR

ITEM:

FAILURE MODE:

MDM FA1,FA2,FA3,FA4

PREMATURE OPERATION TO LRU



I)2)3)4)s)6)7)8)9)

DPS



CRITICALITIES



LIFTOFF: 3/IR TAL:

ONORBIT: 3/2R AOA:

DEORBIT: 3/IR ATO:


HDW/FUNC3/IR3/IR3/IR3/IR


LOCATION:


MC615-0004-6110,5110


EFFECTS/RATIONALE:

FCOS DOES NOTIDIRECTLYDETECT THIS ERROR VIA MDM RETURN WORDPROCESSING. FAULT TOLERANCE DEPENDSON REDUNDANT STRINGS TO



F_, AILERONS, RUDDER, SPEEDBRAKE, _DABILITY TO PURGE SSMES ....

AND TANKS.

REFERENCES:

m

mm

"m

m

m

m

I

mmB

m

I

I

m

mm

m

I

mmmm

c

m ,

s

mm

C-16 m

D

n

u

i

u





MDAC ID: 126 ABORT:

HDW/FUNC3/IR3/IR

ITEM: MDM FAI,FA2,FA3,FA4




i)2)3)4)5)6)v)8)9)

DPS



CRITICALITIES








LOCATION:

PART NUMBER:

AV BAY 4,5,6,6

MC615-0004-6110,5110


EFFECTS/RATIONALE:THE GPC'S FCOS AND THE LRUS WOULD REJECT ALL DATA FROM THAT MDM




IF ALL REDUNDANCY FAILS, LOSE USE OF AFT RCS, BODY FLAP,

AILERONS, RUDDER, SPEEDBRAKE, AND ABILITY TO PURGE SSMES AND

TANKS.

REFERENCES:

w

C-17

u




MDAC ID: 127 ABORT:

ITEM:

FAILURE MODE:

MDM FA1,FA2.FA3,FA4STUC_ ON A CONSTANT OUTPUT TO LRU

HDW/FUNC

3/IR3/IR



l)

2)

3)

4)s)

v)s)9)

DPS



CRITICALITIES

FLIGHT PHASE HDW/FUNC ABORT HDW/FUNCPRELAUNCH: 3/2R RTLS: 3/iR


ONORBIT: 3/2R AOA: 3/!R ....zDEORBIT: 3/IR ATo: 3/IR



LOCATION:

PART NUMBER:

AV BAY 4,5,6,6

MC6i5-0004-6110,5110


EFFECTS/RATIONALE: .........FCOS DOES NOT DIRECTLY DETECT THIS ERROR VIA MDM RETURN WORD





AND TANKS.

REFERENCES:

[]mm

[]

z

I

i

i

[]

[]

m

[]

m

l

I

l

I

mm

C-18

U

mm

n

l





MDAC ID: 128 ABORT:

HDW/FUNC

3/IR3/IR

ITEM:

FAILURE MODE:

MDM FA1,FA2,FA3,FA4

FALSELY STUCK ON BUSY MODE



l)2)3)4)5)6)7)8)9)

DPS



CRITICALITIES








LOCATION:


MC615-0004-6110,5110


STRAP STUCK HIGH







REFERENCES:

C-19



DATE: 10/03/86SUBSYSTEM: DPSMDAC ID: 140

HIGHEST CRITICALITY

FLIGHT:ABORT:

ITEM: MDM PFI,PF2FAILURE MODE: LOSS OF OUTPUT TO GPC

HDW/FUNC

3/IR3/3



l)2)3)4)s)6)v)s)9)

DPS

MULTIPLEXER-DEMULTIPLEXERS (MDM)PAYLOAD FORWARD MDM (PF1..2)

CRITI!__CIALITiES


PRELAUNCH: 3/2R RTLS:LIFTOFF: 3/3 TAL:

ONORB_T: 3/IR AOA:

DEORBIT: 3/3 ATO:

LANDING/SAFING: 3/3

REDUNDANCY SCREENS:

HDW/FUNC3/3

3/33/5113/3

A[ I] B[P] C [ P]

LOCATION: AV BAY 1,2PART NUMBER: MC615-0004-6710,5710


EFFECTS/RATIONALE:FCOS/BSS SETS COMMFAULT FLAG FOR THAT DATA. APPLICATION SWIGNORES THAT DATA. SYSTEM SOFTWARE BYPASSES MDM AFTER 2ND

CONSECUTIVE COMMFAULT, AND DISPLAYS FAULT MSG ON CRTS. PORT

MODING MAY NOT RECOVER MDM. IF ALL REDUNDANCY FAILS, LOSE

ABILITY TO RELEASE, OPEN, CLOSE, AND LATCH PAYLOAD BAY DOORS, ANDABILITY-TO CRADLE AND LATCH RMS ARM WITHOUT AN EVA.

REFERENCES:

l

l

ms

l

i

B

ms

m

i i

I

m

I

mm

m

mm

C-20g

z

ms

m

i

w

w

DATE:

SUBSYSTEM:

MDAC ID:



10/03/86 HIGHEST CRITICALITY

DPS FLIGHT:

141 ABORT:

HDW/FUNC

3/1R3/3

ITEM:

FAILURE MODE:

MDM PFI,PF2LOSS OF OUTPUT TO LRU



l)2)3)4)s)6)7)8)9)

DPS


PAYLOAD FORWARD MDM (PFI..2)

CRITICALITIES



LIFTOFF: 3/3 TAL:

ONORBIT: 3/IR AOA:

DEORBIT: 3/3 ATO:

LANDING/SAFING: 3/3

REDUNDANCY SCREENS: A [ 1 ] B [ P ]

HDW/FUNC

3/3

3/3

3/3

3/3

c[p]

LOCATION: AV BAY 1,2

PART NUMBER: MC615-0004-6710,5710


EFFECTS/RATIONALE:

FCOS/BSS DOES NOT DIRECTLY DETECT THIS ERROR VIA MDM RETURN WORD

PROCESSING. FAULT TOLERANCE DEPENDS ON REDUNDANT PF MDMS.

DETECTION DEPENDS ON SEPARATE, REDUNDANT FEEDBACK SIGNALS. IF

ALL REDUNDANCY FAILS, LOSE ABILITY TO RELEASE, OPEN, CLOSE, AND

LATCH PAYLOAD BAY DOORS, AND ABILITY TO CRADLE AND LATCH RMS ARM

WITHOUT AN EVA.

REFERENCES:

m

w

w

C-21

I



DATE:

SUBSYSTEM:

MDAC ID:


142 ABORT:

ITEM:

FAILURE MODE:

MDM PFI,PF2


HDW/FUNC

3/IR

3/3



l)2)3)4)5)6)v)8)9)

DPS



CRITICALITIES



LIFTOFF: 3/3 TAL:

ONORBIT: 3/1R AOA:

DEORBIT: 3/3 ATO:

LANDING/SAFING: 3/3

HDW/FUNC

3/3

3/3

3/3

3/3



PART NUMBER: MC615-0004-6710,5710


EFFECTS/RATIONALE:

FCOS/BSS SETS COMMFAULT FLAG FOR THAT DATA. APPLICATION SWIGNORES THAT DATA. SYSTEM SOFTWARE BYPASSES MDM AFTER 2ND

CONSECUTIVE COMMFAULT, AND DISPLAYS FAULT MSG ON CRTS. PORT

MODING MAY NOT RECOVER MDM. IF ALL REDUNDANCY FAILS, LOSE

ABILITY TO RELEASE, OPEN, CLOSE, AND LATCH PAYLOAD BAY DOORS, AND

ABILITY TO CRADLE AND LATCH RMS ARM WITHOUT AN EVA.

REFERENCES:

m

l

z

m

m

M

z

I

U

J

M

I

mI

C-22

m

m

w

m




MDAC ID: 143 ABORT:

HDW/FtrNC

3/IR

3/3

ITEM:

FAILURE MODE:

MDM PFI,PF2ERRONEOUS OUTPUT TO LRU



I)2)3)4)s)6)7)8)9)

DPS



CRITICALITIES


PRELAUNCH: 3/2R RTLS: 3/3

LIFTOFF: 3/3 TAL: 3/3

ONORBIT: 3/IR AOA: 3/3

DEORBIT: 3/3 ATO: 3/3

LANDING/SAFING: 3/3



PART NUMBER: MC615-0004-6710,5710


EFFECTS/RATIONALE:

FCOS/BSS DOES NOT DIRECTLY DETECT THIS ERROR VIA MDM RETURN WORDPROCESSING. FAULT TOLERANCE DEPENDS ON REDUNDANT PF MDMS.




WITHOUT AN EVA.

REFERENCES:

C-23

J




MDAC ID: 144 ABORT:

ITEM:

FAILURE MODE:MDM PF1,PF2PREMATURE OPERATION TO GPC

HDW/FUNC3/1R3/3



i)2)3)4)s)6)7)8)9)

DPS


PAYLOAD FORWARD MDM (PF1..2)

CRITICALITIES


PRELAUNCH: 3/2R RTLS: 3/3LIFTOFF: 3/3 TAL: 3/3



LANDING/SAFING: 3/3


LOCATION: AV BAY l, 2PART NUMBER: MC615-0004-6710,5710


EFFECTS/RATIONALE :THIS FAILURE ON EITHER PORT CAN INTERFERE WITH FCOS/BSS RETURNING

DATA FROM OTHER PF MDM AND CAUSE GOOD MDM TO BE BYPASSED. PORTMODING WILL NOT FIX A BLABBING MDM. POWER CYCLING MAY RESET

ELECTRONICS, BUT WILL NOT ALWAYS STOP PREMATURE OPERATIONS. IF

ALL REDUNDANCY FAILS, LOSE ABILITY TO RELEASE, OPEN, CLOSE, ANDLATCH PAYLOAD BAY DOORS, AND ABILITY TO CRADLE AND LATCH RMS ARM

WITHOUT AN EVA.

REFERENCES:

m

I

I

m

I

l

m

[]J

m

m

mR

mm

g

m

I

m

m

i

C-24

g

U

Ru-

i

=-.

o

w



DATE:

SUBSYSTEM:

MDAC ID:


145 ABORT:

HDW/FUNC

3/IR3/3

ITEM:

FAILURE MODE:

MDM PF1,PF2PREMATURE OPERATION TO LRU



l)

2)

3)

4)

S)

6)

7)

8)9)

DPS

MULTI PLEXER- DEMULTI PLEXERS (MDM)

PAYLOAD FORWARD MDM (PFI.. 2)

CRITICALITIES






LANDING/SAFING: 3/3


LOCATION:

PART NUMBER:

AV BAY 1,2

MC615-0004-6710,5710


EFFECTS/RATIONALE:





WITHOUT AN EVA.

REFERENCES:

w

m

C-25




MDAC ID: 146 ABORT:

HDW/FUNC

3/1R

3/3

ITEM: MDM PFI,PF2FAILURE MODE: SELECTED ALL CHANNELS WRONG

LEAD ANALYST: W. A. HAUFLER


l)2)3)4)s)6)v)8)9)

SUBSYS LEAD: B. ROBB

DPS



CRITICALITIES

HDW/FUNC ABORTFLIGHT PHASE

PRELAUNCH: 3/2R

LIFTOFF: 3/3

ONORBIT: 3/1RDEORBIT: 3/3

LANDING/SAFING: 3/3

RTLS:

TAL:

AOA:ATO:

HDW/FUNC3/3

3/3

3/33/3



PART NUMBER: MC615-0004-6710,5710



EXCEPT ANY DATA THAT HAPPENED TO BE IN THE SAME FORMAT AS THEEXPECTED DATA. REDUNDANCY MGT. SOON DETECTS AND BYPASSES THAT


IF ALL REDUNDANCY FAILS, LOSE ABILITY TO RELEASE, OPEN, CLOSE,AND LATCH PAYLOAD BAY DOORS, AND ABILITY TO CRADLE AND LATCH RMSARM WITHOUT AN EVA.

REFERENCES:

iBm

mm

i

n

z

n

mm

l

i

l

w

n

m

[]

i

numB

i

i

BUm

mm

m

C-26 U

mmm

i

m

w





MDAC ID: 147 ABORT:

HDW/FUNC

311R

3/3

ITEM:

FAILURE MODE:

MDM PFI,PF2STUCK ON A CONSTANT OUTPUT TO LRU



i)

2)3)4)s)6)7)B)9)

DPS



CRITICALITIES






LANDING/SAFING: 3/3



PART NUMBER: MC615-0004-6710,5710

B [ P ] C [ P ]


EFFECTS/RATIONALE:





WITHOUT AN EVA.

REFERENCES:

C-27


DATE:

SUBSYSTEM:

MDAC ID:

10/03/86 HIGHEST CRITICALITYDPS FLIGHT:148 ABORT:

HDW/FUNC

3/1R3/3

ITEM:

FAILURE MODE:MDM PFI,PF2FALSELY STUCK ON BUSY MODE



i)2)3)4)5)6)7)8)9)

DPS


PAYLOAD FORWARD MDM (PF1..2)

CRITICALITIES



LIFTOFF: 3/3 TAL: 3/3ONORBIT: 3/IR AOA: 3/3


LANDING/SAFING: 3/3


LOCATION_

PART NUMBER:AV BAY 1,2

MC615-0004-6710,5710

CAUSES: VIB_TION, CORROSION, CONTAMINATION, SCU BUSY CROSS-STRAP STUCK HIGH

EFFECTS/RATIONALE:FCOS/BSS SETS COMMFAULT FLAG FOR THAT DATA. APPLICATION SWIGNORES THAT DATA. SYSTEM SOFTWARE BYPASSES MDM AFTER 2ND

CONSECUTIVE COMMFAULT, AND DISPLAYS FAULT MSG ON CRTS. PORTMODING MAY NOT RECOVER MDM. IF ALL REDUNDANCY FAILS, LOSE

ABILITY TO RELEASE, OPEN, CLOSE, AND LATCH PAYLOAD BAY DOORS, ANDABILITY TO CRADLE AND LATCH RMS ARM WITHOUT AN EVA.

REFERENCES:

l

i

l

I

am

I

_I

mm

M

i

l

im

i

u

l

mum

i

mmm

u

C-28 I

i

n

w

w

w

_=

w

m

u

w

i



DATE:

SUBSYSTEM:

MDAC ID:


180 ABORT:

HDW/FUNC

312R

/NA

ITEM:

FAILURE MODE:

MDM LF1,LA1

LOSS OF OUTPUT TO GPC



I)

2)

3)

4)

5)

6)

7)

8)

9)

DPS


PRELAUNCH FORWARD & AFT MDM (LF,LA)

CRITICALITIES


PRELAUNCH: 3/2R RTLS: /NA

LIFTOFF: /NA TAL: /NA

ONORBIT: /NA AOA: /NA

DEORBIT: /NA ATO: /NA




PART NUMBER: MC615-0004-6610,5600

B [ P ] C [ P ]




AND DISPLAYS FAULT MSG ON CRTS. PORT MODING MAY RECOVER MDM. IF

ALL REDUNDANCY FAILS, LOSE ABILITY OF GSE TO MONITOR AND CONTROL

SYSTEMS WHILE ATTACHED.

REFERENCES:

C-29



DATE : 10/03/86 HIGHEST CRITICALITY HDW/FUNCSUBSYSTEM: DPS FLIGHT : 3/2R

MDAC ID: 181 ABORT: /NA

ITEM: MDM LFI, LAIFAILURE MODE: LOSS OF OUTPUT TO LRU ........


BREAKDOWN HIERARCHY :

I) DPS

2) MULTIPLEXER-DEMULTIPLEXERS (MDM) ......3) PRELAUNCH FORWARD & AFT MDM (LF,LA)

4)s)6)7)s)9)

CRITICALITIES


PRELAUNCH : 3/2R RTLS : /NALIFTOFF : /NA TAL: /NA

ONORBIT : /NA AOA: /NA

DEORBIT : /NA ATO : /NALANDING/SAFING: 3/2R


LOCATION: AV BAY i, 6

PART NUMBER: MC615-0004-6610,5600


EFFECTS/RATIONALE :Fcos DOES NOT D_RECTLY DETE_T T_S E_O_ V!_a MDM RE_ WOR_D _ _PROCESSING. FAULT TOLERANCE DEPENDS ON REDUNDANT STRINGS TO


SIGNALS. IF ALL REDUNDANCY FAILS, LOSE ABILITY OF GSE TO MONITORAND CONTROL SYSTEMS WHILE ATTACHED.

REFERENCES :

m

l

mR

l

ml

!w

I

l

l

za

I

mm

l

|

m

g

z

mmm

i

C-30 I

m

u

w

L

u

t

l-





MDAC ID: 182 ABORT:

HDW/FUNC

3/2R/NA

ITEM:

FAILURE MODE:

MDM LF1,LA1




I)

2)

3)

4)

S)

6)

V)

8)

9)

DPS



CRITICALITIES








LOCATION:


MC615-0004-6610,5600


EFFECTS/RATIONALE:

FCOS SETS COMMFAULT FLAG FOR THAT DATA. APPLICATION SW IGNORES




REDUNDANCY FAILS, LOSE ABILITY OF GSE TO MONITOR AND CONTROLSYSTEMS WHILE ATTACHED.

REFERENCES:

m C-31




MDAC ID: 183 ABORT:

HDW/FUNC

312R

/NA

ITEM:FAILURE MODE:

MDM LFI,LAIERRONEOUS OUTPUT TO LRU



i)

2)3)4)5)6)

8)9)

DPS


PRELAUNCH FORWARD & AFT-MDM°(LF,LA)

CRITICALITIES

FLIGHT PHASE HDW/FUNC ABORTPRELAUNCH: 3/2R RTLS:

LIFTOFF: /NA TAL:ONORBIT: /NA AOA:

DEORBIT: /NA ATO:

_DING/SAFING: 3/2R

HDW/FUNC/NA/NA

/NA

/NA

REDUNDANCY SCREENS: A [ ! ] B [ P ] C [ P ]

LOCATION:PART _BER:

AV BAY 1,6

MC615-0004-6610,5600

CAUSES: VIBRATION, CORROSION, CONTAMINATION ........

EFFECTS/RATIONALE:FCOS DOES NOT DIRECTLY DETECT THIS ERROR VIA MDM RETURN WORD _



SIGNALS. IF ALL REDUNDANCY FAILS, LOSE ABILITY OF GSE TO MONITORAND CONTROL SYSTEMS WHILE ATTACHED.

REFERENCES:

I

miI

m

m

l

l

m

m

mmm

m

m

mmmm

INto

L

mm

m

W

mm

C-32 m

m

E

m

u

m




MDAC ID: 184 ABORT:

HDW/FUNC

3/2R

/NA

ITEM: MDM LF1,LAI

FAILURE MODE: PREMATURE OPERATION TO GPC



l)

2)3)4)5)6)7)s)9)

DPS



CRITICALITIES








LOCATION:

PART NUMBER:

AV BAY 1,6

MC615-0004-6610,5600



DATA FROM OTHER BTU(S) AND CAUSE GOOD BTU(S) TO BE BYPASSED.PORT MODING WILL NOT FIX A BLABBING MDM. POWER CYCLING MAY RESET

ELECTRONICS, BUT WILL NOT ALWAYS STOP PREMATURE OPERATIONS. IF



REFERENCES:

C-33




MDAC ID: 185 ABORT:

HDW/FUNC

3/2R

/NA

ITEM:

FAILURE MODE:MDM LFI,LA1PREMATURE OPERATION TO LRU_ _



l)2)3)4)s)6)v)8)9)

DPS



CRITICALITIESFLIGHT PHASE HDw/FUNC ABORT

PRELAUNCH: 3/ 2R RTLS :

LIFTOFF : /NA TAL:

ONORBIT: /NA AOA:

DEORBIT: /NA ATO:


HDW/FUNC/NA_/NA

/NA/NA


LOCATION: AV BAY 1,6PART NUMBER: MC615-0004-6610,5600


EFFECTS/RATIONALE:FCOS DOES NOT DIRECTLY DETECT THIS ERROR VIA MDM RETURN WORDPROCESSING. FAULT TOLERANCE DEPENDS ON REDUNDANT STRINGS TO


SIGNALS. IF ALL REDUNDANCY FAILS, LOSE ABILITY OF GSE TO MONITORAND CONTROL SYSTEMS wHILE ATTACHED.

REFERENCES:

m

|

m

m

m

m

m

m

[]

[]

m

mm

[]

m

mm

mm

=

im

C-34

m

D





MDAC ID: 186 ABORT:

HDW/FUNC

312R

/NA

ITEM: MDM LF1,LAI




l)

2)3)4)s)6)v)8)9)

DPS



CRITICALITIES








LOCATION:

PART NUMBER:

AV BAY 1,6

MC615-0004-6610,5600






IF ALL REDUNDANCY FAILS, LOSE ABILITY OF GSE TO MONITOR AND

CONTROL SYSTEMS WHILE ATTACHED.

REFERENCES:

C-35



DATE: i0/03/86 HIGHEST CRITICALITYSUBSYSTEM: DPS FLIGHT:

MDAC ID: 187 ABORT:

HDW/FUNC

3/2R/NA

ITEM:

FAILURE MODE:MDM LFI,LA!

STUCK ON A CONSTANT OUTPUT TO LRU



l)2)3)4)s)6)v)s)9)

DPS



CRITICALiTIES








LOCATION:


MC615-0004-6610,5600





SIGNALS. IF ALL REDUNDANCY FAILS, LOSE ABILITY OF GSE TO MONITORAND CONTROL SYSTEMSWHILE ATTACHED.

REFERENCES:

l

|

|

I

im

[]

_=m

[]

i

[]

l

I

z

i

mi

i

C-36

B -

m

w

m

i

DATE:

SUBSYSTEM:

MDAC ID:




188 ABORT:

HDW/FUNC

3/2 /NA

ITEM:

FAILURE MODE:

MDM LF1,LAIFALSELY STUCK ON BUSY MODE



l)

2)

3)4)s)6)T)s)9)

DPS

MULTI PLEXER- DEMULTI PLEXERS (MDM)


CRITICALITIES








LOCATION:


MC615-0004-6610,5600


STRAP STUCK HIGH



AND DISPLAYS FAULT MSG ON CRTS. PORT MODING MAY RECOVER MDM. IF



REFERENCES:

m

C-37

DATE:

SUBSYSTEM:MDAC ID:




201 ABORT:

HDW/FUNC3/1R3/1R

ITEM:FAILURE MODE:

INPUT/OUTPUT pROCE SSOR (!oP)LOSS OF OUTPUT

LEAD ANALYST: T. B. CRIBBS SUBSYS LEAD: B. ROBB


I)

2)3)4)s)6)7)8)9)

DPS

GENERAL PURPOSE COMPUTER (GPC)

INPUT/OUTPUT PROCESSOR (IOP)_i_

CRITICALITIES


PRELAUNCH: 3/2R RTLS: 3/IRLIFTOFF: 3/IR TAL: 3/IR

ONORBIT: 3/2R AOA: 3/1R




LOCATION: AV BAYS

PART NUMBER:

CAUSES: MIA FAILS TO OUTPUT TO DATA BUS DUE TO PIECE/PART

FAILURE FROM CONTAMINATION OR MECHANICAL, THERMAL, OR ELECTRICAL

OVERSTRESS, OR POWER FAILURE

EFFECTS/RATIONALE:LOSS OF A BUS-COMMANDING MIA RESULTS IN LOSS OF A GPC'S ABILITY

TO COMMUNICATE OVER THAT BUS, ATTACHED BUS TERMINAL UNITS

(BTU'S), AND ALL INPUTS AND OUTPUTS CONNECTED TO THOSE BTU'S.DYNAMIC FLIGHT PHASES, WHERE A SINGLE BTU CONTROLS AN ACTUATOR,THE CREW WOULD HAVE TO MANUALLY INTERVENE ON A SINGLE FAILURE,

AND SWITCHING TRANSIENTS COULD ARISE. LOSS OF ALL REDUNDANCY

WOULD CAUSE LOSS OF VEHICLE CONTROL.

IN

REFERENCES: JSC 18820, JSC ii174, JSC 12770

I

i

m

g

mR

m

!mm

I

ms

l

Iu_

m

mm

z

I

l

m

C-38 m

uu

m

m

=m

w

=

L

w



DATE:

SUBSYSTEM:

MDAC ID:


DPS FLIGHT:

202 ABORT:

HDW/FUNC

3/mR3/IR

ITEM:

FAILURE MODE:

INPUT/OUTPUT PROCESSOR (IOP)

ERRATIC/ERRONEOUS OUTPUT



1)2)3)4)5)6)7)s)9)

DPS



CRITICALITIES








LOCATION:

PART NUMBER:

AV BAYS

CAUSES: COMPONENT FAILURE DUE TO CONTAMINATION OR MECHANICAL,

THERMAL, OR ELECTRICAL OVERSTRESS IN MIA, ALU, MUX, LOCAL STORE,

OR MEMORY

EFFECTS/RATIONALE:CRITICAL GPC OUTPUTS ARE VALIDATED BY SUMWORD COMPARISON;

HOWEVER, ERRORS ARE DOWNLINKED AND LOGGED, BUT NOT CORRECTED.

MDM/ACTUATOR HARDWARE CANCELS THE EFFECTS OF AN ERRONEOUS OUTPUT

FROM A SINGLE CHANNEL BY "FORCE FIGHTING", BUT MULTIPLE FAILURES

DURING CRITICAL FLIGHT PHASES WOULD LIKELY RESULT IN LOSS OF

VEHICLE/LIFE.

REFERENCES: JSC 18820, JSC 11174, JSC 12770

w

C-39

w




MDAC ID: 203 ABORT:

HDW/FUNC

2/IR

2/1R

ITEM:FAILURE MODE:

INPUT/OUTPUTPROCESSOR (IOP)PREMATURE OPERATION_



l)2)3)4)s)6)7)8)9)

DPS

GENERAL PURPOSE COMPUTER (GPC) ......INPUT/OUTPUT PROCESSOR (IOP)

CRITICALITIES

FLIGHT PHASE HDW/FUNC ABORTPRELAUNCH: 3/3 RTLS:

LIFTOFF: 2/!R TAL:

ONORBIT: 3/2R AOA:DEORBIT: 2/IR ATO:


HDW/FUNC

2/IR3/1R3/1R_

7


LOCATION: AV BAYS

PART NUMBER:

CAUSES: CONTROL MONITOR, CHANNEL CONTROL, MSC, OR M"ICROCODESTORE FAILURE RESULTS IN INVALID EXECUTION OF PROGRAM. CAUSED BY

PIECE/PART FAILURE.

EFFECTS/RATIONALE:PREMATURE ISSUANCE OF CRITICAL OUTPUTS IS DETECTED BY OTHER GPC'S

IN THE REDUNDANT SET. GPC FAILS TO SYNC AND STRINGS ARE BYPASSEDBY OTHER GPC'S. FAULTY COMMANDS ARE STILL PASSED TO THE ACTUATOR

BY FAILED GPC. PREMATURE COMMANDS TO ACTUATORS DURING DYNAMIC

FLIGHT PHASES WOULD LIKELY RESULT IN LOSS OF VEHICLE/LIFE, IFACTUATOR REDUNDANCY WAS LOST OR IF SIMULTANEOUS LOSS OF TWOOUTPUT CHANNELS.


m

mm

u

!

mm

ms

I

[]

i

U

[]l

|um

I

m

m

mm

U

C-40I

I

m

L L





MDAC ID: 204 ABORT:

HDW/FUNC3/IR3/IR

ITEM:

FAILURE MODE:


ERRONEOUS INPUT



l)2)3)4)s)6)7)8)9)

DPS



CRITICALITIES






LANDING/SAFING: 3/3


LOCATION:

PART NUMBER:

AV BAYS

CAUSES: COMPONENT FAILURE DUE TO CONTAMINATION OR MECHANICAL,

THERMAL, OR ELECTRICAL OVERSTRESS IN MIA, ALU, MUX, LOCAL STORE,

MEMORY, OR DMA QUEUE

EFFECTS/RATIONALE:

CRITICAL GPC/IOP INPUTS ARE VALIDATED THRU PARITY CHECKING.RECURRING INPUT ERRORS RESULT IN EITHER GPC "FAIL-TO-SYNC"

BRINGING DOWN AN ERRING GPC, OR IGNORING INPUTS FROM AN ERRING

MDM VIA A GPC MASK. ERRONEOUS INPUTS, IF PROPAGATED THROUGH THE

GPC, COULD RESULT IN ERRONEOUS COMMAND OUTPUTS AND LOSS OF

VEHICLE/LIFE, IF COMPLETE FUNCTION WAS LOST.


w

C-41




MDAC ID: 205 ABORT:

HDW/FUNC

3/1R3/iR

ITEM:

FAILURE MODE:CENTRAL PROCESSING UNIT (CPU)LOSS OF OUTPUT



l)

2)

3)

4)s)6)7)8)9)

DPS


CENTRAL PROCESSING UNIT (CPU)

CRITICALITIES


PRELAUNCH: 3/3 RTLS: 3/1R



DEORBIT: 3/IR ATO: 3/iR


REDUNDANCY SCREENS:

LOCATION: AV BAYS

PART NUMBER:

A [ 1 ] B [ P ] C [ P ]

CAUSES: CPU FAILS TO FUNCTION DUE TO LOSS OF POWER OR FAILURE OF

MEMORY TIMING PAGE

EFFECTS/RATIONALE:

IN DYNAMIC FLIGHT P_SES WHERE REDUNDANT SET (RS) IS OPERATING,

OTHER GPC'S RECOGNIZE GPC FAILING TO SYNC AND ISSUE FAIL VOTES

AGAINST IT. THE FAILING GPC'S VOTING LOGIC THEN REMOVES IT FROM

THE RS. FOUR RS GPC'S CONT_O_U_IT_CAL FLIGHT FUNCTIONS; IF AT

LEAST THREE ARE LOST, THE 5TH GPC (BACKUP FLIGHT COMPUTER, BFS)

IS ENGAGED. LOSS OF BFS WOULD RESULT IN LOSS OF VEHICLE/LIFE.


g

D

B

m

U

i

L__

B

B

g

m

mmI

m

C-42 D

m

m

w

w

u

w

w

w

W

U

w

u

w

I

w

E

J




MDAC ID: 206 ABORT:

HDW/FUNC3/IR3/IR

ITEM:

FAILURE MODE:


ERRONEOUS/ERRATIC OUTPUT



l)

2)

3)

4)

5)

6)

7)

S)

9)

DPS



CRITICALITIES




ONORBIT: 3/3 AOA: 3/IR




LOCATION:

PART NUMBER:

AV BAYS

CAUSES: CPU OUTPUTS INVALID DATA TO IOP DUE TO MEMORY PARITY

ERROR, OR FAILURE OF MASTER BUS CONTROL, ALU, DATA FLOW MUX, ORLOCAL STORE

EFFECTS/RATIONALE:

CRITICAL GPC OUTPUTS ARE VALIDATED BY SUMWORD COMPARISON TO

OUTPUTS FROM REDUNDANT GPC'S; HOWEVER, DETECTED ERRORS ARE MERELY

LOGGED AND DOWNLINKED WITHOUT CORRECTIVE ACTION. INVALID COMMAND

OUTPUTS ARE PASSED THROUGH BUS TERMINAL UNITS (BTU'S) TO

ACTUATORS WHICH "FORCE FIGHT" THE REDUNDANT COMMANDS IN ORDER TO

VOTE OUT THE ERRONEOUS COMMAND. LOSS OF MORE THAN ONE OUTPUT

CHANNEL TO THE SAME ACTUATOR WOULD REQUIRE CREW INTERVENTION,

POSSIBLY CAUSING UNSTABLE SWITCHOVER TRANSIENTS.


mC-43


DATE:

SUBSYSTEM:MDAC ID:

10/03/86 HIGHEST CRITICALITYDPs FLIGHT:

207 ABORT:

HDW/FUNC3/IR

ITEM:

FAILURE MODE:


DELAYED�PREMATURE�INADVERTENT OPERATION



l)2)3)4)5)6)T)8)9)

DPS

GENERAL PURPOSE COMPUTER (GPC) .......


CRITICALITIES


PRELAUNCH: 3/2R RTLS: 3/IR _LIFTOFF: 3/IR TAL: 3/IR


DEORBIT: 3/1R ATO: 3/IR



LOCATION: AV BAYS

PART NUMBER:

CAUSES: CPU ATTEMPTS TO OUTPUT DATA AT INAPPROPRIATETIME DuE To

PROCESSOR SLOW-DOWN WHILE SERVICING RECURRING I/O ERRORS, FAILURE

OF INTERRUPT LOGIC, OR INTERMITTENCE IN TIMING PAGE.

EFFECTS/RATIONALE:REDUNDANT SET GPC'S SYNC UP BY WAITING FOR SYNC POINT MESSAGESFROM OTHER GPC' S TO iNDIC-ATE COMPLETION OF I--DENTIC_ OPEP_ATIONS.

EXCESSIVE PROCESSOR LOAD COULD REQUIRE ALL GPC'S TO WAIT

EXCESSIVELY, BUT EACH GPC WOULD RECOGNIZE THE SLOW DOWN AND ISSUE

A FAIL-TO-SYNC VOTE, AND THE SLOW GPC'S VOTING LOGIC WOULD REMOVEIT FROM_THE RS. IF PERFORMANCE OF ALL GPC'S WAS DEGRADED DURING

DYNAMIC FLIGHT PHASES, VEHICLE INSTABILITY COULD OCCUR UNLESS

CREW TOOK CONTROL.


I

m

lmm

u

m

m

i

[]

m

mU

l

i

Z

mm

m

Z[]

l

mm

I

mm

C-44 R

_m _--

i °

%

m

D

w

w

w

w

w





MDAC ID: 208 ABORT:

HDW/FUNC

2/1R2/IR

ITEM:

FAILURE MODE:


INADVERTENT OPERATION



l)

2)

3)

4)

5)

6)

7)

8)

9)

DPS



CRITICALITIES


PRELAUNCH: 3/3 RTLS: 2/IR





REDUNDANCY SCREENS: A [ 1 ] SIP] C[P]

LOCATION:

PART NUMBER:

AV BAYS

CAUSES: CPU ATTEMPTS TO OUTPUT DATA ON INCORRECT DATA BUS DUE TO

ERRORS IN MEMORY LOCATIONS CONTAINING CONFIGURATION OR BUS-

STRINGING PARAMETERS.

EFFECTS/RATIONALE:

LOSS OF MEMORY IN BUS ASSIGNMENT TABLE (NBAT) COULD RESULT IN A

GPC ATTEMPTING TO COMMAND A DATA BUS COMMANDED BY ANOTHER GPC.

BOTH EXAMINE THEIR RESPECTIVE NBAT AND ASSUME NO ERROR CONDITION,

AND CONTINUE TRANSMISSION ON THAT SAME BUS. THIS WOULD CAUSE ALL

DATA ON THAT BUS TO BE ERRONEOUS. FURTHERMORE, IDLE BUS IS

CREATED AND 2 COMMAND PATHS ARE LOST. POSSIBLE TO OUTVOTE GOOD

COMMANDS: LOSS OF VEHICLE/LIFE.


C-45


ORBITER SUBSYSTEM ANALYSIS WO_SHEET


MDAC ID: 209 ABORT:

HDW/FUNC

3/33/3

ITEM:FAILURE MODE:

CPU POWERSWITCHFAILS CLOSED



l)2)3)4)s)6)7)s)9)

DPS


CENTRAL PROCESSING UNIT (CPU)CPU POWER SWITCH

CRITICALITIES

FLIGHT PHASE HDW/FUNC ABORT HDW/FUNCPRELAUNCH: 3/3 RTLS: 3/3 _i _

LIFTOFF: 3/3 TAL: 3/3 :_

ONORBIT: 3/3 AOA: 3/3

DEORBIT: 3/3 ATO: 3/3_LANDING/SAFING: 3/3


LOCATION: PANEL 06

PART NUMBER:

CAUSES: CPU POWER SWITCH IS STUCK IN THE "ON" POSITION DUE TO

CONTAMINATION

EFFECTS2RAT_ALE:FLIGHT RULES DICTATE THAT THE CREW SHOULD POWER OFF ANY GPC WHICH

HAS RECURRING ERRORS DURING DYNAMIC FLIGHT PHASES, AS SOON AS

POSSIBLE TO AVOID ERRONEOUS OUTPUTS BEING SENT TO ACTUATORS. IFTHE CPU POWER SWITCH WERE STUCK IN THE-_'O_SiTiON AND ANOTHER

GPC BEGAN SENDING ERRONEOUS DATA, THE ACTUATORS COUL_NOT VOTE ........OUT THE ERRONE0_S _Q_NDS AND THEIICRE_ WOULD NEED TO T_KE MANUAL

CONTROL. _ _z_ ? i _ _ : _ :::_


m

U

l

Wammmmm

I

l

l

U

!

II

i i

[] !5

[]

[]=

E_m

m

i il

mmmm

C-46 m

w

w

L_

w

i

w

m

I

w

i

i

L

DATE:

SUBSYSTEM:

MDAC ID:



lo/o3186DPS

210

HIGHEST CRITICALITY

FLIGHT:

ABORT:

HDWIFUNC3/ZR3/1R

ITEM:

FAILURE MODE:

GPC MODE SWITCH

FAILS CLOSED



l)

2)

3)

4)

S)

6)

7)

8)

9)

DPS



GPC MODE SWITCH

CRITICALITIES








LOCATION:

PART NUMBER:

PANEL 06

CAUSES: CPU MODE SWITCH IS STUCK IN THE "HALT" OR "STANDBY"

POSITION DUE TO CONTAMINATION

EFFECTS/RATIONALE:IF THE MODE SWITCH FOR A GPC WERE STUCK IN A NON-RUN POSITION THE

GPC WOULD IN EFFECT BE DISABLED, SIMILAR TO FAILING TO HALT. THE

REMAINING GPC'S WOULD IGNORE THIS GPC, AND THE GPC WOULD NOT BE

AVAILABLE AS A BACKUP OR REDUNDANT MEMBER. IF ALL GPC'S WERE

STUCK IN THE STANDBY MODE, THE CREW COULD NOT PERFORM CRITICAL

FLIGHT CONTROL FUNCTIONS.


w

C-47

= :




MDAC ID: 211 ABORT:

HDW/FUNC

S/IRS/ZR

ITEM:

FAILURE MODE:

GPC OUTPUT SWITCH

FAILS CLOSED



l)2)s)4)s)6)7)8)9)

DPS



GPC OUTPUT SWITCH

CRITICALITIES



LIFTOFF: 3/IR TAL: 3/iR





LOCATION: PANEL 06

PART NUMBER:

CAUSES: CPU OUTPUT SWITCH IS STUCK IN THE "TERMINATE" OR

"BACKUP" POSITION DUE TO CONTAMINATION

EFFECTS/RAT!ONALE, _L_ _ _i!_ _ iiIF THE OUTPUT SWITCH WERE STUCK IN THE "TERMINATE" POSITION, THIS

WOULD HAVE THE SAME EFFECT OF DISABLING THE GPC'S OUTPUT; ALL

SWITCHES IN THIS POSITION WOULD CAUSE LOSS OF VEHICLE CONTROL.

IF THE SWfTCH-W'2_ES_TUCK -_iN THE "BAcKuP ''_-PO_TION THIS GPC WOULD

ONLY BE AVAILABLE AS BFS. IF ALL SWITCHES IN "BACKUP" GPC 5

WOULD BE BAC_P WHEN ENGAGED.


I

mm

mm

I

B

!m

|!

lg

R

mm

Rg

i

mm

II

lm

w

I

C-48 mm

mm

u

L

-tu

L

m



DATE:

SUBSYSTEM:

MDAC ID:


212 ABORT:

HDW/FUNC

3/33/3

ITEM:

FAILURE MODE:

IPL SOURCE SWITCH

FAILS OPEN



l)2)3)4)s)6)7)s)9)

DPS



MMU INITIAL PROGRAM LOAD (IPL) SOURCE SWITCH

CRITICALITIES

FLIGHT PHASE HDW/FUNC ABORT HDW/FUNCPRELAUNCH: 3/3 RTLS: 3/3


ONORBIT: 3/3 AOA: 3/3DEORBIT: 3/3 ATO: 3/3

LANDING/SAFING: 3/3


LOCATION:

PART NUMBER:

PANEL 06

CAUSES: IPL SELECTOR SWITCH IS SHORTED OR POWER SOURCE IS LOST

DUE TO CONTAMINATION

EFFECTS/RATIONALE:IPL SOURCE SWITCH IS USED AT PRE-LAUNCH TO INITIALIZE GPC'S.

THIS FAILURE COULD CAUSE LOSS OF A MISSION OPPORTUNITY DUE TOLAUNCH DELAY. DURING FLIGHT THE GPC'S ARE NOT TYPICALLY RE-

IPL'ED, EVEN THOUGH THE MMU IS USED TO RETRIEVE NEW MEMORY

OVERLAYS (AS OPPOSED TO THE IPL LOADING THE ENTIRE SYSTEM

SOFTWARE, INCLUDING MCDS INITIALIZATION).


n C-49

m




MDAC ID: 213 ABORT:

HDW/FUNC

3/IR

3/IR

ITEM:

FAILURE MODE:

GPC POWER SWITCH

FAILS OPEN



l)2)3)4)s)6)?)8)9)

DPS


CENTRAL PROCESSING UNIT (CPU)GPC POWER SWITCH

CRITICALITIES


PRELAUNCH: 3/3 RTLS: 3/IRLI FTOFF: 3/IR TAL: 3/IR



LANDING/SAFING: 3/IR ........ " '


LOCATION: PANEL 06PART NUMBER:

B [ P ] C [ P ]

CAUSES: CPU POWER SWITCH IS STUCK IN "OFF" POSITION, OR GPC _ _

POWER IS LOST

EFFECTS/RATIONALE: ....... :IF THE GPC POWER SWITCH WERE STUCK IN THE "OFF" POSITION, THE GPC

COULD NOT FUNCTION, SAME AS CPU LOSS OF OUTPUT.


I

iI

II

i

I

m

I

i'

i

I

I

I

[]

iI

II

m

I

I

I

C-50 I

II



DATE:

SUBSYSTEM:

MDAC ID:


DPS FLIGHT:

300 ABORT:

HDW/FUNC

311R3/IR

ITEM:

FAILURE MODE:

KEYBOARD SWITCH

OPEN/CLOSED

LEAD ANALYST: H J LOWERY SUBSYS LEAD: B. ROBB


i)2)3)4)5)6)7)s)9)

DPS

MULTIFUNCTION CRT DISPLAY SYSTEM (MCDS)

KEYBOARD

SWITCH

CRITICALITIES



LIFTOFF: 3/IR TAL:

ONORBIT: 3/IR AOA:

DEORBIT: 3/IR ATO:


HDW/FUNC

3/IR3/IR3/IR3/IR

REDUNDANCY SCREENS: A [ 1 ] scP] C[P]

LOCATION:

PART NUMBER:

UPPER CREW AREA

CAUSES: MECHANICAL FRACTURE/ CONTAMINATION/ DEBRIS

EFFECTS/RATIONALE:LOSS OF INPUTTING COMMAND CAPABILITY. REDUNDANT HARDWARE WOULD

NOT BE ACCESSIBLE DURING PERIODS OF ANTICIPATED HIGH

ACCELERATION/DEACCELERATION FORCES. IE. i. LIFT-OFF THROUGH MAINENGINE CUT-OFF - APPROXIMATELY 8 MIN 40 SEC; 2. ENTRY THROUGH

SAFEING -APPROXIMATELY 400,000FT (TD -40 MIN) THROUGH SAFEING.

REFERENCES:

C-51



DATE: 10/03/86 HIGHEST CRITICALITYSUBSYSTEM: DPS FLIGHT:MDAC ID: 301 ABORT:

HDW/FUNC3/IR3/IR

ITEM: X/Y DEFLECTION AMPLIFIERS

FAILURE MODE: NO OUTPUT/ERRONEOUS/ERRATIC OUTPUT



I)

2)3)4)s)6)v)s)9)

DPS

MULTIFUNCTION CRT DISPLAY SYSTEM (MCDS)DISPLAY UNIT

X/Y DEFLECTION AMPLIFIERS

FLIGHT PHASE

PRELAUNCH: 3/2R

LIFTOFF: 3/IR

ONORBIT: 3/IR

DEORBIT: 3/IR


REDUNDANCY SCREENS:

C_iTIC_ITIESHDW/_NC ABORT HDW/FUNC

RTLS: 3AIR ii_

TAL: 3/IRAOA: 3/!R

ATO: 3/iR

A [ 1 ] B [ P ] C [ P ] :_ :.

LOCATION:

PART NUMBER:

UPPER CREW AREA

CAUSES: TEMPERATURE STRESS/ CONTAMINATION/ DEBRIS

EFFECTS/RATIONALE:LOSS OF MONITORING CAPABILITY. REDUNDANT HARDWARE WOULD NOT BE

ACCESSIBLE DURING PERIODS OF ANTICIPATED HIGH



REFERENCES:

Hmm

|

ms

a

I

i

[]

m

w i

m

m

mm

m

m

m

C-52 m

m

m

w

n

w

i

w

h




MDAC ID: 302 ABORT:

HDW/FUNC

3/IR3/IR

ITEM:

FAILURE MODE:

VIDEO AMPLIFIER

NO OUTPUT/ERRONEOUS/ERRATIC OUTPUT



i)

2)

3)

4)

5)

6)

7)

S)

9)

DPS


DISPLAY UNIT

VIDEO AMPLIFIER

CRITICALITIES



LIFTOFF: 3/IR TAL:

ONORBIT: 3/IR AOA:

DEORBIT: 3/1R ATO:


HDW/FUNC

3/IR

3/IR

3/IR

3/IR


LOCATION: UPPER CREW AREA

PART NUMBER:

B[P] c[P]

CAUSES: TEMPERATURE STRESS/ CONTAMINATION/ DEBRIS





REFERENCES:

C-53




MDAC ID: 303 ABORT:

HDW/FUNC

311R

311R

ITEM:FAILURE MODE:

CATHODE-RAY TUBE




1)2)3)4)s)6)

s)9)

DPS


DISPLAY UNITCATHODE-RAY TUBE

CRITICALITIES









PART NUMBER:

CAUSES: SHOCK/ TEMPERATURE STRESS/ MECHANICAL FRACTURE/

VIBRATION/ CONTAMINATION/ DEBRIS

EFFECTS/RATIONALE ....LOSS OF MoNIT_GCAPABILITY. REDUNDANT HARDWARE WOULD NOT BE


ACCELERATION/DEACCELERATION FORCES. IE. i. LIFT-OFF THROUGH MAINENGINE CUT-OFF - APPROXIMATELY 8 MIN 40 SEC; 2. ENTRY_THROUGH: : {:_


REFERENCES:

m

mm

I

[]

m

m

m

D

m

I

I

ms

mn

D

mm

z

M

z

I

C-54

m i

w

r-u

L_

m



DATE: 10/03/86 HIGHEST CRITICALITY HDW/FUNC

SUBSYSTEM: DPS FLIGHT: 3/1R


ITEM:

FAILURE MODE:

HI AND LOW VOLTAGE POWER SUPPLIES

NO OUTPUT�ERRONEOUS�ERRATIC OUTPUT



i)

2)

3)

4)

S)

6)

V)

8)

9)

DPS


DISPLAY UNIT

HIGH AND LOW (+/-5, 15, 28 & 80 VDC) VOLTAGE POWER SUPPLIES

CRITICALITIES




ONORBIT: 3/IR AOA: 3/IR

DEORBIT: 3/IR ATO: 3/!R



LOCATION:

PART NUMBER:

UPPER CREW AREA

CAUSES: MECHANICAL FRACTURES/ CONTAMINATION/ DEBRIS

EFFECTS/RATIONALE:

LOSS OF MONITORING CAPABILITY. REDUNDANT HARDWARE WOULD NOT BE


ACCELERATION/DEACCELERATION FORCES. IE. i. LIFT-OFF THROUGH MAIN

ENGINE CUT-OFF - APPROXIMATELY 8 MIN 40 SEC; 2. ENTRY THROUGH


REFERENCES:

C-55

DATE:

SUBSYSTEM:

MDAC ID:




305 ABORT:

HDW/FUNC3/1R3/1R

ITEM:

FAILURE MODE:

RPC

OPEN/CLOSED/PREMATuR_OPE_ION



4)S)6)?)8)9)

i) DPS

2) m3LTIFUNCTIONCRT 0ZSP_Y SYSTEM (MOOs)...._3 ) DISPLAY UNIT

RPC

CRITICALITIES


PRELAUNCH: 3/2R RTLS: 3/IRLIFTOFF: 3/IR TAL: 3/iR





LOCATION: UPPER CREA AREA

PART NUMBER:

CAUSES: MECH_ICAL FRACTURE/ CONTAMINATION/ DEBRIS

EFFECTS/RATIONALE:LOSS OF MONITORING cAPABILITY. REDUNDANT HARDWARE WOULD NOT BE

ACC_S_BL_bURING PERIODS OF ANTi_ATE_ _ _HI_CH_ ..... _.................

ACCELERATION/DEACCELERATIONFORCES. IE. 1. LIFT-OFF THROUGH_NENGINE CUT-OFF - APPROXIMATELY 8 MIN 40 SEC; 2. ENTRY THROUGH

SAFEING _A_XI_TELY_-40-O_OO0_T _(°T_'4_O_MI_N ) " 'THRO'O_G_°SA-_E_'_ _i

REFERENCES:

I

I

I

I

I

I

I

mi

I

I

[]

I

I

iI

___ igm

i iI _"

i

C-56

i --

w

m

m

L_

w

=

k_.

= :

=

w




MDAC ID: 306 ABORT:

HDW/FUNC3/IR3/IR

ITEM:

FAILURE MODE:

MEMORY




l)

2)

3)

4)

s)6)v)8)9)

DPS


DEU

MEMORY

CRITICALITIES








LOCATION:

PART NUMBER:

UPPER CREW AREA

CAUSES: CONTAMINATION/ DEBRIS





REFERENCES:

w C-57




MDAC ID: 307 ABORT:

HDW/FUNC

311R

311R

ITEM: KEYBOARD ADAPTER

FAILURE MODE: NO OUTPUT/E--RRO-NEOUS/ERRATIC OUTPUT


BREAKDOWN HiE_CHY:

i) DPS2) MULTIFUNCTION CRT DISPLAY SYSTEM (MCDS)

3) DEU4) KEYBOARD ADAPTER

s)6)7)8)9)

CRITICALITIES

FLIGHT PHASE HDW/FUNC ABORT HDW/FUNCPRELAUNCH: 3/2R RTLS: 3/IR

LIFTOFF: 3/1R TAL: 3/IR


DEORBIT: 3/IR ATO: 3/IRLANDING/SAFING: 3/1R


LOCATION:

PART NUMBER:

UPPER CREW AREA


EFFECTS/RATIONALE:LOSS OF INPUTTING COMMAND CAPABILITY. REDUNDANT HARDWARE WOULDNOT BE ACCESSIBLE DURING PERIODS OF ANTICIPATED HIGH

ACCELERATION/DEACCELERATION FORCES. IE. I. LIFT-OFF THROUGH MAINENGINE CUT-OFF - APPROXIMATELY 8 MIN 40 SEC; 2. ENTRY THROUGH


REFERENCES:

u

m

mm

U

mm

I

B

mm

a

wJ

i

|

m

g

u

i

m

g

m

C-58 I

m

r

w

z

u

_===

L

w

mmm

n





MDAC ID: 308 ABORT:

HDW/FUNC

3/IR3/IR

ITEM:

FAILURE MODE:

SYMBOL GENERATOR




l)2)3)4)s)6)T)8)9)

DPS


DEU

SYMBOL GENERATOR

CRITICALITIES








LOCATION:

PART NUMBER:

UPPER CREW AREA







REFERENCES:

C-59





MDAC ID: 309 ABORT:

HDWlFUNC3/IR3/IR

ITEM:

FAILURE MODE:

MIA

NO OUTPUT/ERRONEOUS/ERRAT_OUTPUT



I)

2)3)4)5)6)7)s)9)

DPS


DEU

MIA

CRITICALITIES

FLIGHT PHASE HDW/Fi_NC ABORT

PRELAUNCH: 3/2R RTLS :

LIFTOFF : 3/1R TAL:

ONORBIT : 3/IR AOA:

DEORBIT : 3/IR ATO :

LANDiNG/SAFING : 3/IR

HDW/FUNC

3/IR3/IR

3/IR

3/1R


LOCATION:

PART NUMBER:

UPPER CREW AREA






REFERENCES:

m

m

I

mmm

i

I

I

mmzg

z

Imm

B

l

i

ii

i

mm

i

D

I

g

C-60 mg

I

m

L

w

w

L.

m

w

i




MDAC ID: 310 ABORT:

HDW/FUNC

3/IR3/IR

ITEM:

FAILURE MODE:

CONTROL LOGIC




l)

2)3)4)s)6)v)

9)

DPS


DEU

CONTROL LOGIC

CRITICALITIES









PART NUMBER:






REFERENCES:

C-61





MDAC ID: 311 ABORT:

HDW/FUNC

3/IR

3/IR

ITEM:

FAILURE MODE:

POWER SUPPLIES

NO OUTPUT�ERRONEOUS�ERRATIC OUTPUT



l)

2)

3)

4)

s)6)7)8)9)

DPS


DEU

POWER SUPPLIES (+/-5, 12 & 15 VDC)

FLIGHT PHASE

PRELAUNCH:

LIFTOFF:

ONORBIT:

DEORBIT:

LANDING/SAFING:

CRITICALITIESHDW/FUNC

3/2R3/IR3/IR3/1R3/IR

ABORT

RTLS:

TAL:

AOA:

ATO:

HDW/FUNC

3/IR311R3/IR3/IR


LOCATION:

PART NUMBER:

UPPER CREW AREA


EFFECTS/RATIONALE:LOSS OF MONITORINg CAPABILITY. REDUNDANT HARDWARE WOULD NOT BE


ACCELERATION/DEACCELERATION FORCES. IE. I. LIFT-OFF THROUGH MAINENGINE CUT-OFF - APPROXIMATELY 8 MIN 40 SEC; 2. ENTRY THROUGH


REFERENCES:

D

mB

U

mm

Z

U

m

g

U

= im

mm

Q

mR

g

g

C-62 B

u

=

w

n




MDAC ID: 312 ABORT:

HDW/FUNC

311R

3/IR

ITEM:

FAILURE MODE:

RPC

OPEN/CLOSED/PREMATURE OPERATION



I) DPS

2) MULTIFUNCTION CRT DISPLAY SYSTEM (MCDS)

3 ) DEU

4 ) RPC

s)6)T)s)9)

CRITICALITIES



LIFTOFF: 3/IR TAL:

ONORBIT: 3/IR AOA:

DEORBIT: 3/IR ATO:



HDW/FUNC3/IR3/IR3/IR3/IR

B[P] C[P3

LOCATION:

PART NUMBER:

UPPER CREW AREA

CAUSES:

DEBRIS

TEMPERATURE STRESS/ MECHANICAL FRACTURE/ CONTAMINATION/






REFERENCES:

c-63 C- <



DATE:

SUBSYSTEM:

MDAC ID:


313 ABORT:

HDW/FUNC3/33/3

ITEM:

FAILURE MODE:

LOAD SWITCH

OPEN/CLOSED/PREMATURE OPERATION



1)

2)3)4)5)6)T)8)9)

DPSMULTIFUNCTION CRT DISPLAY SYSTEM (MCDS)

DEU

LOAD SWITCH

CRITICALITIES

FLIGHT PHASE HDW/FUNC

PRELAUNCH: 3/3LIFTO?F: 3/3

ONORBIT: 3/3

DEORBIT: 3/3

LANDING/SAFING: 3/3

ABORTRTLS:

TAL:

AOA:ATO:

HDW/FUNC313_.3/3

3/3

3/3



PART NUMBER:

B [ P ] c[P]


EFFECTS/RATIONALE:DEUS ARE NOT NORMALLY RELOADED DURING A MISSION.NEEDED.

SWITCH IS NOT

REFERENCES:

n

[]

J

z

mm

mmm

l

|

l

[]

[]

!

E

m

m

z

m

C-64 m

I

w

w

i

L

5_

W

w





MDAC ID: 314 ABORT:

ITEM:

FAILURE MODE:

FUNCTION SWITCH

OPEN�CLOSED�PREMATURE OPERATION



i)

2)

3)

4)

S)

6)

V)

8)

9)

DPS


DEU

FUNCTION SWITCH

CRITICALITIES



LIFTOFF: 3/IR TAL:

ONORBIT: 3/IR AOA:

DEORBIT: 3/IR ATO:


REDUNDANCY SCREENS: A [ 1 ] B[P]

HDW/FUNC

3/IR3/IR3/IR3/IR

c[P]

LOCATION:

PART NUMBER:

UPPER CREW AREA


EFFECTS/RATIONALE:IMPROPER MAJOR FUNCTION IDENTIFICATION.

HDW/FUNC

3/IR

3/IR

REFERENCES:

w

C-65




MDAC ID: 315 ABORT:

HDW/FUNC

3/IR

3/IR

ITEM:

FAILURE MODE:

DATA BUS COUPLER (DBC)

OPEN/SHORT



l)

2)

3)

4)S)

6)

V)8)9)

DPS


DBC

CRITICALITIES


PRELAUNCH: 3/2R RTLS:LIFTOFF: 3/IR TAL:

ONORBIT: 3/IR AOA:DEORBIT: 3/IR ATO:


HDW/FUNC

3/1R

3/1R3/1R3/IR


LOCATION: ALL AV BAYS

PART NUMBER:

B[P] c[P]


EFFECTS/RATIONALE:LOSS OF DATA BUS. REDUNDANT HARDWARE WOULD NOT BE ACCESSIBLE

DURING PERIODS OF ANTICIPATED HIGH ACCELERATION/DEACCELERATIONFORCES. IE. i. LIFT-OFF THROUGH MAIN ENGINE CUT-OFF -

APPROXIMATELY 8 MIN 40 SEC; 2. ENTRY THROUGH SAFEING -

APPROXIMATELY 400,000_T (TD -40 MIN) THROUGH SAFEING.

REFERENCES:

mm

i

,,m

U

I

i

m

I

i

I

m

m,,

mmmm

Iii

m

B

i

I

C-66 B

=

m

m

m

rw

m





MDAC ID: 316 ABORT:

ITEM:

FAILURE MODE:

DBIA

OPEN/SHORT/ERRONEOUS/ERRATIC oUTPUT



l)

2)

3)

4)

S)

6)

V)

8)

9)

DPS


DBIA

CRITICALITIES



LIFTOFF: 3/2R TAL:

ONORBIT: /NA AOA:

DEORBIT: /NA ATO:

LANDING/SAFING: /NA

REDUNDANCY SCREENS: A [ 1 ] B [NA ]

HDW/FUNC

3/2R/NA

/NA

/NA

c[P]

LOCATION:

PART NUMBER:

AV BAY 5


EFFECTS/RATIONALE:

LOSS OF ONE COMMAND/DATA PATH.

REFERENCES:

HDW/FUNC

3/2R

/NA

m

w

C-67



DATE: 10/03/86 HIGHEST CRITICALITYSUBSYSTEM: DPS FLIGHT:MDAC ID: 400 ABORT:

HDW/FUNC3/2R

3/2R

ITEM:

FAILURE MODE:

TAPE TRANSPORT MECHANISM

LOSS OF OUTPUT

LEAD ANALYST: K. PIETZ SUBSYS LEAD: B. ROBB


l)2)3)4)s)6)v)8)9)

DPS

MASS MEMORY UNITS (MMU)


CRITICALITIES


PRELAUNCH: 3/2R RTLS: /NA _LIFTOFF: 3/2R TAL: 3/2R


DEORBIT: /NA ATO: 3/2R

LANDING/SAFING: /NA _


LOCATION: AV BAY 1,2PART NUMBER: MC 615-0005

B [ P ] C [ P ]

CAUSES: WORN TAPE OR FOREIGN MATTER ON TAPE, MOTOR FAILURE (WORN

BRUSHES, ETC.), WORN HEADS, FAILURE OF NEGATOR SPRING CAUSINGTAPE SLIPPAGE DUE TO INCORRECT TENSION.

EFFECTS/RATIONALE:

IF BOTH MMUS FAIL, OPS 2 AND 3 SOFTWARE CANNOT BE LOADED.

HOWEVER, OPS 3 CAN BE UPLINKED OR BFS ENGAGED FOR ENTRY.

REFERENCES:

±

mI

mm

m

g

!

[]

m

iB

[]

m

iI

i

m

m

g

I

I

C-68D

i

w

mm

w

m





MDAC ID: 401 ABORT:

HDW/FUNC3/2R3/2R

ITEM:

FAILURE MODE:


ERRONEOUS OUTPUT



l)

2)

3)

4)

S)

6)

V)

8)

9)

DPS



CRITICALITIES






LANDING/SAFING: /NA


LOCATION:

PART NUMBER:

AV BAY 1,2

MC 615-0005

CAUSES: WORN TAPE OR FOREIGN MATTER ON TAPE, TAPE SLIPPAGE DUE

TO INCORRECT TENSION.

EFFECTS/RATIONALE:



REFERENCES:

r_

m

C-69




MDAC ID: 402 ABORT:

HDW/FUNC3/2R3/2R

ITEM:

FAILURE MODE:

READ ELECTRONICSLOSS OF OUTPUT



1)2)3)4)5)6)7)8)9)

DPS

MASS MEMORY UNITS (MMU)READ ELECTRONICS

FLIGHT PHASE HDW/FUNC

PRELAUNCH: 3/2RLI-FTOFF: 3/2R

ONORBIT: 3/2RDEORBIT: /NA

LANDING/SAFING: /NA

REDUNDANCY SCREENS:

CRITICALITIES

ABORT

RTLS:TAL:

AOA:

ATO:

A [ 2 ]

HDW/FUNC

/NA

3/2R312R312R_

B[P] C[P]

LOCATION:PART NUMBER:

AV BAY 1,2MC 615-0005

CAUSES: _ ELECT_ICALFAILURE _ ::_!__

EFFECTS/RATIONALE:IF BOTH MMUS FAIL, OPS 2 AND 3 SOFTWARE CANNOT BE LOADED.HOWEVER, OPS 3 CAN BE UPLINKED OR BFS ENGAGED FOR ENTRY.

REFERENCES:

I

m

mm

z[]

B

m

m

mm

i

[]

[]

mm

u

m :

mm

C-70z :

m

|

m

w

wmm

m

l





MDAC ID: 403 ABORT:

ITEM:

FAILURE MODE:

READ ELECTRONICS

ERRONEOUS OUTPUT



l)

2)

S)

4)

S)

6)

7)

S)

9)

DPS

MASS MEMORY UNITS (MMU)READ ELECTRONICS

CRITICALITIES






LANDING/SAFING: /NA


LOCATION:

PART NUMBER:

AV BAY 1,2

MC 615-a005

CAUSES: ELECTRICAL FAILURE

EFFECTS/RATIONALE:



REFERENCES:

HDW/FUNC3/2R3/2R

r

w

C-71




MDAC ID: 404 ABORT:

ITEM:

FAILURE MODE:

MIALOSS OF OUTPUT



I) DPS2) MASS MEMORY UNITS (MMU)

3) MIA

4)s)6)v)s)9)

CRITICALITIES

FLIGHT PHASE HDW/FUNC ABORT HDW/FUNCPRELAUNCH: 3/2R RTLS: /NA

LIFTOFF: 3/2R TAL: 3/2_


DEORBIT: /NA ATO: 3/2RLANDING/SAFING: /NA


LOCATION:

PART NUMBER:AV BAY 1,2MC 615-0005


EFFECTS/RATIONALE:IF BOTH MMUS FAIL, OPS 2 AND 3 SOFTWARE CANNOT BE LOADED.


REFERENCES:

HDW/FUNC3/2R3/2R

i

mm

I

m[]

i

z

i

mm

l

[]

I

|

m

am

i

m

i

i

i

C-72 i

mm

F

1

w

i

w



DATE: 10/03/86. HIGHEST CRITICALITYSUBSYSTEM: DPS FLIGHT:

MDAC ID: 405 ABORT:

ITEM: MIA

FAILURE MODE: ERRONEOUS OUTPUT



l) DPS

2) MASS MEMORY UNITS (MMU)

3) MIA

4)s)6)v)s)9)

CRITICALITIES






LANDING/SAFING: /NA


LOCATION:



EFFECTS/RATIONALE:



REFERENCES:

HDW/FUNC

3/2R

3/2R

C-73


DATE:

SUBSYSTEM:

MDAC ID:

10/03/86DPS

406

HIGHEST CRITICALITY HDW/FUNC

FLIGHT: 3/2R

ABORT: 3/2R

ITEM:FAILURE MODE:

WRITE ELECTRONICS

LOSS OF OUTPUT



1)2)

3)

4)5)

6)7)s)9)

DPS

MASS MEMORY UNITS (MMU)WRITE ELECTRONICS

CRITICALITIES


PRELAUNCH: 3/2R .....RTLS: ....../_ _LIFTOFF: 3/2R TAL: _3/2R



_DING/SAFING: /NA


LOCATION:



EFFECTS/RATIONALE:IF THE ABILITY TO WRITE TO MMUS WERE LOST, THE MISSION COULD BE

TERMINATED EARLY. NO DANGER TO CREW OR VEHICLE.

REFERENCES:

zD

I

U

I

m

i

i

mmm

B

[]

m

m

i

!

m

B

_I

m

l

g

C-74 U

w

u

n

w





MDAC ID: 407 ABORT:

ITEM: RPC

FAILURE MODE: FAILED OPEN



i) DPS


3 ) POWER SUPPLY

4) RPCS)6)7)8)9)

CRITICALITIES






LANDING/SAFING: /NA



PART NUMBER: MC 615-0005

CAUSES: BROKEN CONTACT

EFFECTS/RATIONALE:



REFERENCES:

HDW/FUNC

3/2R

3/2R

m

C-75



DATE: 10/03/86

SUBSYSTEM: DPS

MDAC ID: 408

HIGHEST CRITICALITY

FLIGHT:

ABORT:

ITEM:

FAILURE MODE:

SWITCH

FAILED OPEN



I) DPS


3 ) POWER SUPPLY

4 ) SWITCH

5)

6)

7)8)9)

FLIGHT PHASE

PRELAUNCH: 3/2R

LIFTOFF: 3/2R

ONORBIT: 3/2R

DEORBIT: /NA

LANDING/SAFING: /NA

REDUNDANCY SCREENS:

CRITICALITIES

HDW/FUNC ABORT HDW/FUNC

" RTLS: 7NATAL: 3/2-R-

AOA: 3/2R

ATO: 3/2R

A [ 1 ] B [ P ]

LOCATION:

PART NUMBER:

AV BAY 1,2

MC 615-0005

c[P]

CAUSES: BROKEN CONTACT

EFFECTS/RATIONALE:


HOWEVER, OPS 3 CAN BE UPLINKED OR BFS ENGAGED FOR ENTRY'

REFERENCES:

HDW/FUNC

3/2R3/2R

I

ms

I

mm

m

m

I

mmm

J

m

J

B

g

mR

C-76 g

I

w

w

u

E,w

zri





MDAC ID: 409 ABORT:

ITEM:

FAILURE MODE:

SWITCH

FAILED CLOSED (ON)



l) DPS


3) POWER SUPPLY

4) SWITCH

5)

6)

7)

S)

9)

CRITICALITIES



LIFTOFF: 3/3 TAL:

ONORBIT: 3/3 AOA:

DEORBIT: /NA ATO:

LANDING/SAFING: /NA

HDW/FUNC/NA

3/3

3/3

3/3


LOCATION:

PART NUMBER:

AV BAY 1,2

MC 615-0005

CAUSES: STRAY PARTICLE

EFFECTS/RATIONALE:NONE

REFERENCES:

HDW/FUNC

3/3

3/3

C-77

I

DATE:

SUBSYSTEM:

MDAC ID:




410 ABORT:

ITEM:

FAILURE MODE:

CONTROL LOGIC

LOSS OF OUTPUT



1)

2)

3)

4)

5)

6)v)s)9)

DPS


CONTROL LOGIC

CRITICALITIES






LANDING/SAFING: /NA



PART NUMBER: MC 615-0005

B [ P ] C [ P ]


EFFECTS/RATIONALE:

IF BOTH MMUS FAIL, OPS 2 OR 3 SOFTWARE CANNOT BE LOADED.


REFERENCES:

HDW/FUNC

312R3/2R

g

mR

i

I

[]

B

mm

l

q

i

U

U

m

l

mm

N

w

C-78

mm

I

mmZ

w

w

w

w

w

=



DATE:

SUBSYSTEM:

MDAC ID:


411 ABORT:

ITEM:

FAILURE MODE:

CONTROL LOGIC

ERRONEOUS OUTPUT



I)

2)

3)

4)s)6)v)s)9)

DPS


CONTROL LOGIC

CRITICALITIES






LANDING/SAFING: /NA


LOCATION:

PART NUMBER:

AV BAY 1,2

MC 615-0005


EFFECTS/RATIONALE:

IF BOTH MMUS FAIL, OPS 2 OR 3 SOFTWARE CANNOT BE LOADED.


REFERENCES:

HDW/FUNC3/2R3/2R

E ....

C-79



DATE:

SUBSYSTEM:

MDAC ID:


DPS FLIGHT:

412 ABORT:

ITEM:

FAILURE MODE:

POWER SUPPLYFAILS OUT OF TOLERANCE OR INTERRUPT



I)

2)

3)

4)

S)

6)

V)

S)

9)

DPS


POWER SUPPLY

CRITICALITIES






LANDING/SAFING: /NA


LOCATION:

PART NUMBER:

AV BAY 1,2

MC 615-0005


EFFECTS/RATIONALE:



OF THESE OPTIONS REQUIRE THE USE OF MMUS.

REFERENCES:

HDW/FUNC3/2R3/2R

NEITHER

I

m

m

[]

mm

mm

mm

l

[]g

|

[]

mm

mm

I

I

m

C-80 mm

w

m

w

m

w

u




MDAC ID: 501 ABORT:

HDW/FUNC3/IR3/1R

ITEM:

FAILURE MODE:

CIA

LOSS OF OUTPUT TO MAIN ENGINE ON ONE CHANNEL

LEAD ANALYST: B. ROBB SUBSYS LEAD: B. ROBB


l)2)3)4)5)6)

s)9)

DPS

ENGINE INTERFACE UNIT (EIU)CONTROLLER INTERFACE ADAPTER

CRITICALITIES




ONORBIT: /NA AOA: 3/IR

DEORBIT: /NA ATO: 3/IR

LANDING/SAFING: /NA


LOCATION:

PART NUMBER:

AV BAY 4,5,6

CAUSES: CONTROLLER INTERFACE ADAPTER FAILS

EFFECTS/RATIONALE:

LOSS OF THROTTLE COMMANDS, SHUTDOWN COMMANDS, LIMIT

INHIBIT/ENABLE COMMANDS, GPC SHUTDOWN COMMANDS, AND MPS DUMPCOMMANDS. LOSS OF ONE OF THREE COMMAND PATHS WILL BE VOTED

INVALID. NO EFFECT ON ENGINE OPERATIONS.

REFERENCES:

=

C-81




MDAC ID: 502 ABORT:

HDW/FUNC

3/!R

ITEM:

FAILURE MODE:

MIA

LOSS OF OUTPUT TO MAIN ENGINE ON ONE CHANNEL



l)2)3)4)5)6)v)s)9)

DPS

ENGINE INTERFACE UNIT (EIU)MULTIPLEXER INTERFACE ADAPTER

CRITICALITIES

FLIGHT PHASE HDW/FUNC ABORTPRELAIYNCH: 3/2R RTLS:

LIFTOFF: 3/IR TAL:

ONORBIT: /NA AOA:DEORBIT: /NA ATO:

LANDING/SAFING: /NA

HDW/FUNC

3/IR3/IR3/1R

3/IR


LOCATION:

PART NUMBER:AV BAY 4,5,6

CAUSES: MULTIPLEXER INTERFACE ADAPTER--FAILS

EFFECTS/RATION_ALE:LOSS OF THROTTLE COMMANDS, SHUTDOWN COMMANDS, LIMIT

INHIBIT/ENABLE COMMANDS, GPC SHUTDOWN COMMANDS, AND MPS DUMPCOMMANDS. LOSS OF ONE OF THREE COMMAND PATHS WILL BE VOTEDINVALID. NO EFFECT ON ENGINE OPERATIONS.

REFERENCES:

g

i

I

!g

l

!

l

l

l

I

IU

I

m

i

m

[]

[]

m

m

l

m

C-82 l

m

w

J

w

w




MDAC ID: 503 ABORT:

HDW/FUNC3/IR3/IR

ITEM: POWER CONTROL SWITCH

FAILURE MODE: LOSS OF OUTPUT TO MAIN ENGINE ON ANY OF THREE

COMMAND CHANNELS



l)

2)

3)

4)

S)

6)v)s)9)

DPS

ENGINE INTERFACE UNIT (EIU)POWER CONTROL SWITCH

CRITICALITIES






LANDING/SAFING: /NA


LOCATION:


CAUSES: EIU POWER CONTROL SWITCH FAILS OPEN

EFFECTS/RATIONALE:LOSS OF ALL COMMANDS AND STATUS OF THE ENGINE FOR THIS FAILURE

MODE THE LOSS OF THE ENTIRE EIU WILL RESULT IN ENGINE SHUTDOWN BY

CREW BY SWITCHING AC POWER TO THE ENGINE TO OFF POSITION.

REFERENCES:

w

C-83





MDAC ID: 504 ABORT:

HDW/FUNC3/IR3/IR

ITEM: INTERNAL POWER SUPPLIES

FAILURE MODE: LOSS OF OUTPUT TO MAIN ENGINE ON ANY OF THREE

COMMAND CHANNELS



l)

2)

3)

4)

5)

6)

7)

B)

9)

DPS

ENGINE INTERFACE UNIT (EIU)

INTERNAL POWER SUPPLIES

CRITICALITIES

FLIGHT-P_SE HbW/FUNC ...........ABO_RT


LIFTOFF: 3/IR TAL:

ONORBIT: /NA AOA:

DEORBIT: /NA ATO:

LANDING/SAFING: /NA

REDUNDANCY sCREENS: A [ 1 ] B [ P ]

HDW/FtmC_311R311R3/IR3/IR

c[p]

LOCATION:

PART NUMBER:

AV BAY 4,5,6

CAUSES: INTERNAL POWER SUPPLIES FAIL

EFFECTS/RATIONALE:

LOSS OF THROTTLE COMMANDS, SHUTDOWN COMMANDS, LIMIT

INHIBIT/ENABLE COMMANDS, GPC SHUTDOWN COMMANDS, AND MPS DUMP

COMMANDS. THE LOSS OF THE ENTIRE EIU WILL RESULT IN ENGINE

SHUTDOWN BY CREW BY SWITCHING AC POWER TO THE ENGINE TO OFF

POSITION.

REFERENCES:

u

zmm

R

mI

B

i

|

|m

msm

[]

m

Dl

B

ml

S

mm

m

C-84 m

[]

i

w

w

w

DATE:

SUBSYSTEM:

MDAC ID:



10/03/86 HIGHEST CRITICALITY HDW/FUNCDPS FLIGHT: 3/IR

505 ABORT: 3/IR

ITEM:

FAILURE MODE:

ENGINES.

CONTROLLER INTERFACE ADAPTER

LOSS OF OUTPUT TO ONE OR THREE GPC ON STATUS OF



l)

2)

3)

4)

5)

6)

7)

8)

9)

DPS

ENGINE INTERFACE UNIT (EIU)

CONTROLLER INTERFACE ADAPTER

CRITICALITIES






LANDING/SAFING: /NA


LOCATION:


CAUSES: CONTROLLER INTERFACE ADAPTER FAILURE

EFFECTS/RATIONALE:NO MAIN ENGINE MONITORING BY ONE OR THREE OF FOUR GPCS. MCC

CONFIRMS COMMAND PATH GOOD BY MONITORING 3-G THROTTLE CONTROL.

IF ENGINE IS NOT OPERATING, THE PUSHBUTTON FOR THE ENGINE MUST BE

USED TO INFORM GUIDANCE FOR PREVALVE CLOSURES. FLIGHT RULE 2-17

PRECLUDES RESTRINGING DURING POWERED ASCENT THROUGH MECO.

REFERENCES:

C-85


DATE : 10/03/86 HIGHEST CRITICALITY HDW/FUNCSUBSYSTEM: DPS FLIGHT : 3/3


ITEM: OIE

FAILURE MODE: LOSS OF OUTPUT TO S-BAND, MAINTENANCE RECORDER, ORLPS T-0 UMBILICAL



I) DPS2) ENGINE INTERFACE UNIT (EIU)

3) OPERATIONAL INTERFACE ELEMENT4)s)6)

s)9)

CRITICALITIES

FLIGHT_P_KAS -_--_ HDW/_C ....... ABORT }{OW/_FUNC

PRELAUNCH: 3/2R RTLS : 3/IR

LIFTOFF: 3/3 TAL: 3/IR

ONORBIT : /NA AOA: 3/IR


LANDING/SAFING: /NA


LOCATION: AV BAY 4,5,6P_T NUMBER:

CAUSES: OPERATIONAL INTERFACE ELEMENT FAILURE

EFFECTS/RATIONALE'_ _ _ iNO FM DATA RECORDING, NO MCC STATUS MONITORING OF ENGINE EXCEPT _IN DOWNLIST DATA FROM GPC.

REFERENCES :

Imm

i

m

Em

mB

m

I

l

mID

B

m

B

M

B

C-86 B

B

i

w

w

u

E

m

W

MDAC ID

203

2O8

APPENDIX D

POTENTIAL CRITICAL ITEMS

ITEMun_u

IOP

CPU

FAILURE MODE

Premature Operation

Inadvertent Operation

D-I

I

B

m

i

mIB

m

ID

II

m

m

m

[]ml

iIR

mmiI

gm

iII

[]

mmmmmB

I

_mmII

|

zm

MCDONNELL DOUGLAS ASTRONAUTICS COMPANY HOUSTON …€¦ · remote locations. Each MDM_has internal...

Documents

Transcript of MCDONNELL DOUGLAS ASTRONAUTICS COMPANY HOUSTON …€¦ · remote locations. Each MDM_has internal...