STi was approached by APL to conduct a Failure Modes and Effects Analysis (FMEA) on the total design of the CONTOUR Observatory, which includes the CONTOUR spacecraft and CRISP, CFI and NGIMS instruments.

Table below shows an example of a FMEA work sheet.

CONTOUR Graph

This analysis identified approximately twenty anomalies in the CONTOUR spacecraft and the associated instruments design. An example of one of the critical anomalies is described below:

Finding #1: If the portion of the circuitry on the motherboard called SIDE_A-B comparator or associated circuitry on the Uplink CCD fails, such that both IEMs indicate the same side selection, then neither IEM will function properly. Eventually this will cause a critical C&DH failure. This situation cannot be remedied from ground because the spacecraft would no longer be able to distinguish between the two IEMs.

SIDE_A-B defines the C&DH processor virtual address for decoding commands and the remote terminal address of the G&C processor. Also directly available to the C&DH processor is the 1553BC-RT control that could be used to separate the intended processor to execute commands.

The critical command decoder only executes relay commands. Both CCDs may execute these commands in parallel (although this operation is not intended).

Recommendation #1: Use a second unique A/B indicator as a redundancy if such an indicator is available to the IEM.

The 1553BC-RT_B1/B2 signal is available to the C&DH card. (Note that the C&DH Processor only communicates with the G&C Processor over the 1553 Bus. Since they are not linked through the IEM backplane, a C&DH has no way of telling which G&C Processor it is sharing an IEM with.)

Another possibility is to record the A/B indicator in software at power-up. However, how is this made permanent? A bus undervoltage situation, causing temporary shut-off of the IEM converters, would erase any information stored in a register or in memory. If there are no other technical issues associated with it, the A/B indicator can be registered in the EEPROMs by command, and periodically verified against the hardware.