Next was to address both the ground spare and the failed IUA 2 on-orbit. For the ground spare the TDA  hardware was removed to prevent inadvertent actuation once in service. The IUA itself is still required for  power conditioning, TUS cable to MT interface conn ections, and cable strain relief. This modified spare  unit was installed in place of the failed IUA 2 during the STS-121/ ISS ULF1.1 mission. With the removal and replacement (R&R) of the TUS 2 Reel, installation of the blade blocker onto the IUA 1, and R&R of  IUA 2 with the newly configured spare, the MT System was left with full redundancy at the end of the  mission. In a subsequent decision, the ISS Mission Management Team decided the crew would disassemble the failed TDA on-orbit and only return that small portion to the ground for failure  investigation. The failed IUA 2 was re-configured much like the spare unit during the mission and now  serves as a fully operational IUA spare on-orbit without any ground re-processing required. Figure 10 illustrates the configuration of a newly configured IUA.                                                Figure 10.  New IUA Configuration  Lessons Learned  During teardown of the failed unit, four opportunities for improvement were identified: The original  requirement to remotely free a stranded MT was no longer valid, mechanism initial position could significantly change the load path, a critical inspection point was missed, and structural materials were  not selected for robustness. The TDA remained in place after a major program change eliminated the risk  it was meant to mitigate. Unfavorably stacked tolerances would create a load-changing gap. Installation requirements checked torques, but not seating between subassemblies. Finally, a polymer was selected  for a compressive strength application. Explanations of each issue and our recommendations for  correction are presented as mitigation for similar problems in other mechanisms.  Requirement Validity In this case, the original requirement was based on a need to mitigate an explosive hazard with a short  time to effect. The explosive hazard was created by  moving hydrazine propellant tanks onboard the MT  for re-supply. If a system failure prevented the MT from moving the tanks, fast recovery was critical. This drove the design process towards selecting a remotely activated device. The fast acting Split Spool  mechanism in the TDA responds very quickly and was a good choice for those conditions. A different use  environment with a longer time to effect may have changed the design direction.  Changes in requirements eliminated the need for external hydrazine tanks. When Russian derived  propulsion systems were added, the external tanks of hydrazine were eliminated. Without the tanks, there was no longer an explosive hazard onboard the MT.  Removing the major hazard from the system changes the trade study variables, especially time to effect.  In this case, without a need for instant response, an externally activated quick disconnect or motor driven  mechanism may have been adequate. Failures of those mechanisms would not require the expense and  difficulty of a shuttle mission to deliver a large, new, replacement part.  Cover Plate in  Place of Removed  TDA 267