higherwhenclosingagainstafrozenO-ringbuttheunitwasqualifiedtoperformundertheseconditions soitwasneveranissue. DoorOpening Failure inSystem Thermal/Vacuum Test DoorOpeninq Failure Thefullyintegrated Chandra X-rayObservatory wassubjected tooveronemonthofthermal/vacuum testingatTRW(Chandra primecontractor). Thefinaltestplanned forthisperiodwasastraylighttest,in whichtheACISdoorwouldbeopened andtheACISusedasasensortomeasure straylightlevelswithin thetelescope (lampbankssimulating thesunwereinstalled intheTNchamber). Testconditions priorto thestraylighttestwerenominal forthetelescope, withtheACISrunning atcoldtemperatures aswould benormalforobservations inflight.Sincetherehadbeenseveral pastdooropenings withACIScoldand awarm-up wouldhavetakenextratime,itwasdecided toopenthedoorinthecoldcondition. Atthe time,therewasnoobjection fromanyone onthispoint. TheACISdooropening procedure wasrunat5amPDTonJune18,1998,butthedoordidnotopen. Theinformation available atthetimewasasfollows: 1)DoorOpenActuator exceeded itspowershut-off temperature at133°Cwithautonomous removal ofpowerbytheACISelectronics (PSMC), 2)usingX-ray measurements fromadoormounted calibration source, itwasdetermined thatlittletonomotionofthe doorhadoccurred, 3)STARSYS actuator limitswitchoperation indicated lessthan20degrees ofrotation hadoccurred, 4)icehadbeenobserved onexternal surfaces ofObservatory, indicating thepresence of atleastsomewaterintheT/Vchamber, 5)theACISdoorandcamera bodywereat--60°C, and6)the STARSYS Actuator wasat-42°Catthestartoftheprocedure. Post-test Failure Recovery andAnalysis InitiallySuspected FailureModes Asisusualinsuchcases,asmall"tiger"teamwasformed todetermine animmediate courseofaction. Evenatthisearlystage,theteambelieved therewasahighprobability thattheACISwouldhavetobe removed fromtheObservatory. Afullstallofthemechanism withnodoormovement wouldmorethan likelyhaveruptured thesheardiskinsidetheParaffin Actuator basedonexperience withtheLargeVent ValveMechanism. Afaulttreewascreated tohelpdetermine possible causes oftheanomaly. Thefinal formofthefaulttreeisshowninFigure3.Thefirstthreeitemswereconsidered attheoutsetofthe failureinvestigation. Ideally, theteamwouldhavelikedtoseetheunitleftundisturbed toprevent thelossofinformation that couldultimately leadtodetermination ofthefailuremode. However, theMITandLockheed Martinteam concluded thattherewastoogreatariskofdamage tothefocalplaneandOBF'sfromcontamination if thedoorwerenotfullyclosedpriortore-pressurization ofthechamber. Thedoorprovides anearly hermetic sealthatwouldprotectthefocalplaneandOBF'sfromcontamination astheshrouds and spacecraft werewarmed upandthechamber re-pressurized. Recovery_ frQmF0il_]re inThermal/Vacuum Test Thedecision wasmadetowarmthedetector assembly anddoorto25°Cusingheaters thatwere designed forbakingoffcontamination on-orbit. Toprotect theinstrument andgetthedoorclosed, the openactuator hadtobeheatedtosoftentheparaffin. Withawarmopenactuator, therewasahigher probability thatthecloseactuator couldre-setthemechanism andlatchthedoorclosed again. The procedure wasperformed at7pmPDTwithout success. Neither theopennorthecloselimitswitches changed state,andthecloseactuator wentover-temperature at133°CasthePSMCautonomously removed power. Anominal opening orclosing wouldnormally resultinanactuator temperature ofaround 105°Catlimitswitchshutoff. Nowthequestion waswhether ornotthedoorwassufficiently sealedto allowforchamber re-pressurization. Asdrynitrogen wasbledintothechamber, thedifferential pressure transducers onthedetector assembly quickly confirmed thatthedoorwassealed, sinceavacuum was measured withinthedetector housing. ThefocalplaneandOBFwereinasafecondition, sinceone 21