Elon Musk does not appear in this video. These are not his words.
** This transcript is unrelated to SpaceX or other endeavors of Elon Musk, but is related to commercial spaceflight. **
Transcript of the Tuesday, 28 July 2015, 0930 EDT (-0500) meeting of the National Transportation Safety Board to determine the probable cause of the commercial space launch accident of Scaled Composites' SpaceShipTwo on 31 October 2014.
NTSB Board and Staff in attendance at the meeting: Christopher A. Hart, NTSB Chairman T. Bella Dinh-Zarr, PhD, MPH, NTSB Vice Chairman Robert L. Sumwalt, NTSB Member Earl F. Weener, PhD, NTSB Member Tom Zoeller, Managing Director John DeLisi, Director, Office of Aviation Safety Lorenda Ward, Investigator-in-Charge of this accident Dr. Katherine Wilson, Human Performance Group Chairman Mike Hauf System Safety Group Chairman Capt. David Lawrence, Operations Group Chairman Jeff Marcus, Safety Recommendations Mike Bauer, Systems Group Chairman Jason Fedok, Survival Factors Group Chairman Karen Stein, Report Writer Jim Ritter, Acting Director, Office of Research and Engineering David Toshen, General Counsel Sharon Bryson, Acting Director, Office of Communications Rob Hunsberger, Propulsion Group Chairman Clint Crookshanks, Structures Group Chairman Jim Rodriguez, Attorney Advisor for the Office of General Counsel Sean Payne, Data Group Chairman John O'Callaghan, Vehicle Performance Group Chairman
0:00:05 Chairman Christopher Hart: I'd like to call this meeting to order. [Gavel]
0:00:10 Good morning, and welcome to the boardroom of the National Transportation Safety Board. I'm Christopher Hart and it is my privilege to serve as chairman of the NTSB. Joining me are vice chairmen Bella Dinh-Zarr, member Robert Sumwalt, and member Earl Weener.
0:00:29 Today we meet in open session as required by the Government in the Sunshine Act, to consider a report on the in-flight breakup of Scale Composites' SpaceShipTwo during a test flight near Koehn Dry Lake, California, on October 31, 2014. While the public is invited to observe the meeting here or via webcast, only the board members and NTSB staff will participate in today's discussions.
0:00:57 Tragically, the copilot died and the pilot suffered serious injuries as a result of the breakup. On behalf of my fellow board members and the entire NTSB staff, I would like to extend my sincerest condolences to the family of the copilot. I would also like to extend wishes to the pilot and his family for a full and speedy recovery. We cannot undo what happened, but it is our hope that through this investigation we will find ways to prevent such an accident from happening again, thereby improving the safety of manned commercial spaceflight. these two test pilots took on an uncommon challenge, testing technologies for manned commercial spaceflight which is still in its infancy. Human spaceflight is subject to unique hazards, and test pilots work in an environment in which unknown hazards might emerge at any time. In an environment in which it is common to encounter unknown hazards, it is of utmost importance to incorporate as much as possible of what is known, the lessons that have already been learned from other more developed modes of transportation.
0:02:00 The accident that we consider today involves SpaceShipTwo, a manned, rocket powered, suborbital vehicle that Scaled Composites developed for Virgin Galactic. Our investigation was greatly aided by the abundance of data that was available, including cockpit video telemetry, and as investigators explained, in addition to incorporating information provided by the pilot, we were able to see the actions of flight crew members and learn with a high degree of certainty the events that resulted in the breakup. What we say led us to explore the extent to which Scale Composites considered human factored into this launch. This morning we will learn from staff about the pilot training and procedures that were in place. We will also hear how human factors were considered in the design and manufacture of SpaceShipTwo.
0:02:45 The test flight was subject to oversight by the Federal Aviation Administration. The FAA's oversight role in commercial space is different from its oversight role in aviation. For commercial space the FAA does not certify the vehicle. It only certifies the launch, focusing mainly on public safety. Nonetheless, many of the safety issues that we will hear about today arose not from the novelty of a space launch test flight but from human factors that were already known elsewhere in transportation. And although commercial space transportation is in a period of great innovation, the FAA does have a process for addressing human factors for experimental launches. We will ask today whether whether the FAA's procedures and oversight were effective and whether they can be improved upon. We will examine the process by which the FAA issued and subsequently renewed a launch permit to Scaled Composites and the process by which the FAA granted waivers from human factors and software hazard analysis requirements in the renewal process. We will also inquire whether there could have been more extensive communication between Scaled Composites and the FAA regarding these critical issues.
0:03:52 The NTSB is not a regulator and have no power to require changes. We identify the causes of accidents in all modes of transportation and make safety recommendations which, if acted upon, can help prevent recurrences. More than 80% of our recommendations are acted upon favorably, contributing to a high standard of transportation safety today and pointing toward even safer transportation tomorrow. It is our objective in this meeting to identify actions that the FAA and industry can take to collaboratively improve the safety of commercial space transportation in the future. Now Managing Director Tom Zoeller will introduce the staff. Mr. Zoeller. 0:04:30 Tom Zoeller: Good morning, Mr. Chairman, Madam Vice Chairman, members of the board. I would ask those in the audience, if they have not already done so, please silence their personal electronic devices. In the event of an emergency, there are three emergency exits here, two to either side of the dais and one in the back in the rear entrance. And if necessary, there's an AED at the far wall in the lobby. Sitting at the table this morning, starting on my right and working down, John DeLisi, Director, Office of Aviation Safety; next to him Lorenda Ward, the Investigator-in-Charge of this accident; Dr. Katherine Wilson, Human Performance Group Chairman; Mike Hauf System Safety Group Chairman; and Capt. David Lawrence, Operations Group Chairman. Behind Capt. Lawrence is Jeff Marcus, Safety Recommendations; next to him is Mike Bauer, Systems Group Chairman, next is Jason Fedok, Survival Factors Group Chairman, Karen Stein, the Report Writer, Jim Ritter, Acting Director, Office of Research and Engineering; David Toshen, the General Counsel; and Sharon Bryson, the Acting Director of the Office of Communications. Behind Ms. Bryson is Rob Hunsberger, who is the Propulsion Group Chairman and also operating the visuals and the timer; next is Clint Crookshanks, the Structures Group Chairman; Jim Rodriguez, the Attorney Advisor for the Office of General Counsel; Sean Payne who is the Data Group Chairman; and finally John O'Callaghan, Vehicle Performance Group Chairman.
0:05:59 John DeLisi, the Director, Office of Aviation Safety will start with an opening statement.
0:06:06 John DeLisi: Thank You. Good Morning. Although this is the first time that the Office of Aviation Safety has investigated an accident involving a reusable suborbital rocket, we've been involved with commercial space transportation for over 25 years. In fact, the board conducted the investigation of a launch procedure anomaly involving a Pegasus extendable launch vehicle which was deployed from a B-52 aircraft in 1993 and issued a special investigation report with probable cause and safety recommendations. AS staff has ensured that we remained prepared for a commercial space accident investigation by attending industry conferences, completing outreach with manufacturers, and participating in tabletop accident investigation exercises. I'd like to recognize retired NTSB investigator Bob Benzon, as well as Joe Sedor, the chief of our Major Investigations Division, and Lorenda Ward, the IIC of this investigation for their efforts to prepare us for an investigation like the one we'll be discussing today.
0:07:17 Although SpaceShipTwo is a different type of vehicle, I'm pleased to report that our procedures and protocols proved to be effective during the investigation of this accident. As with all major investigations, we dispatched a Go Team, consisting of a Board Member as the spokesman, an Investigator-in-Charge, NTSB specialist to serve as Group Chairmen. We named parties to the investigation. We collected factual information, including the highly valuable cockpit video images, and prepared a document of factual information which was released to the public today.
0:07:56 We appreciate the participation and cooperation of the parties, as well as the respect they showed to our staff throughout the investigative process. While always a party to our investigations, the FAA's participation in a commercial spaceflight investigation is different than in an airline accident investigation. For example, during an airline accident investigation, we interface with the staff of the FAA's Office of Aviation Safety, as we look at issues regarding the federal regulations for the certification of aircraft and their oversight of commercial air carriers. However, during this investigation our technical interface was with the FAA's Office of Commercial Space Transportation, as we examined the role it plays in protecting public safety during the launch of an experimental suborbital rocket.
0:08:53 In conclusion, I'd like to thank our investigative team for taking on the challenges of this investigation and allowing us to promptly deliver this draft report less than nine months after the accident. Thank you. Lorenda Ward will now give the IIC opening presentation.
0:09:15 [Slide 1] Lorenda Ward: Good morning, Chairman Hart, Vice Chairman Dinh-Zarr, and members of the board.
0:09:20 [Slide 2] On October 31, 2014, at 10:07 local time, Scaled Composites SpaceShipTwo broke up 13 seconds into its fourth rocket powered test flight, and impacted terrain over an area five miles long near Koehn Dry Lake, California.
0:09:41 [Slide 3] The pilot was seriously injured and the copilot was fatally injured. SpaceShipTwo was destroyed and no one on the ground was injured by the falling debris. Scaled was operating the vehicle under an experimental permit issued by the FAA's Office of Commercial Space Transportation, or AST.
0:10:00 [Slide 4] The Office of Commercial Space Transportation was initially established as part of the Office of the Secretary of Transportation within the Department of Transportation, and was transferred to the FAA in November of 1995. Among other things, AST protects public health and safety and safety of property, the US national security and foreign policy interests, and encourages, facilitates, and promotes the commercial space industry. As part of these responsibilities, AST issues licenses and experimental permits for commercial launches of orbital and suborbital rockets.
0:10:38 [Slide 5] Scale Composites have developed both White Knight Two and SpaceShipTwo for Virgin Galactic. White Knight Two was the high altitude launch platform for SpaceShipTwo. SpaceShipTwo was the reusable suborbital rocket. The design mission profile for SpaceShipTwo was for an air launch from White Knight Two followed by the boost phase during which SpaceShipTwo's rocket motor would propel the vehicle from a gliding flight attitude to an almost vertical attitude and accelerate from subsonic speeds through the transonic region to supersonic speeds. Then the rocket motor would cut off and the vehicle would coast to apogee. Afterwards, SpaceShipTwo would transition to the reentry phase, which was to occur in feathered configuration that would stabilized attitude and increased drag. Next would be the glide phase, after the vehicle had transitioned from a feathered to an unfeathered configuration. Then the mission profile would be completed with an unpowered landing.
0:11:43 [Slide 6] As mentioned earlier, the feather system was utilized to stabilize SpaceShipTwo's attitude and increase drag during reentry into the Earth's atmosphere. This was done by rotating the feather flap assembly and twin tail booms from the vehicle's normal configuration up to 60 degrees. Before the feather flap assembly could move it had to be unlocked.
0:12:08 [Slide 7] The feather lock handles were located on the center console and held in the locked or unlocked positions by small detents. The detents prevented the handles from moving under normal vibration. To move the handles, a slight side force to the right would allow the handles to move past the detents. To unlock the feather, the pilot moved the unlock handles downward to their mechanical stop. The feather is then extended by pulling two feather handles out.
0:12:40 [Slide 8] On the day of the accident it took about 48 minutes for the mated pair to climb to an altitude of 46,400 feet, where SpaceShipTwo was released.
0:12:52 [Slide 9] The investigation had numerous data sources for the accident flight, including ground base cameras, and cameras on both White Knight Two and SpaceShipTwo. The video about to be shown will start screen split in thirds, with the upper left showing the ground-based camera video, the upper right showing White Night Two's pylon camera video, and the bottom center of the screen showing SpaceShipTwo's boom camera video. Then each video will play individually, starting with the tail boom camera for SpaceShipTwo, then the ground based video, then the pylon camera from White Knight Two. The videos will stop before SpaceShipTwo breaks up. We would like to take a moment to pause to see if anyone would like to leave the room before the video is shown.
0:13:41 [Slide 10 (Video): DCA15MA016 / Scaled Composites / SpaceShipTwo / N339SS / Powered Flight 4]
0:14:52 [Slide 11] Telemetry data show that the feather moved, even though we know from the cockpit image recording that neither pilot had deployed the feather. However, the cockpit video did show that the copilot had unlocked the feather just after 0.8 Mach. Per the test card, the copilot was to unlock the feather when SpaceShipTwo reached a speed of 1.4 Mach. This was to allow the vehicle time to transition through the transonic region.
0:15:20 [Slide 12] Since the feather was unlocked in the transonic region, aerodynamic and inertial loads imposed on the feather flap assembly overcame the feather actuators and the feather extended uncommanded, causing the catastrophic structural failure.
0:15:37 [Slide 13] Range instrumentation radar located on Edwards Air Force Base tracked White Knight, with SpaceShipTwo attached, and SpaceShipTwo itself, following its release from White Knight Two, until the impact of SpaceShipTwo's main oxidizer tank and wings with the ground. The telemetry data ended during the breakup. During the breakup sequence, the pilot was thrown from the vehicle while still restrained in his seat. During his descent to the ground, the pilot released himself from his seat and his parachute deployed automatically. The pilot's seat and parachute were found separately. The top middle of the slide shows where the left and right tail booms landed, and the cockpit and nose and the rocket motor were located towards the bottom left of the slide.
0:16:28 [Slide 14] Parties to the investigation were Scaled Composites, Virgin Galactic, the Federal Aviation Administration, and Butler Parachute Systems. I would like to acknowledge the parties for their professionalism, openness, responsiveness, and their willingness to trust our process. Their cooperation enabled us to complete this investigation within nine months.
0:16:51 [Slide 15] The NTSB launched a Go Team and Chairman Hart was a board member on scene. The next two slides show all of the NTSB staff who participated in the investigation or supported the team.
0:17:08 [Slide 16]
0:17:15 [Slide 17] The investigation identified the following safety issues: a lack of human factors guidance for commercial space operators; the efficiency and timing of the preapplication process; the limited interactions between FAA and applicants during the experimental permit evaluation process; missed opportunities during the FAA's evaluation of Scaled Composites' hazard analysis and the waivers issued; the limited inspector familiarity with the commercial space operators; the need for improved emergency response planning; and a fully developed database for commercial space operators on mishaps lessons learned.
0:17:55 Dr. Wilson's and Mr. Hauf's presentations will go into more detail on the human factors and safety issues.
0:18:03 [Slide 18] This concludes my presentation and Dr. Wilson is ready to begin hers.
0:18:10 [Slide 19] Dr. Katherine Wilson: Good morning. I will discuss human factors issues surrounding the flight crew and design of SpaceShipTwo, as well as organizational issues of the FAA's Office of Commercial Space Transportation.
0:18:43 [Slide 20] Before release from White Knight Two, the flight crew completed all required checklists and the pilot briefed the task to be completed during the boot phase. About eight seconds after release from White Knight Two, the copilot made the 0.8 Mach callout as appropriate. About two seconds later, at a speed of 0.82 Mach, the copilot stated 'unlocking' and then moved the feather lock handle to the unlocked position. Both pilots acknowledged the pitch up of the vehicle, and then the cockpit image recording ended.
0:19:15 [Slide 21] I will now describe the sequence of events that should have occurred during the boost phase. Duties were divided between pilot and copilot. Each pilot memorized his task due to the dynamic nature of the boot portion of Flight. After release from White Knight Two, the pilot was responsible for vehicle control, and would command 'Fire' to which the copilot was to ignite the rocket motor. At a speed of 0.8 Mach, the copilot was to verbally call the speed to alert the pilot to expect the transonic bobble. The transonic bobble is a nose up and then a nose down motion of the vehicle that occurs due to aerodynamic forces resulting from a shift in the center of lift and becoming supersonic. No physical action was required by either pilot. As the vehicle became supersonic, the pilot was to trip the horizontal stabilizers, and the copilot was to assist the pilot by verbalizing the stabilizer trim position. Finally, at 1.4 Mach, the copilot was to move the feather lock handle to the unlock position. Only the physical action was required. There was no required callout of the speed.
0:20:27 [Slide 22] Preparation for PF-04 for began in January 2014. To learn the procedures and ensure proficiency, Scaled took a three-pronged approach to training SpaceShipTwo pilots: the SpaceShipTwo simulator, the White Knight Two aircraft, and the Extra 300 aerobatic airplane. The SpaceShipTwo simulator was a fixed base, no motion simulator that replicated the SpaceShipTwo cockpit layout. The simulator was used by the pilot and copilot to practice running through the test card and non-normal procedures, as well as to conduct full mission rehearsals with the entire mission team. SpaceShipTwo pilots also trained using White Knight Two as its cockpit layout was designed similarly to the SpaceShipTwo cockpit and in certain configurations White Knight Two had a similar flight path and decent profile as SpaceShipTwo, which simulated glide through touchdown. Finally, SpaceShipTwo pilots received aerobatics training in the Extra 300, which included G tolerance and upset recovery training. Scaled required SpaceShipTwo pilots to complete at least three full mission rehearsals, three simulated approaches in White Knight Two, and three aerobatic training flights in the Extra 300 to prepare for SpaceShipTwo powered flight.
0:21:45 [Slide 23] In addition to training, Scaled performed several flight readiness reviews before PF-04. In addition to the test team reviewing the vehicle configuration and any changes for the flight, the intent of these meeting was to get management buy-in on the risks that the team had identified and to determine potential unidentified risks through the use of independent subject matter experts. Scaled also held a town hall meeting to provide the team the opportunity to ask unanswered questions and to discover unknown issues that could delay the remaining program schedule. There were no items discussed at these meetings for PF-04 that were related to pilot procedures for the feather system.
0:22:27 [Slide 24] Stressors were present during the boost phase of flight that likely contributed to the copilot unlocking the feather prior to 1.4 Mach. As previously mentioned, the copilot memorized his three tasks to be accomplished during this phase. Calling out 0.8 Mach, calling out the stabilizer position in degrees, and unlocking the feather at 1.4 Mach. In addition to recalling these tasks from memory, each of the tasks needed to be accomplished in a limited time frame, less than 26 seconds, according to post-accident simulator tests. If the feather was not unlocked by 1.8 Mach, the flight was to be aborted. Scaled designed a caution messages to illuminate on a center multifunctional display along with an aural annunciator at 1.5 Mach as a reminder to the crew if the feather was not unlocked by that speed. Because of the importance of unlocking the feather before 1.8 Mach, the copilot might have been anxious to unlock the feather to avoid aborting the flight. Another stressor during the boost phase was the operational environment, specifically the vibration and loads experienced with the motor ignited. The vibrations and loads experienced during powered flight were not replicated in the simulator and the copilot had not flown SpaceShipTwo under power since Powered Flight 1 in April 2013. Although the pilots received G tolerance training prior to the flight, pilots were not required to perform and mission related tasks other than to demonstrating vehicle control during this training. The lack of recent experience with powered flight vibration and loads, could have increased the copilot's stress and thus his workload during a critical phase of Flight.
0:24:10 [Slide 25] Scaled Composites did not emphasize human factors in the design, operational procedures, simulator training, or hazard analysis for SpaceShipTwo. During the design of SpaceShipTwo, Scaled did not consider the possibility that a pilot would unlock the feather before 1.4 Mach, and as such, no safeguards were built into the feather system designed to prevent this. Although SpaceShipTwo program personnel said they were aware that unlocking the feather during transonic flight would be catastrophic, there was no warning, caution, or limitation in the SpaceShipTwo Pilot Operating Handbook or on the PF-04 test card that specified this risk. The only documented discussions about the loads on SpaceShipTwo's tail occurred more than three years before the accident in an email and a PowerPoint presentation. AST was also not informed of this hazard. In addition, human factors was not fully considered in SpaceShipTwo training as the simulator did not replicate the vibration and loads, nor did pilots train with the same flight gear that they were expected to wear during the actual flights in the vehicle. Finally, Scaled's hazard analysis did not consider pilot included hazards that could pose a risk to public safety. This area will be discussed more in Mr. Hauf's presentation. By not considering unlocking early in the boost phase as the potential cause of an uncommanded feather extension, Scaled missed opportunities to identify design and/or operational factors that could have mitigated the catastrophic consequences of this single human error. Although scaled engineers referenced some military standards and FAA circulars, because commercial spaceflight is an emerging industry, no human factors guidance currently exists specifically for commercial space operators. Staff has proposed recommendations in this area.
0:26:02 [Slide 26] According to federal regulations for commercial space transportation, a prospective applicant must consult with the FAA before submitting an experimental permit or mission license application to discuss the application process and possible issues relevant to the FAA's licensing or permitting decision. Scaled Composites began meeting with the FAA as a part of this process in March 2010. While Scaled fully complied with the preapplication requirements, when the preapplication process began, SpaceShipTwo had been designed and manufactured, and the system safety analysis was well underway. At that point, it could have been difficult and costly for Scaled to make changes to SpaceShipTwo if the FAA had found inadequacies in Scaled's hazard analysis during the preapplication consultations. Staff has proposed a recommendation in this area.
0:26:53 [Slide 27] Scaled Composites submitted its experimental permit application for SpaceShipTwo in January 2012. AST's experimental evaluation team then had 120 days to perform a comprehensive review of the application, including asking for and receiving additional information from the applicant. Throughout this process there was one point of contact between the FAA and Scaled. This was to reduce the burden on Scaled of having to interact with multiple individuals from the FAA during the project. In addition, questions from the AST evaluation team were filtered by management prior to being sent to Scaled because they did not pertain to public safety. As a result, technical information requested from team was never received. AST staff indicated there was pressure to approve experimental permit applications within the 120 day review period, even though they believed that technical data was still needed to complete their review. Staff has proposed a recommendation in the area. On May 23rd, 2012, the FAA issued Scaled its initial experimental permit for SpaceShipTwo.
0:28:01 [Slide 28] Once the permit was approved and prior to launch operations beginning the FAA assigned a safety inspector and an assistant safety inspector to each launch activity. The inspectors used a safety inspection plan to ensure compliance with federal regulations and the terms and conditions of the experimental permit. In addition inspectors were supposed to verify that the representations made in the operator's experimental permit application were still accurate. Safety inspection plans were generally accomplished several days before a launch. Finally, safety inspectors were assigned to an individual launch operation and not specifically to an operator, such as Scaled. Therefore, inspectors did not have adequate time to familiarize themselves with Scaled's training, procedures, and operation prior to conducting the safety inspection plan, and could not perform a comprehensive review of Scaled or SpaceShipTwo. Staff has proposed a recommendation in this area.
0:28:59 [Slide 29] Thank you. Mr. Hauf will now discuss issues regarding Scaled Composites hazard analysis and the waivers issued by the FAA.
0:29:09 [Slide 30] Mike Hauf: Good morning.
0:29:11 [Slide 31] As outlined in section 437.55, experimental permit applicants must perform an analysis that identifies hazards, including those resulting from human and software errors. For each identified hazard, the applicant must assess the risk ensure it meets acceptable criteria, and if not, risk elimination and mitigation measures must be identified to reduce the risk to an acceptable level. The last step of this hazard analysis is to demonstrate that risk elimination and mitigation measures achieve an acceptable reductions in risk through validation and verification.
0:29:49 Chairman Christopher Hart: Excuse me Mr. Hauf, I'm not sure that you have clarified what this is section 437 of.
0:29:53 Mike Hauf: Part 437, 437.55 is the hazard analysis.
0:29:58 Chairman Christopher Hart: And that's in the Code of Federal Regulations? I'm not sure we have identified where that came from.
0:30:03 Mike Hauf: Yes, Code of Federal Regulations.
0:30:04 Chairman Christopher Hart: And which section of the Code of Federal Regulations, do you know?
0:30:06 Mike Hauf: Part 437.
0:30:07 Chairman Christopher Hart: 437, I see. OK, thank you.
0:30:12 [Slide 32] Mike Hauf: An FAA advisory circular provides guidance to applicants on hazard analysis requirements, including approaches to identifying and describing hazards, risk assessment, risk elimination or mitigation, and validation or verification. Regarding human error, the advisory circular states that a hazard analysis must address human errors including decision errors and, such as using flight controls at the wrong time, and skill-based errors, such as improperly following a procedure.
0:30:48 [Slide 33] One of the hazards Scaled identified was uncommanded feather operation. Their analysis indicated this hazard would be catastrophic if it occurred during the boost phase of flight. To identify the potential failure conditions that could lead to this hazard, scale performed a fault tree analysis. This analysis assumed the flight crew would be properly trained through simulator sessions and that the flight crew would follow established procedures. Because of these assumptions, the analysis only identified system failures or malfunctions occurring after the locks were normally released by the flight crew.
0:31:28 [Slide 34] Specifically, the analysis showed that after normal release of the feather locks, a failure involving both feather actuation systems would need to occur for it to move uncommanded. Because the probability of failure for this hazard met the risk criteria, Scaled determined that the feather system design was adequate. No mitigations were considered to prevent the flight crew from unlocking the feather locks early.
0:31:56 [Slide 35] In May of 2013 Scaled was granted a renewal of the SpaceShipTwo experimental permit. However, FAA personnel's concerns led the FAA to re-examine Scaled's hazard analysis. FAA determined that the SpaceShipTwo hazard analysis did not fully comply with the human and software error requirements of the regulation. The FAA chose to waive those requirements from Scaled's permit and issued a waiver in July 2013. Scaled did not request the waiver, or participate in the waiver writing or evaluation processes, or have an opportunity to comment on the waiver before it was issued, except to identify proprietary information. The waiver was extended when the permit was renewed in May 2014.
0:32:49 [Slide 36] According to the FAA, issuance of the waiver was based on mitigation measures, most of which were extracted from Scaled's experimental permit application. These included the training program, an incremental approach to flight testing, and the use of chase planes. Further, the permit's limited duration, the remoteness of the operating area, and the use of winged vehicle led the FAA to conclude that Scaled's activities would not jeopardize the safety of the public or property. However, in its development of the waiver, the FAA did not verify that Scaled was in compliance with the mitigations cited in the waiver from regulatory compliance or validate whether those mitigations would adequately address human errors. Further, staff's investigation found that some FAA inspectors were unfamiliar with the details of the waiver and all of the inspectors thought that Scaled had complied with the mitigations contained within the waiver. It is important for the FAA inspectors to ensure that a commercial space operator is implementing mitigations in a waiver to determine their effectiveness in ensuring public safety. Staff has proposed a recommendation to address this issue.
0:34:08 [Slide 37] This concludes my presentation, and staff is ready to answer questions.
0:34:20 Chairman Christopher Hart: Thank you for those excellent presentations. We will begin the question and answer question with member Sumwalt.
0:34:27 Member Robert Sumwalt: Good morning. I want to thank this staff for doing a great job with a very complex investigation. As Mr. DeLisi pointed out, it was done in nine months, and as Ms. Ward pointed out, I think the parties played a huge role in allowing the investigation to be done successfully and in a timely fashion. You know, as humans we all commit mistakes, and I commit errors in my personal life all the time, and when i was flying i made a lot of mistakes as well. Some were pretty darn serious, and some were errors that I never even noticed, but yet the error had occurred. And I think the question we're all trying to answer here is why did the copilot unlock the feather early? And I think that's a question that people have been pounding their head trying to figure out for nine months now. To put it in perspective, I was reading the interview summaries, and according to one of the Scaled test pilots, he said the accident copilot was, and I quote, 'as professional of a copilot as you could have and 100% prepared for the mission. He was always looking ways to do things better. He knew the FAA regulations better. No one knew the FAA regulations better than him. No one was better at procedures than him.' And I think that that really puts in perspective that this was somebody who was really a professional, trying to do it the right way, and yet the error occurred. Some of the people that were interviewed, some of the test pilots that were interviewed, commented that the pilot workload was high right after launch. One test pilot commented that with respect to unlocking the feather prior to 1.4, 'It was difficult not to be late. It's a busy time and personally I would be late on it if my workload was high.' He said, 'You've got to be on your game to get it right every time.' So Dr. Wilson, when your human factors expertise, I noted that four days before the accident the copilot unlocked the feather late. He did it after 1.4, and I think that got the alerting in the cockpit, and he was debriefed on that. And given that that's prevalent in his mind, everyone knew the hazards associated with unlocking late. It would require an abort of the mission. He had been debriefed on this four days prior to the accident. In your mind, do you believe that this recency of experience may have been a factor in his wanting to hurry up and get it done?
0:37:16 Dr. Katherine Wilson: That was something that we considered, and we did talk to pilots that were involved in that simulator session and also the debrief following that simulator session. Nobody seem to be overly concerned that the pilot had unlocked delayed. It was debriefed after the simulator session, but it was debriefed as any other debrief item. So there wasn't extra emphasis placed on that. We also know that the day prior to the accident the copilot and pilot were in the simulator for an extended period of time, several hours, running numerous simulations, running the test card, and at no time was the feather unlocked early or late during those sim sessions. So we felt confident that the late unlocking four days before the event did not contribute to the pilot's early unlocking on the accident flight.
0:38:08 Member Robert Sumwalt: Thank you. But pilot's interviewed did comment on the difficulty of getting it done due to workload. And I noticed that one of the things that I did notice going through the docket was that Scaled had added steps for the copilot in PF-04. For example, in PF-01, powered flight one, they did not even deploy the feather because of the short burn time of about 16 seconds, I think. But on PF-02 and PF-03 the only duties during the burn, for the copilot, were to feather unlock at, it was 1.2 on one flight and 1.3 on the next. So there was just one memory item for that copilot to do on those two flights. But finally when we got to PF-04 there were the three things that they had to do. He had to call Mach 0.8, call the stab trim, and that in increments, right?, for every degree that it changed he had to call those out, right? It wasn't just a one time thing, it was like '8 degrees, 9 degrees, 10 degrees.' I that correct?
0:39:20 Dr. Katherine Wilson: Yes.
0:39:21 Member Robert Sumwalt: And then finally, at 1.4, unlock the feather. So, my point is that in a high workload environment, Scaled actually increased the workload on PF04. And I think that with each step that you add for a pilot to do, it adds complexity, and with increased complexity comes the increased possibility of an error. So I am out of time and I will come back in just a moment. Thank you.
0:39:53 Chairman Christopher Hart: Thank you member Sumwalt. Member Weener?
0:39:55 Member Earl Weener: Thank you. Mr. Hauf, I would like to discuss the hazard analysis. What did the hazard analysis for this kind of vehicle consist of?
0:40:06 Mike Hauf: It consisted of identifying and characterizing hazards, coming up with mitigations for those hazards, and then verifying and validating the mitigations.
0:40:17 Member Earl Weener: And at what point in a design process was this hazard analysis done?
0:40:22 Mike Hauf: I believe Scaled started their systems safety assessment in about 2006.
0:40:28 Member Earl Weener: And how far along in the design process was the vehicle at that point?
0:40:32 Mike Hauf: I'd like to defer that. I'm not sure.
0:40:37 Member Earl Weener: I guess the question is really more along the line of, was the hazard analysis, particularly the hazard analysis that related to the human factors, done early enough so that had problems been found, that there was plenty of time to take care of it without holding up the process?
0:41:00 Mike Hauf: I believe so.
0:41:04 Member Earl Weener: So, were human factor requirements put into the early design requirements?
0:41:12 Mike Hauf: Scaled did consider human error in their fault tree analysis. They considered the possibility of human error for the flight crew responding to functional failures that they identified in their analysis.
0:41:36 Member Earl Weener: So, they consider the possibility of flight crew error in their responses to system anomalies and so forth?
0:41:44 Mike Hauf: Correct. System functional failures.
0:41:50 Member Earl Weener: I think that it was presented that their analysis did not consider the fact that the pilot might have done the wrong thing with regards to the feather system, unlocking. Is that correct?
0:42:04 Mike Hauf: Well, their hazard analysis did not consider pilot induced hazards.
0:42:10 Member Earl Weener: But their analysis did consider that if the system was unlocked at the lower Mach numbers that you could have a catastrophic loss of the vehicle?
0:42:22 Mike Hauf: Their fault tree analysis for the feather system considered uncommanded feather as a catastrophic hazard. For that particular hazard they considered that the flight crew had normally released the locks and the failures would be system failures that would cause the uncommanded hazard.
0:42:43 Member Earl Weener: So, they were not focused then on the flight crew, the copilot in this case, taking the wrong action?
0:42:53 Mike Hauf: That's correct.
0:43:00 Member Earl Weener: In the design assurance process, so they have that functional hazard assessment. They had a fault tree analysis, is that correct?
0:43:14 Mike Hauf: Yes, a functional hazard analysis and a fault tree analysis.
0:43:18 Member Earl Weener: And just make a few comments about, what does a fault tree analysis show?
0:43:24 Mike Hauf: It's a systematic deductive analysis, top down, identifying failure modes that could cause the top hazard.
0:43:33 Member Earl Weener: And the functional hazard assessment, by the same token?
0:43:36 Mike Hauf: The functional hazard assessment is identifying vehicle functions and failures of the systems.
0:43:48 Member Earl Weener: And ordinarily, these are done in the design process at a point they can be, that if you find something that you don't like, you can recover from it?
0:44:00 Mike Hauf: Yeah, advisory circular guidance said the iterative process should be done very early on in the design phase, throughout the entire process of designing and developing the vehicle.
0:44:12 Member Earl Weener: OK, so the fault tree is a top down analysis and the functional hazard assessment is kind of a bottom up analysis?
0:44:18 Mike Hauf: Well, the functional hazard analysis is the identification of the hazards, looking at the vehicle functions and the systems, such as uncommanded feather operation.
0:44:34 Member Earl Weener: And they got waivers on the human factors assessment as well as the software assessment, is that correct?
0:44:45 Mike Hauf: Correct.
0:44:46 Member Earl Weener: And these were waivers that were not asked for?
0:44:49 Mike Hauf: Scaled did not request the waiver. No.
0:44:55 Member Earl Weener: What sort of educational background or professional background is required for human factor analysis?
0:45:08 Mike Hauf: I defer to Dr. Wilson.
0:45:12 Dr. Katherine Wilson: Could you repeat the question?
0:45:18 Member Earl Weener: We had a waiver on the human factors analysis and the software analysis. I'm just curious about, in the human factors analysis, what kind of, let's say educational background, professional background, should have been available in terms of the human factor analysis? In other words, everybody thinks they're a human factors analyst because they are human, but in fact more is required than simply that.
0:45:52 Dr. Katherine Wilson: From our interviews we found that there was not a person on AST staff that had a specific human factors background. People may have had a class in human factors, but not a specific degree in human factors. So it could have been difficult for them to identify what was needed for the human factors hazard analysis.
0:46:13 Member Earl Weener: And the human factors analysis, just to finish this off, is more than simply the ergonomics?
0:46:18 Dr. Katherine Wilson: Correct.
0:46:19 Member Earl Weener: Thank you.
0:46:22 Chairman Christopher Hart: Thank you member Weener. Vice chairman Dinh-Zarr?
0:46:26 Vice Chairman T. Bella Dinh-Zarr: I was very impressed with the thorough and efficient investigation and report that the staff conducted with the cooperation of the parties. So, no one wants to impede innovation, but our priority is to ensure that safety is served. And the report proposes several recommendations to the FAA, specifically to AST. Would you explain why it's important to safety for the FAA and FAA inspectors to be aligned with individual operators who are applying for an experimental permit or a launch license?
0:47:05 Capt. David Lawrence: The genesis of that particular recommendation comes from the philosophy that's familiar with the FAA right now. During manufacture certification process of specific aircraft, the FAA assigns flight test engineers and flight test pilots specifically to that vehicle, specifically for oversight of that particular vehicle. In the process of this investigation we found that several of the inspectors were unfamiliar with the vehicle. They were unfamiliar with the Pilot Operating Handbook and the procedures that were used by the SS2 pilots. So, the process of finding inspectors and assigning specific to a vehicle would provide a better comprehensive knowledge of the vehicle, the history of the vehicle, and of the consistency throughout. And this is modeled after the process used in aviation for FAA.
0:48:03 Vice Chairman T. Bella Dinh-Zarr: Thank you, Captain Lawrence. Some people in attendance or watching may not be familiar with the way the NTSB issues safety recommendations, to whom or why we issue certain recommendations, and whether and when an action is taken that we no longer issue that safety recommendation. So, could someone explain the actions to increase safety that Scale Composites and Virgin Galactic, separate organizations, have taken since the accident, hence why we no longer are issuing them recommendations?
0:48:42 Lorenda Ward: I'll take that one. Scaled Composites, right after the accident, actually grounded their fleet and went back and did a flight readiness review of all their airplanes to make sure they were ready to return to flight. They also looked at their parachute training; they improved that. And Mr. Fedok can go into more detail about what was done at Scaled. They also identified that they did not have the human factors expertise, and looking at that to add into their system safety analysis. As far as Virgin Galactic, they did look at the design of the vehicle and they have added an inhibitor so that the feather locks cannot be unlocked at a certain condition. They have also chosen to do a challenge and response, and incorporate crew resource management for their pilots.
0:49:43 Vice Chairman T. Bella Dinh-Zarr: Thank you Ms. Ward. And I may come back with a question for Mr. Fedok later about parachutes. But first, could you describe the relationship between Scaled and Virgin Galactic at the time of the accident and now, just so that we and the public can understand that?
0:50:02 Lorenda Ward: Yes, at the time of the accident Scaled Composites was actually the one that had the experimental permit. With the FAA, they were the ones who were doing the developmental and flight testing of the SpaceShipTwo. They had transitioned White Knight Two to Virgin Galactic, so there was a Virgin Galactic pilot on board the day of the accident flight. The intent was to transition SpaceShipTwo to Virgin Galactic at the end of the year, around December 2014. After the accident, Virgin Galactic assumed the developmental and testing of serial number 2 of SpaceShipTwo, and so now The Spaceship Company will be building the second vehicle. Scaled Composite does have contractual relationships with Virgin Galactic, so they are still assisting in case there are questions in regards to the vehicles.
0:50:57 Vice Chairman T. Bella Dinh-Zarr: Thank you. I'm glad to hear about the actions that are being taken. My time is almost up, but I will proceed on the next round. Thank you, Chairman.
0:51:07 Chairman Christopher Hart: Thank you. I'd like to ask some questions about how realistic the simulation is. So, for example, what do the two pilots wear in an actual flight? Is it a spacesuit type thing? Is it flight suit, helmet, visor, gloves? What do they wear when they're actually flying?
0:51:28 Capt. David Lawrence: They wear a flight suit that is like a jumpsuit, a helmet, visor, oxygen mask, and gloves.
0:51:35 Chairman Christopher Hart: And how much of that are they wearing while they are in the simulator? Just to have the realism of how they fit in the seat and how they flick switches with gloves and what they can see through their visor and that sort of thing.
0:51:46 Capt. David Lawrence: Based on our interviews, they do not don the full gear when they're doing simulation work.
0:51:52 Chairman Christopher Hart: So they do it in shirtsleeves, I mean just in regular, not necessarily flight clothes? Or do we know?
0:51:58 Capt. David Lawrence: We don't know, exactly. But we do know that they weren't using the gear that was replicated in the actual vehicle during flight.
0:52:06 Chairman Christopher Hart: And there was also reference of the G loading. There's horizontal G's, there's vertical G's, and also vibrations. So, I assume the simulator couldn't replicate those three either?
0:52:16 Capt. David Lawrence: That's correct.
0:52:17 Chairman Christopher Hart: What do we know about how NASA replicates vertical G's or horizontal G's when they're training their astronauts? Because they go through some pretty serious G's too.
0:52:26 Capt. David Lawrence: Right. It's interesting, because several of the AST evaluators that we interviewed in response to their evaluation of the permit had former NASA experience, and several of them had work in that NASA simulation as well. They do have the capability of doing motion simulation, but the evaluators we talked to who had experience with the NASA sim and the Space Shuttle simulator said there's just really no way that you can replicate in a full motion simulator the boost phase and the acceleration phase when the rocket is ignited.
0:53:03 Chairman Christopher Hart: And just to provide some context, could you give me an idea of the range of horizontal and vertical G's that what would be experienced during these 13 seconds after the launch? Do you have any sense of that?
0:53:12 Capt. David Lawrence: I don't have that information, no.
0:53:15 Staffer (unidentified): I think that we know from the data that it's around 2.5. Mr. O'Callaghan can correct me.
0:53:20 Chairman Christopher Hart: Horizontal or vertical?
0:53:21 Staffer (unidentified): I think they were both around that. John?
0:53:27 John O'Callaghan: Yeah, I have that information. Let me take a look here. So the longitudinal load factor would be close to 2.5. And the vertical load factor could be as high as about four.
0:53:43 Chairman Christopher Hart: OK, thank you. Let me ask about the reference that AST was not warned about the potentially catastrophic nature of a premature unlock. And, I'm just wondering, maybe this is actually a legal question, maybe I'm asking the wrong people, but I'm just wondering, is there anything in the process, since AST is looking at public safety, that's their mandate is to look at public safety but no to certificate the vehicle as they would in aviation, the reference that AST was not notified of this, were they required to be notified of this? Was there anything in the structure of this process that would have required them to be notified of the potentially catastrophic nature of a premature unlock? If that's really a legal question, I don't really want to, maybe I can ask counsel, but.
0:54:30 Dr. Katherine Wilson: Well, there was no requirement that said they had to be warned of that specific failure. But as Mr. Hauf mentioned, in the fault tree analysis they assumed failures would only occur by the pilots after a system failure, and then a pilot's inappropriate response to that. So, while no legal requirement, Scaled did not consider that the pilot would induce that kind of failure.
0:55:00 Chairman Christopher Hart: So the the assumption was that if there was a chain of events that went the wrong way, it would not be pilot induced, it would be system induced?
0:55:07 Dr. Katherine Wilson: Right.
0:55:08 Chairman Christopher Hart: OK. I am concerned about this granting of a waiver that wasn't requested. Maybe somebody can walk me through that process. Why is a waiver granted when is wasn't even requested. Anybody have an thoughts on that?
0:55:26 Mike Hauf: After the renewal of the first permit, AST did another evaluation or review of Scaled's hazard analysis. And based upon that review, they identified that Scaled had not met the specific requirements of the part 437.55 hazard analysis regulations. And then based on that, AST management determined that they should issue a waiver to Scaled and Scaled had not rested that.
0:56:00 Chairman Christopher Hart: OK, my time is about up, but before I go I would like to follow on what member Sumwalt said about congratulating the staff for quite an amazing job done in a short period of time, and of course, with the cooperation of the parties. But that was quite a feat that you accomplished, because I know you had mountains of data, which is good news and bad news. But you had mountains of data, you when through that, and kudos to the staff for what you did and the amazing job that you did in such a short time. We will now go to the second round of questions. Member Sumwalt?
0:56:27 Member Robert Sumwalt: Well, thanks. While we're congratulating people, Mr. chairman, when a board member goes to an accident scene, you always are nice in the board meeting and thank us for our service. So I want to thank you for going to this accident and your service there. And that was tough, and thank you.
0:56:45 So, in the last round, I talked about how I felt that Scaled, well not just I felt, but Scaled had added steps to PF-04 for the copilot, and I think in PF-02, they found that it was a good technique for for the copilot to call Mach 0.80 to prepare the other pilot for the transonic bobble. And they thought it was such a good idea, that they said, let's go ahead and incorporate that as a procedure. And I am sure that is a good procedure, but technology could help us out here. We already got a high workload period where there's a lot going on. There's G's, vibrations, and a lot going on. And so why would you want to increase workload in an already workload intensive phase of flight? Two months ago I went and flew Airbus's latest model, the A350, and a computer called out, on takeoff roll, v1, and pilots used to make that call out late, which would cause problems. So here technology comes to the rescue. Something like that. Scaled is certainly a very technologically advanced company. Technology could have been used to reduce some of that workload during the high workload period of time instead of increasing it. What i want to know, Dr. Wilson, you said in your statement there that the copilot may have been anxious to unlock. Do you think, is it possible that there was so much emphasis within the company to make sure they unlocked at 1.4, and less of an emphasis on the consequences, the deadly consequences, catastrophic consequences of unlocking early?
0:58:40 Dr. Katherine Wilson: We definitely saw from our interviews ans also from the documentation that we reviewed there was more of an emphasis to ensure that the feathers were unlocked prior to 1.8 Mach, because of the risk of them not unlocking at apogee could result in the feather not deploying for the reentry. And that, they new, could be catastrophic. So, there was definitely more of an emphasis on that. We only have two documented evidence that shows that, there was an email that talked about the loads on the tail and also a PowerPoint presentation. But really in neither of those situations was it emphasized that unlocking early would be catastrophic.
0:59:27 Member Robert Sumwalt: So I want to probe on that. We have a statement in the draft report that discusses Scaled's failure to fully inform the pilots of the risk of unlocking the feather system early. I see conflicting information on that. It's hard for me to tell exactly what the deal is here. Like on page 21 of the human performance group chairman's factual report. It says, 'There was no documentation in the POH (the Pilot's Operating Handbook) that discussed the risk of unlocking the feather before Mach 1.4, but according to interviews, pilots were aware of the risk of unlocking the feather during the transonic phase of the flight.' Then I go to page 50 of the ops group chairman's factual report, and it says, 'According to multiple interviews with Scaled engineers, there was a recognized risk to unlocking the feather prior to 1.4 Mach, because unlocking the feather when the tails were generating a large lift could overpower the feather actuators. The SS2 accident pilots knew the feather should not be unlocked prior to Mach 1.4, but he could not,' and this is the accident pilot himself, the surviving pilot, 'but he could not remember if that information was covered in the design review or informal discussions. And he said he believed it was common knowledge that the feather lock were required in the transonic region. Other Scaled Composites and Virgin Galactic pilots stated they were also aware of the hazards associated with unlocking the feathers during the early boost.' It says, 'The accident pilot could not recall a discussion of unlocking the feather in the transonic region as being hazardous or catastrophic. The pilot further stated that he and the other pilots were aware that the locks were required to be locked in the transonic regime. He said that he knew that if the feather locks were not locked it could be hazardous or catastrophic, but he did not remember discussing it in an analysis.' So based on those things that I just read, why is it that staff believes that Scaled failed to fully inform the pilots of the risk of unlocking the feather system early? I mean, it's right there in the interview summaries.
1:01:49 Capt. David Lawrence: I believe what we discovered during the interviews, as you pointed out, that there was a knowledge. But it was a conversational knowledge. It was not institutionalized in any formal documents or guidance material. For instance, the Pilot Operating Handbook, as this board is, I'm sure, very aware of, is the repository of the operational information the pilots use. And this information includes the normal checklist, the emergency procedures checklist, but it also includes warnings, cautions, and limitations on the vehicle itself. A review of the Pilot Operating Handbook had no reference to the catastrophic consequences of the early unlocking. It's not unique that it wouldn't have that, because there was also a reference in the handbook about the feather unlocking or the feather actuation while mated, and there was a warning there that said that could be catastrophic as well. So staff believes that the logical place to institutionalize some type of single failure action that could cause a catastrophic failure would be the Pilot Operating Handbook because that's the reference the pilots would use on a continual basis to operate the vehicle.
1:03:08 Member Robert Sumwalt: Thank you so much. Thank you.
1:03:11 Chairman Christopher Hart: Thank you member Sumwalt. Member Weener?
1:03:14 Member Earl Weener: I'd like to go back to some of the design criteria. Were there requirements in the FAR's or in Part 14 CFR? Because you mentioned 14 CFR 437.55. What do those requirements consist of?
1:03:36 Mike Hauf: For the hazard analysis, specifically, it's part 437.29, which states that you have to do a hazard analysis per section 437.55, and provide the results of that analysis to the FAA. SECTION 437.55 has the steps or procedures to conduct the hazard analysis, which is identify the hazards, classify the hazards, come up with mitigations, and also perform verification and analysis of the mitigations.
1:04:15 Member Earl Weener: So, what was the requirement in terms of a single event causing a catastrophic outcome? Was there a probabilistic value to that?
1:04:29 Mike Hauf: There was not. Section 437.55 requires that you identify hazards, including human error, and it requires you to do it qualitatively, not quantitatively.
1:04:49 Member Earl Weener: But there was an advisory circular that accompanied that. Am I correct?
1:04:57 Mike Hauf: I'm sorry could you repeat that?
1:05:00 Member Earl Weener: Well, there was an advisory circular, 437.55-1.
1:05:04 Mike Hauf: That's correct.
1:05:05 Member Earl Weener: And that advisory circular did have numerical requirements in it, or at least advisory material?
1:05:14 Mike Hauf: It did provide a definition of extremely remote, which is 10 to the minus six.
1:05:19 Member Earl Weener: 10 to the minus six. Just out of curiosity, what by comparison is a similar requirement for a certified aircraft?
1:05:33 Mike Hauf: 10 to the ninth.
1:05:35 Member Earl Weener: 10 to the minus ninth. The report talked about test readiness reviews. What is a test readiness review consist of?
1:06:00 Dr. Katherine Wilson: They reviewed outstanding issues with the vehicle. A test readiness review covered, I believe, issues from the ground vehicles and ground operations and then they also had the flight readiness reviews which covered any issues that were related to issued in flight. Typically though when we reviewed, especially leading up to power flight 4, it dealt more with the systems and the structure versus pilot procedures.
1:06:31 Member Earl Weener: So there were two flight readiness reviews, or two reviews?
1:06:36 Dr. Katherine Wilson: There was test readiness reviews and flight readiness reviews.
1:06:40 Member Earl Weener: So what is the so called town hall meeting?
1:06:45 Dr. Katherine Wilson: When the flight was delayed, just prior to powered flight four, the company held a town hall meeting which allowed members of the team to come in and ask any unanswered questions related to the flight, and also to discuss any other issues that may come up that could delay the SpaceShipTwo schedule.
1:07:06 Member Earl Weener: So this was a voluntary meeting?
1:07:10 Dr. Katherine Wilson: Right, and it was more impromptu. This wasn't a regularly scheduled meeting as a part of the powered flight process.
1:07:18 Member Earl Weener: All right, thank you. I'll yield the remainder of my time.
1:07:22 Chairman Christopher Hart: Thank you member Weener. Vice chairman Dinh-Zarr.
1:07:25 Vice Chairman T. Bella Dinh-Zarr: Thank you, Chairman. I appreciate the FAA's role ensuring safety and I understand the challenges they face in commercial space. So my question is, did you find that FAA staff have enough of the technical data they need or the right kind of technical data to do safety assessments? And if not, why not?
1:08:36 Capt. David Lawrence: Well, I can address the experience level from the AST staff that we did do interviews for, the evaluators that looked at the permit applications during that process. Most of those evaluators had Space Shuttle and ISS experience as well and brought that expertise to AST.
1:08:22 Vice Chairman T. Bella Dinh-Zarr: And were they able to obtain sufficient data in their interactions with, for example Scaled or Virgin Galactic, to make the safety assessments?
1:07:55 Capt. David Lawrence: Well, that was one of the problem that they voiced to us, was that during the permit evaluation process and the technical review of the vehicle and the whole process, they had requested information directly to Scaled to obtain information based on questions they would have. However, management at AST would filter or scrub, is the term some of the evaluators told us, some of those questions as it related to simply protecting the public. So, some of the questions and some of the inquiries from AST evaluators and staff never made it to scaled for proper identification and answers.
1:09:26 Vice Chairman T. Bella Dinh-Zarr: Thank you Captain Lawrence. But it sounds like the information is available. It's just maybe a communication issue.
1:09:32 Capt. David Lawrence: I should point out, in interviews with Scaled, they were very open about their role, and also receptive to answering any questions that AST could have posed to them. So, I think the filtration came from the AST side down. Scaled was welcome to answer any questions about the vehicle in the process.
1:09:55 Vice Chairman T. Bella Dinh-Zarr: Thank you Captain Lawrence. That is very helpful. So the draft report also proposes some recommendations to the Commercial Space Federation, but as i understand it, not everyone is a member of the Commercials Space Federation, so I assume FEDERATION, so i assume we are not intending to leave out any companies on this discussion of standards and we want all the different companies involved in this field to be involved. Could you elaborate on that and discuss why we're only issuing it to the Commercial Space Federation?
1:10:31 Lorenda Ward: Actually, it is a joint recommendation to both FAA and the Commercial Spaceflight Federation, and the reason that the Commercial Spaceflight Federation was chosen is they happen to be an industry organization that have over 60 members. Granted, not all commercial space organizations are part of it, but we do encourage both FAA and the Commercial Spaceflight Federation to invite them to participate.
1:10:56 Vice Chairman T. Bella Dinh-Zarr: So, we're using them as one means, but the recommendation and the invitation to take part in the guidance crafting is open to everyone. Is that correct?
1:11:12 Lorenda Ward: Correct.
1:11:13 Vice Chairman T. Bella Dinh-Zarr: Thank you. And I yield my last one minute of time.
1:11:19 Chairman Christopher Hart: Thank you Vice Chairman. I have some questions about, it is a little bit surprising that if this premature action could be catastrophic to the vehicle that there wasn't stronger emphasis on that fact in lots of places including, as Captain Lawrence said, in the Pilot Operating Handbook. So I'm just wondering, how robust with that analysis that anything before 1.4 could be a problem. I know that previous launches it was 1.2 and then it was 1.3. Was that on the basis of wind tunnel or calculation, or just how robust was that? Was it almost certainly was going to be a problem, or maybe be a problem? Just how robust was that analysis about the need to wait until 1.4?
1:11:58 Lorenda Ward: Mr. O'Callaghan can answer that.
1:12:01 John O'Callaghan: Scaled computed feather moments acting on the vehicle on the bases of computational fluid dynamic studies, with computers, and then verified some of the results through flight tests, with the glide flight tests that had occurred, many of them, and then the three previous powered flights. On the powered flights, they had strain gauge instrumentation in various parts of the vehicle that could be used to compare the measured loads with the CFD loads, and it turns out that there was a pretty good correlation. And after the fact, we verify through computation with that model that in fact feather moments were sufficient to overcome the actuators and fold the vehicle up, as was observed on the video.
1:12:57 Chairman Christopher Hart: Thank you. And was there a reference to an event in a previous flight, that once the locks were unlocked, that there was a slight movement out of lock? I'm trying to remember what that reference was about. There was a previous event referred to going through the transonic range, I think, with there was a brief movement from locked to unlocked. Am I remembering that correctly?
1:13:22 John O'Callaghan: That's correct. That occurred on powered flight two. The vehicle goes through the transonic region two times, once while it's accelerating with the rocket motor on, and then when the rocket motor shuts off, it decelerates back through the transonic region. And in terms of moment coefficients, you have the same high coefficients wanting to move the feather up. On powered flight two, the deceleration through this region occurred at a relatively lower altitude and a deliberately tested point to explore the limits of the feather operating envelope. So it was deliberately flown very close to the edge of the ability of the actuators to keep the feather down, and in fact they got a slight movement of about 0.8 degrees for less than half a second.
1:14:19 Chairman Christopher Hart: OK, thank you. That's all for me. Do we have any further questions from any of the members? Member Sumwalt?
1:14:25 Member Robert Sumwalt: Yes, thank you. I'm not sure exactly who this question will be directed to. I will figure that out in just a moment. So Scaled understood very well that in the transonic region if the feather was not locked, the aerodynamic loads would push the feather up, those forces would exceed the ability of the actuators to hold them down. So therefore they had to remain locked during that transonic region. Right? So they knew that and understood that very well. So, the lock had to remain in place through the transonic region to keep the tail down, the feather down. What was Scaled 's mitigation for making sure that those locks did not get unlocked early? Didn't they say, 'We rely on the pilots to do it correctly.'? Is that correct?
1:15:28 Staffer (unidentified): That's correct.
1:15:29 Member Robert Sumwalt: So, they put all of their eggs in the basket of the pilot doing it correctly, right?
1:15:34 Staffer (unidentified): Yes.
1:15:35 Member Robert Sumwalt: So that's a single point failure. If The Pilot does it wrong, or the copilot does it wrong, then it will have very bad results, catastrophic results in fact.
1:15:45 Staffer (unidentified): Yes.
1:15:46 Member Robert Sumwalt: And that was know, the catastrophic effect was known. So, would a single point, and I guess, Mr. Hauf, this is for you, would a single point mechanical failure with catastrophic consequences be acceptable?
1:16:03 Mike Hauf: It would not.
1:16:04 Member Robert Sumwalt: It would not. So why would a single point human failure be acceptable? And it really should not be acceptable. The fact is, if you put all of your eggs in the basket of a human to do it correctly, and i don't mean this flippantly because I've made plenty of mistakes, but humans will screw up anything if you give them enough opportunity. And I do not mean that in any disrespect to the crew, but the fact is a mistake was made here. But the mistake is oftentimes a symptom of a flawed system. And so, it's important to anticipate the errors in designing an error tolerance system. You don't go into it believing that, oh, no one will ever make a mistake. You design it knowing and believing that the error will occur and then design the system to trap or mitigate that error. Here the error occurred, the catastrophic error occurred on the fourth powered flight. So, it was not an error that had unimaginable probability of occurring. How many times have they deployed the feather in the glide flights, the cold flows, or any of that? The feather had been unlocked on how many flights approximately? Probably six or eight or a dozen?
1:17:36 Staffer (unidentified): I think it's nine.
1:17:37 Member Robert Sumwalt: Nine, plus two other power flights where it was unlocked, because it was not unlocked at powered flight one. So nine plus two, eleven. This happened on the 12th time that Scaled was unlocking the feather.
1:17:53 Staffer (unidentified): I meant nine total times, sorry.
1:17:55 Member Robert Sumwalt: Nine total times? That makes it even more compelling. My point is that a single point human failure had to be anticipated, and the system has to be designed to compensate for that error. In fact, if you look at the safety order of precedence, Scaled use the very lowest form of mitigation. Because the system safety order of precedence says the first thing that you should do, the highest mitigation would be that you design or engineer such that the error will not occur. And then the next order down, is that you would then put guards in the system, which they have now done. They guard it so that this error can't occur. There's an interlock in there that it won't allow it to unlocked until you get to, I think, 1.4. Then you put warnings, which we're hearing Captain Lawrence say there were no warnings in the POH. And what they really relied on was the lowest measure, which is procedures and training. So I think that say a lot right there.
1:19:05 I've got 23 seconds. Is it fair to say that there was a silo mentality within the FAA AST? Is that a fair statement? If everything had to flow through one person and sometimes that information would flow in, but it wouldn't flow back, that's what I'm reading in the report. Is that generally correct?
1:19:35 Dr. Katherine Wilson: Yes, all information from staff had to flow through management and then from management, one point of contact to Scaled.
1:19:42 Member Robert Sumwalt: And the people with the technical knowledge within the FAA complained that by the time their answers got answered, they were basically so watered down that their concerns weren't accurately relayed. Do you agree with that? Is that correct?
1:19:58 Dr. Katherine Wilson: Yes. There seemed to be a disconnect between the information that staff wanted, the technical information, and management, which believed that those questions were not relevant to public safety.
1:20:08 Member Robert Sumwalt: Thank you. And I've got one last question, and that is that in the report, it states the FAA AST evaluator added that there was 'a lot of pressure, political pressure' to issue experiment permits. And when I read that, that worries me. What do we mean by pressure, political pressure? What is this? Where is this pressure coming from? They had to get these permits done in 120 days, right? They needed more time is what some of them were saying, right? So, you know, we don't want a slow government. We all hear about the bureaucracy, and that we can't get thing out of the government. We hear that. As citizens, we hear that. But what, you know, if they needed more time, I mean, where was this pressure coming from? I remember back 20 years ago, to the ValuJet accident, '96, 19 years ago, where there was supposedly an administration push to have lots of new entrant carriers in there, and ValuJet was running and they pressured to allow them to do things. Was there that sort of political pressure within AST?
1:21:29 Lorenda Ward: I just want to step back for a second and say they did have a 120 day requirement. One of the things that helped to meet that 120 day requirement is they had the preapplication process. And so what that would do, is they would work with the applicant and then they could decide whether or not the application was complete enough and then it could move forward. So that could help with that 120 days. If, at the 120 day mark, there's also a [unclear] process that can be put in place, so it actually could have an extension where they could get additional information.
1:22:00 Member Robert Sumwalt: OK, thanks. How about this political pressure? Where is that coming from? Is that just one person's opinion? We must have felt it was significant because it ended up in the report. What are we talking about there? That sounds like a John DeLisi question.
1:22:17 John DeLisi: Well, certainly we interviewed a number of FAA personnel and you are asking about what the thoughts of the person who provided that information to us are. We assimilated all of that and we have made a number of recommendations to the FAA to improve the approval process, providing better information and better time. That's what we felt the most important takeaways from those interviews were.
1:22:42 Member Robert Sumwalt: OK, thank you very much. No further questions.
1:22:47 Chairman Christopher Hart: Any further questions from any other of the members? In that case, we will proceed to deliberations. Managing director Zoeller, please read the proposed conclusions and findings.
1:23:06 Tom Zoeller: As a result of this accident staff proposes 17 findings.
1:23:12 Number one. Although the copilot made the required 0.8 Mach callout at the correct point in the flight, he incorrectly unlocked the feather immediately afterward instead of waiting until SpaceShipTwo reached the required speed of 1.4 Mach.
1:23:29 Two. The unlocking of the feather during the transonic region resulted in uncommanded feather operation because the external aerodynamic loads on the feather flap assembly were greater than the capability of the feather actuators to hold the assembly in the unfeathered position with the locks disengaged.
1:23:52 Three. The copilot was experiencing high workload as a result of recalling tasks from memory while performing under time pressure and with vibration and loads that he had not recently experienced, which increased the opportunity for errors.
1:24:11 Four. The pilot and copilot were properly certificated and qualified. Fatigue and medical and pathological issues were not factors in this accident. The recovered vehicle components showed no evidence of any pre-impact structural, system, or rocket motor failures.
1:24:32 Five. SpaceShipTwo's instantaneous impact point on the day of the accident was consistent with the requirements of 14 Code of Federal Regulations 437.57, 'Operating Area Containment.'
1:24:51 Six. Although Scaled Composites' systems safety analysis (SSA) correctly identified that uncommanded feather operation would be catastrophic during the boost phase of flight and that multiple independent system failures had to occur to result in this hazard, the SSA process was inadequate because it resulted in an analysis that failed to (1) identify that a single human error could lead to unintended feather operation during the boost phase and (2) consider the need to more rigorously verify and validate the effectiveness of the planned mitigation measures.
1:25:34 Seven. By not considering human error as a potential cause of uncommanded feather extension on the SpaceShipTwo vehicle, Scaled Composites missed opportunities to identify the design and/or operational requirements that could have mitigated the consequences of human error during a high workload phase of flight.
1:25:58 Eight. Scaled Composites did not ensure that the accident pilots and other SpaceShipTwo test pilots adequately understood the risks of unlocking the feather early.
1:26:13 Nine. Human factors should be emphasized in the design, operational procedures, hazard analysis, and flight crew simulator training for a commercial space vehicle to reduce the possibility that human error during operations could lead to a catastrophic event.
1:26:32 Ten. The Federal Aviation Administration Office of Commercial Space Transportation's evaluations of Scaled Composites' initial and first renewal of the SpaceShipTwo experimental permit application were deficient because the evaluations failed to recognize that Scaled Composites' hazard analysis did not meet regulatory requirements to identify hazards caused by human error.
1:27:01 Eleven. The lack of direct communications between Federal Aviation Administration Office of Commercial Space Transportation technical staff and Scaled Composites technical staff, the pressure to approve experimental permit applications within a 120-day review period, and the lack of a defined line between public safety and mission safety assurance interfered with the Federal Aviation Administration's ability to thoroughly evaluate the SpaceShipTwo experimental permit applications.
1:27:36 Twelve. The Federal Aviation Administration Office of Commercial Space Transportation did not ensure that Scaled Composites was in compliance with the mitigations cited in the waiver from regulatory requirements or determine whether those mitigations would adequately address human errors with catastrophic consequences.
1:27:58 Thirteen. The experimental permit preapplication consultation process would be more effective if it were to begin during a commercial space vehicle's design phase so that concerns can be resolved before a commercial space vehicle is developed and manufactured and potential catastrophic hazards resulting from human error can be identified early.
1:28:23 Fourteen. The effectiveness of the Federal Aviation Administration Office of Commercial Space Transportation's inspection process would be improved if inspectors were assigned to commercial space operators rather than individual commercial space launch operations because the inspectors could become more familiar with the operators' training and procedures and could identify ways to enhance safety.
1:28:51 Fifteen. A database of lessons learned from commercial space mishap investigations would provide mutual benefits to public safety and industry promotion and would thus be consistent with the Federal Aviation Administration's mission and authority.
1:29:09 Sixteen. Scaled Composites and local emergency response officials could improve their emergency readiness for future test flights by making better use of available helicopter assets.
1:29:22 And seventeen. Additional parachute training and procedures would have better prepared Scaled Composites' test pilots for emergency situations.
1:29:35 Chairman Christopher Hart: Thank you Mr. Zoeller. Is there a motion to adopt the findings as proposed?
1:29:39 Vice Chairman T. Bella Dinh-Zarr: So moved.
1:29:40 Chairman Christopher Hart: Second. Any discussion? The motion has been seconded. All those in favor, signal with a hand and aye. The vote is four to zero in favor of adopting the findings as proposed. We will move on now to the probable cause. Managing director Zoeller, please read the probable cause.
1:30:04 Tom Zoeller: Staff proposes the following probable cause. The National Transportation Safety Board determines that the probable cause of this accident was the copilot's premature unlocking of the SpaceShipTwo (SS2) feather system as a result of time pressure and vibration and loads that he had not recently experienced, which led to the uncommanded extension of the feather during the transonic region and resulted in the aerodynamic overload and in-flight breakup of the SS2 vehicle. Contributing to the accident was Scaled Composite's failure to consider the possibility that the effects of a single human error could cause the feather to extend uncommitted and fully inform pilots about the risk of unlocking the system early.
1:30:54 Chairman Christopher Hart: Thank you. I know there have been several possible amendments floating around, and I've got one myself. But if anybody else any they would like to read in first, i will go in order. I think it's easier to, before we make a motion, to look at what all is on the table and discuss it in toto. So anybody else have any, I think everybody has seen the proposal that I've put out. We've handed it out. And I would propose to read it and see if there's a motion and then commence discussion on it.
1:31:24 My proposed probable cause would be. The National Transportation Safety Board determines that the probable cause of this accident was Scaled Composites' failure to protect against the possibility that a single human error in an environment involving time pressure, vibration, and unusual G loads could result in premature unlocking of the feather in SpaceShipTwo at a time when such action could result in uncommanded feather extension and cause aerodynamic overload and in-flight breakup of the vehicle. I think you have what I just read except the next to last line 'would' is changed to 'could'. But other than that I believe you have what I just read. So I'm going to make the motion to amend the probable cause accordingly and see if there's a second.
1:32:09 Member Robert Sumwalt: I second for discussion.
1:32:11 Chairman Christopher Hart: OK. I would like to have discussion from both the board and the staff to see how everyone feels about it. The motion has been seconded, so lets start with staff. Does staff have a position on the proposed amendment?
1:32:27 John DeLisi: Thank you, Chairman. We certainly appreciate an opportunity to participate in this discussion. One comment from staff on this version. It does not include the action of the copilot. It perhaps reads more like a finding from an audit or a design review as opposed to this accident investigation. As accident investigators, we certainly looked at the data, the video was compelling and helped propel us into the findings of this investigation. So this particular version leaves out the phrase 'the copilot's premature unlocking of the feather system.'
1:33:07 Chairman Christopher Hart: Thank you for that comment. And actually that was intentional because the intention was to go for the 'but for' cause, if you will. But I would entertain any friendly amendments if you would like to revise that accordingly. If you have any suggested language, I'd be happy to entertain that. Do you have thoughts in that regard? While you're thinking about it, let me see if other members have any discussion regarding this probable cause. Please. Member Sumwalt?
1:33:32 Member Robert Sumwalt: Thank You. I saw this at basically quarter till nine this morning. I notified your assistant that yes, I could support it, but in the intervening time, and by the way, I do like a lot of what's there, but my thoughts are exactly along the lines of Mr. DeLisi's. Just going back through accident causation theory. Usually there are two pathways. There's a latent pathway and there's an active pathway. And so this discusses the latent pathway. This does not say what the initiating event was. What is read here is was in the system For PF-01, PF-02, and PF-03, and there was no accident. So, what is it that made PF-04 different? And it was that active failure of the copilot. So I think, frankly, it is incomplete unless we add in that triggering mechanism. I'm very pleased, as my colleagues know and staff knows, I circulated a probable cause yesterday where I felt like Scaled should be moved up to the probable cause and not just the contributing factor, and I believe that's accurate. But again, I think one thing that's missing here is that. And I think that we can get there, and I was playing with some wording and it gets very redundant from what's already said, but we could take what's there, what's just been read, and then some language that staff, well, I'm just not going to quite propose it yet, but throw it out there. After what has been read, something along, this set the stage for the copilot's premature premature unlocking of the feather system, which resulted in the aerodynamic overload and in-flight breakup of the vehicle. The think I don't like about it is that the wording starts getting redundant from what's already said, but it does add in that what the chairman just read set the stage for the allowing of the copilot error.
1:35:50 Chairman Christopher Hart: Thank you, and I appreciate those concerns. I'm going to suggest, why don't we take a twenty minute break and let the staff play with it, wordsmith with it, and then we can resume in twenty minutes. Let's resume at 11:30 and see what staff can come up with? And member Sumwalt, thank you for those comments and thank you for your suggestions on this one as we read it as well. Anybody have any comments now before we break? OK, let's take a brief break and we will resume at 11:30. [Gavel]
2:03:21 Chairman Christopher Hart: By way of a progress report, we're in the final stages of getting a revision of the probable cause. So we'll be resuming in a few minutes. Thank you.
2:09:50 Chairman Christopher Hart: Could we take our seats? We're going to start in a couple minutes.
2:10:09 Chairman Christopher Hart: [Gavel] We are now back in session. I want to thank the staff for revisiting the probable cause. But before we get to that I understand that there is an issue regarding one of the findings. So please let me turn that over to the staff.
2:10:24 John DeLisi: Thank you Chairman. We did notice the need for a technical correction to conclusion number four. We have the phrase 'pre-impact structural damage' in that conclusion. We'd like to technically corrected to now say, 'The recovered vehicle components showed no evidence of any structural, system, or rocket motor failures before the in-flight breakup.'
2:10:50 Chairman Christopher Hart: OK, so would you read that again, the exact wording, the last sentence of finding number four?
2:10:57 John DeLisi: Finding number four. The second sentence would now read, 'The recovered vehicle components showed no evidence of any structural, system, or rocket motor failures before the in-flight breakup.'
2:11:17 Chairman Christopher Hart: OK, thank you. Since we've already voted on the findings, this would take a motion from one of the members to revise finding number four as suggested.
2:11:25 Member Robert Sumwalt: So moved. I recommend that finding four be amended to read as follows. 'The pilot and copilot were properly certificated and qualified. Fatigue and medical and pathological issues were not factors in this accident. The recovered system vehicle components showed no evidence of any structural, system, or rocket motor failures before the in-flight breakup.' And that would be my motion.
2:11:55 Chairman Christopher Hart: OK, any seconds on that motion? Any discussions from the members? Discussion from staff? Motion to amend finding number four has been seconded. All those in favor signal with a hand and say aye. The vote is 4 to 0 in favor of adopting finding number four as amended. Now we need to revote for adopting the findings in their completion. So is there a motion to adopt the total findings as amended? Second? OK. The motion to adopt the findings as amended has been seconded. All those in favor, signal with a hand and say aye. The vote is 4 to 0 in favor of adopting the findings as amended.
2:12:38 Now let's turn over to the probable cause. Staff has handed me something that they have prepared as a revision to the probable cause. I would be willing to rescind my motion and make a new motion. Maybe that's the cleanest way to do it. And my new motion would be to accept the probable cause as the staff has revised it, and I will read that. 'The National Transportation Safety Board determines that the probable cause of this accident was Scaled Composites' failure to consider and protect against the possibility that a single human error could result in a catastrophic hazard to the SpaceShipTwo vehicle. This failure set the stage for the copilot's premature unlocking of the feather system as a result of time pressure and vibration and loads that he had not recently experienced, which led to uncommanded feather extension and the subsequent aerodynamic overload and in-flight breakup of the vehicle.' So I move to adopt that as the probable cause. Any second on that motion? Any discussion from members? Any discussion from staff? OK, the motion has been seconded. All those in favor, signal with a hand and say aye. The vote is 4 to 0 in favor of adopting the probable cause as amended. Managing director Zoeller, please read the proposed recommendations.
2:13:55 Tom Zoeller: As a result this accident, staff proposes 10 new safety recommendations. There are eight to the Federal Aviation Administration.
2:14:03 One. In collaboration with the Commercial Spaceflight Federation, develop and issue human factors guidance for operators to use throughout the design and operation of a crewed vehicle. The guidance should address, but not be limited to, the human factor issues identified during the SpaceShipTwo accident investigation.
2:14:24 Number two. Implement steps in your evaluation of experimental permit applications to ensure that applicants have (1) identified single flight crew tasks that, if performed incorrectly or at the wrong time, could result in a catastrophic hazard, (2) assessed the reasonableness, including human factor considerations, of the proposed mitigations to prevent errors that could result from performing those tasks, and (3) fully documented the rationale used to justify related assumptions in the hazard analysis required by 14 Code of Federal Regulations 437.55
2:15:08 Number three. Develop a process to determine whether an experimental permit applicant has demonstrated the adequacy of existing mitigations to ensure public health and safety as well as safety of property before granting a waiver from the human error hazard analysis requirements of 14 Code of Federal Regulations 437.55.
2:15:34 Number four. Develop and implement procedures and guidance for confirming that commercial space operators are implementing the mitigations identified in a safety-related waiver of federal regulations and work with the operators to determine the effectiveness of those mitigations that correspond to hazards contributing to catastrophic outcomes.
2:15:56 Number five. Develop and issue guidance for experimental permit applicants that (1) includes the information in Advisory Circular 413-1, 'License Application Procedures,' and (2) encourages commercial space vehicle manufacturers to begin the consultation process with the Office of Commercial Space Transportation during a vehicle's design phase.
2:16:22 Number six. Develop and implement a program for Office of Commercial Space Transportation inspectors that aligns them with individual operators applying for an experimental permit or a launch license to ensure that the inspectors have adequate time to become familiar with the technical, operational, training, and management controls that they will inspect.
2:16:47 Number seven. Direct Office of Commercial Space Transportation (AST) management to work with AST technical staff to (1) develop clearer policies, practices, and procedures that allow direct communications between staff and applicants, (2) provide clearer guidance on evaluating commercial space transportation permits, waivers, and licenses, and (3) better define the line between the information needed to ensure public safety and the information pertaining more broadly to ensuring mission success.
2:17:22 And eight. In collaboration with the commercial space flight industry, continue work to implement a database of lessons learned from commercial space mishap investigations and encourage commercial space industry members to voluntarily submit lessons learned.
2:17:40 And there are two recommendations to the Commercial Spaceflight Federation.
2:17:44 Advise commercial space operators to work with local emergency response partners to revise emergency response procedures and planning to ensure that helicopter and other resources are appropriately deployed during flights.
2:18:00 And the last recommendation to them. Work with the Federal Aviation Administration to develop and issue human factors guidance for operators to use throughout the design and operation of a crewed vehicle. The guidance should address, but not be limited to, the human factor issues identified during the SpaceShipTwo accident investigation.
2:18:23 Chairman Christopher Hart: Thank you, Mr. Zoeller. Is there a motion to adopt the recommendations as proposed? Second? Th motion has been seconded. All those in favor, signal with a hand and say aye? The vote is 4 to 0 in favor of adopting the recommendations as proposed. Is there a motion to adopt the report as revised? Second? The motion to adopt the report as revised has been seconded. All those in favor signal, with a hand and say aye. The vote is 4 to 0 in favor of adopting the report as revise. The report has therefore been adopted. Do any board members wish to file concurring or dissenting statement. Hearing none, is there any further discussion?
2:19:13 In closing, I would like to recognize the hard work of NTSB staff in producing this report, in record time I would add, and thank my fellow board members for their very thoughtful and extensive participation in this process.
2:19:25 Throughout this meeting, we discussed various human factors issues that were known from previous transportation accident experience but that were not thoroughly addressed in this test flight by Scaled Composites. We also examined how certain hazard analysis requirements were waived by the FAA. In the big picture, commercial space travel stands on the verge of becoming reality. Some of you may remember the iconic scene in the film 2001: A Space Odyssey in which a Pan Am passenger shuttle approaches a space station. In 1968, Pan Am even started a waiting list of people interested in taking a commercial space flight. That list grew to 93,000 applicants. Today, the vision of commercial space travel is close to fulfillment. Hundreds of people whose only qualification for space flight is their ability to purchase a ticket await the opportunity to go into space on commercial space launches. But for such flights to proceed safely, commercial space transportation must continue to evolve and mature. The success of commercial space travel depends on the safety of commercial space travel, at the level of every operator and every crew.
2:20:30 The recommendations to the FAA and to the Commercial Space Industry that we approved today are early steps in this commercial space safety journey. If acted on, they will help ensure that the FAA's evaluation of experimental permit and license applications is more robust and that the FAA demands and ensures the mitigation of risks to the public and property if and when it waives requirements. In commercial space transportation, manufacturers are pursuing widely varying approaches to find the best technological solutions. Today's recommendations, if heeded, will enhance the FAA's ability to provide oversight that more fully recognizes each operator's specific and variable approach. These recommendations will also result in stronger guidance regarding human factors in the design and operation of commercial space vehicles, enhanced collaboration between FAA technical staff and operators, and the collaborative sharing of safety lessons in commercial spaceflight through a database that is now under development at the FAA. Such a database will allow the commercial space sector to benefit from a longstanding principle in commercial aviation, namely, that anybody's accident is everybody's accident. Operators can and do compete on many levels, whether in commercial aviation or in commercial space transportation. But when it comes to safety, they must cooperate and collaborate, with each other and with the FAA.
2:21:50 Thank you for your attention. We stand adjourned. [Gavel]