Virgin Galactic Executive Summary: SpaceShipTwo, N339SS Rocket-Powered Flight Test Koehn Dry Lake, California, October 31, 2014
EXECUTIVE SUMMARY
Submission to the
NATIONAL TRANSPORTATION SAFETY BOARD for the Investigation of Scaled Composites, LLC’s SpaceShipTwo, N339SS Rocket-Powered Flight Test
Koehn Dry Lake, California, October 31, 2014
May 29, 2014
By Virgin Galactic, LLC and The Spaceship Company, LLC
EXECUTIVE SUMMARY
Factual Background
On October 31, 2014, at approximately 10:07 PDT, Scaled Composites’ SpaceShipTwo flight test vehicle, SS2-001 (N339SS) experienced a serious in-flight anomaly during a rocket-powered test flight approximately 13 seconds after release that resulted in the destruction of the vehicle and the death of the copilot. The pilot survived after successfully parachuting to the ground. No other persons were injured in the air or on the ground.
The accident occurred during the program’s 55th overall and fourth powered test flight (PF-04) of SpaceShipTwo. Scaled Composites, the vehicle’s designer and builder, held an experimental launch permit from the Federal Aviation Administration’s Office of Space Transportation (FAA-AST) to conduct the vehicle’s rocket-powered test flights. Scaled Composites, a wholly-owned subsidiary of the Northrop Grumman Corporation, was under contract with Virgin Galactic (VG) and The Spaceship Company (TSC) to carry out SpaceShipTwo’s developmental flight test program, maintaining both operational control and safety oversight. At the time of the accident, SpaceShipTwo was piloted by two Scaled Composites test pilots.
The mishap test flight, designated PF-04, had three primary objectives:
1) Expand SpaceShipTwo’s powered flight envelope utilizing a 38-second rocket burn to attain approximately 135,000 feet above mean sea level (MSL) and Mach 2.00;
2) Conduct the first supersonic feathered re-entry of SpaceShipTwo;
3) Conduct the first flight using an alternative, polyamide-based hybrid rocket motor fuel that was essentially structurally identical to previously flown motors.
Following a delay to ensure nitrous oxide (N2O) temperatures warmed into the acceptable launch range, WhiteKnightTwo departed Mojave Air and Spaceport at 09:19:30 PDT with SpaceShipTwo mated to its underside. WhiteKnightTwo uneventfully carried SpaceShipTwo to a release altitude of approximately 47,000 feet MSL. An abbreviated timeline of the accident events follows:
10:07:19.27 SpaceShipTwo released from WhiteKnightTwo.
10:07:19.51 The pilot commanded the copilot to fire the rocket motor. Rocket motor ignition and burn were nominal.
10:07:26.83 The vehicle accelerated through 0.80 Mach.
10:07:26.91 The copilot announced 0.80 Mach in accordance with checklist procedures.
10:07:28.39 The copilot announced “unlocking” at approximately 0.92 Mach.
10:07:28.90 The copilot moved feather lock handles to the full unlock position.
10:07:32.80 Telemetric data ceased.
At the loss of data, multiple onboard and offboard video and data sources documented SpaceShipTwo entering an accelerated, high-g pitch up that telemetry confirmed exceeded the vehicle’s structural design loads. SpaceShipTwo broke up into several large pieces that impacted terrain over a five-mile area near Koehn Dry Lake, California.
A comprehensive investigation by the NTSB using telemetered and recovered onboard data conclusively demonstrated that all vehicle systems were operating normally up until the point of breakup. The rocket motor met or exceeded expectations, running smoother and with less vibration than during any previous powered flight.
SpaceShipTwo used a patented feathering system designed to aerodynamically provide stable reentry into the Earth’s atmosphere upon completion of a sub-orbital spaceflight. It functioned by rotating SpaceShipTwo’s twin tail booms upward about the wing’s trailing edge approximately 65 degrees to increase both stability and drag during the descent. In the feather down position a pair of feather lock hooks were engaged at the leading edge of the boom to provide the structural integrity required during the transonic (approximately 0.8 to 1.2 Mach) region where large up loads on the tail during powered flight would otherwise overpower the actuators and cause the feather system to extend without any additional pilot action.
Normal extension of the feather system required a two-step sequence of aircrew actions:
1) Feather Lock Handles UNLOCK. This action disengaged the feather lock hooks from the tail booms and enabled rotation of the system. Unlocking of the feather system was accomplished through the copilot’s single movement of the feather lock handles into the unlocked position. When accomplished at 1.4 Mach or greater (as required per the SpaceShipTwo checklist procedures and the PF-04 test card) the feather system remained retracted due to a sufficient closing pre-load from the feather actuators and favorable, tail-down aerodynamic loads.
2) Feather Handle EXTEND. This action commanded the feather system into the extended position. Normal extension occurred subsequent to unlocking the feather locks when the copilot moved the feather handle (a lever independent from the feather lock handle) to the extended position. On normal rocket-powered flights, checklist procedures called for this step to occur after rocket motor burn out while in space just prior to apogee.
Probable Cause and Contributing Causes
The Probable Cause of this accident was the copilot’s unlocking of SpaceShipTwo’s feather locks at 0.92 Mach, approximately 14 seconds prior to the flight manual minimum speed of 1.4 Mach.
Although normal checklist procedures maintained the feather locks in the locked position until after obtaining a minimum speed of 1.4 Mach, the mishap copilot prematurely unlocked the system at approximately 0.92 Mach. This premature unlocking was indisputably confirmed by telemetric, in-cockpit video and audio data. At this speed, lift from the horizontal tails well exceeded the feather actuator’s ability to prevent a rapid aerodynamic extension of the feather system. These forces caused the feather to rapidly extend without any further pilot action or mechanical malfunction.
A thorough review of the mishap flight data conclusively determined that there were no misleading indications on the pilot displays and that all flight data were accurately displayed to the aircrew.
Extension of the feather while in boosted flight under these conditions imparted over 9g’s of pitch up acceleration forces on the spaceship. These forces exceeded SpaceShipTwo’s designed structural load capability and resulted in its in-flight breakup.
The Contributing Causes of the accident were:
Feather Lock system design. The Feather Lock system design did not have an automatic mechanical inhibit to prevent premature movement of the feather system.
Crew Resource Management. Scaled Composites’ aircrew procedures did not require a challenge/response protocol prior to moving the feather lock handle.
Recommendations
Scaled Composites was responsible for all aspects of the flight test program at the time of the accident. Subsequently, Virgin Galactic has assumed full responsibility for the completion of SpaceShipTwo flight test program and the commercial operations which will follow.
Well prior to the accident, Virgin Galactic and TSC began a vehicle improvement program in anticipation of the program’s planned January 2015 transition from Scaled Composites. The improvement program was based on lessons learned from both SS2-001’s construction and the flight test program. Commercial service enhancements were scheduled to be included in both SS2-001 and SS2-002 (currently under construction by TSC) prior to either vehicle entering commercial service.
Following the accident, Virgin Galactic and TSC undertook a comprehensive internal and external program review of the SpaceShipTwo design and operations. Virgin Galactic recommends these actions:
1) Modify the SpaceShipTwo feather lock system with an automatic mechanical inhibit to prevent unlocking or locking the feather locks during safety-critical phases of flight.
Status: Completed
2) Add to the SpaceShipTwo Normal Procedures checklist and Pilot’s Operating Handbook an explicit warning about the consequences of prematurely unlocking the feather lock.
Status: Completed
3) Implement a comprehensive Crew Resource Management (CRM) approach to all future Virgin Galactic SpaceShipTwo operations in a manner consistent with the pre-existing CRM program VG has employed for WK2 operations. This includes, as a minimum:
Standardized procedures and call outs
Challenge/response protocol for all safety-critical aircrew actions, to include feather lock handle movement
Formalized CRM training
Status: Completed
4) Conduct a comprehensive internal safety review of all SpaceShipTwo systems to identify and eliminate any single-point human performance actions that could result in a catastrophic event.
Status: An initial assessment was completed and modifications to SS2-002 are in progress. Virgin Galactic will continually evaluate and improve System Safety throughout SpaceShipTwo’s lifecycle.
5) Conduct a comprehensive external safety review of Virgin Galactic and The Spaceship Company’s engineering, flight test and operations as well as SpaceShipTwo itself.
Status: Initial Assessment Completed. The external review team will review the program both prior to commencement of flight test activities as well as prior to entering commercial service.
6) Ensure Virgin Galactic employs pilots who meet or exceed the highest standards and possess a depth and breadth of experience in high performance fighter-type aircraft and/or spacecraft. Minimum VG qualifications during the flight test program shall be:
A long course graduate of a recognized test pilot school with a minimum of 2.5 years post-graduation experience in the flight test of high performance, military turbojet aircraft and/or spacecraft.
A minimum of 1000 hours pilot in command of high performance, military turbojet aircraft.
Experience in multiengine non-centerline thrust aircraft
Experience in multi-place, crewed aircraft and/or spacecraft
These criteria are based on industry best practices for flight testing, using DCMA INST 8210.1C, paragraph 4.3 as guidance.
Status: Completed. All current Virgin Galactic pilots exceed the above minimum VG standards.
