NTSB SpaceShipTwo Accident Cause Determination
The end of NTSB’s investigation and the future of Virgin Galactic, Richard Branson’s blog
“This photo shows pilot Pete Siebold as he parachutes safely down to earth, with his arm up in the air to show everybody that he is alive and well.” Larger image
Lack of Consideration for Human Factors Led to Breakup of SpaceShipTwo
“The NTSB determined the cause of the Oct. 31, 2014 in-flight breakup of SpaceShipTwo, was Scaled Composite’s failure to consider and protect against human error and the co-pilot’s premature unlocking of the spaceship’s feather system as a result of time pressure and vibration and loads that he had not recently experienced.”
– NTSB Concludes Scaled Composites SpaceShipTwo Flight Test Accident Investigation, Virgin Galactic
– NTSB Executive Summary: In-Flight Breakup During Test Flight Scaled Composites SpaceShipTwo, N339SS, NTSB
– Virgin Galactic Executive Summary: SpaceShipTwo, N339SS Rocket-Powered Flight Test Koehn Dry Lake, California, October 31, 2014, Virgin Galactic
– The end of NTSB’s investigation and the future of Virgin Galactic, Richard Branson’s blog
– Investigator-in-Charge Presentation – Lorenda Ward, NTSB
– Human Factors and Organizational Issues , Human Performance Presentation – Dr. Katherine Wilson, NTSB
– Hazard Analysis and Waivers, System Safety Presentation – Mike Hauf, NTSB
Very sad accident, very sad thing to have happened. Hope VG can learn from and recoup from this tragic loss.
Human error can be equally fatal in a plane or a car. It probably makes sense to turn the hands-on flying (and driving) over to robotic systems.
Except that robotic systems don’t handle the unexpected very well. How could they? If the situation is unexpected, it’s unlikely that the software developers wrote any code to handle it.
For example, take the recent cargo Dragon loss. It did not deploy its parachutes when that could have saved the capsule and most of the (internal) cargo. Had there been a person on board, they could have pressed the big red emergency parachute deploy button.
True but entirely wrong in this case. A computer wouldn’t have released the tail flutter system prematurely.
Actually, if a Human were in the Dragon, it would have had abort thrusters – most likely an automatic abort would have initiated. Score one for the computers in that scenario…
Agreed. Deploying parachutes from a Cargo dragon after launch vehicle destruction was not considered likely enough to include the software to do so. Clearly in a manned Dragon, abort scenarios are given much higher priority.
Looking at the CRS-7 video, it’s not clear that a person on board would have remained cognizant enough to do anything, let alone initiate a previously unplanned abort sequence. Assuming the capsule was even still sufficiently intact to support human life until a safe landing, which remains a pretty big if.
I hate getting morbid, but given the forensic evidence left from the Challenger disaster, I think it is entirely possible a human riding inside CRS-7 Dragon might have either stayed conscious or regained consciousness after the second stage disintegrated.
As pointed out, if a human had been aboard the vehicle would have had super dracos and the computer would have had the software to initiate a launch abort and deploy the chutes.
The problem is not that the situation was unexpected. The situation in this case was exactly what was expected. The problem is that humans do not respond consistently and precisely to predictable situations, because we become distracted, preoccupied, task-saturated, bored, or forgetful. Machines don’t.
Agreed, that’s the double edged sword of humans in the loop. They are better than computer programs when dealing with the unexpected. Unfortunately, humans do make mistakes, even when dealing with the expected.
Exactly. I feel the role of a human on a spacecraft or aircraft (or car) should be that of a captain on a ship; to decide goals and strategies and give high-level orders, but not necessarily to put hands on the stick and throttle.
Seems over time that machines will become better at dealing with emergency situations. Seems much will be applied from autonomous cars, planes.
There should never be a situation where a cargo capsule doesn’t attempt to save itself again.
Why did some one as knowledgeable as Burt Rutan design a spacecraft with a single-point-of-failure to begin with? Rutan must take some of the blame.
There always are and always will be single points of failure in any vehicle. That really isn’t the issue here.
Burt Rutan did not design SpaceShipTwo. Jim Tighe was the chief aerodynamicist and he left the company some time ago, just as Rutan retired in 2010
All aircraft and all cars can fail catastrophically and in many cases instantly if the pilot or driver makes a mistake.
There is an excellent blog post about how emphasis on a particular aspect of a flight can lead to pilot error here:
https://waynehale.wordpress…
However the shuttle was perfectly cable of landing on autopilot, and as great a pilot as Brewster Shaw was, the autopilot would have hit the numbers because it is never distracted.
No, it wasn’t. The Shuttle was not designed with an automated landing system. It had a system that could automatically navigate the shuttle to a runway, but not to land it. The shuttle required a human pilot to deploy the landing gear and do the actual landing.
That only changed after Columbia, when a connector cable was made that enabled a means to return the shuttle without crew intervention, a 28-foot-long cable that would be used to connect an avionics bay located on the mid-deck with the flight-deck controls. The cable enables flight controllers on the ground to land the Shuttle completely by remote control, including the ability to lower the landing gear. That first flew on STS-121.
Yes it was. It required a crewman to start the APUs, deploy the landing gear, drag chute, and air data probe. It did not require a crewman to have hands and feet on the stick and rudder. The autoland system was tested all the way to rollout on the STA.
http://llis.nasa.gov/lesson…
Thank you for proving my point, that the Shuttle could not have landed on its own. Even with the jumper cable, a person physically in mission control would have been guiding the Shuttle to a landing, so there was no automatic landing capability in the Shuttle at any point in its history.
Did you actually read the information in the link you provided?
“The space shuttle system presently includes an autoland system that provides automated guidance capable of navigating the orbiter to the selected landing runway.”
That doesn’t include landing on it.
“the issue of the possible need to fully automate all landing, rollout, and braking functions so that the orbiter could be returned safely from orbit without any crew intervention, if necessary.”
This directly says that the Shuttle did not have those capabilities at that point (it is dated 1992).
“The existing automated approach guidance system never has been fully flight tested. The second space shuttle flight, STS-2, left the auto mode engaged until the latter part of the team region and demonstrated that the system was capable of returning the vehicle to a flyable energy state from a low energy state. STS-3 left the system in auto until the commander’s scheduled takeover at 125 feet.”
Important is the Recommendation portion:
“Develop a detailed test of the automatic landing system that will include all functions through touchdown and rollout to wheel stop.”
So thank you for proving that the Shuttle did not have an automated landing system in 1992.
There was a plan to test the autoland system all the way to touchdown on STS-53 but a temporarily assigned military officer refused to approve it. The landing, which was made under manual control, was dicey due to pilot distraction at a critical point in the approach and poor visibility (clouds at 3000 feet). https://waynehale.wordpress… . Autoland is used routinely in airliners and on the X-37, the latter touches down only a little slower than the Shuttle. The Shuttle crew was needed to start APUs, lower the landing gear, deploy the drag chute and apply wheel brakes. Nosewheel steering (developed later in the program) may also have required crew input, but all flight controls were auto until touchdown.
I am confused by your statement that the flight controllers would be “flying” the shuttle during an autoland. They would be performing their normal mission management functions. They would not have hands on the stick and rudder.
The premature release of the feather lock in the Spaceship incident did not involve the primary flight controls, but it was a function that could easily have been automated, or for that matter performed later in the flight since the actual feathering maneuver was not needed until descent. The copilot should also have announced the control action to the pilot, who learned what happened only much later. It’s never good when both pilots are flying and they do not communicate.
When the crew has to deploy the landing gear, etc…. that means the Shuttle can’t land on its own. The Remote Control Orbiter (RCO) in-flight maintenance (IFM) cable included after STS-121 did allow mission control to send commands to perform those functions and to remotely control the orbiter.
Pretty simple concept here. Of course other aircraft can land automatically these days, but the Shuttle never could, and never did.
Just what I said. Since the Shuttle had no autonomous landing capacity it would have had to be remotely controlled from mission control to land it.
OK, I guess you want to talk about SS2 now that you’ve been beaten on the Shuttle issue.
The Feather unlock was a safety feature – they wanted to unlock before they had reached the point of no return, that way if the unlock failed they could abort the flight, if the feather can’t unlock . I agree that the unlock function should have been automated. There was a “feather unlock” call-out.
It’s tough for me to see how something as simple as an unlocking mechanism would be so unreliable it had to be operated on ascent.
The feathering process still required working actuators that would not be tested until descent. Did the co-pilot say anything when he actuated the feather unlock?
The term “autoland” might be ambiguous.
Some drones are landed manually even though they are unmanned, with the remote operator directly operating the primary controls. The X-37 lands autonomously; no external commands are required between entry and wheel stop.
Airliner crews must lower the landing gear manually during an automatic landing and perform other control actions. No airliner I am aware of can fly or land without a crew. But the critical criterion is that the primary flight controls are controlled by the autopilot until touchdown. This was the goal of the Shuttle autoland system, to relieve the pilot of the difficult and somewhat hazardous task of directly controlling the flight path during approach and landing, particularly under conditions of poor visibility. Only at the very end of the program was there a requirement to deorbit and land without a crew on board. http://www.nasaspaceflight….
The Shuttle Autoland system was designed to perform the same functions as a typical airliner autoland system (which were in use in a few aircraft even before STS-1), i.e. to operate the primary flight controls, including the speed brake, from 10,000 ft to touchdown. http://ntrs.nasa.gov/search… By the usual meaning of the word in aeronautics, that is an automatic landing.
Reliability has nothing to do with it. It’s like a safety on a gun, doesn’t mean the gun is more or less reliable. You still have to flip off the safety to fire the gun.
Yes, there was a call out.
ALSBURY 17:07:28.39 [straining] Unlocking.
You can read the rest of the transcript here:
http://www.parabolicarc.com…
Yes, the Shuttle has a system that controlled the flight of the orbiter during descent, but could not deploy the landing gear, etc. until STS-121, and those features would still have to be activated by mission control. Still sounds like it’s not an automated landing system to me.