NTSB Update on SpaceShip Two Accident

On October 31, 2014, at 1007:32 Pacific daylight time, the SpaceShipTwo (SS2) reusable suborbital rocket, N339SS, operated by Scaled Composites LLC (Scaled), broke up into multiple pieces during a rocket-powered test flight and impacted terrain over a 5-mile area near Koehn Dry Lake, California. The pilot received serious injuries, and the copilot received fatal injuries. SS2 was destroyed, and no one on the ground was injured as a result of the falling debris. SS2 had been released from its launch vehicle, WhiteKnightTwo (WK2), N348MS, about 13 seconds before the structural breakup. Scaled was operating SS2 under an experimental permit issued by the Federal Aviation Administration’s (FAA) Office of Commercial Space Transportation (AST) according to the provisions of 14 Code of Federal Regulations (CFR) Part 437.

Scaled had developed WK2 and was developing SS2 for Virgin Galactic, which planned to use the vehicles to conduct future commercial space suborbital operations. SS2 was equipped with a feather system that rotated a feather flap assembly with twin tailbooms upward from the vehicle’s normal configuration (0º) to 60º to stabilize SS2’s attitude and increase drag during reentry into the earth’s atmosphere. The feather system included actuators to extend and retract the feather and locks to keep the feather in the retracted position when not in use.

After release from WK2 at an altitude of about 46,400 ft, SS2 entered the boost phase of flight. During this phase, SS2’s rocket motor propels the vehicle from a gliding flight attitude to an almost-vertical attitude, and the vehicle accelerates from subsonic speeds, through the transonic region (0.9 to 1.1 Mach), to supersonic speeds. The flight test data card used during the accident flight indicated that the copilot was to unlock the feather during the boost phase when SS2 reached a speed of 1.4 Mach. (The feather was to be unlocked at this point in the flight to mitigate the hazard resulting from a reentry with the feather down due to a lock failure.) However, a forward-facing cockpit camera and flight data showed that the copilot unlocked the feather just after SS2 passed through a speed of 0.8 Mach. Afterward, the aerodynamic and inertial loads imposed on the feather flap assembly were sufficient to overcome the feather actuators, which were not designed to hold the feather in the retracted position during the transonic region. As a result, the feather extended uncommanded, causing the catastrophic structural failure.

Before Scaled received its experimental permit to conduct rocket-powered test flights for SS2, the company prepared an experimental permit application for the FAA/AST’s review. One of the pertinent regulations relating to the issuance of an experimental permit is 14 CFR 437.55, “Hazard Analysis,” which, among other things, requires the applicant to identify and describe those hazards that could result from human errors. In its SS2 hazard analysis, Scaled did not account for the possibility that a pilot might prematurely unlock the feather system, allowing the feather to extend under conditions that would cause a catastrophic failure of the vehicle structure. Instead, Scaled assumed that pilots would correctly operate the feather system every time because they would be properly trained through simulator sessions and would follow the normal and emergency procedures for a given situation. However, this accident demonstrated that NTSB Aerospace Accident Report mistakes can occur even with a flight crewmember who had extensive flight test experience and had performed numerous preflight simulations during which the feather was unlocked at the proper speed of 1.4 Mach.

The FAA/AST evaluated Scaled’s SS2 experimental permit applications and granted the initial SS2 permit in May 2012 and the first and second renewals of the permit in May 2013 and May 2014, respectively. After granting the first renewal of the permit, the FAA/AST conducted another review of the SS2 hazard analysis included in Scaled’s application and determined that the hazard analysis did not meet the software and human error requirements of 14 CFR 437.55(a). As a result, in July 2013, the FAA/AST issued a waiver from these hazard analysis requirements for the first renewal of Scaled’s experimental permit. Scaled did not request the waiver, participate in the waiver evaluation process, or have an opportunity to comment on the waiver before it was issued (except to identify proprietary information that should not be disclosed). In May and October 2014 (as part of the second renewal of Scaled’s SS2 experimental permit and Scaled’s application to modify the permit to reflect changes made to SS2, respectively), the FAA/AST issued additional waivers from the software and human error hazard analysis requirements of section 437.55(a).

The FAA/AST determined that each of the waivers was in the public interest and would not jeopardize public health and safety, safety of property, or US national security and foreign policy interests. The FAA/AST also determined that, even though Scaled’s hazard analysis did not comply with software and human error regulatory requirements, specific mitigations that Scaled had in place would prevent hazards resulting from such errors. However, the FAA/AST issued the waivers without understanding whether the mitigations would adequately protect against a single human error with catastrophic consequences. In addition, the FAA/AST did not determine whether mitigations, other than those intended to protect against human error, were sufficient to ensure public safety.

​The National Transportation Safety Board determines that the probable cause of this accident was Scaled Composites’ failure to consider and protect against the possibility that a single human error could result in a catastrophic hazard to the SpaceShipTwo vehicle. This failure set the stage for the copilot’s premature unlocking of the feather system as a result of time pressure and vibration and loads that he had not recently experienced, which led to uncommanded feather extension and the subsequent aerodynamic overload and in-flight breakup of the vehicle.