[House Hearing, 111 Congress]
[From the U.S. Government Publishing Office]
ENSURING THE SAFETY OF HUMAN SPACEFLIGHT
=======================================================================
HEARING
BEFORE THE
SUBCOMMITTEE ON SPACE AND AERONAUTICS
COMMITTEE ON SCIENCE AND TECHNOLOGY
HOUSE OF REPRESENTATIVES
ONE HUNDRED ELEVENTH CONGRESS
FIRST SESSION
__________
DECEMBER 2, 2009
__________
Serial No. 111-66
__________
Printed for the use of the Committee on Science and Technology
Available via the World Wide Web: http://www.science.house.gov
----------
U.S. GOVERNMENT PRINTING OFFICE
53-689 PDF WASHINGTON : 2010
For sale by the Superintendent of Documents, U.S. Government Printing
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800;
DC area (202) 512-1800 Fax: (202) 512-2104 Mail: Stop IDCC,
Washington, DC 20402-0001
COMMITTEE ON SCIENCE AND TECHNOLOGY
HON. BART GORDON, Tennessee, Chair
JERRY F. COSTELLO, Illinois RALPH M. HALL, Texas
EDDIE BERNICE JOHNSON, Texas F. JAMES SENSENBRENNER JR.,
LYNN C. WOOLSEY, California Wisconsin
DAVID WU, Oregon LAMAR S. SMITH, Texas
BRIAN BAIRD, Washington DANA ROHRABACHER, California
BRAD MILLER, North Carolina ROSCOE G. BARTLETT, Maryland
DANIEL LIPINSKI, Illinois VERNON J. EHLERS, Michigan
GABRIELLE GIFFORDS, Arizona FRANK D. LUCAS, Oklahoma
DONNA F. EDWARDS, Maryland JUDY BIGGERT, Illinois
MARCIA L. FUDGE, Ohio W. TODD AKIN, Missouri
BEN R. LUJAN, New Mexico RANDY NEUGEBAUER, Texas
PAUL D. TONKO, New York BOB INGLIS, South Carolina
PARKER GRIFFITH, Alabama MICHAEL T. MCCAUL, Texas
JOHN GARAMENDI, California MARIO DIAZ-BALART, Florida
STEVEN R. ROTHMAN, New Jersey BRIAN P. BILBRAY, California
JIM MATHESON, Utah ADRIAN SMITH, Nebraska
LINCOLN DAVIS, Tennessee PAUL C. BROUN, Georgia
BEN CHANDLER, Kentucky PETE OLSON, Texas
RUSS CARNAHAN, Missouri
BARON P. HILL, Indiana
HARRY E. MITCHELL, Arizona
CHARLES A. WILSON, Ohio
KATHLEEN DAHLKEMPER, Pennsylvania
ALAN GRAYSON, Florida
SUZANNE M. KOSMAS, Florida
GARY C. PETERS, Michigan
VACANCY
------
Subcommittee on Space and Aeronautics
HON. GABRIELLE GIFFORDS, Arizona, Chair
DAVID WU, Oregon PETE OLSON, Texas
DONNA F. EDWARDS, Maryland F. JAMES SENSENBRENNER JR.,
MARCIA L. FUDGE, Ohio Wisconsin
PARKER GRIFFITH, Alabama DANA ROHRABACHER, California
STEVEN R. ROTHMAN, New Jersey FRANK D. LUCAS, Oklahoma
BARON P. HILL, Indiana MICHAEL T. MCCAUL, Texas
CHARLES A. WILSON, Ohio
ALAN GRAYSON, Florida
SUZANNE M. KOSMAS, Florida
BART GORDON, Tennessee RALPH M. HALL, Texas
RICHARD OBERMANN Subcommittee Staff Director
PAM WHITNEY Democratic Professional Staff Member
ALLEN LI Democratic Professional Staff Member
KEN MONROE Republican Professional Staff Member
ED FEDDEMAN Republican Professional Staff Member
DEVIN BRYANT Research Assistant
C O N T E N T S
December 2, 2009
Page
Hearing Charter.................................................. 2
Opening Statements
Statement by Representative Gabrielle Giffords, Chairwoman,
Subcommittee on Space and Aeronautics, Committee on Science and
Technology, U.S. House of Representatives...................... 19
Written Statement............................................ 20
Statement by Representative Ralph M. Hall, Ranking Minority
Member, Committee on Science and Technology, U.S. House of
Representatives................................................ 22
Written Statement............................................ 36
Statement by Representative Pete Olson, Ranking Minority Member,
Subcommittee on Space and Aeronautics, Committee on Science and
Technology, U.S. House of Representatives...................... 36
Written Statement............................................ 38
Witnesses:
Mr. Bryan O'Connor, Chief of Safety and Mission Assurance,
National Aeronautics and Space Administration
Oral Statement............................................... 39
Written Statement............................................ 41
Mr. Jeff Hanley, Program Manager, Constellation Program,
Exploration Systems Mission Directorate, National Aeronautics
and Space Administration
Oral Statement............................................... 45
Written Statement............................................ 47
Mr. John C. Marshall, Council Member, Aerospace Safety Advisory
Panel, National Aeronautics and Space Administration
Oral Statement............................................... 52
Written Statement............................................ 54
Mr. Bretton Alexander, President, Commercial Spaceflight
Federation
Oral Statement............................................... 57
Written Statement............................................ 58
Dr. Joseph Fragola, Vice President, Valador, Inc.
Oral Statement............................................... 66
Written Statement............................................ 68
Lt. Gen. (Ret.) Thomas Stafford, United States Air Force
Oral Statement............................................... 73
Written Statement............................................ 76
Discussion
Safety of Launch Systems....................................... 80
NASA--Commercial Industry: Sharing of Safety Standards......... 82
Potential Impact of Constellation Program on Commercial Sector. 83
Human Rating for Commercial Sector............................. 84
Program Management and Scheduling Issues Between Congress,
Administration, and NASA Over Time........................... 85
Implementation and Application of Safety Standards............. 87
Constellation Program: Human and Certification Options Concerns 89
ESAS Recommendations for Human Space Flight.................... 91
Availability and Economic Viability of Commercial Crew
Transport.................................................... 92
Orbital Sciences and SpaceX.................................... 94
Timetable: Commercial Crew Transport........................... 94
Ares Program: Safety and Future Impact......................... 95
COTS vs. Constellation Program................................. 96
Risk Assessment: Commercial Vehicle............................ 97
Ares, Delta, Atlas: Comparison................................. 97
Orion Space Craft.............................................. 98
Commercial Crew Development Program............................ 99
Training for Commercial Space Operatives....................... 99
Soyuz Space Craft: Concerns Moving Forward..................... 101
Addressing the Gap in Human Spaceflight........................ 103
Ares........................................................... 103
Delta IV and Atlas............................................. 103
Appendix: Answers to Post-Hearing Questions
Mr. Bryan O'Connor, Chief of Safety and Mission Assurance,
National Aeronautics and Space Administration.................. 108
Mr. Jeff Hanley, Program Manager, Constellation Program,
Exploration Systems Mission Directorate, National Aeronautics
and Space Administration....................................... 116
Mr. John C. Marshall, Council Member, Aerospace Safety Advisory
Panel, National Aeronautics and Space Administration........... 122
Mr. Bretton Alexander, President, Commercial Spaceflight
Federation..................................................... 126
Dr. Joseph Fragola, Vice President, Valador, Inc................. 130
Lt. Gen. (Ret.) Thomas Stafford, United States Air Force......... 136
ENSURING THE SAFETY OF HUMAN SPACEFLIGHT
----------
WEDNESDAY, DECEMBER 2, 2009
House of Representatives,
Subcommittee on Space and Aeronautics,
Committee on Science and Technology,
Washington, DC.
The Subcommittee met, pursuant to call, at 10:00 a.m., in
Room 2318 of the Rayburn House Office Building, Hon. Gabrielle
Giffords [Chairwoman of the Subcommittee] presiding.
hearing charter
COMMITTEE ON SCIENCE AND TECHNOLOGY
SUBCOMMITTEE ON SPACE AND AERONAUTICS
U.S. HOUSE OF REPRESENTATIVES
Ensuring the Safety of
Human Space Flight
december 2, 2009
10 a.m.-noon
2318 rayburn house office building
I. Purpose
On December 2, 2009 the Subcommittee on Space and Aeronautics will
hold a hearing focused on issues related to ensuring the safety of
future human space flight in government and non-government space
transportation systems. The hearing will examine (1) the steps needed
to establish confidence in a space transportation system's ability to
transport U.S. and partner astronauts to low Earth orbit and return
them to Earth in a safe manner, (2) the issues associated with
implementing safety standards and establishing processes for certifying
that a space transportation vehicle is safe for human transport, and
(3) the roles that training and experience play in enhancing the safety
of human space missions.
II. Scheduled Witnesses:
Mr. Bryan D. O'Connor
Chief of Safety and Mission Assurance
National Aeronautics and Space Administration
Mr. Jeff Hanley
Program Manager
Constellation Program
Exploration Systems Mission Directorate
National Aeronautics and Space Administration
Mr. John C. Marshall
Council Member
Aerospace Safety Advisory Panel
National Aeronautics and Space Administration
Mr. Bretton Alexander
President
Commercial Spaceflight Federation
Dr. Joseph R. Fragola
Vice President
Valador, Inc.
Lt. Gen. Thomas P. Stafford, USAF (ret.)
III. Overview
The Review of U.S. Human Space Flight Plans Committee, also known
as the Augustine committee, recently issued its final report. The
committee was tasked to ``conduct an independent review of ongoing U.S.
human space flight plans and programs, as well as alternatives, to
ensure the Nation is pursuing the best trajectory for the future of
human space flight--one that is safe, innovative, affordable, and
sustainable. The review committee should aim to identify and
characterize a range of options that spans the reasonable possibilities
for continuation of U.S. human space flight activities beyond
retirement of the Space Shuttle.''
As directed, the committee's final report offered a number of
options to the president for the conduct of future space exploration,
ranging from continuing with the Constellation Program of Record (with
slight modifications) to pursuing a ``flexible path'' with alternative
launch vehicles, including modified Evolved Expendable Launch Vehicles
(EELV) currently used primarily by the Department of Defense to
transport military payloads. Several of the committee's options
included the use of as-yet-to-be-developed commercial services to
provide future crew transportation to and from the International Space
Station (ISS) following retirement of the Space Shuttle. While the
committee stated that it recognized both the risks and opportunities
presented by commercial crew services, it believed such services could
be available by 2016. Specifically, the report stated:
``The United States needs a way to launch astronauts to low-
Earth orbit, but it does not necessarily have to be provided by
the government. As we move from the complex, reusable Shuttle
back to a simpler, smaller capsule, it is an appropriate time
to consider turning this transport service over to the
commercial sector. This approach is not without technical and
programmatic risks, but it creates the possibility of lower
operating costs for the system and potentially accelerates the
availability of U.S. access to low-Earth orbit by about a year,
to 2016. The Committee suggests establishing a new competition
for this service, in which both large and small companies could
participate.''
Using commercial providers for space transportation is not a new
idea. Congress has encouraged NASA to use commercial transportation
services when appropriate as part of its space exploration strategy.
Support for the commercial space industry was affirmed in P.L. 110-422,
the National Aeronautics and Space Administration Authorization Act of
2008. Along with that support however was a requirement for commercial
services' prior conformance with NASA's safety requirements.
Specifically, regarding crew transportation, the Act stated in Sec. 902
that the National Aeronautics and Space Administration (NASA) shall:
``make use of United States commercially provided
International Space Station crew transfer and crew rescue
services to the maximum extent practicable, if those commercial
services have demonstrated the capability to meet NASA-
specified ascent, entry, and International Space Station
proximity operations safety requirements.''
Those NASA safety requirements are primarily embodied in NASA
Procedural Requirements (NPR) document NPR 8705.2B, ``Human-Rating
Requirements for Space Systems'' as well as in the ISS Visiting Vehicle
requirements that govern proximity operations around the ISS. While the
NPR requirements apply to the development and operation of crewed space
systems developed by NASA and used to conduct NASA human spaceflight
missions, the NPR also states that it ``may apply to other crewed space
systems when documented in separate requirements or agreements''.
Progress has been made in the past few years by commercial entities
in designing and developing cargo launch capabilities which have the
potential to access the ISS. However, they are not scheduled to
demonstrate the capability to transport cargo to the ISS as part of
NASA's Commercial Orbital Transportation Services (COTS) Demonstration
project until the second quarter of Fiscal Year 2010, at the earliest.
The transporting of NASA astronauts to low Earth orbit and ensuring
their safe reentry to Earth is considered to be significantly more
challenging than transporting cargo to the ISS.
That is the crux of the issue. Establishing and enforcing safety
standards for the transport of crew on commercially provided orbital
crew transportation services is in many ways uncharted territory.
Furthermore, a process has yet to be advanced by the government on how
the ``airworthiness'' of commercial space flight vehicles used to
transport government passengers will be ``certified''. While the
Augustine committee's report projected that commercial crew
transportation services could be available in 2016, it does not appear
that the committee's projection accounts for all of the milestones that
must be met prior to the point at which NASA would be able to use such
services to fly its astronauts to the ISS. Notionally, these include:
prior Congressional authorization and appropriation of funds for such
an activity, which could not occur before enactment of the FY 2011
appropriation for NASA at the earliest; agreement on human-rating and
other safety standards and means for verifying compliance, development
and implementation of new safety processes, testing and verification
procedures to ensure safety, and potentially a new regulatory regime
for certification; development of a COTS-like demonstration program
open to multiple participants and competition/award of Space Act
Agreements for the demonstration program; completion of the
development/demonstration program, which would need to include a TBD
number of demonstration flights, including tests of launch escape
systems, etc.; subsequent preparation of an RFP for commercial crew
transportation/ISS crew rescue services; contract competition,
negotiation and award of contract(s), and potential protest(s) by
losing bidder(s) [which unfortunately has become a more frequent
occurrence in recent Department of Defense (DoD)/NASA contract
competitions]; manufacturing of the operational flight vehicle systems
[some of which could potentially be initiated during the development/
demonstration phase, assuming the companies would be able to fund those
tasks with private capital]; TBD number of ``certification'' flights of
the production vehicle system prior to NASA agreement to put its
astronauts on board; and finally, commencement of initial operations to
and from the ISS.
Any mismatch between the timetable asserted in the Augustine
committee's report and the actual time required to bring commercially
provided crew transportation services to operational status is relevant
because it highlights a potential inability to meet even a fraction of
NASA's crew transfer needs for the ISS prior to the end of even an
extended ISS operations period [i.e., an ISS extension to 2020], which
in turn calls into question the ability of would-be commercial
providers to identify a credible government market when seeking private
capital commitments. In the absence of a government commitment to pay
for services whether or not they are available when needed, would-be
commercial providers could face pressures to cut costs [or cease to
compete], and the government would thus have to be vigilant to ensure
that safety-related processes and practices were not compromised as a
result.
Regardless of the approach to NASA's human space flight and
exploration program that is recommended to Congress by the president,
commercial space providers may well play an expanding role in
transporting cargo to low Earth orbit (LEO) and eventually beyond LEO,
and potentially transporting crew to and from LEO in the future.
Consequently, it is prudent to initiate a detailed examination of the
steps needed to establish confidence in commercial space transportation
systems' capabilities to transport U.S. and partner astronauts to low
Earth orbit and return them to Earth safely.
At the hearing, witnesses will provide a historical perspective on
the establishment of safety requirements in NASA human space flight
systems; NASA's efforts to develop human safety standards and
requirements; the incorporation of crew safety requirements in the
design of NASA's Constellation Program; and the commercial space
transportation companies' expectations of how NASA's safety standards
and requirements would be applied to commercial spacecraft as well as
the level of governmental insight and oversight over their development
activities and operations that they would consider appropriate.
IV. Issues
The hearing will focus on the following questions and issues:
What are the most important safety-related issues
that need to be addressed in either a government or non-
government space transportation system?
What would be the safety implications of terminating
the government crew transportation system currently under
development in favor of relying on as-yet-to-be-developed
commercially provided crew transportation services? What would
the government be able to do, if anything, to ensure that no
reduction in planned safety levels occurred as a result?
What expectations should Congress have regarding the
safety standards commercial providers should meet if their
proposed crew transportation and ISS crew rescue services were
to be chosen by NASA to carry its astronauts to low Earth
orbit? What would be required to verify compliance with those
standards?
If a policy decision were made to require NASA to
rely solely on commercial crew transfer services, which would
have to meet NASA's safety requirements to be considered for
use by NASA astronauts, what impact would that have on the
ability of emerging space companies to pursue innovation and
design improvements made possible [as the industry has argued]
by the accumulation of flight experience gained from commencing
revenue operations unconstrained by a prior safety
certification regime? Would it be in the interest of the
emerging commercial orbital crew transportation industry to
have to be reliant on the government as its primary/sole
customer at this stage in its development?
What lessons learned from the evolution of NASA's
human space flight systems should be reflected in the design
and operation of future crewed space transportation systems,
whether government or non-government?
What role does NASA's Office of Safety and Mission
Assurance play in ensuring the safety of human space flight at
NASA? What initiatives does the office have underway to enhance
the safety of human space flight at NASA?
What is being done to communicate NASA's safety and
human-rating requirements to potential commercial crew space
transportation and ISS crew rescue services providers?
How and to what extent did safety considerations,
especially with respect to launch, inform the choices made in
NASA's Exploration Systems Architecture Study (ESAS)?
How has the Constellation Program incorporated safety
and applicable human-rating requirements, as well as Astronaut
Office input on launch/entry systems safety, into the program's
design, development, and testing activities?
What has NASA learned so far in executing the
Constellation Program that can assist in developing a better
understanding of the impact of design features, development and
testing and manufacturing processes, and operations procedures
on the safety of crewed space transportation system
alternatives?
What are the expectations of potential commercial
crew transportation services providers as to how safety
standards and processes will be determined if the government
decided to use commercial services for the transport of NASA
astronauts to and from low Earth orbit and the ISS?
What do potential commercial crew transportation
services providers consider to be an acceptable safety standard
to which potential commercial providers must conform if their
space transportation systems were to be chosen by NASA to carry
its astronauts to low Earth orbit and the ISS? Would the same
safety standard be used for non-NASA commercial human
transportation missions?
What do potential commercial crew transportation
services providers consider to be an acceptable level of
insight and oversight over their development, test, and
manufacturing process, their vehicles, and operations if their
services are used to transport NASA astronauts to and from low
Earth orbit and provide ISS crew rescue services?
What do potential commercial crew transportation
services providers consider to be an acceptable certification
regime that potential commercial services providers must comply
with to address the government's regulatory responsibilities
over the safety and ``air worthiness'' of commercial crew
transportation vehicles prior to their approval for use in
revenue-generating flight operations, whether for government or
non-government customers?
What training and familiarization with non-NASA
crewed spacecraft and launch vehicles would astronauts flying
on such non-NASA spacecraft and launch vehicles need in order
to deal with off-nominal conditions, contingency operations and
emergencies?
V. Background
Relevant Legislation and Hearing on Safety Issues Associated with
Commercial Space Launches
NASA Authorization Act of 2005
P.L. 109-155, the National Aeronautics and Space Administration
Authorization Act of 2005, directed that an independent presidential
commission be established to investigate incidents resulting in the
loss of a U.S. space vehicle used pursuant to a contract with the
Federal government or loss of a crew member or passenger in such a
vehicle. The Act made clear that Congress believed that an accident
involving astronauts riding on a commercial vehicle would be treated as
at least as serious a matter as one involving a government vehicle.
Specifically, the Act specified:
``(a) ESTABLISHMENT.--The President shall establish an
independent, nonpartisan Commission within the executive branch
to investigate any incident that results in the loss of--
(1) a Space Shuttle;
(2) the International Space Station or its operational
viability;
(3) any other United States space vehicle carrying
humans that is owned by the Federal Government or that
is being used pursuant to a contract with the Federal
Government; or
(4) a crew member or passenger of any space vehicle
described in this subsection.
(b) DEADLINE FOR ESTABLISHMENT.--The President shall establish
a Commission within 7 days after an incident specified in
subsection (a).''
The independent commission would be tasked, to the extent possible,
to investigate the incident; determine the cause of the incident;
identify all contributing factors to the cause of the incident; make
recommendations for corrective actions; providing any additional
findings or recommendations deemed by the Commission to be important;
and prepare a report to Congress, the president, and the public.
NASA Authorization Act of 2008
The Congress affirmed its support for the commercial space industry
in P.L. 110-422, the National Aeronautics and Space Administration
Authorization Act of 2008. The Act states in its findings that
``Commercial activities have substantially contributed to the
strength of both the United States space program and the
national economy, and the development of a healthy and robust
United States commercial space sector should continue to be
encouraged.''
With regards to the potential use of commercially-provided ISS crew
transfer and crew rescue services, the Act states that NASA may make
use of commercial services if those commercial services have
demonstrated the capability to meet NASA's safety requirements.
Specifically, the Act states:
``(a) IN GENERAL.--In order to stimulate commercial use of
space, help maximize the utility and productivity of the
International Space Station, and enable a commercial means of
providing crew transfer and crew rescue services for the
International Space Station, NASA shall--
(1) make use of United States commercially provided
International Space Station crew transfer and crew
rescue services to the maximum extent practicable, if
those commercial services have demonstrated the
capability to meet NASA-specified ascent, entry, and
International Space Station proximity operations safety
requirements;
(2) limit, to the maximum extent practicable, the use
of the Crew Exploration Vehicle to missions carrying
astronauts beyond low Earth orbit once commercial crew
transfer and crew rescue services that meet safety
requirements become operational;
(3) facilitate, to the maximum extent practicable, the
transfer of NASA-developed technologies to potential
United States commercial crew transfer and rescue
service providers, consistent with United States law;
and
(4) issue a notice of intent, not later than 180 days
after the date of enactment of this Act, to enter into
a funded, competitively awarded Space Act Agreement
with 2 or more commercial entities for a Phase 1
Commercial Orbital Transportation Services crewed
vehicle demonstration program.''
However, with respect to subsection (4) above, the 2008 Act also
made clear in Sec. 902(b) that:
``(b) CONGRESSIONAL INTENT.--It is the intent of Congress that
funding for the program described in subsection (a)(4) shall
not come at the expense of full funding of the amounts
authorized under section 101(3)(A), and for future fiscal
years, for Orion Crew Exploration Vehicle development, Ares I
Crew Launch Vehicle development, or International Space Station
cargo delivery.''
Government Indemnification for Commercial Space Launch Operations
In 1988, Congress amended the Commercial Space Launch Act of 1984
to indemnify the commercial space launch industry against successful
claims by third parties. Specifically, the United States agreed,
subject to appropriation of funds, to pay third party claims against
licensees in amounts up to $1.5 billion [in 1989 dollars] above the
amount of insurance that a licensee carries. The Act's definition of
``third party'' excludes all government employees, private employees,
and contractors involved directly with the launch of a vehicle.
The Act requires that private launch companies purchase sufficient
liability insurance. This amount is determined by the Federal Aviation
Administration (FAA) on a case-by-case basis depending on its
calculation of the ``maximum probable loss'' from claims by a third
party. This amount is capped at $500 million for coverage against suits
by private entities.
Since the majority of commercial launch activity occurs at federal
launch ranges, the Act also requires any insurance policy a company
obtains to also protect the federal government, its agencies,
personnel, contractors, and subcontractors. The liability insurance
section of the Act requires reciprocal waivers of claims between the
licensee and its contractors, subcontractors, and customers. In effect,
the licensee and any other organization assisting in the actual launch
are prevented from seeking damages from one another. The
indemnification and liability regime was first established by Congress
as part of the Commercial Space Launch Act Amendments of 1988 and has
been extended four times since its original enactment. On October 20,
2009, the U.S. House of Representatives passed H.R. 3819, a bill to
extend the commercial space transportation indemnification and
liability regime, by a voice vote. The liability risk-sharing regime
extension is set to expire at the end of the year; H.R. 3819 would
extend it for three more years. Congress has not yet explicitly
addressed the issues of indemnification and liability for future
commercially provided orbital human space flight services.
Commercial Space Launch Amendments Act of 2004
The Commercial Space Launch Amendments Act of 2004 put an initial
regulatory framework in place for commercial human space flight. The
intent of the law was to support the development of this private sector
effort while also protecting the safety of uninvolved public on the
ground. The law established an ``informed consent'' regime for carrying
space flight crew and participants (passengers). The Act also created a
new experimental launch permit for test and development of reusable
suborbital launch vehicles. The 2004 law called for FAA to ``encourage,
facilitate, and promote the continuous improvement of the safety of
launch vehicles designed to carry humans.'' To allow the industry to
grow and innovate, the Act stated that ``Beginning 8 years after the
date of enactment of the Commercial Space Launch Amendments Act of
2004, the Secretary may propose regulations'' pertaining to crew and
passengers, further adding that ``Any such regulations shall take into
consideration the evolving standards of safety in the commercial space
flight industry.'' The eight year period [which ends in 2012] reflected
the view that by then, the commercial human space flight industry would
be ``less experimental.''
As part of the ``informed consent'' regime, FAA regulations require
an operator to inform in writing any individual serving as crew that
the United States Government has not certified the launch vehicle and
any reentry vehicle as safe for carrying flight crew or space flight
participants. Similarly, the operator must inform each space flight
participant in writing about the risks of the launch and reentry,
including the safety record of the launch or reentry vehicle type. The
``informed consent'' rules became effective in December 2006.
FAA's subsequent rules call for launch vehicle operators to provide
certain safety-related information and identify what an operator must
do to conduct a licensed launch with a human on board. The protocols
also include training and general security requirements for space
flight participants. As part of the new measures, launch providers must
also establish requirements for crew notification, medical
qualifications, and training, as well as requirements governing
environmental control and life-support systems. An operator must also
verify the integrated performance of a vehicle's hardware and any
software in an operational flight environment before carrying a space
flight passenger. However, in issuing operator licenses, FAA does not
certify the launch vehicle as safe as the agency customarily does with
aircraft. In the latter case, the agency's Office of Aviation Safety
provides initial certification of aircraft and periodically inspects an
aircraft and certifies it as safe to fly. With regards to spacecraft,
FAA can also issue experimental permits for launches of reusable
vehicles conducted for research and development activities related to
suborbital flight, for demonstrations of compliance with licensing
requirements, or for crew training before obtaining a license.
2003 Joint Hearing on Commercial Human Space Flight
The Subcommittee and the Senate's Subcommittee on Science,
Technology, and Space of the Committee on Commerce, Science and
Transportation held a hearing entitled Commercial Human Space Flight in
July 2003. Among the issues discussed at the joint hearing were when
revenue launches would begin to happen, ``what is safe enough'', and
whether the government should certify the safety of commercial vehicles
prior to the commencement of passenger-carrying operations.
At the 2003 hearing, Senator Sam Brownback asked the witnesses when
they could take their first commercial paying human customer into
space. Mr. Jeff Greason, President of XCOR Aerospace said:
``That depends, in part, on factors that are not entirely in
my control, like how fast we lock up some of the remaining
investment. But if the investment is in hand, not sooner than
about three years, because we have an extensive test program we
have to go through.''
In response to Senator Brownback's question, Mr. Elon Musk, the CEO
of Space Exploration Technologies, said:
``Well, the task that SpaceX has set for itself is probably an
order of magnitude greater than sub-orbital flight. We've
really aimed at orbital flight, really essentially the job that
the Space Shuttle does. That's a longer road. But I think it's
conceivable we could get something done in the 2006 time frame,
as well.''
With regards to safety, then-Subcommittee Ranking Member Bart
Gordon asked Mr. Greason ``What is safe enough, and who should verify
that?'' Mr. Greason replied:
``I mean, it's safe enough when the customers start to show
up, and you go through a process of demonstrating the vehicle
over and over and over again. Now, we have our own internal
business targets about how safe we have to know it is before we
can base a business on it. But it's important to realize that
long before we get to the point where we know it's safe enough
that our expensive asset won't crash and be lost to revenue
service, something we have to do for our own business, long
before that point, we will have demonstrated safety far
superior to what people think of as space flight safety as
being right now. I mean, the test program, alone is probably
going to be 50 flights.''
In a response to a question for the record posed by then-
Subcommittee Chairman Dana Rohrabacher to Mr. Dennis A. Tito, CEO of
Wilshire Associates, Inc, on what features of current aircraft
standards and space launch safety standards should be applied to
commercial human space flight, Mr. Tito provided the following
response:
``As I stated in my testimony, commercial aviation is a mature
and well-established industry. Aircraft safety standards
reflect 100 years of powered flight experience, and are part of
a 75+ year history of federal regulation increasingly focused
on protecting the safety of airline passengers as well as
uninvolved third parties. The commercial space launch industry
is a somewhat less mature industry, with just over two decades
of commercial experience. This industry's heritage, however, is
based on over a half-century of military and civilian
development and testing of ballistic missiles and their
descendant launch vehicles. Missiles and most current launch
vehicles have significant destructive potential and, because
they are expendable, cannot be flight tested, fixed, and re-
tested in the way aircraft or other reusable systems can.
Launch safety standards have therefore focused on detailed
oversight, complex system redundancy and flight termination
(self-destruct) capabilities. Neither of these two operational
safety paradigms is appropriate for commercial human space
flight. There may be some similarities between aircraft and
sub-orbital reusable launch vehicles, and others between RLVs
[Reusable Launch Vehicles] and expendable rockets. However, I
predict that these new space planes will in fact merit their
own operational safety approaches. At this point, we need to
develop and fly some vehicles so we can learn what to do and
what not to do. That, after all, is the beauty of the
competitive marketplace: better ideas are rewarded while less-
good approaches suffer until they are improved or die off.''
Responding to a similar question for the record by Mr. Gordon on
whether the government should certify the safety of his vehicles prior
to commencement of passenger-carrying operations, Mr. Greason replied:
``The government should absolutely not certify the safety of
our vehicles prior to the commencement of commercial,
passenger-carrying operations. Today, we have a gap of one-
million-to-one between the safety of space flight (roughly 40
fatalities per thousand emplanements for U.S. space missions)
and aircraft (roughly 25 fatalities per billion emplanements
for U.S. scheduled air carriers). When aviation started, its
accident rate was as bad or worse than today's space
transportation technology. In the early days, carrying
passengers for ``barnstorming'' was one of the few sources of
revenue in the aircraft industry. Today, risk tolerance is
lower than in the 1920s. We believe we can and must do better.
But if commercial RLV operators are ten times safer than
government space flight efforts (which may be achievable), that
is still 100,000 times less safe than aircraft. We are clearly
too early for any kind of certification regime as that
practiced in commercial aviation.
Early generation RLVs should be allowed to fly as long as the
uninvolved general public are kept reasonably safe. The key is
a system which investigates failures and shares the methods
used successfully. The best and fastest path to safety is
establishing a regulatory culture of continuous improvement
based on experience; and the more flights we get, the faster we
will gain that experience. Attempts to shortcut this process by
establishing standards based on guesses or predictions about
future technologies will stifle innovation, fix in place
present practices, and slow the pace of safety improvement.
This might not be so bad if the current safety record of space
transportation were something to preserve. But it is not; it is
something to change for the better.''
``The current safety situation will change when operational
track records are established. It is very likely that there
will be dramatic differences in safety between vehicle types.
When that happens, AST, industry, and the NTSB need to
collaborate on raising the bar, perhaps by establishing minimum
safety records, perhaps by design standards, or a mix of both.
As this evolves, it will be important to avoid applying these
new regulations to vehicle test flights. Research and
development test flights should continue with the sole burden
of protecting the safety of the general uninvolved public. In
this way we can hope that people will look back on the first
century of private space flight and see the same dramatic
improvement in safety which has been demonstrated by
aircraft.''
In addition to illuminating the discrepancy between the schedule
predictions of the emerging commercial providers and their actual
performance to date, the testimony cited above raises the policy issue
of the potential impact of a decision to require NASA to rely on
commercially provided crew transportation services, which would have to
meet NASA's safety requirements prior to NASA having its astronauts
utilize those services. Given that the emerging commercial providers
appear to believe strongly in an evolutionary approach to design and
safety innovation to be achieved through flight experience gained from
revenue flights undertaken without any prior safety certification
regime, premature reliance on the government as the dominant/only
customer would call into question the ability of the emerging
commercial providers to sustain the approach to innovation that they
appear to believe is essential to their long-term success.
NASA's Incorporation of Safety Measures into Its Human Space Flight
Programs
Several key safety initiatives were undertaken by NASA following
the experience gained from flight missions:
In January 1986, the Space Shuttle Challenger and its
crew were lost 73 seconds after launch because of the failure
of a seal (an O-ring) between two segments of a Solid Rocket
Booster. In response to the findings of the Rogers Commission
that investigated the Challenger accident, NASA established
what is now known as the Office of Safety and Mission Assurance
(OSMA) at Headquarters to independently monitor safety and
ensure communication and accountability agency-wide. The Office
monitors ``out of family'' anomalies and establishes agency-
wide Safety and Mission Assurance policy and guidance such as
human-rating requirements to which NASA program managers must
adhere. OSMA also reviews the Space Shuttle Program's Flight
Readiness Process and signs the Certificate of Flight
Readiness.
In February 2003, Shuttle Columbia disintegrated as
it returned to Earth. In the ensuing investigation by the
Columbia Accident Investigation Board (CAIB), the CAIB found
that Columbia broke apart from aerodynamic forces after the
left wing was deformed from the heat of gases that entered the
wing through a hole caused during launch by a piece of foam
insulation that detached from the External Tank. The CAIB found
that the tragedy was caused by technical and organizational
failures and provided 29 recommendations.
Then-NASA Administrator Sean O'Keefe requested that Lt. Gen.
Thomas Stafford, U.S. Air Force (Ret.) assign his Task Force on
International Space Station Operational Readiness to undertake
an assessment of NASA's plans to return the Space Shuttle to
flight. At that time, the Stafford Task Force was a standing
body chartered by the NASA Advisory Council, an independent
advisory group to the NASA Administrator. Lt. Gen. Stafford
activated a sub-organization with Col. Richard O. Covey, U.S.
Air Force (Ret.) leading the day-to-day effort of conducting an
independent assessment of the 15 CAIB ``return-to-flight''
recommendations. As a result, the Return to Flight Task Group
was chartered in July 2003. Over the next two years, using
expertise from academia, aerospace industry, the federal
government, and the military, the task group, with Lt. Gen.
Stafford and Col. Covey as co-chairs, assessed the actions
taken by NASA to implement the 15 CAIB return-to-flight
recommendations plus one additional item the Space Shuttle
Program assigned to itself as a ``raising the bar'' action. The
task group conducted fact-finding activities, reviewed
documentation, held public meetings, reported the status of its
assessments to NASA's Space Flight Leadership Council, and
released three interim reports. The task group issued its final
report (dated July 2005) on August 17, 2005.
Lt. Gen. Stafford will be a witness at the hearing and can
provide insights into safety challenges associated with human
space flight.
Among the CAIB's recommendations was one for NASA to
establish an independent Technical Engineering Authority
responsible for technical requirements and all waivers to them.
In response, NASA created the NASA Engineering and Safety
Center's (NESC) whose mission is to perform value-added
independent testing, analysis, and assessments of NASA's high-
risk projects to ensure safety and mission success.
According to NASA, rather than relieving NASA program
managers of their responsibility for safety, the NESC
complements the programs by providing an independent technical
review. Additionally, NASA states that the NESC provides a
centralized location for the management of independent
engineering assessment by expert personnel and state of the art
tools and methods for the purpose of assuring safety. The NESC
Management Office is located at NASA Langley Research Center in
Hampton Virginia, but the NESC has technical resources at all
10 NASA Centers and Headquarters, as well as partnerships with
academia, industry and other Government organizations. These
technical resources are pooled to perform NESC activities and
services. Operationally, the NESC falls under the
responsibility of NASA's Office of Safety and Mission
Assurance.
NASA said that it recognized the importance of
capturing the lessons learned from the loss of Columbia and her
crew to benefit future human exploration, particularly future
crewed vehicle system design. Consequently, the Space Shuttle
Program commissioned the Spacecraft Crew Survival Integrated
Investigation Team (SCSIIT) to perform a comprehensive analysis
of the accident, focusing on factors and events affecting crew
survival; and to develop recommendations for improving crew
survival for all future human space flight vehicles. The Team's
final report was released in December 2008, although findings
were shared within NASA during the 3-year effort. Some
illustrative recommendations with regards to future space craft
design were as follows:
``Future spacecraft seats and suits should be
integrated to ensure proper restraint of the crew in
offnominal situations while not affecting operational
performance. Future crewed spacecraft vehicle design
should account for vehicle loss of control to maximize
the probability of crew survival.''
``Future vehicle design should incorporate an
analysis for loss of control/breakup to optimize for
the most graceful degradation of vehicle systems and
structure to enhance chances for crew survival.
Operational procedures can then integrate the most
likely scenarios into survival strategies.''
``Future spacecraft crew survival systems
should not rely on manual activation to protect the
crew.''
The Constellation Program's design is in conformance with the
Team's findings. For example, with regards to the recommendation listed
above on crew restraint, the program has (a) outfitted the Orion seats
with the latest innovations in seat and restraint systems for enhanced
occupant protection; (b) implemented limb flail requirements and
additional protections to ensure proper arm positioning to maintain
control of the vehicle under high acceleration events; and (c) is
designing suit and seat in an integrated fashion with the entire
spacecraft.
Mr. Jeff Hanley, Program Manager of the Constellation Program, will
be a witness at the hearing and can provide additional details on how
that Program is incorporating safety and applicable human-rating
requirements, as well as Astronaut Office input on launch/entry systems
safety, into the Constellation program's design, development, and
testing activities.
NASA's Human Rating and Safety Requirements
According to NASA's Inspector General, NASA assembled a diversified
group in 2007 composed of astronauts, engineers, safety engineers,
flight surgeons, and mission operations specialists to rewrite the
agency's human-rating requirements, which had been embodied in NPR
8705.2A, ``Human-Rating Requirements for Space Systems.'' As stated in
the NASA Inspector General's report IG-09-016 dated May 21, 2009:
``This group reviewed human-rating documents from the last 45
years that were used in the development of Mercury, Gemini,
Apollo, Skylab, the Space Shuttle, and the International Space
Station. The lessons learned from these programs, and
information from numerous books and studies, resulted in NPR
8705.2B, issued May 6, 2008.''
The stated purpose of NPR 8705.2B is ``to define and implement the
additional processes, procedures, and requirements necessary to produce
human-rated space systems that protect the safety of crew members and
passengers on NASA space missions.''
The NPR states that ``a human-rated system accommodates human
needs, effectively utilizes human capabilities, controls hazards and
manages safety risk associated with human spaceflight, and provides, to
the maximum extent practical, the capability to safely recover the crew
from hazardous situations. Human-rating is not and should not be
construed as certification for any activities other than carefully
managed missions where safety risks are evaluated and determined to be
acceptable for human spaceflight.''
The NPR further states that ``Human-rating must be an integral part
of all program activities throughout the life cycle of the system,
including design and development; test and verification; program
management and control; flight readiness certification; mission
operations; sustaining engineering; maintenance, upgrades, and
disposal.''
As to applicability, the NPR states that ``The human-rating
requirements in this NPR apply to the development and operation of
crewed space systems developed by NASA used to conduct NASA human
spaceflight missions. This NPR may apply to other crewed space systems
when documented in separate requirements or agreements.'' The NPR notes
that ``The Space Shuttle, the International Space Station (ISS), and
Soyuz spacecraft are not required to obtain a Human-Rating
Certification in accordance with this NPR. These programs utilize
existing policies, procedures, and requirements to certify their
systems for NASA missions.'' The NPR is applicable to the Constellation
Program.
The NPR views human-rating as consisting of three fundamental
tenets:
1. Human-rating is the process of designing, evaluating, and
assuring that the total system can safely conduct the required
human missions.
2. Human-rating includes the incorporation of design features
and capabilities that accommodate human interaction with the
system to enhance overall safety and mission success.
3. Human-rating includes the incorporation of design features
and capabilities to enable safe recovery of the crew from
hazardous situations.
According to NASA's guidance, human-rating is an integral part of
all program activities throughout the life cycle of the system,
including design and development; test and verification; program
management and control; flight readiness certification; mission
operations; sustaining engineering; maintenance/upgrades; and disposal.
The NPR technical requirements for human-rating address system
safety, crew/human control of the system, and crew survival/aborts. The
requirements associated with crew survival and abort capability were
established following the two previously cited Shuttle accidents. For
example, the NPR states that for Earth Ascent Systems:
``The space system shall provide the capability for
unassisted crew emergency egress to a safe haven during Earth
prelaunch activities.''
``The space system shall provide abort capability
from the launch pad until Earth-orbit insertion to protect for
the following ascent failure scenarios (minimum list):
a. Complete loss of ascent thrust/propulsion
b. Loss of attitude or flight path.''
``The crewed space system shall monitor the Earth
ascent launch vehicle performance and automatically initiate an
abort when an impending catastrophic failure is detected.''
Regarding Earth ascent abort, the NPR states that:
``The space system shall provide the capability for
the crew to initiate the Earth ascent abort sequence.''
``The space system shall provide the capability for
the ground control to initiate the Earth ascent abort
sequence.''
``If a range safety destruct system is incorporated
into the design, the space system shall automatically initiate
the Earth ascent abort sequence when range safety destruct
commands are received onboard, with an adequate time delay
prior to destruction of the launch vehicle to allow a
successful abort.''
Once in orbit, the NPR requires the crewed space system to
``provide the capability to autonomously abort the mission from Earth
orbit by targeting and performing a deorbit to a safe landing on
Earth.''
In addition, NPR 8715.3C which establishes NASA's General Safety
Program Requirements, has a section entitled ``Hazardous Work
Activities That Are Outside NASA Operational Control.'' The NPR states
that it is NASA policy to ``document and verify that risks are
adequately controlled and any residual risk is acceptable''.
Applicability to commercial human space flight is cited. Specifically,
Section 1.14.1 states:
``It is NASA policy to formally review and approve NASA
participation in hazardous work activities that are outside
NASA operational control as needed to ensure that NASA safety
and health responsibilities are satisfied. This policy applies
unconditionally to NASA participation in commercial human
spaceflight where current federal regulations do not
necessarily provide for the safety of spaceflight vehicle
occupants. This policy is non-retroactive and applies to
hazardous ground or flight activities that involve research,
development, test and evaluation, operations, or training,
where all five of the following conditions exist:
a. NASA civil service personnel, Government detailees,
specified contractors, or specified grantees are
performing work for NASA.
b. The activity is outside NASA's direct operational
control/oversight.
c. An assessment by the responsible NASA manager
indicates there are insufficient safeguards and/or
oversight in place.
d. The activity is not covered by a basic contract,
grant, or agreement where Federal, State, and/or local
requirements address personnel safety.
e. The nature of the activity is such that, if NASA
were controlling it, a formal safety and/or health
review would be required as part of the NASA approval
process.''
In terms of responsibilities, the NASA Associate Administrator, as
chair of the Agency Program Management Council, is the authority for
human-rating and is responsible for certifying systems as human-rated.
In this capacity, the NASA Associate Administrator makes the
determination to certify a system as human-rated. Appeals for
exceptions and waivers to the NPR are made to the NASA Associate
Administrator. The Chief, Safety and Mission Assurance, is the
Technical Authority for Safety and Mission Assurance and is responsible
for assuring the implementation of safety-related aspects of human-
rating.
In its 2008 Annual Report, the Aerospace Safety Advisory Board
(ASAP), the congressionally established body which evaluates and
provides advice on NASA's safety performance, noted changes in NPR
8705.2B from the prior guidance:
``The ASAP is concerned about HRR [human rating requirements]
substance, application, and standardization NASA-wide.
After several briefings, the Panel is just beginning
to fully understand the changes (e.g., in failure tolerance,
inadvertent actions, redundancy, and integrated design
analysis) and the implications for future system development--
an index of the challenge facing NASA.
The new HRR standards move from validating compliance
with mandatory failure tolerance requirements to an approach of
designing to acceptable risk, but without any apparent clear
and visible criteria for estimating ``how safe is safe enough''
for various mission categories.
A direct linkage between current standards and
engineering directives is missing.
NASA training materials on the new HRR standards are
still in development and should be accelerated to distribute
information before new Constellation systems are developed.''
Mr. Bryan O'Connor, Chief of Safety and Mission Assurance and
former astronaut, will be a witness at the hearing and can provide
additional details on OSMA's latest activities associated with
implementing safety-related aspects of human-rating, including
addressing the ASAP's concerns. Mr. John Marshall, a member of the
ASAP, will also be testifying at the hearing.
Enhancing Safety through Crew Training
As evidenced by the performance of the crew of Apollo 13 after the
incident that created a serious emergency situation en route to the
Moon, astronauts play a major role in ensuring human safety in space.
In that situation, the crew detected, reacted, and with the help of
engineers and technicians on the ground, overcame problems that
mechanical systems could not. Integral to that crew's ability to
improvise under difficult conditions was the training they received.
Today's astronaut training program builds on years of flight
experience. Once selected as candidates, astronauts undergo a rigorous
training program that ranges from basic training in generic vehicle
systems to being trained to operate spacecraft systems using
simulators. Survival training includes emergency egress from the
Shuttle and surviving in a water or wilderness environment. As a final
step, crews conduct integrated operational training with flight
controllers in NASA's Mission Control Center at the Johnson Space
Center.
Training for off-nominal operations is an important facet of crew
training. Astronauts are acquainted with non-safety-critical failure
modes and the ways to respond to them. Training for off-nominal
conditions is primarily accomplished by inserting failures during
simulations at which time astronauts are trained to recognize the off-
nominal conditions and identify corrective measures. The level of
difficulty arises when several failures are injected during simulations
and crew members must perform failure analyses in an integrated manner
and apply corrective procedures in sequence. Emergency training is
needed for those situations where all measures identified through other
forms of training cannot be used. The most critical emergencies
primarily involve fire, depressurization, and toxic contamination. The
goal of NASA's training is to have a trained astronaut who is able to
respond and assist in any contingency situation that may arise.
Safety Considerations in NASA's Selection of Space Exploration Vehicles
In January 2004, President Bush announced his Vision for Space
Exploration, which called for NASA to safely return the Space Shuttle
to flight; complete the International Space Station (ISS); return to
the Moon to gain experience and knowledge for human missions beyond the
Moon, including Mars; and increase the use of robotic exploration to
maximize our understanding of the solar system and pave the way for
more ambitious human missions. Congressional support for a new
direction in the Nation's human spaceflight program was clearly
articulated in the 2005 NASA Authorization Act. Specifically, the Act
directed the NASA Administrator ``to establish a program to develop a
sustained human presence on the Moon, including a robust precursor
program, to promote exploration, science, commerce, and United States
preeminence in space, and as a stepping-stone to future exploration of
Mars and other destinations. The Administrator was further authorized
to develop and conduct appropriate international collaborations in
pursuit of these goals.''
Shortly after Dr. Michael Griffin was named the new NASA
Administrator in April 2005, he set out to restructure the Exploration
Program by giving priority to accelerating the development of the Crew
Exploration Vehicle (CEV) to reduce or eliminate the anticipated gap in
U.S. human access to space following the retirement of the Space
Shuttle. Specifically, he established a goal for the CEV to begin
operation as early as 2011and to be capable of ferrying crew and cargo
to and from the ISS. He also decided to focus on existing technology
and proven approaches for exploration systems development. In order to
reduce the number of required launches for exploration missions and to
ease the transition after Space Shuttle retirement in 2010, the
Administrator, consistent with the congressional guidance contained in
the NASA Authorization Act of 2005, directed the Agency to examine the
cost and benefits of developing a Shuttle-derived Heavy-Lift Launch
Vehicle to be used in lunar and Mars exploration. As a result, the
Exploration Systems Architecture Study (ESAS) team was established to
determine the best exploration architecture and strategy to implement
these changes.
In November 2005, NASA released the results of the ESAS, an initial
framework for implementing the VSE and a blueprint for the next
generation of spacecraft to take humans back to the Moon and on to Mars
and other destinations. ESAS made specific design recommendations for a
vehicle to carry crews into space, a family of launch vehicles to take
crews to the Moon and beyond, and a lunar mission ``architecture'' for
human lunar exploration. ESAS presented a time-phased, evolutionary
architectural approach to returning humans to the Moon, servicing the
ISS after the Space Shuttle's retirement, and eventually transporting
humans to Mars. Under the 2005 ESAS plan, a Crew Exploration Vehicle
(CEV and now called Orion) and Crew Launch Vehicle (CLV and now called
Ares I) development activities would begin immediately, leading to the
goal of a first crewed flight to the ISS in 2011. Options for
transporting cargo to and from the ISS would be pursued in cooperation
with industry, with a goal of purchasing transportation services
commercially. In 2011, the development of the major elements required
to return humans to the Moon would begin--the lunar lander (now called
Altair), heavy lift cargo launcher (now called Ares V), and an Earth
Departure Stage vehicle. These elements would be developed and tested
in an integrated fashion, with the internal goal of a human lunar
landing in 2018. When resources needed to achieve the 2011 goal for CEV
operations were not forthcoming, the Constellation Program established
a formal target of 2015 for initial CEV flights to the ISS.
According to the ESAS report, the team's major trade study was a
detailed examination of the relative costs, schedule, reliability,
safety, and risk of using DoD's Evolved Expendable Launch Vehicle
(EELV) and Shuttle derived launchers for crew and cargo missions. Among
its operational ground rules and assumptions was the CAIB finding on
the desirability of an architecture that will ``separate crew and large
cargo to the maximum extent practical''.
The EELV options examined for suitability for crew transport by the
ESAS team were derived from the Delta IV and Atlas V families. The team
found that:
None of the medium versions of either vehicle had the
capability to accommodate CEV lift requirements. Augmentation
of the medium-lift class systems with solid strap-on boosters
was thought by the team to pose an issue for crew safety
because of small strap-on Solid Rocket Motor reliability.
Both vehicles required modification for human-rating,
particularly in the areas of avionics, telemetry, structures,
and propulsion systems.
Both Atlas- and Delta-derived systems required new
upper stages to meet the lift and human rating requirements.
Both Atlas and Delta single-engine upper stages fly
highly lofted trajectories, which can produce high deceleration
loads on the crew during an abort an, in some cases, can exceed
crew load limits as defined by NASA standards.
CLV options derived from Shuttle elements focused on the
configurations that used a Reusable Solid Rocket Booster (RSRB), either
as a four-segment version nearly identical to the RSRB flown today or a
higher-performance five-segment version of the RSRB. The team sought to
develop options that could meet the lift requirement using a four-
segment RSRB. To achieve this, a 500,000-lbf vacuum thrust class
propulsion system would be needed. Two types of upper stage engines
were assessed. According to ESAS, the option chosen, including using
the Space Shuttle Main Engine (SSME) for the upper stage, was selected
due to projected lower cost, higher safety/reliability, its ability to
utilize existing human-rated systems and infrastructure and the fact
that it gave the most straightforward path to a heavy lift launch
vehicle for cargo. Subsequently, to achieve lower recurring costs, the
rocket motor powering the upper stage was changed to a variant of the
J-2S Saturn-era motor and now called J-2X.
The following chart from the ESAS report summarizes the team's
findings with regards to CLV options and compares these options on the
basis of Loss of Mission (LOM) and Loss of Crew (LOC) probabilities:
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Source: NASA (ESAS)
With regards to crew safety, as shown in the table above, analysis
by the ESAS team showed that the initially recommended concept had a
mean LOC of 1 in 2,021 and the current design had a mean LOC of 1 in
1,918. As such, initially both concepts met the recommendations from
the CAIB and the Astronaut's Office that a Shuttle replacement have at
least a LOC of 1 in 1,000 missions. In comparison, the other options
ranged from 1 in 614 to 1 in 1,100. The selected CLV design, which
later became known as Ares I, was also projected to offer significant
improvement in Loss of Mission over other launch options.
In his presentation to the Augustine Committee on July 29, 2009,
Dr. Joseph Fragola, a member of the ESAS team and Vice President of
Valador, Inc., told the Committee that this meant that ``Ares I is at
least a factor of 2 safer from a loss of crew perspective and in some
cases closer to a factor of 3.'' In a recent conversation between
Subcommittee staff and Dr. Fragola, he indicated that the ESAS team was
more interested in establishing the relative risk among the options and
not in their absolute risk values. According to NASA, the recommended
concept's lower LOC estimate is a direct reflection of the use of a
simpler design and fewer moving parts characteristic of a single solid
propellant first stage. The recommended concept was accepted and formed
the basis of the Ares I crew launch vehicle.
Dr. Fragola will be a witness at the hearing and can provide
additional details on the ESAS Team's analysis of how alternative
configurations compared with regards to loss of crew and loss of
mission projections.
Safety Oversight by the Aerospace Safety Advisory Panel
Since it was established in 1968 by Congress, the Aerospace Safety
Advisory Panel (ASAP) has been evaluating NASA's safety performance and
advising the agency on ways to improve that performance. The Panel
consists of members appointed by the NASA Administrator and is
comprised of recognized safety, management, and engineering experts
from industry, academia, and other government agencies.
The ASAP reports to the NASA Administrator and Congress. The Panel
was established by Congress in the aftermath of the January 1967 Apollo
204 spacecraft fire. The Panel's statutory duties, as prescribed in
Section 6 of the NASA Authorization Act of 1968, Public Law 90-67, 42
U.S.C. 2477 are as follows:
``The Panel shall review safety studies and operations plans
that are referred to it and shall make reports thereon, shall
advise the Administrator with respect to the hazards of
proposed operations and with respect to the adequacy of
proposed or existing safety standards, and shall perform such
other duties as the Administrator may request.''
The Panel was authorized in Section 106, Safety Management, of the
National Aeronautics and Space Administration Authorization Act of
2005, [P.L. 109-155]. The ASAP bases its advice on direct observation
of NASA operations and decision-making. The Panel provides an annual
report. In addition to examining NASA's management and culture related
to safety, the report also examines NASA's compliance with the
recommendations of the CAIB. Advice from the ASAP on technical
authority, workforce and risk management practices has been provided to
the NASA Administrator.
Critical human space flight safety issues the Panel identified in
its 2008 Annual Report included the proposed extension of the Space
Shuttle Program; the use of commercial transportation sources; the
safety and reliability of the Russian Soyuz spacecraft; an opportunity
to hardwire safety into the fabric of the Constellation Program; the
suitability of agency management approaches; and technical Standards
Program focused on safety and risks.
In his testimony at the Subcommittee's June 2009 hearing on
``External Perspectives on the FY 2010 NASA Budget Request and Related
Issues'', the ASAP witness stated that while the Panel endorses and
supports investing in a Commercial Orbital Transportation Services
(COTS) program, it believes ``at this juncture that NASA needs to take
a more aggressive role articulating human rating requirements for the
COTS Program since most programs are well underway. To do otherwise
may, at a later time, pressure NASA into accepting a system for
expediency that is below its normal standard for safety''. In its 2008
report, the ASAP stated:
``COTS vehicles currently are not subject to the Human-Rating
Requirements (HRR) standards and are not proven to be
appropriate to transport NASA personnel.''
and
``The capability of COTS vehicles to safely dock with the ISS
still must be demonstrated.''
In addition to its annual report, the Panel submits Minutes with
recommendations to the NASA Administrator resulting from its quarterly
meetings. The Panel held its Third Quarterly Meeting in July 2009 [the
Panel's most recent Quarterly Meeting was held on October 22, 2009 at
the Kennedy Space Flight Center]. At that meeting, the Panel's official
minutes referenced the panel's continuing concerns regarding the
application of human rating criteria to commercial crew transportation
services:
``As far as the safety issues, they basically boil down to
expanding the cargo capability to include crew. If that is
done, the traditional method would be to apply full human
rating criteria initially at the beginning of the program's
development. However, thus far NASA has consciously chosen to
not use a traditional approach, and there yet have been any
performance requirements identified to put crews on board a
COTS vehicle. The Panel previously had made a recommendation
regarding this issue and continues to be perplexed as to why
NASA has delayed this important action.''
``The Panel has addressed its concern in its previous
quarterly and annual reports. The issue is becoming more
focused and more urgent. The prospect of a COTS delivery of
cargo to space is organizationally and politically simpler than
crew transport. The issue of human rating with COTS and the
delivery of NASA astronauts into space is the primary concern.
Admiral Dyer [Chairman of the ASAP] noted that the Panel
remains concerned that in the probing of this question, NASA
looks to the FAA, which doesn't have the institutional history
and people to speak clearly to the topic. This issue represents
an opportunity for improved interagency performance.''
Admiral Dyer also noted at the July meeting that ``If the
[commercial] vehicle is being designed to be a cargo hauler, that is a
different mission and a different set of designs than a crew
transporter.'' Mr. John Frost, a Panel member, added that ``the human
rating requirements for the Agency are built around the design process
and those processes are ongoing now at the COTS contractors. It would
be problematic to come back later to put these requirements into a
process that is already complete.''
As mentioned above, Mr. John Marshall, a member of the ASAP, will
be a witness at the hearing and can provide additional details on the
Panel's work and safety-related concerns.
Commercially Provided Crew and Cargo Space Transportation Services
At present there are no commercially owned and operated human space
transportation systems in service. Only one company, Scaled Composites,
has successfully launched and returned humans safely to space and back
on suborbital flights in an experimental spacecraft [SpaceShipOne] and
launch system. Virgin Galactic intends to purchase operational vehicles
from Scaled Composites and enter into commercial operations. Originally
slated to enter into commercial operations in 2007, they are currently
projecting a 2011 debut for SpaceShipTwo's suborbital flight
operations. Several other companies/ventures also have plans to take
paying passengers on suborbital 'tourism' trips, but have not yet flown
any craft to space with humans aboard.
Along with space tourism, the `NewSpace' community has stated that
suborbital services will be able to provide opportunities for
suborbital science experiments, suborbital travel and package delivery.
According to members of this `Newspace' community, after carrying out
suborbital business operation, a number of them have hopes of being
able to undertake orbital operations in the future. However, there are
a number of regulatory concerns and technical issues that would have to
be addressed, as well as significant investments made, before such a
future could be realized. Orbital flight operations are considered
significantly more challenging than suborbital flight operations.
Commercial Orbital Transportation Services Demonstrations
Under the Commercial Orbital Transportation Services (COTS)
Demonstration project, NASA is helping industry develop and demonstrate
cargo space transportation capabilities. According to NASA, the COTS
project provides a vehicle for industry to lead and direct its own
efforts with NASA providing technical and financial assistance. NASA
will invest approximately $500 million toward cargo space
transportation flight demonstrations. There are currently two funded
participants in the COTS demonstration project, namely Space
Exploration Technologies (SpaceX) and Orbital Sciences Corporation
(Orbital).
According to NASA, as of September 16, 2009, SpaceX had completed
15 of 22 milestones and has received a total of $243 million in
payments, with $35 million available for the remaining milestones.
Milestone tasks range from Project Plan Review to Flight Demonstration.
SpaceX has begun manufacturing the flight Dragon capsule and Falcon 9
launcher to be used for the COTS demonstration flight 1. Under the
terms of the current Space Act Agreement, SpaceX was scheduled to
complete its first demonstration flight in June 2009 (The initial Space
Act Agreement between NASA and SpaceX was signed in August 2006 and
called for a scheduled first demonstration flight by September 2008).
To allow additional time for Dragon and Falcon 9 manufacturing and
testing programs, SpaceX indicated in June 2009 that it expected to
complete its first demonstration flight in January 2010, with the
second and third flights then planned for June 2010 and August 2010,
respectively. However, making the first COTS demonstration flight in
January 2010 will be challenging. According to an October 29th, 2009
Space News article, development of the Falcon 9 rocket--along with that
of its smaller sibling, the Falcon 1--has taken longer than SpaceX
expected. The same Space News article reports that SpaceX's range
request for the inaugural Falcon 9 flight made for February 2010
conflicts with another already approved launch. This is significant
because of the relationship between the Falcon 9 inaugural flight and
the first COTS demonstration flight. The first COTS flight must receive
an FAA license before it is launched. In its June 2009 briefing to the
Augustine Committee, SpaceX projected that the first COTS demonstration
flight would occur 2 months after the inaugural Falcon 9 flight. The
smaller Falcon 1, which is designed for transport of satellites to low
Earth orbit and is not part of the COTS project, has encountered its
share of developmental challenges. In July 2009, Falcon 1 successfully
delivered the Malaysian RazakSAT satellite to orbit. Prior to a
successful test flight in September 2008 at which time a dummy payload
reached orbit, there had been three unsuccessful Falcon 1 flights, the
first of which occurred in March 2006.
As of September 16, 2009, NASA says that Orbital has completed 10
of its planned 19 milestones and has received a total of $120 million
to date with an additional $50 million available for future milestones.
The Orbital demonstration flight is currently planned for March 2011
due to the company's decision to change its cargo transportation
architecture from an unpressurized (external) cargo system to a
pressurized (internal) cargo system. The initial Space Act Agreement
signed in February 2008 had a scheduled first demonstration flight date
of December 2010.
According to NASA, the agency will not pay for any milestone until
the milestone is successfully completed per the Space Act Agreement and
approved by the agency. Should a milestone be missed, NASA says that it
will evaluate partner progress made and recommend future actions that
are in the best interest of the government.
Commercial Resupply Services
In December 2008, NASA awarded contracts to two companies for the
delivery of cargo to the ISS after the retirement of the Space Shuttle.
The successful bidders for Commercial Resupply Services (CRS) contracts
were Orbital and SpaceX, the two COTS demonstration program funded
participants. NASA says that it awarded two contracts to mitigate the
risk of being dependent on a single contractor. A protest lodged to the
Government Accountability Office (GAO) in January 2009 by PlanetSpace,
Inc, an unsuccessful bidder, was subsequently denied by GAO in April
2009.
The scope of the CRS effort includes the delivery of pressurized
and/or unpressurized cargo to the ISS and the disposal or return of
cargo from the ISS. In addition, there are non-standard services and
special task assignments and studies that can be ordered to support the
primary standard resupply service. NASA ordered 8 flights valued at
$1.88 billion from OSC and 12 flights valued at $1.59 billion from
SpaceX. According to NASA's press release announcing the contracts, the
maximum potential value of each contract is $3.1 billion. Based on
known requirements, the combined value of the two awards is projected
at $3.5 billion.
Each award under the contracts calls for the delivery of a minimum
of 20 metric tons of cargo to the ISS, as well as the return or
disposal of 3 metric tons of cargo from the orbiting complex. The CRS
contracts are firm-fixed price, Indefinite Delivery Indefinite Quantity
procurements with a period of performance from January 1, 2009, through
December 30, 2015.
Commercial Crew Transportation Services
Although NASA currently has no contracts for the transportation of
crew by commercially provided space transportation services [which do
not at present exist], it has recently applied funds from the American
Recovery and Reinvestment Act of 2009 to work on the Commercial Crew
and Cargo Program:
A modification to the Bioastronautics contract with
Wyle Integrated Science & Engineering Group was made to develop
a set of human system integration requirements for application
to commercial spacecraft in support of NASA's Commercial Crew
and Cargo Program. According to NASA, the human system
integration requirements developed under this task order will
be based on a review of existing Human Rating requirements,
Spaceflight Human Systems Standards, Constellation Program
requirements, Commercial Crew and Cargo Program Office
operational concepts and requirements, and the Johnson Space
Center Space Life Sciences Directorate Human Interface Design
Handbook.
NASA's Commercial Crew and Cargo Program is applying
Recovery Act funds to solicit proposals from all interested
U.S. industry participants to mature the design and development
of commercial crew spaceflight concepts and associated enabling
technologies and capabilities. NASA plans to use its Space Act
authority to invest up to $50 million dollars in multiple
competitively awarded, funded agreements. This activity is
referred to as Commercial Crew Development, or CCDev.
Commercial Spaceflight Federation
According to the Commercial Spaceflight Federation (CSF), its
mission is to ``promote the development of commercial human
spaceflight, pursue ever higher levels of safety, and share best
practices and expertise throughout the industry. CSF member
organizations include commercial spaceflight developers, operators, and
spaceports''. The Commercial Spaceflight Federation is governed by a
board of directors, composed of the member companies' CEO-level
officers and entrepreneurs.
The Federation recently voiced strong support for the report by the
Review of U.S. Human Space Flight Plans Committee which included in its
options the creation of a Commercial Crew program to develop commercial
capabilities to transport crew to the International Space Station.
Mr. Bretton Alexander, President of the Commercial Spaceflight
Federation, will be a witness at the hearing and can provide details
related to commercial provider plans to human rate commercial space
transportation systems as well as the commercial space industry
expectations of how NASA's safety standards and requirements would be
applied to commercially crewed spacecraft.
Chairwoman Giffords. Good morning. This hearing has now
come to order.
This hearing this morning is the latest in a series of
hearings that this Subcommittee is holding on a critical issue,
an issue that we will have to take into consideration as
Members of Congress and also the White House in considering the
future direction and funding for NASA. In many ways, the topic
of today's hearing is one of the most important issues
confronting us, namely, how to ensure the safety of those brave
men and women whom the Nation sends into space to explore and
push back the boundaries of the space frontier. Of course, I am
not under any illusion that human spaceflight can ever be risk-
free. Nothing in life, of course, is.
The Apollo 1 fire, the Challenger, Columbia, these fatal
accidents, as well as other spaceflight incidents that could
have led to loss of life, have driven that point home in stark
and tragic terms. Indeed, this Subcommittee is holding today's
hearing because we need to be sure that any decision being
contemplated by the White House or by the Congress are informed
by our best understanding of the fundamental crew safety issues
facing our human spaceflight program. And in making those
decisions, we should not let either advocacy or unexamined
optimism replace probing questions and thoughtful analysis.
That is why the Subcommittee has invited this distinguished
panel of witnesses to appear before us today. We need the
benefit from your perspective and experience as we examine
critically important questions that Congress will need to have
answered if we are to assess the various proposals that are
being put forth.
Much has been said about the potential future plans for
exploration in recent months, but there has been precious
little discussion about safety. Today's hearing is the first
step in rectifying that situation.
Let me list just a few questions that we hope our witnesses
will answer today. As several of the witnesses have put in
their prepared testimony, the Constellation program strove to
respond to the recommendations of the Columbia Accident
Investigation Board that the design of the system that replaces
the shuttle should give overriding priority to crew safety. The
result is a system that is calculated to be significantly safer
than the space shuttle, and two to three times safer than the
alternative approaches considered by NASA. Given that, we hope
that our witnesses as to whether--we will hear from them
whether or not they believe that the burden of proof should be
put on those who would propose alternatives to Constellation to
demonstrate that their systems will be at least as safe as Ares
and Orion. Alternatively, we would like to hear whether or not
it would be acceptable to reduce the required level of crew
safety on commercially provided crew transport services used to
transport U.S. astronauts much below what looks likely to be
achievable in the Constellation program.
In addition, we need to hear our witnesses' views on
whether the timetable suggested for the availability of
commercial crew transport services is realistic or not. That
is, when one takes into account all of the steps, not just
those that are explicitly safety related, that will need to be
taken before the first NASA astronaut can ride to the
International Space Station on an operational commercial crew
vehicle, do our witnesses believe that such vehicles will be
available in time to meet a significant fraction of NASA's ISS
crew transfer and crew rescue needs prior to 2020 or not.
Similarly, given those required steps, do our witnesses believe
that would-be commercial crew transport service providers will
be able to garner sufficient revenues from non-NASA passenger
transport services to remain viable over that same time period
or not.
I ask these questions, and we will hear other questions of
course from our members, because it is going to be difficult to
make reasoned judgments about the wisdom of investing
significant taxpayer dollars in would-be commercial providers
or of altering Congress's commitment to the existing
Constellation program in the absence of clear answers.
Finally, what do our witnesses consider to be the most
important safety-related issues that will need to be addressed
if we are to make our decisions on the future of NASA's human
spaceflight and exploration program, and, at the end of the
day, what will Congress need to do to have the assurance that
we have done all we can to ensure the safety of our Nation's
future human spaceflight activities? This is not a hypothetical
question. It is fundamental for fulfilling our responsibilities
as Members of Congress. With so much for our Subcommittee to
consider, I am comforted that we have a very distinguished
panel who can speak with conviction and knowledge about safety
issues and everything that needs to be considered.
So I welcome all of you to today's hearing. All of us here
of course are passionate about space, whether in the private
sector or the public sector. We want the best possible future
for our Nation in its space endeavors. I hope that this
morning's hearing will help us chart a productive and a
responsible path forward.
And finally, I would be remiss if we did not acknowledge
the unique contributions of one of our witnesses to the
advancement of safety in human spaceflight, and I want to
welcome each of you to our hearing but particularly Gen. Tom
Stafford, a veteran of Gemini, Apollo, Apollo-Soyuz, Shuttle
Return to Flight, and countless other space flight efforts. He
can speak as a true national hero and an authority.
So in closing, I know that my colleagues join me in saying
that we all owe General Stafford a great amount of debt for
everything you have done for our country and we are honored,
sir, that you are here with us today. Thank you.
[The prepared statement of Chairwoman Giffords follows:]
Prepared Statement of Chairwoman Gabrielle Giffords
Good morning. This morning's hearing is the latest in a series of
hearings that this subcommittee is holding on critical issues that the
White House and Congress need to consider as decisions are made on the
future direction and funding for NASA. In many ways, the topic of
today's hearing is one of the most important issues confronting us--
namely, how to ensure the safety of those brave men and women whom the
nation sends into space to explore and push back the boundaries of the
space frontier. Of course, I am under no illusions that human
spaceflight can ever be made risk-free. Nothing in life is.
The Apollo 1 fire, the Challenger and Columbia fatal accidents, as
well as other space flight incidents that could have led to loss of
life, have driven that point home in stark and tragic terms. Indeed,
this subcommittee is holding today's hearing because we need to be sure
that any decisions being contemplated by the White House and Congress
are informed by our best understanding of the fundamental crew safety
issues facing our human space flight program. And in making those
decisions, we should not let either advocacy or unexamined optimism
replace probing questions and thoughtful analysis.
That is why the subcommittee has invited this distinguished set of
witnesses to appear before us today. We need the benefit of your
perspectives and experience as we examine critically important
questions that Congress will need to have answered if we are to assess
the various proposals that have been put forth.
Much has been said about potential future plans for exploration in
recent months, but there has been precious little discussion of crew
safety Today's hearing is a first step in rectifying that situation.
Let me list just a few of the questions that we would like our
witnesses to address today. As several of the witnesses at today's
hearing will testify, the Constellation program strove to respond to
the recommendation of the Columbia Accident Investigation Board that
``The design of the system [that replaces the Shuttle] should give
overriding priority to crew safety . . .'' The result is a system that
is calculated to be significantly safer than the Space Shuttle, and two
to three times safer than the alternative approaches considered by
NASA. Given that, we hope to hear from our witnesses as to whether they
believe that the burden of proof should be put on those who would
propose alternatives to the Constellation program to demonstrate that
their systems will be at least as safe as Ares/Orion. Alternatively, do
they think it would it be acceptable to reduce the required level of
crew safety on commercially provided crew transport services used to
transport U.S. astronauts much below what looks to be achievable in the
Constellation program?
In addition, we need to hear our witnesses' views on whether the
timetable suggested for the availability of commercial crew transport
services is realistic or not.
That is, when one takes into account all of the steps--not just
those that are explicitly safety-related--that will need to be taken
before the first NASA astronaut can take a ride to the ISS on an
operational commercial crew vehicle, do our witnesses believe that such
vehicles will be available in time to meet a significant fraction of
NASA's ISS crew transfer and crew rescue needs prior to 2020 or not?
Similarly, given those required steps, do our witnesses believe that
would-be commercial crew transport services providers will be able to
garner sufficient revenues from non-NASA passenger transport services
to remain viable over that same time period or not?
It will be difficult to make reasoned judgments about the wisdom of
investing significant taxpayer dollars in would-be commercial providers
or of altering Congress's commitment to the existing Constellation
program in the absence of clear answers to those questions.
Finally, what do our witnesses consider to be the most important
safety-related issues that will need to be addressed as we make our
decisions on the future of NASA's human space flight and exploration
program.
And, at the end of the day, what will Congress need to do to have
the assurance that we have done all we could to ensure the safety of
the nation's future human space flight activities? That is not a
hypothetical question. It is fundamental to fulfilling our
responsibilities as Members of Congress. With so much for this
subcommittee to consider, I am comforted by the realization that we
have a very distinguished panel who can speak with conviction and
knowledge about the safety issues that will need to be considered.
I want to welcome each of you to today's hearing. All of us who are
passionate about space, whether in the private sector or the public
sector, want the best possible future for our nation in its space
endeavors. I hope that this morning's hearing will help us chart a
productive and responsible path forward.
Finally, I would be remiss if I did not acknowledge the unique
contributions of one of our witnesses to the advancement of safety in
human space flight. I want to welcome each of you to today's hearing.
Lt. Gen. Thomas P. Stafford, a veteran of the Gemini, Apollo, Apollo-
Soyuz, Shuttle Return-to-Flight, and countless other space flight
efforts, can speak with authority on safety issues--he has lived them.
He is a true national hero.
So in closing, I know that my colleagues join me in saying that we
owe Gen. Stafford and the other pioneers of human space flight a debt
of gratitude. Without their efforts--and bravery--NASA would not have
made the safety advances that it has.
Chairwoman Giffords. The Chair now recognizes Mr. Olson for
his opening statement.
Mr. Olson. Madam Chairwoman, I would like to yield to the
ranking member of our full Committee if he is ready to make his
statement at this time.
Mr. Hall. I don't know how ready I am but I will take a
shot at it.
I really enjoyed, Madam Chairman, your speech and I agree
with everything you have said. You are in an unusual position
to know what you are talking about and have more than just a
passing interest and more than a committee chairman's interest
in the safety that we are going to talk about today, and I want
to thank you for allowing me to make the statement and for
holding this hearing. It is one of the topics that I think I am
most passionate about and that is the safety of our crews. It
simply has to be at the heart of everything NASA does in space.
Also, I want to sincerely thank all of today's witnesses
for taking the time and effort. I know it takes time. You
prepared yourself back during your lifetime for this
presentation to us and you are the very type of citizen that
comes here that gives us information from which we glean the
ingredients that go into the bills, and we know it takes your
time. Your time is valuable and you didn't suffer to get here
but you paid the price to get here. We are very honored to have
each one of you. I want to sincerely thank all of you for
taking the time and effort.
I especially want to welcome a friend of mine here and have
the liberty of saying a word or so about Gen. Tom Stafford. He
is a good friend. He is a national hero. I have relied on his
advice for many years. He is the kind of guy that I call and
get him out of the garden or wherever he is, the library,
wherever he may be, but I have called on him for a lot of
information on many occasions and we have exchanged personal
letters through the years, most recently when he chaired the
Stafford-Covey Return to Flight Task Force established to
ensure that the Columbia Accident Investigation Board's
recommendations were carried out.
And we have a lot of important issues to cover today. The
Columbia Accident Board gave NASA many safety recommendations
and principles to follow in the design of future launch
vehicles. In May of 2004, after carefully reviewing the
findings, the Astronaut Office published their position on the
safety of future launch systems. One recommendation was to
include a crew escape system module as part of any new launch
vehicle. In the NASA authorization bill of 2005, many of us
worked together to ensure that such a system was part of NASA's
plans for the next human exploration vehicle, and I know we all
will continue to insist that this remains the case.
Much of what I say today is in a piece in Monday's edition
of Space News. Madam Chair, I would like to ask unanimous
consent to include a copy of the May 4, 2004, Astronaut Office
position on future launch system safety and throw in a copy of
my November 30th Space News editorial into the record.
[The information follows:]
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Chairwoman Giffords. Without objection.
Mr. Hall. And with that, I want to just say another word or
so about Tom Stafford. He graduated from the U.S. Naval Academy
ten years after Sam Rayburn came to my breakfast table to talk
to my mother to tell her why he couldn't appoint me to the
Naval Academy. They were in school together at Mayo College
there. It is now Texas A&M at Commerce, but they were friends
forever. She was part of the first team to ever get Sam Rayburn
to run for office. She wanted him to appoint me to the Naval
Academy. He said there are just four reasons and all four
reasons are his grades. Later, Madam Chairman, that came home
to me because they ran an article in the paper when I was
running for reelection for judge one time that I had made four
F's and a D one time and my dad had punished me for spending
too much time on one subject. That wasn't very good. But Tom
has also flown two Gemini missions. He is the first Gemini
mission, and he piloted the first rendezvous in space. He is
cited by the Guinness Book of World Records for the highest
speed ever obtained by a man, or a woman, I am sure, 24,791
miles per hour during the reentry of Apollo 10. He was
instrumental in our early space missions with the Russians. He
logged over 507 hours in space and flew four different types of
spacecrafts. He obtained the rank of three-star general and he
served as a defense advisor to one of the great Presidents of
the century, President Ronald Reagan. Tom and you other five
gentlemen, we thank all of you for what you are doing and your
presence here today.
I yield back. Thank you, Madam Chairman.
[The prepared statement of Mr. Hall follows:]
Prepared Statement of Representative Ralph M. Hall
Madame Chair I want to thank you for recognizing me to make a
statement, and for holding today's hearing on ensuring the safety of
human space flight in future space transportation systems. It is one of
the topics I am most passionate about. Safety of our crews simply must
be at the heart of everything NASA does in space.
I also want to sincerely thank all of today's witnesses for taking
the time and effort to share their unique and valuable wisdom and
expertise with us. I especially want to welcome General Tom Stafford.
Tom is a good friend and a real national hero. I have relied on Tom's
advice for many years, most recently when he chaired the Stafford-Covey
Return to Flight Task Group that was established to ensure the Columbia
Accident Investigation Board's recommendations were carried out.
We have a lot of very important issues to cover today so I will be
brief.
The Columbia accident board gave NASA many safety recommendations
and principles to follow in the design of future launch vehicles. In
May 2004, after carefully reviewing the findings, the Astronaut office
published their position on the safety of future launch systems. One
recommendation was to include a crew escape system as part of any new
launch vehicles. In the NASA Authorization Bill of 2005, I ensured that
such a system was part of NASA's plans for the next human exploration
vehicle, and I will continue to insist that this remains the case.
Much of what I would say today is in my editorial piece in Monday's
edition of Space News. Madame Chair I'd like to ask unanimous consent
to include a copy of the May 4, 2004 Astronaut Office Position on
Future Launch System Safety; and a copy of my November 30, 2009 Space
News editorial into the record.
With that, I look forward to a very productive hearing and yield
back my time.
Chairwoman Giffords. Thank you, Mr. Hall.
If there are other members who wish to submit additional
opening statements, your statements will be added to the record
at this point.
Mr. Olson. Madam Chairwoman?
Chairwoman Giffords. Yes.
Mr. Olson. May I make an opening statement?
Chairwoman Giffords. Sure.
Mr. Olson. Thank you very much. I appreciate that, and I
know part of this is my fault for getting the ranking member in
here.
Madam Chairwoman, thank you for calling this morning's
hearing on a topic of paramount importance to the future of our
human spaceflight program. The issue of safety is really the
starting point from which all discussions about the course and
purpose of our Nation's human spaceflight program should begin.
I am certain we would have a line of people out the door to
test-drive the new rocket. That pioneering spirit is in the
fabric of our Nation, but we must not take it for granted, not
cheapen it by failing to provide the direction or performance,
performing the diligence necessary to ensure the astronauts'
safety.
I would like to thank our witnesses for their appearance
before the Subcommittee today. I recognize that each of you has
spent considerable time and effort preparing for this hearing
and in some cases traveling long, long distances to be here,
and we are not going to calculate General Stafford's distance
that he has traveled because he has got a big advantage over
the rest of us. But please know that the Subcommittee
appreciates your efforts as well as the wisdom and experience
you bring and that we will refer to your guidance in the coming
months and years ahead as the Committee goes forward.
NASA is facing a transition away from the space shuttle to
the Constellation program, a program that is in the midst of
testing and design, desperately needs more funds, and thank
you, Mr. Hanley, for all you have done for the Constellation
program. But there is a theme across our entire spaceflight
program, human spaceflight program. An increase in resources
would enhance the abilities and capabilities of the commercial
sector to allow their increased participation as well. I fully
support all of the current endeavors including commercial
cargo, but sadly, from my position, fully supporting and fully
funding are not synonymous. I truly wish they were.
Safety is and must be on the minds of the men and women of
NASA all the time. We have astronauts orbiting in the ISS right
now and each shuttle flight carries with it the extra increment
of risk that an accident could end NASA as we know it.
I would like in my brief time to focus on an area of
concern to me that is just as critical as design standards,
human ratings requirements, airworthiness, to name a few, and
that is the issue of culture. Culture is difficult to define. I
know that. But it is something that the Columbia Accident
Investigation Board spent a great deal of time on. It found
that, and this is a quote, ``The NASA organizational culture
had as much to do with this accident as the foam.'' The
Augustine report cites that, another quote, ``Significant space
achievements require continuity of support over many years. One
way to assure that no successes are achieved is to continually
introduce change.''
It must not be lost on this committee that the increased
participation of commercial providers will necessitate a change
in business as usual at NASA. We cannot take that lightly.
Changing the way a bureaucracy operates is not easy. In many
cases, it is not advisable, and frustratingly, in most cases,
not achievable, but make no mistake, I am not for letting the
status quo dictate the way our government runs. I am just
stating that in this case, a change like this brings challenges
and risk that we must not overlook.
The agency faces limited budgets, massive contractor
layoffs and retirement of the signature program and perhaps a
new way of doing things. Again, a new way of doing things is
not inherently bad. I am not saying that. I am just saying it
would bring forth challenges to a workforce and systems and
processes that are every bit as difficult as designing rockets.
I do not believe the CAIB report is a historical artifact
but a guiding document. The Constellation program was designed
with the CAIB freshly in mind, and we must keep that report
fresh in ours as time goes on.
The challenge of a lack of funding permeates every
discussion we have about NASA but not a distant second is a
lack of commitment to a defined program. We have a program
before us. It is time we committed to it with our actions and
the funding necessary to see it through. In my mind, the cost
of not doing so far exceeds the amount needed to complete the
task. We are a Nation founded by great explorers who were
willing to take great risks. Great success is achieved out of
the willingness to make great sacrifice. However, as a Nation,
especially at taxpayer expense, we must be diligent in making
sure that the promised success is worth the promised sacrifice.
Thank you, Madam Chairwoman. I yield back my time.
[The prepared statement of Mr. Olson follows:]
Prepared Statement of Representative Pete Olson
Madam Chairwoman, thank you for calling this morning's hearing on a
topic of paramount importance to the future of our human space flight
program. The issue of safety really is the starting point from which
all discussions about the course and purpose of our nation's human
space flight program should begin.
I am certain we would have a line of people out the door (and
behind me, by the way) to test ride a new rocket. That pioneering
spirit is in the fabric of our nation, but we must not take it for
granted, nor cheapen it by failing to provide the direction or
performing the diligence necessary to ensure their safety.
I'd like to thank our witnesses for their appearance today before
this subcommittee. I recognize that each of you has spent considerable
time and effort preparing for this hearing, and in some cases traveling
considerable distance (although we won't calculate all of Gen.
Stafford's career miles) to be here. Please know that this subcommittee
appreciates your efforts, as well as the wisdom and experience that you
bring, and that we will refer to your guidance in the months and years
ahead.
NASA is facing the transition away from the space shuttle and to
the Constellation program, a program that although is in the midst of
testing and design, desperately needs more funds. But that is a theme
across our entire human space flight program. An increase in resources
would enhance the abilities and capabilities of the commercial sector
to allow their increased participation in space as well. I fully
support all of the current endeavors, including commercial cargo, but
sadly from my position, fully supporting and fully funding are not
synonymous. I truly wish they were.
Safety is and must be on the minds of the men and women at NASA all
the time. We have astronauts orbiting in the ISS right now, and each
shuttle flight carries with it the extra increment of risk that an
accident could end NASA as we know it.
I would like in my brief time to focus on an area of concern that
to me is just as critical as design standards, human-ratings
requirements, and airworthiness, to name a few (and not making light of
any of them) and that is the issue of culture.
Culture is difficult to define I know, but it is something that the
Columbia Accident Investigation Board spent a great deal of time on. It
found that ``the NASA organizational culture had as much to do with
this accident as the foam.''
The Augustine report cites that ``significant space achievements
require continuity of support over many years. One way to assure that
no successes are achieved is to continually introduce change.'' It must
not be lost on this committee that the increased participation of
commercial providers will necessitate a change in business as usual at
NASA. We cannot take that lightly. Changing the way a bureaucracy
operates is not easy, in many cases not advisable, and frustratingly,
in most cases, not achievable. Make no mistake, I am not for letting
the status quo dictate the way our government runs, I am just stating
that in this case a change like this brings challenges, and risks, that
we must not overlook.
The agency faces limited budgets, massive contractor layoffs, the
retirement of a signature program, and perhaps a new way of doing
things. Again, a new way of doing things is not inherently bad, I am
not saying that, I'm just saying that it will bring forth challenges to
a workforce and to systems and processes that are every bit as
difficult as designing rockets.
I do not believe the CAIB report is a historical artifact, but a
guiding document. The Constellation program was designed with CAIB
freshly in mind, and we must keep that report fresh in ours as time
goes on.
The challenge of a lack of funding permeates every discussion we
have about NASA. But a not distant second is the lack of a commitment
to a defined program. We have a program before us; it is time we
committed to it with our actions and the funding necessary to see it
through. In my mind, the cost of not doing so far exceeds the amount
needed to complete the task.
We are a nation founded by explorers who were willing to take
risks. Great success is achieved out of the willingness to make great
sacrifice. However, as a nation, especially at taxpayer expense, we
must be diligent in making sure that the promised success is worth the
possible sacrifice.
Thank you, Madam Chairwoman. I yield back by time.
Mr. Hall. Will the gentleman yield to me just one minute
before he yields back his time?
Mr. Olson. Yes, sir. Yield back to the ranking member.
Mr. Hall. Madam Chairperson, we have in the audience a
longtime staffer and part of the bedrock of the NASA program
and the bedrock of this Committee, Tom Tate. Tom, we are always
glad to have you back here and thanks for the many years you
have spent back on this side of the desk.
Thank you, Madam Chairman. I yield back.
Chairwoman Giffords. Thank you.
Because we anticipate votes probably occurring in about 45
minutes, I am going to ask if other members have additional
opening statements that we submit them for the record at this
point.
We do have a distinguished set of panelists today. I would
like to introduce them briefly. Mr. Bryan O'Connor is here. He
is a veteran of two space shuttle missions and is currently the
Chief of Safety and Mission Assurance at NASA. He will be
discussing NASA's processes and plans for resolving safety and
human rating issues. Next we will hear from Mr. Jeff Hanley,
who is Program Manager for the Constellation program at NASA.
He will be discussing the steps taken by the Constellation
program to maximize crew safety in its Ares-Orion System. We
will also hear from Mr. John C. Marshall, who is a Council
Member on NASA's Aerospace Safety Advisory Panel. He will
provide the perspectives of the agency's outside safety
advisory board. Welcome. Also, we will hear from Mr. Bretton
Alexander, who is currently the President of the Commercial
Spaceflight Federation. He will provide the commercial
industry's perspectives and plans for addressing crew safety
issues. Welcome. Dr. Joseph Fragola is Vice President of
Valador Incorporated. He has more than 40 years experience in
risk analysis in the aerospace and nuclear industries and will
provide his perspectives on the issues involved in ensuring the
safety of both government and non-government crew space
transportation systems, a true expert. Welcome, Dr. Fragola.
And of course, Lt. Gen. Tom Stafford, who has been introduced a
couple times already. We are just very, very delighted that you
are here.
As our witnesses should know, you will each have five
minutes for your spoken testimony. Your written testimony will
be included in the record for the hearing, and when you have
completed your spoken testimony, we will begin with questions,
and each member will have five minutes to question the panel,
and we would like to begin this morning with Mr. O'Connor.
STATEMENT OF BRYAN O'CONNOR, CHIEF OF SAFETY AND MISSION
ASSURANCE, NATIONAL AERONAUTICS AND SPACE ADMINISTRATION
Mr. O'Connor. Thank you, Chairwoman Giffords, members of
the Subcommittee. I appreciate the opportunity to appear here
today to discuss how NASA works to ensure the safety of human
spaceflight. In your letter inviting me to testify at today's
hearing, you asked that I address a number of questions related
to the Office of Safety and Mission Assurance at NASA and how
we work with safety of human spaceflight. My statement will
address those questions and provide additional context.
The Office of Safety and Mission Assurance provides policy
direction, functional oversight and assessment for all agency
safety reliability and quality engineering activities. We are
responsible for the agency's safety and mission assurance
requirements and standards and we serve as principal advisor to
the Administrator on matters pertaining to human spaceflight
safety and mission success.
In the past several years, my organization has sponsored
several initiatives to take advantage of our lessons learned
from the past 50 years of human spaceflight. Included are
increased emphasis on the qualifications and credibility of our
professional workforce, formal technical authority for
associated safety and mission assurance requirements as well as
the authority to determine safety risk acceptability for
designs and for operations including human spaceflight launch,
increased emphasis on safety culture throughout the human
spaceflight programs. This includes more open communications
including encouragement for dissenting opinions, clear appeal
paths all the way to the Administrator as necessary for safety
dissenting opinion, and something we started recently called
the ``Yes If'' initiative. It is an incentive that promotes the
ideal that credible and capable safety and mission assurance
professionals don't simply just know the rules but they
understand the rationale behind those rules to the point that
they can help the designer and the operator with alternative
approaches consistent with safety and mission success,
improvements in critical software, independent validation and
verification and improvements in our knowledge management
systems. A significant portion of these activities as well as
improved audits, assessment and mishap investigation procedures
and capabilities in the agency are primarily managed at the new
NASA Safety Center, which we established two years ago in
Cleveland near the Glenn Research Center.
As I mentioned, much of our current thinking comes from
hard lessons learned from the past. The Columbia Accident
Investigation Board documented for us once again the inherent
risk of human spaceflight, noting that ``the laws of physics
make it extraordinarily difficult to reach earth orbit and
return safely.'' To justify that risk the CAIB called for ``a
national mandate providing NASA a compelling mission requiring
human presence in space.'' It also recommended that design of
the shuttle replacement should give overriding priority to crew
safety rather than to trade safety against other performance
criteria such as low cost and reusability or against advanced
space operations capabilities other than crew transfer. The X-
15 incidents, the Apollo fire, the Challenger, the Columbia
accidents have caused us to insist on clear lines of
accountability in what we do with strong checks and balances,
capable systems integration and a strong safety culture with
open communications in all directions. We treat every crewed
spaceflight like an engineering test flight, retaining adequate
program resources to thoroughly prepare for each flight and to
analyze and resolve ground and flight anomalies. Finally, we
emphasize crew escape and emergency systems to improve crew
survivability during anticipated or unanticipated flight
contingencies.
We have also learned an awful lot working with our Russian
counterparts beginning in Apollo-Soyuz and continuing with
Shuttle-Mir and the International Space Station about the
challenges of spaceflight and safety of human spaceflight. For
example, we note in the Soyuz design the robust reliability and
failure tolerance features. The systems for unknown
contingencies are treated with capable, highly capable abort,
escape and emergency systems.
On the matter of crew egress and escape and abort, the
Columbia Crew Survival Investigation Report prepared by NASA
Spacecraft Crew Survival Integrated Investigation Team released
last December is a comprehensive study of crew safety equipment
and procedures used during the Space Shuttle Columbia accident.
We have made this report available to the Constellation program
as well as to industry for use and guidance in their design for
survivability.
Finally, as we review the options presented by the
Augustine panel, we are considering how best to address their
suggested commercial crew transportation options. We are using
fiscal year 2009 Recovery Act funds to supplement or to support
activities related to technologies that enable commercial human
spaceflight capabilities. We are also investing Recovery Act
funds to begin development of a more concise set of human
rating technical requirements that might apply to non-NASA
developers and we are looking at appropriate oversight and
insight approaches to be used for such a venture.
In closing, the Office of Safety and Mission Assurance
plays a significant role in assuring safety of human
spaceflight. Chairwoman Giffords, I would be happy to respond
to any questions you or other members have on this matter.
[The prepared statement of Mr. O'Connor follows:]
Prepared Statement of Bryan O'Connor
Chairwoman Giffords and other Members of the Subcommittee, thank
you for the opportunity to appear today to discuss how NASA works to
ensure the safety of human spaceflight. In your letter inviting me to
testify at today's hearing, you asked that I address a number of
questions related to the Office of Safety and Mission Assurance and the
safety of human spaceflight at NASA. My statement will address those
questions, and provide additional context.
The Role of OSMA in Ensuring Human Spaceflight Safety
The NASA Office of Safety and Mission Assurance provides policy
direction, functional oversight, and assessment for all Agency safety,
reliability, maintainability, and quality engineering and assurance
activities and serves as a principal advisory resource for the
Administrator and other senior officials on matters pertaining to human
spaceflight safety and mission success. As Chief of the Office of
Safety and Mission Assurance, I report directly to the Administrator.
OSMA supports the activities of--but is organizationally separate
from--the human spaceflight Mission Directorates and the Office of the
Chief Engineer, thus providing the Administrator an independent view of
the safety and effectiveness of human spaceflight designs, flight test
and mission operations in addition to all other mission roles of the
Agency.
Specifically, the Office of Safety and Mission Assurance:
Develops strategies, policies, technical
requirements, standards, and guidelines for system safety,
reliability, maintainability, and quality engineering and
assurance;
Establishes the applicable set of Safety and Mission
Assurance (SMA) requirements for all human spaceflight
programs, and, through delegated technical authority, formally
approves or disapproves waivers, deviations and/or exceptions
to same;
Verifies the effectiveness of safety and mission
assurance requirements, activities, and processes, and updates,
cancels or changes them as time, technology and/or
circumstances dictate;
Advises NASA leadership on significant safety and
mission assurance issues, including investigation of human
spaceflight-related mishaps and close calls, and provides
guidance for corrective actions stemming from those
investigations as well as corrective actions related to ground
and flight test anomalies;
Performs broad-reaching independent assessments of
human spaceflight-related activities, including formal
Independent Validation and Verification (IV&V) of flight and
ground software critical to flight crew safety;
Oversees and assesses the technical excellence of
safety and mission assurance tools, techniques, and practices
throughout the human spaceflight program life cycle;
Provides knowledge management and training in safety
and mission assurance disciplines to the assigned workforce;
and,
Assures that adequate levels of both programmatic and
Center institutional resources are applied to safety and
mission assurance functions.
NASA Human Spaceflight Safety Initiatives
In the past several years, OSMA has sponsored several initiatives
with the intent of enhancing the safety of human spaceflight. OSMA has
increased its emphasis on the qualification and credibility of safety
and mission assurance professionals by working with the Center
Directors to assign some of their best and brightest employees to
safety and mission assurance positions. We have also established a new
Technical Excellence Program with a four-tier training and
qualification system for all safety and mission assurance professionals
across the Agency. Additionally, safety and mission assurance
professionals assigned to human spaceflight programs now have formal
technical authority for associated safety and mission assurance
requirements as well as the authority to determine safety risk
acceptability for designs and/or operations, including human
spaceflight launch.
Another initiative is an increased emphasis on safety culture
throughout the human spaceflight programs. This includes more open
communications, including encouragement for dissenting opinions; clear
appeal paths to the Administrator for safety dissenting opinions; and
the ``Yes if'' initiative, an incentive that promotes the ideal that
credible and capable safety and mission assurance professionals not
simply know the rules, but understand their rationale to the point that
they can help the design or operations team with alternative approaches
consistent with safety and mission success.
OSMA has also made improvements in critical software IV&V by
increasing the emphasis on validation of critical software requirements
early in design. The IV&V team is also increasing the use of modeling
and other systems engineering techniques to enhance their effectiveness
in assessing the safety and utility of the critical software.
Improved knowledge management and requirements management tools and
processes have also been put into place. This includes dedicated
knowledge capture, archiving and dissemination activities, as well as
better tools for tracking, updating, and rationalizing the more than
3,000 NASA technical and operational SMA requirements (many of which
apply to human spaceflight). These activities, as well as improved
audit, assessment and mishap investigation procedures and capabilities,
are all primarily managed at the NASA Safety Center located near the
Glenn Research Center.
Finally, OSMA has increased the amount of mentoring, training and
technical assistance provided by our Headquarters SMA experts to the
human spaceflight programs and their host Center SMA and engineering
organizations.
Incorporating Lessons Learned into Agency Standards and Procedures
The Columbia Accident Investigation Board (CAIB) documented for us
once again the inherent risk of human spaceflight, noting that ``the
laws of physics make it extraordinarily difficult to reach earth orbit
and return safely.'' To justify the risk, the CAIB called for ``a
national mandate providing NASA a compelling mission requiring human
presence in space.'' The Board also recommended that `` the design of
the Shuttle replacement] should give overriding priority to crew
safety, rather than trade safety against other performance criteria,
such as low cost and reusability, or against advanced space operation
capabilities other than crew transfer.''
The many CAIB recommendations dealing with root causal factors, as
well as NASA's own Return to Flight assessments, pointed to several
important lessons including, but not limited to, those outlined below.
These recommendations and lessons indicate that NASA should:
Maintain clear lines of accountability including
strong checks and balances between program/project managers and
their assigned independent technical authorities.
Organize for a strong program-level systems
integration function for complex, multi-element human
spaceflight programs.
Infuse the organization with a strong safety culture
with open communications in all directions, encouragement of
alternate opinions, and formal appeal paths for dissent.
Treat every crewed space flight like an engineering
test flight, and retain adequate program resources to
thoroughly prepare for each flight and analyze and resolve
ground and flight anomalies.
Emphasize crew escape, abort and emergency systems
and procedures to improve crew survivability during anticipated
or unanticipated flight contingencies.
In the early 1990s NASA engaged in a joint U.S.-Russian project
called Shuttle-Mir, picking up where the Apollo-Soyuz Test Project had
left off in 1975. In preparation for the joint activity, NASA technical
experts, including senior safety engineers, spent a significant amount
of time over a three-year period talking with Apollo-Soyuz veterans,
visiting with current Russian counterparts, and reviewing the long
history of Soyuz, Salyut, and Mir operations in an effort to understand
the Russian approach to human spaceflight safety. The two governments
also established a high-level, joint technical oversight body (the
Stafford-Utkin, now Stafford-Anfimov, Commission) in January 1995 to
independently review Soyuz readiness for flight and to report its
findings directly to the heads of agencies. In March 1995, Norm Thagard
became the first U.S. astronaut to launch on the Soyuz. He and the
other five astronauts who spent time on Mir used the Shuttle for
subsequent transportation, but they all received training in Soyuz as
their primary escape system.
Following on the success of the Shuttle-Mir program, NASA and the
Russian Federal Space Agency (Roscosmos) agreed to create a joint space
station in 1993. The International Space Station (ISS)
Intergovernmental Agreement and Memorandum of Understanding (the final
version of which was signed in 1998) recognized the Russian
government's responsibility for crewmember safety for their elements,
including Soyuz. The next American to launch on Soyuz was Bill
Shepherd, the Commander of the first ISS increment in October 2000.
Like Thagard, Shepherd returned to Earth on Shuttle, and like the Mir
astronauts, he was trained on the Soyuz spacecraft. Since then, 14
different NASA astronauts have flown on Soyuz, bringing the total NASA
astronaut trips to 14 up, and 13 down, several of which were made
during the post-Columbia Return-to-Flight timeframe. Canadian and
European partner astronauts have flown to and from ISS on Soyuz, and
the next Soyuz will carry a Japanese partner astronaut. As we speak,
Soyuz is the primary mode of transportation to and from the ISS for all
ISS crewmembers.
NASA's Russian partner engineers and managers have been open with
their designs, operations, system anomalies, and close calls; however,
there have been occasions when, for various reasons, they have
restricted technical information transfer to our engineers. On these
occasions, perseverance by our technical staff on the ground and
dependence on the Russians' proven engineering and operational savvy
that spans more than 40 years of human spaceflight, have resulted in
sufficient confidence in their systems and operations (approximately 96
percent mission success rate, and 98 percent crew safety record for all
versions since 1967), and mutual trust initiated during the ApolloSoyuz
program, and reinforced most recently with over 15 years of joint space
station operations. Some of the many human spaceflight safety lessons
from NASA's joint work with the Russians on Soyuz, Mir, and ISS
include:
The Russian design philosophy depends heavily upon
reliability in addition to adherence to a strong design
heritage (robust systems and failure tolerance, often using
dissimilar redundancy), but they are big believers in abort,
escape, and emergency systems for known or unknown
contingencies that are not covered by reliability alone.
The Russian design philosophy also rests heavily on
testing. During the Soyuz update from the TM (modified
transport) to TMA (TM anthropometric) version (enlarged in the
1990's to accommodate larger astronauts), they performed
multiple tests, including drop tests, to ensure that the design
was equivalent, or superior, to previous versions. This testing
is often carried to conditions beyond the nominal expected
environments. As Roscosmos prepares to upgrade the control
computer system on the Soyuz, they are first installing and
testing this upgrade in the Progress cargo vehicles. In this
way, they can flight test the system with less critical cargo
before it is required to transport crew. This provides an
additional rigorous test and helps to insure overall crew
safety.
The Russian development philosophy is based on
evolutionary upgrades, keeping what works, and modifying or
replacing what does not.
The Russian design and operational organizations
include reliability and quality engineering staffs, but they do
not have an independent safety engineering staff like NASA
does. That said, they include many of the same safety functions
as NASA does as part of the other engineering disciplines, and
they do provide one of their most experienced engineers as
NASA's SMA counterpart.
The Russian technical staff is very skilled and
displays outstanding knowledge of the flight systems. With
relatively low turnover, they also have excellent corporate
memory, which helps them deal with any repeat problems.
The Russians, unlike NASA, rely on automation and
ground control for certain critical dynamic events like abort
initiation, landing, proximity operations and docking.
Although NASA and Roscosmos have occasionally disagreed about
relative risk levels for such things as orbital debris, battery
hazards, etc., our experience to date shows us that they have no
intention of putting crewmembers in known unsafe situations for the
sake of expediency.
The Columbia Crew Survival Investigation Report, prepared by the
NASA Spacecraft Crew Survival Integrated Investigation Team (SCSIIT)
and released in December 2008, is a comprehensive study of crew safety,
equipment and procedures used during the Space Shuttle Columbia
accident. The report contains 29 specific findings, half of which apply
to Space Shuttle and to NASA investigation procedures, and half to
future designs. The Constellation Program has assessed the report's
findings, incorporating several of them into the Orion design, and the
Program plans to incorporate others as the design matures. The
fundamental theme of the findings is that human spaceflight programs
should include crew survivability in the system design, and that
operational plans should provide for safe egress, abort and/or escape
from contingency situations. This is a top level requirement in NASA's
most recent human rating requirements policy contained in NASA
Procedural Requirement (NPR) 8705.2B (May 6, 2008). The rationale comes
from our three fatal human spaceflight accidents. It is not enough to
design a human spaceflight system to be reliable. The Earth-to-orbit
mission is about managing incredibly high-energy systems and
environments, with very little room for error. When measured by number
of flights, human spaceflight transportation is still relatively
immature, and the designers and operators are continuously learning
about the real risks involved with spaceflight activities. Thus, as the
report highlights, and the human rating requirements mandate, there is
a need to provide the crew with a fighting chance for survival if and
when something goes wrong, anticipated or not.
The Constellation Program is using the SCSIIT report as a design
guideline; and as the Program tailors its suggestions into Program
requirements, we in OSMA are drafting a follow-on technical standard
for use by future human spaceflight system developers. The design
standard will provide cues for designers and will also make it clear
that the addition of any systems to increase the survivability of the
crew needs to consider both the system design and concept of
operations. In the meantime, NASA has made the SCSIIT report available
to the public, sending copies directly to all known commercial space
companies. The SCS1IT has also given presentations about the associated
lessons-learned to NASA Centers, as well as to the National
Transportation Safety Board, Federal Aviation Administration, the
Department of Defense, the Defense Contract Management Agency, and
others totaling over 4000 people to date.
Safety and Commercial Spaceflight
NASA will require that any Earth-to-orbit and/or orbit-to-Earth
system that carries NASA astronauts be human rated, thus ensuring that
all of our stringent crew and launch safety requirements would be met
before any NASA crew would be allowed to travel on a spaceflight
vehicle. As part of that process, the Agency's Technical Authorities
(Engineering, SMA and Health and Medical) will determine which of
NASA's mandatory standards apply in designing, manufacturing and
operating their system. OSMA and the Johnson Space Center SMA
organization worked closely with the Constellation program for over six
months in 2008 to establish and tailor the applicable SMA requirements
for the Constellation Program. This was a very detailed and involved
activity that reminded us that the job of validating the right set of
requirements for a new crewed flight system is not a simple cookie-
cutter or checklist task. Nor is it expected to be a one-time task. The
requirements refining and tailoring process will continue as we learn
more about the design, the environment and the operational concepts.
NASA's Commercial Crew and Cargo Program Office has initiated an effort
to determine and establish the requirements (both process and design)
as well as any other standards that should apply to commercial partners
when engaging in services for transporting astronauts.
Currently, NASA is working with two companies, Space Explorations
Technologies Corporation (Space X) and Orbital Sciences Corporation
(Orbital), as part of individual Commercial Orbital Transportation
Services (COTS) projects designed to develop and demonstrate commercial
cargo capabilities to and from low-Earth orbit. In doing so, NASA has
agreed to pay both companies prenegotiated amounts when each company
achieves pre-negotiated milestones outlined in Space Act Agreements,
and OSMA is part of the review team assessing each company's progress
toward meeting required milestones. Last year, NASA also issued
contracts to both Space X and Orbital, for cargo delivery to the ISS
under the Commercial Resupply Services (CRS) Program.
NASA is utilizing FY 2009 Recovery Act funds to support activities
to stimulate efforts to develop and demonstrate technologies that
enable commercial human spaceflight capabilities. NASA is also
investing Recovery Act funds to begin development of a more concise set
of NASA human rating technical requirements. These requirements would
be applicable to NASA developed crew transportation systems as well as
commercially-developed crew transportation systems for use by NASA.
This task is being performed by a team comprised of representatives
from NASA's human spaceflight programs, the Astronaut Office, and
Agency technical authorities, including OSMA. We are also consulting
with other Government partners such as the Federal Aviation
Administration and with commercial stakeholders.
Conclusion
In closing, the Office of Safety and Mission Assurance plays a
significant role in ensuring the safety of human spaceflight. By
continually improving its workforce, communications, and processes, the
Office of Safety and Mission Assurance is an organization of technical
excellence that is well-equipped to support the Agency's human
spaceflight safety efforts. By disseminating and incorporating into its
standards and policies the many lessons learned throughout the history
of human spaceflight, NASA is able to improve safety in its own future
designs, and to facilitate safety in those that may be developed
commercially.
Chairwoman Giffords, I would be happy to respond to any questions
you or the other Members of the Subcommittee may have.
Chairwoman Giffords. Thank you, Mr. O'Connor.
Mr. Hanley.
STATEMENT OF JEFF HANLEY, PROGRAM MANAGER, CONSTELLATION
PROGRAM, EXPLORATION SYSTEMS MISSION DIRECTORATE, NATIONAL
AERONAUTICS AND SPACE ADMINISTRATION
Mr. Hanley. Good morning. Chairwoman Giffords and members
of the Subcommittee, thank you for the opportunity to appear
here today to discuss NASA's emphasis on the continuing effort
to improve safety factors for our most valuable commodity,
NASA's astronauts. Simply put, safety is a top priority of
NASA's Constellation program.
My testimony today will outline how the Constellation
program has sought to improve crew safety above that achieved
in previous crewed spacecraft. This has been accomplished by
incorporating safety into the Constellation design process from
the very beginning, and in doing so, we are ensuring that the
Constellation vehicles are being designed to account for future
missions beyond low earth orbit as well as the less challenging
requirements of our current Space Station missions.
However, before we delve too far into the Constellation
program's risk-informed design process, I think it is first
important that we take a look back where we came from. Many of
you have touched on some of that foundation here this morning
already. Following the loss of the Space Shuttle Columbia, NASA
chartered the Columbia Accident Investigation Board to provide
the agency with the guidelines for moving forward with our
return to flight activities. Mr. O'Connor cited the finding in
their report, and I won't repeat it here again, that informed
our design efforts going forward from there. The crew office
also put out a memo then in 2004 weighing in on the discussion
about how the next generation human spaceflight system should
be designed, stating that an order of magnitude reduction ``in
the risk of loss of human life during ascent compared to the
space shuttle is both achievable with current technology and
consistent with NASA's focus on steadily improving rocket
reliability and should therefore represent a minimum safety
benchmark for future systems.'' NASA's Exploration Systems
Architecture Study of 2005 used this guidance in recommending
that NASA select a single, solid first-stage concept that would
later become known as the Ares I Crew Launch Vehicle.
Today, the Constellation program has a design goal of
increasing astronaut safety 10-fold relative to shuttle
missions and we believe that this goal is achievable for four
key reasons. First, Constellation is utilizing a multifaceted
design approach that remains unchanged since Apollo: design the
system to be inherently as safe as we can make it, eliminate
known risks and hazards where we find them and then add backup
such as an abort system to mitigate the residual risk. In
addition to leveraging systems with human-rated heritage such
as the space shuttle solid rocket motor, NASA is utilizing
improved computer modeling to help identify, reduce and
eliminate hazards and risks where we find them.
Second, unlike the space shuttle, the Orion capsule will
have a launch abort system. During Apollo, NASA had
comparatively little experience and computational capability
and the abort effectiveness of such a system was only
estimated. Today we can use advanced simulation tools and
computers to test within the computer so that NASA can conduct
a more thorough analysis in addition to utilizing test flights.
Third, Constellation has chosen to tightly interweave
design and safety team members into the design process. The
team has actively worked with design engineers to provide
expertise and feedback via various assessments and analyses
throughout the design maturation process and that process is
ongoing and continues.
And finally, Constellation has used the agency's active
risk management approach that identifies technical challenges
early in the design process and aggressively works solutions.
Technical risks are identified by likelihood of occurrence and
consequence, allowing designers to modify the emerging design
to reduce or eliminate hazards.
Currently, the Constellation program is progressing through
an active phase of hardware and software tests, and as tests
are completed and data analyzed, our models will be updated,
allowing us to improve safety and improve system performance.
At the same time, we are investing heavily in risk-reduction
hardware and activities that will help better calibrate and
refine our models and simulations data that is essential to
incorporate as early as possible into the Ares I and Orion
designs.
NASA is also developing an integrated test and verification
plan as part of its program preliminary design review in the
next calendar year that includes a series of developmental
tests to further refine and validate our designs. For example,
on October 28, NASA completed the Ares I-X test flight at the
Kennedy Space Center in Florida, and although the data is still
being collected and processed from more than 700 onboard
sensors, the data is already providing tremendous insight into
the aerodynamic, acoustic, structural, vibrational and thermal
forces that Ares I is expected to experience, knowledge that
will contribute substantially to the reliability and safety of
the Ares I design.
In closing, I would like to reiterate that safety is and
always will be our number one priority in everything we do and
that everyone at NASA is dedicated to ensuring that our
astronauts are equipped to safely conduct the missions asked of
them and that they are able to return safely home.
Chairwoman Giffords, I would be pleased to respond to any
questions the member might have.
[The prepared statement of Mr. Hanley follows:]
Prepared Statement of Jeffrey Hanley
Chairwoman Giffords and Members of the Subcommittee, thank you for
the opportunity to appear today to discuss NASA's next-generation human
spaceflight program and the Agency's emphasis on continuing to improve
safety factors for our most valuable assets--the men and women who dare
to explore the mysteries of our universe. Everyone at NASA is dedicated
to ensuring that these brave pioneers are equipped to safely conduct
the missions asked of them, and that they are then able to safely
return home to their loved ones. Simply put, safety is the first of our
core values at NASA, and it is also the top priority of the Agency's
Constellation Program.
As requested in your invitation to me to testify at today's
hearing, my testimony will outline NASA's ongoing focus on safety
matters with regard to human spaceflight, focusing primarily on how the
Agency sought to improve crew safety for the Constellation Program
above that achieved on previous crewed spacecraft. This has been
accomplished by incorporating safety in all aspects of Constellation
from the beginning of the design process. My testimony will also
outline how the Constellation Program has progressed into the early
developmental testing stages, and how data from those tests is being
used to improve our models and to validate the rigorous safety
requirements developed for the Constellation vehicles.
Columbia Accident Investigation Board and the Exploration Systems
Architecture Study
In 2003, the Columbia Accident Investigation Board (CAIB) report
provided NASA with guidelines for moving forward with our return to
flight efforts. In addition to determining the causes of the Columbia
accident, the CAIB also provided the Agency with a set of comprehensive
recommendations to improve the safety of the Space Shuttle Program and
to change the corporate culture of the Agency--changes that have
positively impacted the Constellation Program. NASA has also
established processes that enhance our ability to assess risk and to
improve communication across all levels and organizations within the
Constellation team.
More specifically, with regard to the design of the next-generation
crew launch vehicle, the CAIB recommended that:
``The design of the system [that replaces the Shuttle] should
give overriding priority to crew safety, rather than trade
safety against other performance criteria, such as low cost and
reusability, or against advanced space operation capabilities
other than crew transfer.''
In other words, the CAIB gave NASA clear guidance that the next-
generation crew launch vehicle should be simpler and safer, and that
crew safety should be the driving design principle. Now the question
became, how did we meet this challenge? More specifically, how did we
make a vehicle ``inherently safe'' while also protecting against
residual risk, in a mass-constrained, highly-energetic system such as a
launch vehicle? We started by going back to the basics, first
identifying the known risks and hazards and then working to eliminate,
or at least to minimize, each one of them. From there, the designers
turned their attention to developing acceptable mitigation approaches
for the residual risks. From the beginning, this complicated and
lengthy process, known as risk-informed design, has been at the heart
of NASA's Constellation Program.
However, before there was even a program known as Constellation,
NASA used the CAIB guidance and other policy directives to initiate the
Exploration Systems Architecture Study (ESAS) in 2005 with the purpose
of assessing and defining the top-level requirements and configurations
for crew and cargo launch systems, not only to support future lunar and
Mars exploration programs, but also to support the International Space
Station.
In conducting its review, the ESAS team focused on guidance issued
by the Chief of the Astronaut Office in May 2004--particularly on one
key statement, which states:
The Astronaut Office believes that an order-of-magnitude
reduction in the risk of loss of human life during ascent,
compared to the Space Shuttle, is both achievable with current
technology and consistent with NASA 's focus on steadily
improving rocket reliability, and should therefore represent a
minimum safety benchmark for future systems. This corresponds
to a predicted ascent reliability of at least 0.999.
Keeping in mind the CAIB recommendation of focusing on crew safety
first, ESAS placed a premium on crew safety. All candidate crew launch
vehicle concepts considered during ESAS included an escape capability
referenced as a launch abort system or LAS. During the study, NASA
eliminated any launch vehicle concept that did not approach at least a
predicted probability for loss of crew (LOC) of 1 in 1,000 missions. In
addition, concepts that would place the crew module in close proximity
to the boosters and/or other potential sources of accident initiation
were eliminated to improve the reliability of a LAS and to improve the
likelihood of crew survival in the event of an accident during ascent.
This process resulted in the selection of the single solid First Stage
concept, which would later become known as the Ares I Crew Launch
Vehicle. In the end, the potential for increased safety provided by
Ares I (compared to other alternatives considered during ESAS) was
based primarily on the simplicity of the First Stage.
As compared to the Space Shuttle, the Ares I will be a simpler
vehicle to process prior to launch because NASA has designed the Ares
Ito have fewer moving parts, thus requiring less hands-on labor prior
to launch, and also reducing the potential for human error. In addition
to the inherent safety associated with the rocket's simplified design,
the Ares I integrated rocket will have a LAS for crew, as will be
outlined in greater detail during the next section of this testimony.
The Constellation Program and Risk-Informed Design
In the Apollo era, crewed launchers were designed with the best
level of expertise available, tested to exhaustion, and then robustness
or redundancy was added to mitigate the residual risk. The goal was to
make the design as reliable as possible, so that backup systems would
never have to be used, and to make the backup systems as robust as
possible to maximize the likelihood of crew survival and return, should
a failure (anticipated or not) of the primary system or element take
place. This approach worked, producing dramatic advances in reliability
and crew safety, as proven, for example, when the Lunar Module did not
experience a single anomaly on the final lunar mission, and the crew
survived despite the explosion aboard the Command/Service Module during
the Apollo 13 mission. However, as my colleague, Bryan O'Connor, will
outline in his testimony, safety at NASA is also about more than
design. NASA's focus on safety also includes ensuring that our crews
and operators know how to deal with contingencies, and that, when
someone has a concern about a safety issue, whether it be a crew
member, a design team member etc. that there are clear paths for those
who have dissenting opinions to raise their concerns to senior
management.
Today, NASA's Constellation Program has a goal of increasing
astronaut safety tenfold relative to Shuttle missions. While a
seemingly daunting challenge, NASA believes that this goal is
achievable for many reasons.
First, NASA is utilizing a multi-faceted design objective for
safety that remains the same as during the Apollo era--design the
system to be as inherently safe as we can make it, and then add backup
to mitigate the predicted as well as unknown residual risk. This, along
with aforementioned guidance issued by the Chief of the Astronaut
Office in May 2004, was the starting point of the Constellation design
team. As has been stated, inherent safety implies the elimination of
hazards that have historically been associated with the operation of
the type of system being designed. This, in turn, implies the
systematic identification of the hazards associated with operation of
the system alternatives being considered.
The key to a risk-informed design is integrating risk analysis into
the design alternative evaluation and selection process in a
fundamental way by using newly capable, logical, and phenomenological
(or physics-based) computer models. These models help focus the design
effort toward identifying and reducing or eliminating design hazards,
which, in turn, helps NASA identify and develop mitigation approaches
to address the residual risks. In addition, NASA recognizes that safety
of an overall system can be improved by addressing human factors
issues, which is why the Ares I Upper Stage and Orion designs have been
developed to simplify and automate processing and operations as much as
possible, thus reducing the potential for human error.
Second, unlike the Space Shuttle, the Orion crew capsule will have
a LAS that will offer a safer and more reliable method of moving the
entire crew out of danger in the event of an emergency on the launch
pad or during the climb to Earth orbit. Mounted at the top of the Orion
and Ares I launch vehicle stack, LAS will be capable of automatically
separating the Orion from the launch vehicles and positioning the Orion
and its crew for landing. In comparison, during Apollo, NASA had
comparatively little experience and computational capability, and the
abort effectiveness was estimated by comparison to escapes from high-
performance military aircraft combined with the results of a few escape
system tests. Today, with the flight tests combined with advanced
simulation tools and advanced computers available, NASA can conduct a
more thorough analysis. Specifically, the integrated abort system's
effectiveness can now be calculated using computer models of the blast
environment by employing more realistic, physics-based, simulations of
abort conditions. While computer models and computational capability
were much less capable during the Apollo era, today this calculation
can be carried out with remarkable speed and accuracy given NASA's
evolved engineering expertise and the computational power of our
computers.
Third, Constellation has chosen to tightly interweave the design
and safety team members into the decision making process. As a result,
the Constellation team represents skills from safety and reliability
engineering disciplines traditionally found under the Safety and
Mission Assurance organizations, as well as engineers with backgrounds
such as computational fluid dynamics, aerospace, and physics
disciplines. The team has been given the clear direction to work daily
with the design engineers to provide expertise and feedback via various
assessments and analysis techniques throughout the design maturation
process. This investment demonstrates a sincere commitment to the CAIB
findings.
Finally, as a key element of our risk-informed design process, the
Agency has an active risk-management process that identifies technical
challenges early in the process and aggressively works solutions. The
Program identified key risks during the risk management process and
associated mitigation steps to inform the designs. Technical risks are
identified by likelihood of occurrence and consequence. For example,
NASA is currently working a thrust oscillation risk for the Ares I
First Stage. This phenomenon is a characteristic of all solid rocket
motors. NASA has made significant progress in identifying both primary
and backup approaches to mitigate the oscillation effect, and we now
believe that we have now baselined a passive mitigation technique.
However, additional testing will continue to ensure we have the best
mitigation prior to making the final decision at the Constellation
Program's Preliminary Design Review (PDR) early next year. With regard
to the Upper Stage, the J-2X engine remains a priority, with the focus
being on achieving needed performance requirements while also
incorporating modem approaches (e.g., materials, manufacturing,
electronics, etc) into this Apollo-era heritage hardware.
In choosing a Shuttle-derived architecture, NASA recognized from
the outset that some of the heritage hardware would need to be modified
or replaced so as to achieve improved safety, reliability, as well as
to meet needed performance and lower lifecycle costs. At the same time,
the Agency recognized that leveraging systems with human-rated heritage
would reduce the uncertainties and risks associated with developing a
new human-rated crew launch vehicle. For example, the Ares I First
Stage consists of a five-segment reusable solid rocket motor (RSRM), an
aft skirt, a forward skirt, and a frustum. The five-segment RSRM is an
evolutionary development from the four-segment solid RSRM strap-ons
currently utilized to power the Space Shuttle. As a result, the
Constellation Program is building on the proven track record of this
heritage hardware. There have been 252 solids flown in the Shuttle
Program with one failure (Challenger STS-51L). The Ares I also benefits
from the improvements in the RSRMs that have resulted from recovery and
post-flight inspections along with modifications that have been made to
the Shuttle boosters. The Ares I booster also will continue the
protocol of recovery and post-flight inspection that began in the
Shuttle Program.
The J-2X engine would be used for both the Ares I and Ares V
vehicles, thus creating a common link between the two vehicles that is
based on evolved heritage hardware, specifically the powerful J-2
engine that propelled the Apollo-era Upper Stage on the Saturn I-B and
Saturn V rockets, and the J-2S that was developed and tested in the
early 1970s. In addition, the J-2X will leverage knowledge from the
Delta IV's RS-68 by incorporating manufacturing techniques from the RS-
68 into the J-2X engine. However, NASA recognizes that there are also
challenges involved with utilizing and integrating heritage systems
into new vehicles, so for the J-2X, NASA has taken steps to increase
the amount of component-level testing, to procure additional
development hardware, and to work to make a third test stand available
to the contractor earlier than originally planned.
Already, the Ares I risk assessment and failure analysis teams have
provided input and/or impacted the outcome of Ares I design issues,
trades, or risks on numerous challenges, including:
Abort triggers study: Provided LOC and Abort
Effectiveness assessments, including engineering models and
timing, to determine what potentially catastrophic scenarios
warrant abort sensors and software algorithms;
Separation study (booster deceleration motors ):
Hazard analysis combined with probabilistic design analysis led
to the design decision to increase the number of booster
deceleration motors from eight to 10; and,
The Hazards Team identified that the First Stage and
Upper Stage designs failed to meet properly at the interface
flange (due to differing number of bolts) and a re-design was
instituted. The team provided an assessment to Upper Stage that
resulted in clocking of the hydrogen and oxygen vents to
improve separation distance.
While NASA awaits further direction from the President and Congress
with regard to the future of human spaceflight, the Agency is
continuing to pursue our current programs, per direction from the
Office of Science and Technology Policy. Currently, the Constellation
Program is progressing through an active phase of hardware and software
tests and, as tests are completed and data analyzed, our models will be
updated, allowing us to improve safety and improve systems performance.
At the same time, we are investing heavily in risk-reduction hardware
and activities that will help calibrate and refine our models and
simulations related to the Ares I and Orion--data that is essential to
incorporate as early as possible into vehicle designs, based on the
Program's risk-based design approach. NASA is developing an Integrated
Test and Verification plan that includes a series of developmental
tests to further refine and validate our designs. Test flights, for
example, are being designed to include several hundred measurement
points that will characterize the actual operating environment and
system performance in the most stressing of cases. NASA is in the
process of continuing to refine this test and verification strategy
prior to the Program's PDR early next year, when the Integrated Test
and Verification plan will be baselined.
Following are just a few examples of recent and upcoming
developmental tests which have yielded, or are expected to yield,
significant amounts of data that will be incorporated into our risk-
based design effort:
In September 2009, NASA and ATK conducted the first
test of the Ares I's five-segment development motor in
Promontory, Utah. This test provided NASA with valuable thrust,
roll-control, acoustics and vibration data as engineers
continue to design the Ares I. In all, seven ground tests are
scheduled for the five-segment booster.
In October 2009, the Ares I-X test flight took place
at Kennedy Space Center in Florida. Although data is still
being collected and processed from more than 700 on-board
sensors, preliminary results show that the vehicle performed
precisely as it was meant to perform. Early data shows that the
vehicle was effectively controlled and stable in flight. Thrust
oscillation frequencies and magnitude data from the Ares I-X
flight are consistent with measurements from recent Shuttle
flights that were instrumented, leading us to conclude that the
oscillation vibration on the Ares I would be within the bounds
that the Ares I is currently being designed to. When assessment
of this data is finalized, we believe it will provide
tremendous insight into the aerodynamic, acoustic, structural,
vibration, and thermal forces that Ares I is expected to
experience--knowledge that will contribute substantially to the
reliability and safety of the Ares I design, as well as to
enhancing NASA's modeling capabilities for future vehicles.
In March 2010, NASA plans to perform its first
developmental test of the Orion LAS at the White Sands Missile
Range, New Mexico. This test will validate the LAS design
approach and will contribute substantially to the Orion's final
designs for reliability and safety. NASA plans a series of
tests to characterize the LAS. The Pad Abort I test is the
first of these tests, and it will address what happens if an
emergency occurs while the Orion and the launch vehicle are
still on the launch pad. Other tests will determine how the LAS
performs in critical parts of the flight regime.
Human Rating and the Constellation Vehicles
The launch of any spacecraft is a very dynamic event that requires
a tremendous amount of energy to accelerate to orbital velocities in a
matter of minutes. There also is significant inherent risk that exposes
a flight crew to potential hazards that could be catastrophic, if not
controlled. Therefore, through a very stringent process of human
rating, NASA attempts to eliminate hazards that could harm the crew,
control the hazards that do remain, train the crews and operators to
react appropriately, control the manufacturing and test of all
components to minimize errors, and provide for crew survival even in
the presence of system failures. Spaceflight vehicles are cleared by
NASA to carry crew for missions that are associated with specific
mission and performance requirements in an engineering flight test
environment. It is also important to note that certification is made
for an entire spaceflight system (i.e. Ares I, Orion, and associated
ground support infrastructure count as one entire system), and not for
specific elements of a system. NASA is currently in the process of
developing those specific mission requirements for Ares I and Orion.
To guide the evolution of human rating requirements for any
mission, NASA is developing Agency-level requirements documents.
However, human rating a spaceflight system is not as easy as following
one document. Instead, it is an intricate, continuing process,
involving the translation of requirements into designs that can be
built, tested, and certified for flight, and an understanding of risks
with mitigation approaches in place. However, the challenge to projects
such as Ares I and Orion is that there is no single document that
spells out what they should do to receive a human rating certification
from the Agency.
NASA is investing FY 2009 Recovery Act funds to begin development
of a more concise set of NASA human rating technical requirements.
These requirements would be applicable to NASA developed crew
transportation systems as well as commercially-developed crew
transportation systems for use by NASA. This task is being performed by
a team comprised of representatives from NASA's human spaceflight
programs, the Astronaut Office, Agency technical authorities, including
the Office of Safety and Mission Assurance. We are also consulting with
other Government partners such as the Federal Aviation Administration
and with commercial stakeholders.
Conclusion
In closing, I would like to quote from the October 2009 Review of
U.S. Human Spaceflight Plans report: ``Human space travel has many
benefits, but it is an inherently dangerous behavior.'' NASA
wholeheartedly endorses this statement because it is a challenge we
live with day in and day out. Safety is and will always be our number
one priority in everything we do. That is why the Constellation Program
has employed a continuous risk-informed design process, and that is why
our designs are being developed with an overriding priority given to
crew safety at every stage of the design and operational process.
Chairwoman Giffords, I would be pleased to respond to any questions
that you or the other Members of the Subcommittee may have.
Chairwoman Giffords. Thank you, Mr. Hanley, for your
testimony.
Next we will hear from Mr. Marshall.
STATEMENT OF JOHN C. MARSHALL, COUNCIL MEMBER, AEROSPACE SAFETY
ADVISORY PANEL, NATIONAL AERONAUTICS AND SPACE ADMINISTRATION
Mr. Marshall. Chairwoman Giffords and other distinguished
members of the committee, good morning. Thank you again for
inviting the ASAP to testify before your Subcommittee today.
As you may know, today's topic has been area of interest
that the ASAP has focused on for a sustained period. Most
recently we visited SpaceX and Orbital Sciences, both currently
commercial providers to NASA for logistics re-supply to the
Space Station, to discuss firsthand their approach to
integrating safety into their vehicles.
Of course, interest in using the commercial space industry
to fulfill NASA's crew delivery services to low earth orbit,
LEO, has spiked because of the recent Augustine report
recommendations that appropriate consideration be given to
turning the service over to the commercial sector. In making
this recommendation, they also noted that while safety never
can be absolutely assured, safety was assumed to be a given.
The ASAP believes this assumption was premature and an
oversimplification of a complex and challenging problem in that
there is no cookie cutter approach to safety in space nor is it
a ``given.''
NASA's Procedural Requirements, NPR 8705.2b, identifies the
human rating process for NASA space systems. It specifies a
risk-based approach to evaluate a system against pre-
established requirements. It does not, however, establish what
those requirements are. NASA emphatically intends this document
to be a starting point with detailed requirements to be
tailored specifically for each NASA human spaceflight program
including a possible NASA-crewed COTS mission.
Because it is illogical to rely on commercial providers to
develop their own requirements for contractual services on
human spaceflight to NASA, the ASAP strongly believes that
specific criteria should be developed to establish how safe is
safe enough for these services. In addition, it is imperative
that the COTS enterprises understand in detail how verification
of compliance shall be demonstrated. This just now is being
developed by NASA.
With the above background, I will now briefly address the
four questions that you asked us to talk to. First was, what do
you consider to be the most safety-related issues that will
have to be addressed if NASA were to consider using commercial
providers for crew transportation and station crew rescue
services. The ASAP believes that ensuring the safety of NASA's
astronauts that we send into space may be the hardest part of
commercialization of the LEO crew transportation mission.
Significant challenges to be solved include first establishing
detailed safety requirements that NASA deems essential to safe
flight. There must be clear and enforceable form that can be
placed into a contract and tested for compliance. Second,
because no launch vehicle can be considered truly safe in the
conventional sense of the word, establishing minimum acceptable
safety levels to guide systems safety design and a baseline for
both NASA and their contractors as to what is safe enough is
critical. Third, much of the inherent safety of spacecraft
design depends upon choices and decisions where risks are
weighed against performance costs and schedule. A process to
ensure that all the potential hazards are properly vetted by
both the government and contractors is important. This will
require more than the hands-off approach that some envision.
And finally, establishing a disciplined process-related checks
and balances so that NASA can verify that the contractor has
demonstrated compliance with the launch vehicle designs
requirements is necessary.
The next question was, what safety standards should
commercial entities have to meet if they are chosen by NASA to
carry U.S. government astronauts to low earth orbit and what
will be required for verification? As noted previously, NASA's
NPR procedures prescribe a human rating process for NASA's
space system. This document, changed in 2008, represents a
significant and substantive shift from the prescriptive
approach to one that applies good engineering standards and
judgments. Prescriptive standards describe how things get done
and are applied rigidly. A good-judgment approach offers less
specific direction and guidance. The ASAP sees advantages in
both but with a clear need for written guidance of record of
change and direct connectivity to establish time-tested
engineering standards.
In this regard, it is the ASAP position that any new
standards for commercial entities should begin with NASA's NPR
and that the human rating for each system must appropriately be
tailored to combine robust design, solid engineering, and
testing along with a system safety approach for examining
options to minimize the probability and impact of failure.
Doing so will in the end provide both higher reliability and
safety for human life. With respect to demonstration,
verification and certification, the ASAP agrees that each of
these actions must be performed for both government and
commercial programs prior to NASA's use. It also is the ASAP's
position that NASA is the best qualified to be the oversight
body for each of these actions.
Three: What would be required to certify the airworthiness
of any commercially provided crew transportation system or
station rescue service prior to its use by U.S. government
astronauts? How long do you anticipate such certification would
take? As you know, airworthiness certification is a process
that is carried out by a regulatory body. Typically, it is an
agency such as the FAA or government organization.
Certification gives assurance that necessary practices,
policies and criteria have been satisfied to protect the safety
of the crew, passengers and the public from harm due to a
design or operational flaw in the functioning of the vehicle.
For certification of any commercial or government space
transportation system, it is clear that the human rating
standard would have to be understood by all of the
participating parties once those standards are known and it is
incumbent upon any party presenting a vehicle for use to
present compelling evidence that the standards have been met.
That evidence can take several forms, most of which are covered
by standard industry practices. In the case of crew delivery,
cargo delivery, rescue from the station, it is well to remember
that it must not only be certified for its own safe operations
in itself but must also be able to approach, dock and interface
with the station without presenting a hazard to that vehicle as
well.
In response to the question of how long such a process
would take, our experience indicates that this is a function of
two things. First, there must be clarity and mutual
understanding the requirements and a process for verifying the
requirements have been met. Second, there must be an openness
and degree of sharing of cooperation of the design process to
the reviewing authority. Of course, the completion of the
review remains directly proportional to the complexity and
uniqueness of the proposed system.
Finally, in the annual report that ASAP published for 2008,
the ASAP is concerned about human rating requirements
substance, applications and standards NASA-wide. What is the
basis for this concern? The basis for our concern is that in
more than two years into the COTS program, efforts to develop
human rating standards for a COTS-D-like program have only just
begun and no guidance thus far has been promulgated. Therefore,
it is premature to consider any potential COTS-D vehicle as
being human rated. If COTS entities are to ever provide the
level of safety expected for NASA crews, it is imperative that
NASA's criteria for safety design of such systems quickly be
agreed upon and provided to current or future providers.
I would be happy to respond to any other questions you or
any other members may have.
[The prepared statement of Mr. Marshall follows:]
Prepared Statement of John Marshall
Chairwoman Giffords and other distinguished members of the
Subcommittee, good morning. Thank you for inviting the Aerospace Safety
Advisory Panel (ASAP) to testify again before your Subcommittee on the
topic of ensuring human space flight safety in future government and
potential future non-government space transportation systems.
As you may know, this topic has been an area of interest that the
ASAP has focused on over a sustained period. Most recently we have
visited the Space Exploration Technologies Corporation (Space X) and
Orbital Sciences Corporation, both currently commercial providers to
NASA for logistical re-supply to the International Space Station
(ISS)--and possible Commercial Orbital Transportation Services (COTS-D)
providers in the future, to discuss firsthand their approach towards
integrating safety into their vehicles.
Of course interest in using the commercial space industry to
fulfill NASA crew-delivery services to Low Earth Orbit (LOE) has spiked
because of the recent Augustine report recommendation that appropriate
consideration be given to turning this service over to the commercial
sector.
Unfortunately, in making this recommendation they also note that
while human safety never can be absolutely assured, safety was assumed
to be ``sine qua non,'' or ``a given'' in their recommendation. The
ASAP believes this assumption is premature and over simplifies a
complex and challenging problem, in that there is no ``cookie-cutter
approach'' to safety in space. Nor is it ``a given.''
We further believe that since NASA has given serious consideration
only recently to what their approach will be in establishing human
rating requirements for a vehicle that is occupied by NASA personnel,
the commercial sector may be substantially behind in addressing human
rating requirements for the future.
NASA's Procedural Requirements (NPR) 8705.2b identifies the human
rating requirements for NASA's space systems. It contains recently
updated requirements and captured lessons learned that are applicable
to the development and operation of crewed space systems. NASA
emphatically intends this document to be a starting point with detailed
requirements to be tailored specifically for each NASA human
spaceflight program, including a possible NASAcrewed COTS mission.
Additionally, NASA specifically caveats that the results of any
tailored effort for a NASA-crewed COTS mission could be different from
that developed for a NASA program.
Because it is illogical to rely on commercial providers to develop
their own requirements for contractual services on human spaceflight to
NASA, the ASAP strongly believes that specific criteria should be
developed to establish how safe is ``safe enough'' for these services,
including the need to stipulate directly the acceptable risk levels for
various categories of activity. In addition, it is imperative that the
COTS enterprises understand in detail how verification of compliance
shall be demonstrated. This too is just now beginning development by
NASA.
With the above background, I will now briefly address the four
specific questions that you posed to the panel:
1. What do you consider to be the most significant safety-
related issues that will have to be addressed if NASA were to
consider using commercially provided crew transportation and
International Space Station (ISS) crew rescue services?
Response: Ensuring the safety of the NASA astronauts that we send
into space may be the hardest part of commercializing LEO crew
transportation. The significant challenges to be solved include:
Establishing detailed safety requirements that NASA
deems essential to safe flight. These must be in a clear and
enforceable form that can be placed on contract(s) and tested
for compliance.
Because of their energy, speed, and complexity, no
launch vehicle can be considered truly ``safe'' in the
conventional sense of the word. Therefore, establishing minimum
acceptable safety levels to guide system designs and set the
baseline for both NASA and their contractors as to what is
``safe enough'' is critical.
Even with clear safety requirements and levels, much
of the inherent safety of complex systems like spacecraft
depends upon the design choices and decisions where risks are
weighed against performance, costs, and of course, schedules.
An open and effective system has been developed within NASA to
accomplish this. A similar process needs to be
institutionalized by any commercial provider as well, whereby
all potential hazards are properly vetted by both government
and contractors. This will not be easy and may require more
than the ``hands off' approach envisioned by some.
Establishing disciplined program and process-related
checks and balances so that NASA can verify that the contractor
has evidence of compliance with the launch vehicle design
requirements in the as-built vehicle and successful completion
of the activities necessary to demonstrate mission readiness.
2. What safety standard should commercial entities have to
meet if they are chosen by NASA to carry U.S. government
astronauts to LEO, and what will be required to verify
compliance?
Response: As noted previously, NASA's NPR 8705.2b prescribes human
rating requirements for NASA's space systems. This document, changed in
2008, represents a significant and substantive shift from a
prescriptive approach to one that applies good engineering judgment.
Prescriptive standards describe how to do things and are applied
rigidly. Good judgment offers less specific direction and guidance. The
ASAP sees advantages in both, but with a need for clear written record-
of-change and direct connectivity to establish and time-tested
engineering standards.
In this regard, it is the ASAP's position that any new standards
for commercial entities should begin with NASA's NPR--the ``gold
standard'' if you will--and that the human rating for each system must
appropriately be tailored to combine testing, solid engineering, and
robust design along with a system safety approach for examining options
to prevent and minimize the impact of failures. Doing so will, in the
end, provide both high reliability and safety of human life.
With respect to demonstration, verification, and certification, the
ASAP agrees that each of these actions must be performed for both
government and commercial programs prior to NASA's use. Further, it
also is the ASAP position that NASA is best qualified to be the
oversight body for each of these actions as today only NASA has the
competence in hand to effectively audit the complex technical work
required.
3. What would be required to certify the ``airworthiness'' of
any commercially provided crew transportation and ISS rescue
service prior to its use by U.S. government astronauts? How
long do you anticipate such certification would take?
Response: Similar to other certifications, ``airworthiness
certification'' is a process that is carried out by a regulatory body.
Typically that is an agency such as the Federal Aviation Administration
or other governmental body that acts in the interest of the party
having the most critical concern in the outcome. Certification is an
oversight process, which serves to give assurance that necessary
practices, policies, and criteria have been satisfied to protect the
safety of the crew, passengers, and the public from harm due to a
design or operational flaw in the functioning of the vehicle.
Building on this basic principal, for certification of any
commercial or government space transportation system, it is clear that
human rating standards that have been discussed in prior answers would
have to be developed, published, and understood by all participating
parties.
Once those standards are known, it then is incumbent on any party
presenting a vehicle for utilization covered under the certification
process to present compelling evidence that the standards have been
met. That evidence can take several forms, most of which are covered by
standard industry practice.
Testing typically is used to verify that the design meets the
standard. The simplest of these would be the proof testing of pressure
vessels that has been common for most of the last century. When testing
is not possible because it is either too dangerous or involves
conditions that cannot be set up in the laboratory, then analysis or
sub-scale experiment is accomplished. Finally, well-validated analysis
(finite element structural analysis, computational fluid dynamics,
physics based simulations) can form an acceptable mechanism to show
compliance.
In the case of crew delivery, cargo delivery, and rescue from the
ISS it is well to remember that not only must the certified vehicle be
safe in and of itself, but it must be able to approach, dock, and
interface with the ISS without presenting a hazard to that vehicle as
well. This means that besides the certification standards for the
vehicle in question it will also have to meet additional requirements
for operation in the vicinity of and docking to/departing from the ISS.
These standards have already been developed and thus any new vehicle
certification would also have to meet these requirements.
In response to the question of how long such a process would take,
our experience indicates that this is most certainly a function of two
things. First, there must be clarity and mutual understanding of the
requirements and a process for verifying that the requirements have
been met. Second, there must be openness and a degree of sharing/
cooperation/transparency of the design process to the reviewing
authority. Waiting until the design is complete and all parts and
pieces are in place, sealed, and potentially inaccessible before
inviting review of the design would be a recipe for failure.
Conversely, providing periodic design reviews, openness for witnessing
testing, clarity of analytical methods as the work progresses can
assure a process with minimum to no delay. If the data is delivered as
requested, testing is witnessed as it takes place, and the analysis
uses known and validated methods, the finalization of the review
remains directly proportional to the complexity and uniqueness of the
proposed system. Missing or absent data, analysis that is incorrect or
faulty, and tests that have been done but not confirmed can extend the
process indefinitely.
4. In its annual report for 2008, the ASAP stated ``the ASAP
is concerned about human rating requirements substance,
application, and standardization NASA-wide.'' What is the basis
of ASAP's concern?
Response: The basis for our concern is that more than two years
into the COTS program, efforts to develop human rating standards for a
COTS-D like program have only just begun and no guidance thus far has
been promulgated. If COTS entities are ever to provide the level of
safety expected for NASA crews, it is imperative that NASA's criteria
for safety design of such systems immediately be agreed upon and
provided to current or future COTS providers.
As a minimum, the ASAP believes that NASA should begin a dialogue
with the funded COTS partners to address requirements for human rating.
Additionally, NASA needs to clarify how much or how little they will be
involved in the design, approval and operation of the NASA-crewed
vehicles in order to verify that the funded COTS partners are compliant
with the human rating requirements. The ASAP recommends the agency be
``hands-on.''
NASA has indicated that they are considering a tiered or stair-step
approach in addressing the technical review and approval processes to
confirm safe flight and operational readiness, starting first with some
level of technical insight for the unmanned services for routine
supplies, then with greater insight for unmanned services involving
high-valued cargo, and finally building up to the technical insight and
process to be used for a NASA-crewed COTS mission. In modeling the COTS
tiered technical insight processes, NASA will use its experience gained
in the ISS program for transfer of routine supplies, and in the launch
services program for commercial Expendable Launch Vehicle launches of
high valued payloads. The ASAP concurs with this methodology.
Finally, as part of the launch certification requirements, NASA
should immediately identify the number of launch successes that COTS
partners will need to achieve with the unmanned vehicle in order to
demonstrate the required vehicle reliability for a NASA-crewed launch.
In developing the criteria for manned launch vehicle certification,
NASA may also need to address whether and how the successful flights
and results from the COTS ISS cargo reservicing and NASA launch
services programs, can provide evidence for consideration in assessing
launch reliability for NASA-crewed vehicle.
Chairwoman Giffords, I would be happy to respond to any questions
you or the other members of the Subcommittee may have.
Chairwoman Giffords. Thank you, Mr. Marshall. It is good to
have you back.
Mr. Alexander.
STATEMENT OF BRETTON ALEXANDER, PRESIDENT, COMMERCIAL
SPACEFLIGHT FEDERATION
Mr. Alexander. Chairwoman Giffords, Ranking Member Olson,
distinguished members of the Subcommittee, thank you for the
opportunity to testify this morning on behalf of the 20 member
organizations of the Commercial Spaceflight Federation. We
appreciate the Committee's longstanding support of commercial
space.
Commercial crew transportation is complementary, not
competitive, with NASA's mission and it is crucial to the
future of our Nation's human spaceflight program for several
reasons. First, after shuttle retirement, the United States
will not have the capability to launch humans into space for
likely six to seven years. Entering this gap, we will send
billions of dollars overseas as we purchase seats on Russian
vehicles at $51 million a seat and rising. A commercial crew
can help prevent future Russian price increases, preserve
redundant access to the space station and potentially shorten
the gap. Second, enhanced commercial spaceflight will allow us
to more fully utilize the space station, which is just now
being completed. Third, commercial missions to low earth orbit
will allow NASA to focus its resources and expertise on
exploration beyond low earth orbit.
Commercial crew has been endorsed by a long line of
Presidents and Congresses from the 2004 Vision for Space
Exploration to the 2005 and 2008 NASA Authorization Acts. As
such, it should come as no surprise that the Augustine
committee stated, ``There is little doubt that the U.S.
aerospace industry has the technical capability to build and
operate a crew taxi to low earth orbit.''
Just as important, the committee stated their unequivocal
belief that commercial spaceflight could be done safely.
Indeed, safety is paramount to everyone in this industry. A
group of 13 former NASA astronauts recently wrote in the Wall
Street Journal that ``We believe that the commercial sector is
fully capable of safely handling the critical task of low earth
orbit human transportation.''
A taxi service to low earth orbit is a less difficult, more
narrowly focused mission than the Orion Crew Exploration
Vehicle and can therefore have more robust margins. For these
reasons, commercial vehicles can be more cost-effective for
Space Station operations without sacrificing safety.
In order to meet stringent safety goals, NASA and industry
must agree upon a detailed, thoughtful plan. The commercial
spaceflight industry believes the following four principles are
key. First, demonstrated reliability through a robust test
program is crucial. Robust testing throughout development and
production is necessary to demonstrate confidence in the
overall system. Commercial crew systems will only begin crewed
flights once reliability has been demonstrated through multiple
successful test flights without crew. Demonstrated launch
reliability is essential for overall safety. The Atlas family,
for example, has had over 90 consecutive successes. The Atlas V
has a perfect record of 19 successful launches. And the Falcon
9 will have launched more than a dozen times for cargo and
satellite missions before crew missions begin.
Second, robust safety will require additional human rating
of the launch vehicle and a reliable crew escape system to
protect the crew in the event of a launch vehicle anomaly.
Third, clear safety standards and requirements are crucial.
It is vitally important that NASA and industry agree on the
safety requirements up front and this dialog must begin in
earnest now. NASA's human rating requirements document will
serve as a starting point for this dialog but must be tailored
for commercial systems just as it is for NASA-developed
vehicles. NASA is currently reviewing their applicability to
commercial systems and the commercial spaceflight industry is
also conducting a similar review.
Finally, let me address government oversight. Any
commercial crew program must be conducted under the current
regulatory regime established by law, namely FAA licensing. FAA
licensing is important to ensuring a consistent regulatory
regime for both government and commercial missions, which is
key to attracting private investment and non-NASA customers.
While the FAA would retain the overall licensing authority,
NASA would maintain oversight as the customer. In particular,
NASA would establish astronaut safety requirements in
consultation with industry, establish mission-unique
requirements such as crew capacity and requirements for space
station docking, and most importantly, have final approval
authority over the launch of NASA astronauts, which would be
granted only after NASA is satisfied that the vehicle is safe,
just as NASA does for today's shuttle missions.
In conclusion, we firmly believe that NASA and commercial
industry can and must work together to develop safer human
spaceflight capabilities. We must begin that dialog now.
Thank you for the opportunity to be here today and I look
forward to your questions.
[The prepared statement of Mr. Alexander follows:]
Prepared Statement of Bretton Alexander
Introduction
Chairwoman Giffords and distinguished members of the Space and
Aeronautics Subcommittee, thank you for the opportunity to testify. I
am pleased to be here.
The Commercial Spaceflight Federation is an association of 20
leading businesses and organizations working to make commercial human
spaceflight a reality. Our members include developers and operators of
orbital spacecraft, suborbital spacecraft, and the spaceports from
which they fly. Our membership also includes product and service
providers for human spaceflight training, medical, and life support
needs. Our mission is to promote the development of commercial human
spaceflight, pursue ever higher levels of safety, and share best
practices and expertise throughout the industry. One goal of all of our
member organizations is to greatly increase the number of people that
fly into space, generating new economic activity here on Earth.
Significant investment has already been committed to the
development of commercial human spaceflight. According to a recent
survey done by The Tauri Group, $1.46 billion in investment has been
committed to commercial human spaceflight activities to date. Coupled
with the more than $500 million in development funding provided by NASA
under the Commercial Orbital Transportation Services, or COTS, program,
more than $2 billion has been pledged for the development of commercial
spaceflight capabilities. I want to take this opportunity to thank the
Congress and NASA for your support of the COTS program.
In my testimony today, I will address the safety and oversight
questions relating to commercially procured crew services. In order to
understand these issues, it is important to first discuss the context
of commercial spaceflight. My testimony covers the following key
topics:
Summary of Key Points
1. Commercial crew transportation to Low Earth Orbit (LEO) is
a goal endorsed by the Vision for Space Exploration (2004), the
Aldridge Commission (2004), the 2005 NASA Authorization Act,
the 2008 NASA Authorization Act, and the Augustine Committee.
Commercial crew is complementary, not competitive,
with NASA activities, as commercial crew transportation
to LEO will allow NASA to focus its unique resources on
the more difficult task of beyond LEO exploration.
After shuttle retirement, the United States will
send billions of dollars overseas to purchase seats on
Russian vehicles during the gap in U.S. government
launch capability. Only commercial crew allows us to
reduce the gap, prevent future Russian price increases,
and preserve redundant access to the Space Station.
2. Safety is paramount for the commercial spaceflight
providers. Indeed, commercial vehicles such as Atlas V and
Delta IV, developed with substantial private funding and
engineering expertise, are already trusted to launch key
government national security assets upon which the lives of our
troops overseas depend.
3. Since computer calculations of vehicle safety cannot
account for most of the root causes of accidents historically,
such as human error or design flaws, and since even reliable
vehicles have historically suffered a period of ``infant
mortality,'' the commercial spaceflight industry believes that
safety must include the following:
Demonstrated reliability from orbital flight tests
of the full system
Not placing crews on initial flights, since early
flights are historically most risky
A highly reliable crew escape system
Standards-driven design and operations
4. Industry believes that the safety of commercial spaceflight
must be greater than that of any vehicle currently in operation
today. In addition to the FAA's existing regulatory authority,
as codified in U.S. law, industry will satisfy customer-
specific requirements levied by NASA in partnership with
industry. This process has already begun with the cooperation
of the stakeholders involved.
5. NASA and FAA will be there every step of the way, and will
have oversight during design, testing, manufacturing, and
operations. As codified in existing U.S. law, a licensing,
rather than certification, regime is appropriate for these
vehicles.
Government Beyond LEO, Commercial to LEO
Support and encouragement for the commercial development of space,
including commercial space transportation services, has been a
cornerstone of civil space policy for decades. It has been endorsed by
numerous Presidential Administrations and Congresses, and by both
parties. A quarter-century ago, the law that created NASA, known as the
Space Act, was amended to specify that NASA is to ``seek and encourage,
to the maximum extent possible, the fullest commercial use of space''
and ``to encourage and provide for Federal Government use of
commercially provided space services and hardware.'' Additionally, the
Commercial Space Act of 1998 directed all agencies including NASA to
``acquire space transportation services from United States commercial
providers whenever such services are required in the course of its
activities.''
In 2004, following the Space Shuttle Columbia accident, the Vision
for Space Exploration (U.S. Space Exploration Policy, National Security
Policy Directive-31), announced by President George W. Bush on January
14, 2004, directed NASA to:
``Develop a new crew exploration vehicle [now called
Orion] to provide crew transportation for missions
beyond low Earth orbit.''
``Acquire''--and it's important to note here the
intentional use of the word ``acquire,'' not
``develop''--``cargo transportation as soon as
practical and affordable to support missions to and
from the International Space Station.''
And again ``Acquire crew transportation to and from
the International Space Station, as required, after the
Space Shuttle is retired from service.''
To put further emphasis on this point, the policy
directed NASA to ``Pursue commercial opportunities for
providing transportation and other services supporting
the International Space Station . . . .''
This was reinforced by the Aldridge Commission on implementation of
the Vision which recommended in June 2004 that ``NASA recognize and
implement a far larger presence of private industry in space operations
. . . most immediately in accessing low-Earth orbit.''
This fall, the Review of U.S. Human Space Flight Plans Committee
endorsed the development of commercial crew capabilities as the primary
means to transport astronauts to and from the International Space
Station. Astronaut Sally Ride, a member of the Committee, stated, ``We
would like to be able to get NASA out of the business of getting people
to low Earth orbit.''
Given the above history, the Augustine Committee's endorsement of
the development of commercial crew capabilities should come as no
surprise. Commercial crew and cargo to the Station has always been part
of the Vision for Space Exploration, which had at its most fundamental
core the philosophy that government should explore beyond low Earth
orbit and the commercial sector should provide transportation to low
Earth orbit. As such, commercial is complementary to government
activities, not competitive.
Congress has noted the importance of commercial spaceflight as
well, as the 2005 and 2008 NASA Authorization bills endorsed commercial
cargo and crew. The 2005 NASA Authorization Act directed NASA to ``work
closely with the private sector, including by . . . contracting with
the private sector for crew and cargo services, including to the
International Space Station, to the extent practicable.'' The 2008 NASA
Authorization Act directed NASA to initiate a commercial crew program
and to fund ``two or more commercial entities . . . for a crewed
vehicle demonstration program.''
To its credit, NASA has already been acquiring cargo delivery to
the Station. First, NASA invested $500 million in the development of
two commercial systems, with additional investment contributed by the
companies themselves, through the Commercial Orbital Transportation
Services (COTS) program. After several years of development, NASA
demonstrated its confidence in the commercial cargo sector by declining
to purchase additional Russian cargo flights after 2011 and instead
awarding over $3 billion in domestic Commercial Resupply Services (CRS)
contracts for Space Station cargo. In just four years, commercial cargo
has transitioned from a small initiative to a program that is crucial
to the continued existence of the Space Station. The bottom line is
that commercial space services are on the critical path for cargo to
the Station and NASA has a vested interest in its success.
With commercial cargo now on the critical path for the Space
Station, it is time to consider the value of commercial crew services
for Space Station as well.
Commercial Crew is Essential to Mitigate the Gap
Despite having an option for crew transportation in the COTS
program--the so-called Capability D option--NASA has not yet invested
in the development of full commercial crew capabilities, opting to
prove out cargo services first with the possibility of crew later. The
case for beginning a commercial crew program has grown stronger in the
years since the COTS cargo program began:
Flights of the Atlas, Delta, Falcon, and other
vehicles have helped mature the capabilities that will
be needed during a future commercial crew program;
Commercial companies have invested their own
internal R&D and study money to explore commercial
crew;
NASA's $50m CCDev program is revealing the strength
of interest in commercial crew by both large and
medium-sized companies in the aerospace industry;
And the Augustine Committee notes that ``the use of
commercial vehicles to transport crews to low-Earth
orbit is much more of an option today than it might
have been in 2005.''
Today, three years after the award of the COTS Space Act Agreements
(SAAs), we no longer have the luxury of time. The Space Shuttle will be
retired next year, or shortly thereafter, while the first flight of
Ares I and Orion has slipped to at least 2017, according to the
Augustine Committee. In fact, the Committee added that if the Space
Station is extended to 2020 as seems likely, the first human launch of
Ares I would slip further, even if NASA receives the extra money the
Committee recommended. As a result, we will be dependent on the
Russians for crew transportation to the International Space Station for
at least five years, if not longer.
Given that Ares I/Orion is not likely to be ready until at least
2017 and that system is optimized for the unique requirements of
exploration beyond Low Earth Orbit, we believe a vibrant U.S.
commercial crew program is essential for avoiding a sole-source
reliance on the Russian Soyuz vehicles in the interim. In fact, we have
already purchased rides on Russian Soyuz spacecraft at the price of $51
million per seat, having taken extraordinary measures and changing U.S.
nonproliferation laws to allow these payments. Buying crew services
from U.S. industry should not be viewed as nearly so extraordinary.
Moreover, Russia's prices are rising and are certain to increase
once we become totally reliant on them. A robust U.S. commercial crew
program, however, will apply competitive pressure on Russia to keep
costs down. Also, NASA's ability to purchase Soyuz vehicles from Russia
expires in 2016. Ares/Orion is not likely to be ready by then. It is
impossible to know with certainty whether another extension of INKSNA
(Iran, North Korea, and Syria Nonproliferation Act) will be granted by
Congress at that time. Pursuing a commercial option to meet near-term
needs for Station could help alleviate the risks inherent in Russian
reliance. By not pursuing commercial, it is almost certain Congress
will have to re-address the INKSNA issue.
Complementary, Not Competitive
Commercial crew is complementary, not competitive with NASA's
exploration program. NASA should once again be focused on exploration
beyond low Earth orbit, and turn over to the private sector the
repetitive tasks of resupplying the Station--and that includes
transporting people there too. Not just a few people, but a multitude
of researchers, engineers, and technical specialists. We need more
activity in low Earth orbit, not less.
Exploration beyond low Earth orbit will not be sustainable--if it
happens at all--without a vibrant commercial sector providing
transportation services to and from low Earth orbit. The Center for
Strategic and International Studies recently released a report on the
U.S. space program which stated: ``Without commercial engagement,
exploration will . . . continually expand the scale of government
obligations, rather than keeping civil space programs focused on the
frontiers of exploration.'' None of us believes that the government can
continuously expand the obligations and expectations of our civil space
program without reaching a breaking point, regardless of where one
thinks that breaking point is. The additional resources and
capabilities of the private sector are essential.
Commercial to LEO is Less Difficult than Exploration Beyond LEO
The Augustine Committee, like the Aldridge Commission before it,
found that the commercial sector is ready and capable to handle the
task of transportation to Low Earth Orbit. Low Earth Orbit is less
difficult, and therefore more achievable by the private sector,
compared to the more capable tasks that NASA's current exploration
vehicles are optimized for.
Thus, it is not an apples-to-apples comparison to compare a
commercial crew capability to the Orion crew exploration vehicle.
Rather, it is apples and oranges, because transporting crew to and from
the International Space Station requires a far less complex spacecraft
than exploring beyond low Earth orbit. It is akin to developing a
Gemini spacecraft for low Earth orbit, rather than an Apollo spacecraft
for reaching the Moon. The Orion spacecraft, for example, must reenter
the atmosphere at one-and-a-half times orbital velocity, encountering
heat loads nearly double those when returning from low Earth orbit, and
Orion must do so with far more precision. Orion must also operate
autonomously in lunar orbit untended while astronauts explore the
surface, acting more like a space station than a crew taxi, and
requiring more complex onboard vehicle systems.
As a result, the Orion spacecraft is a 25 metric ton (mT) vehicle,
whereas spacecraft designed solely for low Earth orbit transportation
are expected to be in the 8-12 mT range, or less than half the size for
the same number of crew. Quite simply, you don't take an 18-wheeler to
the corner grocery store. Nor do you drive a Formula One racecar. The
Orion crew exploration vehicle is, in fact, far more capability than is
needed to go to and from the Space Station.
Because it serves a simpler mission, any vehicle that is designed
simply to service the Space Station--and not go beyond--should be
faster and more cost effective to develop without sacrificing safety,
regardless of whether it is a government or commercial capability. The
Gemini spacecraft, for example, was developed in just under 2 1/2
years, and had a perfect crew safety track record.
Regardless of the extent to which ``the gap'' can be reduced, a
spacecraft designed solely for low Earth orbit transportation will be
more cost effective to operate and require smaller launch vehicles. The
result will be more frequent missions to the Station, increased
research and other utilization of the Station, and more resources
available for exploration beyond low Earth orbit.
Implementing a Commercial Crew Program
In light of all the considerations above, the Augustine Committee
outlined a $2.5-3.0 billion fixed-price Commercial Crew program, in
which NASA would invest in multiple private companies, each of which
would also be required to invest their own funds, thereby putting their
own ``skin in the game.'' The committee also suggested that NASA fund
human rating of a proven U.S. launch vehicle to mitigate the dependence
on the development of new launch systems in addition to the spacecraft
themselves.
A Commercial Crew program of $2.5-3.0 billion over 5 years should
be sufficient funding. For example, one major aerospace company
conducted a study that concluded they could develop a commercial
capsule to transport crew to low Earth orbit and human rate an existing
U.S. launch vehicle for around $1 billion. As another example, SpaceX
has an unfunded option in its COTS Agreement for $308 million to
upgrade its Dragon spacecraft to carry crew to and from the Station.
Demonstrating the diversity of interest and capability, the Augustine
Committee received price estimates from, according to the report,
``five different companies interested in the provision of commercial
crew transportation services to low-Earth orbit. These included large
and small companies, some of which have previously developed crew
systems for NASA.''
Additional evidence that a Commercial Crew program is viable at
$2.5-3.0 billion is again provided by the Gemini program. Despite only
having access to 1960s technology, and with only a few years of total
experience with spaceflight, NASA and industry human-rated the Titan II
launch vehicle (which required 39 months), and designed and tested a
crew capsule, for about $2.5 billion in today's dollars. The Gemini
program completed all missions safely.
Since NASA's budget for the next five years is almost $95 billion,
a $2.5 billion Commercial Crew program represents less than 3% of total
NASA expenditures. Clearly, it is not an either/or proposition between
commercial crew and NASA exploration. Commercial vehicles will not have
the capability to go beyond low Earth orbit, while NASA must develop
the capability to conduct exploration beyond low Earth orbit.
To promote competition and innovation, NASA's investment in a
Commercial Crew program should be structured using milestone-based,
fixed-price agreements as it is in the COTS program, unlike traditional
cost-plus contracts. The COTS Cargo program has shown the wisdom in
this approach. NASA initially selected two winners, SpaceX and
Rocketplane-Kistler, rather than putting all of its eggs into one
basket. When Rocketplane-Kistler failed to raise the capital to meet
its milestones under its Space Act Agreement with NASA, NASA terminated
its funding, held a new competition, and had 85 percent of the funding
left over to give to the new winner, Orbital Sciences. This ``portfolio
approach'' diversified the risk to NASA, greatly enhancing the
likelihood that NASA will get the expected level of capability that it
needs.
Safety of Commercial Human Spaceflight
Let me now address the safety of commercial human spaceflight
systems. Safety is paramount. Private companies understand that they
will not be in business if the systems they develop are not safe. In
fact, private industry recognizes that it must increase safety from
that demonstrated in the past in order to fulfill its vision of greatly
increasing human activity in space. I believe industry has a healthy
respect for the limits of their knowledge when it comes to safety. They
do not presume to know it all and they maintain a strict discipline of
safety. At the same time, they bring fresh eyes and insights from other
cultures and I believe this will ultimately enhance safety.
Human spaceflight is an inherently risky endeavor. This has been
true for government human spaceflight and will also be true for
commercial. Working in partnership with NASA, U.S. industry firmly
believes it can develop the capability to transport crew to low Earth
orbit safely. Last month, 13 former NASA astronauts \1\ endorsed
commercial human spaceflight in a statement in the Wall Street Journal.
This group of astronauts are highly experienced with spaceflight--
collectively, they have flown a total 42 space missions and logged a
total of 2 years and 48 days in space flying six different spacecraft
including Gemini, Apollo, Space Shuttle, Soyuz, Mir, and the
International Space Station. They stated:
---------------------------------------------------------------------------
\1\ The astronaut signatories were Buzz Aldrin, Ken Bowersox, Jake
Garn, Robert Gibson, Hank Hartsfield, John Herrington, Byron
Lichtenberg, John Lounge, Rick Searfoss, Norman Thagard, Kathryn
Thornton, Jim Voss and Charles Walker.
``As astronauts, we know that safety is important. We are
fully confident that the commercial spaceflight sector can
provide a level of safety equal to that offered by the
venerable Russian Soyuz system, which has flown safely for the
last 38 years, and exceeding that of the Space Shuttle.
Commercial transportation systems using boosters such as the
Atlas V, Taurus II, or Falcon 9 will have the advantage of
multiple unmanned flights to build a track record of safe
operations prior to carrying humans. These vehicles are already
---------------------------------------------------------------------------
set to fly over 40 flights to orbit in the next four years.''
Working together, NASA and the commercial industry can develop the
capabilities to safely conduct human spaceflight. NASA and industry
must begin the dialogue now on the requirements, standards, and
processes necessary to make this successful for all involved. Agreement
on the requirements is essential to the success of any partnership
between NASA and the commercial sector.
There are several important factors to keep in mind when discussing
the safety of commercial crew vehicles:
Commercial Spaceflight Has a Demonstrated Track Record
First, when we discuss commercial spaceflight, some tend to think
of an activity in the future. In fact, commercial spaceflight occurs
right now and has for years. Currently, the Atlas V and Delta IV launch
vehicles--both commercially developed with substantial private
funding--are used to launch multi-billion dollar national security
payloads upon which the lives of our troops overseas depend. These
vehicles are also entrusted by NASA to handle some of the most safety-
critical applications in the civil space sector. For example, the Atlas
V is Category 3 certified by NASA for launch of NASA's most critical
payloads, and is also certified for launch of nuclear payloads, such as
NASA's New Horizons spacecraft to Pluto, launched with radioactive
plutonium onboard.
Not only is the commercial spaceflight sector real, but it has an
extensive history of successful flights to orbit: the Atlas and Delta
families of rockets, many of which were developed with substantial
private investment and serve multiple customers, have a combined record
of 114 consecutive successful flights since 2000. The Atlas V, for
instance, has had 19 consecutive successful flights since its
inception.
We must now turn our efforts to extending this demonstrated track
record and depth of operational experience to human spaceflight.
Fortunately, commercial human spaceflight to LEO will not require the
development of new launch vehicles. Instead, it can be accomplished
using existing launch vehicles and those currently under commercial
development, such as the Atlas V, Falcon 9, and Taurus II launch
vehicles. This will allow us to leverage our existing track record.
I will now examine some of the key requirements for ensuring the
safety of commercial spaceflight, and explain how the commercial
spaceflight sector can meet these high standards.
Key Requirements for Commercial Spaceflight Safety
Since computer calculations of vehicle safety cannot account for
most of the root causes of accidents historically, such as human error
or design flaws, and since even reliable vehicles have historically
suffered a period of ``infant mortality,'' the commercial spaceflight
industry believes that safety must include the following:
Demonstrated reliability from orbital flight tests
of the full system
Not placing crews on initial flights, since early
flights are historically most risky
A highly reliable crew escape system
Standards-driven design and operations
I will now consider each of these topics in turn.
I. Demonstrated Reliability from Orbital Flight Tests: By the time
any astronaut climbs onboard a commercial vehicle, including the Atlas
V, Falcon 9, and Taurus 2, each will have had multiple demonstrated
successful flights to orbit. For example, SpaceX's Falcon 9 would
likely have more than 15 missions prior to its first crewed launch, due
to customers such as the COTS Cargo program and satellite launches. As
the Wall Street Journal astronauts pointed out, the Atlas, Falcon,
Delta, and Taurus systems combined have over 40 more missions on the
manifest before 2014, in addition to numerous flights of commercial
systems that have taken place before this year.
Human-rating of existing launch systems will cost money, and care
must be taken, but as a recent study by The Aerospace Corporation
concluded, there are no show-stoppers to human rating the existing
proven fleet of launch vehicles. Norm Augustine pointed out that we did
it safely for Mercury and Gemini, when our expertise in human
spaceflight was much lower than it is today, and we can do it now.
Demonstrated reliability is so important because computer models
and Probabilistic Risk Assessments (PRAs) are not sufficient to capture
the majority of failure modes that affect real, flying vehicles--
especially vehicles that are flying their first few missions. The
Augustine Committee, which included two experienced astronauts, pointed
out the following on PRAs:
``Studies of risk associated with different launch vehicles
(both human-rated and non-human-rated) reveal that many
accidents are a result of poor processes, process lapses, human
error, or design flaws. Very few result from so-called random
component failures. The often-used Probabilistic Risk
Assessment (PRA) is a measure of a launch vehicle's
susceptibility to these component or system failures. It
provides a useful way to compare the relative risks of mature
launch vehicles (in which the design is well understood and
processes are in place); it is not as useful a guide as to
whether a new launch vehicle will fail during operations,
especially during its early flights.''
Probabilistic Risk Assessments and computer models are useful
tools, but they have limitations. While the commercial spaceflight
industry will make use of every tool that is available to improve
safety, computer models are just one tool among many. Demonstrated
reliability and a robust flight test program are crucial. Reasonable
minds can differ on how many successful launches is sufficient before
putting people on top, but there is no debate that more is better.
At this point, let me briefly address two myths surrounding the
safety of commercially procured crew transportation systems. First,
some have claimed that commercial crew systems will only be able to
produce cost savings for NASA by cutting corners and being less safe.
In fact, commercial crew systems are cheaper for a different reason--
because they have a less ambitious mission than systems designed for
exploration. Since commercial LEO systems are simply tackling a less
difficult challenge, commercial crew will be able to achieve cost
savings for Space Station missions without cutting any safety corners.
By focusing on a less ambitious mission that requires less capable
vehicle performance, the commercial spaceflight industry is following a
statement of the Columbia Accident Investigation Board that ``the
design of the system should give overriding priority to crew safety,
rather than trade safety against other performance criteria.''
Second, some have claimed that NASA's Exploration Systems
Architecture Study (ESAS) shows that the current exploration vehicles
are safer than commercial crew vehicles. In actuality, commercial crew
vehicles were never even analyzed in the ESAS report--the ESAS report
only looked at vehicles large enough to carry Orion, such as Ares I and
variants of the triple-core Delta IV Heavy, and did not examine the
smaller, simple, single-core vehicles, such as Atlas V Medium and
Falcon 9 Medium that are sufficiently sized for commercial crew
missions. Moreover, even if ESAS had compared exploration vehicles to
commercial crew-sized vehicles, the comparisons would be ``apples vs.
oranges,'' because of the dramatically different tasks of these two
types of vehicles.
II. Not Risking Crew During Initial Flight Tests: Historical
records show that even reliable vehicles, such as the Soyuz, initially
go through a period of lower reliability (``infant mortality'') as
design flaws are caught and corrected. The use of proven launch
vehicles enhances safety by using a mature system with a demonstrated
track record that has gone through the infant mortality stage
experienced by most new launch systems.
By leveraging the cargo and satellite flights, such as the COTS
Cargo flights, that precede the first crewed flights, the commercial
sector can help ensure that the infant mortality phase does not risk
human lives. Commercial providers are free to pursue multiple
customers, such as NASA science missions, national security missions,
or commercial satellite missions, to help extend and strengthen the
crucial test flight phase before humans are launched. Again, reasonable
minds can differ on how many test flights are needed in light of infant
mortality, but all can agree that it is good that the commercial sector
can leverage non-crewed flights, such as cargo and satellite launches,
to help alleviate crew risks associated with flying during the infant
mortality phase.
III. A Robust Crew Escape System: In addition to demonstrated
reliability of the launch vehicle, ascent safety will be based on an
emergency detection system to detect any anomalies during launch and a
crew escape system to separate the spacecraft from the launch vehicle
in the event of an anomaly.
The commercial spaceflight industry understands that safety
requires not just a reliable launch vehicle, but an integrated system
with robust crew escape capabilities. As the Augustine Committee notes,
``It is unquestionable that crews need access to low-Earth orbit at
significantly lower risk than the Shuttle provides. The best
architecture to assure such safe access would be the combination of a
high reliability rocket and . . . a launch escape system.'' The
commercial spaceflight industry is committed to meeting this
combination.
IV. Effective Government Oversight: Human spaceflight is now almost
50 years old with the first flights of Alan Shepard and John Glenn
occurring before I was born. It is time to transition access to low
Earth orbit to the private sector so NASA can once again lead
exploration beyond. Nevertheless, NASA and the FAA will be involved in
every step of a Commercial Crew Program. In fact, every human
spacecraft to date has been developed in partnership between NASA and
U.S. industry, and this will also be true for a Commercial Crew
Program. I will now address this crucial topic in more detail.
First, any NASA Commercial Crew Program must be conducted under the
current regulatory regime established by law, namely, licensing by the
Federal Aviation Administration (FAA) Office of Commercial Space
Transportation. FAA licensing of commercial spaceflight activities is
established by law, requires a high degree of system safety, and
provides a stable and predictable regulatory environment necessary for
the success of commercial human spaceflight businesses. As codified in
existing U.S. law, a licensing regime, rather than a certification
regime, is appropriate for these vehicles.
While the FAA would retain overall licensing approval authority,
NASA would maintain strong oversight as the mission customer. As with
today's commercial expendable launches, the customer has go/no-go
authority over the readiness of the mission and, therefore, NASA would
maintain its role as safety approval authority for its crew onboard any
commercial vehicle. NASA-unique requirements would be imposed as
customer requirements, rather than as the overall regulator of the
commercial spaceflight activity. (This is discussed in more detail in
the next section.)
While it is appropriate for NASA to establish customer-specific
requirements, an entirely new licensing or regulatory regime, separate
from the current FAA regime, should not be established for NASA or any
other entity that would require compliance with different rules and
regulations for commercial human spaceflight services provided for U.S.
Government and commercial customers. The creation of a NASA-specific
regulatory regime would impose parallel regulatory and operating
environments for commercial operations for private customers and
``commercial'' operations for NASA. A two-track regulatory environment
could hurt industry's ability to obtain non-NASA customers, impacting
business viability by lowering the total number of flights. Such a
situation would be the opposite of the more robust flight history and
greater operational experience that is crucial to enhance safety.
NASA Will Be There Every Step of the Way
In any Commercial Crew program, NASA will play a pivotal role in
the design, development, and operation of the commercial vehicles. NASA
will be there every step of the way. In particular:
NASA, in consultation with industry, will establish
baseline human spaceflight safety requirements. That
dialogue must begin now.
NASA will also establish its mission-unique
requirements, such as crew capacity; ability to dock
with the International Space Station, including meeting
visiting vehicle requirements; and functionality as a
crew rescue vehicle, among others.
And NASA will have final approval authority over the
launch of NASA astronauts on commercial vehicles, which
would be granted only after being satisfied that the
vehicle is safe for launch, just as it does for today's
Space Shuttle missions.
Whether or not these safety requirements are the same as those
found in NASA's current human-rating requirements document (NPR
8705.2B) is currently under consideration. NASA is reviewing its human-
rating requirements as they would be applied to commercial human
spaceflight capabilities. This is the right thing for NASA to do and I
applaud them for doing so.
In fact, there is already a precedent for reviewing human-rating
requirements. During the Constellation Program, NASA revised its human-
rating requirements document in May 2008, going from the original
version A to the current version B. Based on the judgment of NASA
engineers, version B revised some requirements related to structural
safety margins and dual-fault tolerance. In fact, no existing U.S.
spacecraft--or Russian, for that matter--has ever met all of NASA's
human-rating requirements, but rather have obtained waivers to certain
requirements. These examples demonstrate the importance of early
dialogue between NASA and the commercial spaceflight sector on the
nature of human-rating requirements for commercial systems, with
demonstrated reliability, robust test flights, and a reliable crew
escape system being key.
While NASA is conducting its review, U.S. industry is also
conducting a similar review. We have established a Commercial Orbital
Human Spaceflight Safety Working Group. While the Commercial
Spaceflight Federation has taken the lead in organizing the effort, the
working group includes representatives from a broader spectrum of
companies, including several of the major aerospace primes and more
traditional government space contractors. The goal of the effort is to
develop industry consensus on principles for safety of commercial
orbital human spaceflight. So far, we have met among industry and have
begun to engage NASA and the FAA. There is much more work to be done.
However, consensus has been reached among a number of companies on
principles with other companies currently reviewing the document.
Regardless, it has already been useful in illuminating the issues and
differing perspectives of those involved and is an important step in
the right direction.
Finally, I note that industry and NASA standards will include more
than just the launch vehicle. For example, once in orbit, spacecraft
must rendezvous with the Space Station, dock or berth with it, and then
undock and de-orbit, reentering the atmosphere and landing safely back
on Earth. The technologies to rendezvous and dock with the Station have
been demonstrated by the United States, Russia, Europe and Japan.
Working in partnership with NASA, Europe and Japan demonstrated these
capabilities this year, and NASA is working with SpaceX and Orbital
Sciences here at home to demonstrate the same capabilities under the
COTS Cargo program. Examples such as these illustrate the importance of
cooperation between the private sector and NASA to ensure safe
operations.
Conclusion: A Partnership Between NASA and U.S. Industry
The discussion of standards brings me to one of the most important
prerequisites for success of any Commercial Crew Program--how NASA
engages with the private sector is ultimately as important, if not more
important, than the amount of funding provided. NASA's COTS Cargo
program is an excellent example. While some were initially resistant to
commercial resupply of the Station, once it became a necessity NASA
engaged the private sector in true partnership in order to ensure that
the capability is available as soon as possible.
I have every confidence that we are at such a turning point with
Commercial Crew as well. It is now a necessity, and I believe that NASA
and industry will both step up to make it happen.
Thank you for the opportunity to be here today and I look forward
to your questions.
Chairwoman Giffords. Thank you, Mr. Alexander.
Dr. Fragola.
STATEMENT OF JOSEPH FRAGOLA, VICE PRESIDENT, VALADOR, INC.
Mr. Fragola. Madam Chairwoman and distinguished members, it
is an honor to be able to be before you today, and I would like
to share with you some of the experience that I have had in the
form of four simple laws for a safe space launcher design.
The first law has been referred to before, and that is to
make the design as inherently safe as possible. That involves
two important aspects: first, to make the launcher reliable,
and second, and this is four times not mentioned in discussion,
to make sure that the failure modes of the launch vehicle
present a benign environment to the abort system. This is so
important I would like to repeat it: to assess the vehicle to
make sure that the abort modes given a failure represent a
benign environment for the system for escape. Second, separate
the crew from the source of failure as far as possible in the
design, or as I like to say, put them on top where God meant
them to be. Third, establish a credible abort trigger set, and
in doing so, balancing the warning time available with the
threat of false positives against the G load on the crew.
Fourth, include an abort system that is tested and verified for
robustness to allow for a safe crew escape and recovery.
I would mention that from my experience, the Ares I vehicle
is the singular vehicle that has been designed from the very
moment of its conception with safety in mind. What I mean by
that is that other launches, for example, have emphasized
launch reliability but investigation of subsequent two accident
conditions allowing for abort is something they usually don't
address, and the reason for it is very simple. They are
interested primarily in payload to orbit. When a payload fails,
the subsequent conditions are no matter to the person who pays
for the payload. When a crew launcher fails, the conditions
subsequent to that launch failure are important to the payload,
which is the crew.
We hope that the alternatives to the Ares I will follow the
remainder of the rules that we mentioned, but in most of the
literature discussing it, the importance of an abort system and
the testing of an abort system independent of the number of
experiences of the launcher has not really been addressed. Many
times, for example, we speak of successes in terms of maybe 19
successes of the Atlas V, which is a credible, wonderful,
reliable record but I will remind the Subcommittee that the
space shuttle had 25 successes prior to the Challenger
accident.
One of the things to remember in the design of a new launch
vehicle or the application of an existing launch vehicle to
crew is to understand that invariably in modifications of
designs or the development of new designs we have an issue of
reliability growth. Immature designs need time to become
mature, and that is why the abort system testing and
integration into the design and the benign nature of the
failure initiators is extremely important for a crewed
launcher.
Now, as was mentioned, we did an independent assessment of
the Ares on an apples-to-apples comparative basis to all the
other alternatives we were provided, and I showed this on a
slide that is presented there. On a comparative basis, you can
see that from the standpoint of loss of crew, the Ares vehicle
is somewhere between two to three times safer than all the
alternatives, in some cases more than three times safer than
the alternative vehicles. If we look at this, people often
mention yes, but there is a certain amount of uncertainty,
there certainly is uncertainty but even with the uncertainty
taken into consideration, the loss of crew benefits from the
Ares I vehicle are significant above the alternatives. The
reason for it is not only its inherent reliability in the first
stage proven in 255 successful shuttle launches but also the
nature of a solid rocket booster. The predominant failure mode
by far is case breach, nozzle burn-through or joint burn-
through. All of those alternatives, although they are very
significant when combined with a single core liquid or a tandem
booster in a singular solid rocket booster present a rather
benign abort environment to launch abort system. It is the
combination of this inherent reliability and its inherent
benign abort conditions that make the Ares I such a safe
launcher and that is the reason why it was designed from the
beginning in that way. Thank you.
[The prepared statement of Mr. Fragola follows:]
Prepared Statement of Joseph R. Fragola
Madam Chairwoman, distinguished members of the Subcommittee: I want
to thank you for the opportunity to address you today. My testimony
will detail my personal perspective on the ongoing focus on safety
matters with regard to human space flight, focusing primarily on how
NASA sought to better safety ratios for the Constellation Program via a
risk-informed design process whose overriding priority has always been
and will always be crew safety.
Introduction
Risk-based Design for Inherently Safe Crewed Launchers: The
design of the system [that replaces the shuttle] should give
overriding priority to crew safety, than trade safety against
other performance criteria, such as low cost and reusability,
or against advanced space operation capabilities other than
crew transfer. (Columbia Accident Investigation Board (CAIB)
Report Section 9.3)
This quote from the CAIB gives NASA clear direction to the design
of the next generation crew launch system: make it simple, make it
safe, and let the driving design principle be crew safety. That is
simple enough to say, but how do we design for safety from the start?
In other words, how do we make it ``inherently safe'' while also
protecting against residual risk, in a mass-constrained, highly-
energetic system such as a launch vehicle? To paraphrase the definition
of inherently safe design is to say that the principle objective of the
design process should be to eliminate, or at least reduce to a minimum,
the hazards associated with the process so that the elimination or
reduction is both permanent and inseparable from the design. Once a
design concept has eliminated or reduced the hazards to a minimum, the
designers can focus on developing acceptable mitigation approaches for
the residual risks. This process is referred to as a risk-based or
risk-informed design.
NASA has utilized the May 2004 memo from the Chief of the Astronaut
Office on future system launch safety as guidance in designing for
ascent safety. A key statement from this memo is,
The Astronaut Office believes that an order-of-magnitude
reduction in the risk of loss of human life during ascent,
compared to the Space Shuttle, is both achievable with current
technology and consistent with NASA's focus on steadily
improving rocket reliability, and should therefore represent a
minimum safety benchmark for future systems. This corresponds
to a predicted ascent reliability of at least 0.999. To ensure
that a new system will achieve or surpass its safety
requirement, it should be designed and tested to do so with a
statistical confidence level of 95%. (Astronaut Office Memo)
The paragraphs that follow explain how this is being accomplished
in the development of what has come to be the Ares I crew launcher and
Orion spacecraft, and why the current design is believed to be
inherently safer and operationally safer than alternative design
concepts that might be equal in operational capability, or in some
cases even more capable. The Constellation system is the only launch
system that has been specifically engineered to meet the Crew Office
memorandum guidance of 1 in 1,000 missions loss of crew (LOC).
The Two Elements of Risk-Informed Design
In the Apollo era, crewed launchers were fundamentally designed
with the best level of expertise available, tested to exhaustion, and
then robustness or redundancy was added to mitigate the residual risk.
This redundancy was applied across the design and included engine-out
capability during at least portions of ascent, launch escape
capability, a ``life boat'' vehicle on the way to the Moon, an abort
stage possibility during descent to the lunar surface, and component
robustness or redundancy where element redundancy was no longer
possible. Reliability and risk-informing analyses were primarily
qualitative, such as Failure Modes and Effects Analyses (FMEAs), which
were applied as a check of the design rather than being integral to the
design development.
Design development for Constellation, therefore, has consisted of
two key tenets related to safety. These are to make the design as
reliable as possible (inherent safety), so that backup systems would
never have to be used, and to make the backup systems as robust as
possible to maximize the likelihood of crew survival and return given a
failure of the primary system or element. Notice that, in the Apollo
era, redundancy or robustness was not added for mission continuance as
it was in the shuttle era in some cases at least, but was applied to
ensure safe return of the crew.
Tenet Number 1--Make the Design Inherently Safe
As codified in Constellation Program safety policy, inherent safety
implies the elimination of hazards that have historically been
associated with the operation of the type of system being designed.
This in turn implies the systematic identification of the hazards
associated with operation of the system alternatives being considered.
The process of hazard identification is implemented in a global sense
by a hazard analysis, which essentially establishes the potential
spectrum of generic hazards that might be applicable to a particular
design. The hazard analysis also establishes a local evaluation of the
credibility of these hazards being applicable to the design in terms of
their likelihood of being activated, as well as the local conditions
that would determine their consequences if unmitigated. Both the
likelihood of activation and the associated consequences once activated
are established and developed from historical data on heritage systems
and the combined judgment of design and safety experts on how this
heritage data applies to each specific design alternative.
If mission reliability, i.e., inherent safety, were equivalent to
crew safety as it is for payload ``safety,'' then the task that would
be left to the analysts would be to inform the decision makers of the
forecasted mission reliability of each design. Even in this case, an
alternative that employed a first stage that made use of a solid, which
could subsume the reliability of the shuttle solid, would be a strong
contender because the shuttle solid has demonstrated a mission
reliability of just a single failure in approximately 250+ booster
firings. This implied demonstrated reliability of 0.996, or 99.6%,
rivals the best of the best of the boosters worldwide. However, in the
case of crew safety, mission reliability is not the entire story.
Tenet Number 2--Adequacy of ``Abort Effectiveness''
The shuttle designers, unlike the Apollo designers before them,
concentrated fully and completely on the inherent safety of the
vehicle--that is, they relied on the forecasted mission reliability of
the design alone to guarantee crew safety. Clearly, the primary focus
of a launcher design should be on mission reliability, regardless of
whether or not it is crewed. The primary objective of the design should
always be to avoid failure.
A mitigating system, given a failure, should never be used as a
crutch to enhance crew safety, but rather only be used as a way to
abort the mission and recover the crew. However, unless the reliability
of the primary design can be assured to a significantly high degree, a
mitigating system (such as the Orion Launch Abort System) is essential
to ensuring crew safety. The crew safety enhancing power of an abort
system is generated by the fact that it provides an additional or
conditional crew survival probability given the occurrence of a crew
threatening event. This conditional probability of a successful abort
and return given a crew-threatening event is referred to as the ``Abort
Effectiveness.''
The abort effectiveness value is a function of several things: the
probability that the abort can be initiated in time to allow for a safe
distance to be established for crew survival with employing an
acceleration that also allows for survival, the reliability of the
abort system, and the conditions that the crew vehicle will be
obligated to negotiate subsequent to the abort initiation. In the days
of Apollo, when NASA had comparatively little experience and
computational capability, the abort effectiveness was estimated by
comparison to escapes from high-performance military aircraft combined
with the results of a few escape system tests, Little Joe I and II.
Today, Constellation is systematically applying throughout the
design process the software simulation tools and advanced computers
that allow us to do a much better analytic design assessment than
Apollo. Specifically, the integrated abort effectiveness can now be
calculated by employing more realistic simulations of abort conditions.
The integrated abort effectiveness is the effectiveness of each abort
against each initiated abort scenario weighted by the occurrence
probability of the scenario. While simulation tools and computational
capability were unavailable in the Apollo era, today this calculation
can be carried out with reasonable accuracy.
The value of the abort effectiveness for each acceptable, payload-
capable alternative is possible but complicated to determine. However,
what is known is that the primary determinate of the effectiveness of
an abort is the time available to affect the abort along with the
severity and extent of the environment in the abort locale.
Top Level Risk-Informed Design Selection During ESAS
The above paragraphs have indicated the importance of incorporating
risk evaluation from the very beginning of the crewed launcher design
selection process to achieve an overriding priority for crew safety.
Without this focus on safety risk evaluation, the crew launcher focus
can slip into one emphasizing performance over safety. Even with safety
as the overriding priority, the launcher must have acceptable payload
capability and be affordable. Safety risk alone cannot be the criteria
for the selection of a crew launcher design. Decisions must be made
with safety risk as a priority, but within the context of a risk,
performance, and cost picture. This implies that from a top-down
perspective, potential crewed launchers should be each evaluated on the
basis of cost, performance, and risk simultaneously, and this is just
how the ESAS study efforts for the selection of a crewed launcher
design proceeded.
During ESAS, any launch vehicle concept that did not approach at
least 1 in 1,000 forecasted launch Loss of Crew (LOC) risk was
eliminated. In addition, concepts that would place the crew module in
close proximity to the boosters and/or other potential sources of
accident initiation were eliminated because it as anticipated they
would interfere in NASA's ability to incorporate a launch abort system
into the next-generation launch vehicles. Lastly, as part of its
findings, the ESAS team recommended that this risk-informed design
process be extended to the development of the design of the selected
single solid First Stage concept, which would later be known as the
Ares 1 Crew Launch Vehicle.
Constellation Safety Story
The Constellation program baseline was derived directly from the
ESAS recommendations, and a clear discriminator among crew launch
vehicle alternatives was the relative complexity of the launcher's
first stage and the effectiveness of the crew escape system.
The Ares I first stage (FS) consists of a 5-segment reusable solid
rocket motor (RSRM), an aft skirt, a forward skirt, and a frustum. The
5-segment solid is an evolutionary growth from the 4-segment solid RSRM
tandem boosters utilized to power the space shuttle. The Ares I booster
will continue the protocol of recovery and post-flight inspection that
began in the Shuttle Program. To summarize, the 5-segment solid for the
Ares I has many advantages over other designs, including:
Drawing extensively from the heritage and knowledge
derived from the Shuttle RSRM Program. There have been 252
solids flown in the Shuttle Program with one failure
(Challenger STS-51L).
Applying the knowledge gained from that experience-
base to actively improve design features.
Utilizing extensive qualification and flight test
programs.
Incorporating a failure-tolerant design against the
primary failure modes of joint leakage and case burn-through.
Incorporating an extensive system of process controls
in manufacturing and assembly.
Benefiting from the basic Ares ``single-stick''
architecture, which eliminates the possibility of engaging
elements that are radially or tandem mounted.
The Orion crew capsule will have a Launch Abort System (LAS) that
will offer a safe, reliable method of moving the entire crew out of
danger in the event of an emergency on the launch pad or during entire
first stage and the most risk intense portion of the second stage climb
to Earth orbit. Mounted at the top of the Orion and Ares I launch
vehicle stack, the abort system will be capable of automatically
separating the Orion from the launch vehicle and positioning the Orion
and its crew for a safe landing. NASA plans a series of tests to
characterize the LAS. Pad Abort (PA)-1, which is planned for March
2010, is the first of these tests and will address what happens if an
emergency occurs while the Orion and the launch vehicle are still on
the launch pad. Other such tests will determine how the LAS behaves
during critical parts of the flight regime. These tests will take place
at White Sands Missile Range, New Mexico.
NASA is making substantial progress in maturing its approach and
design methodology for designing a robust crew-launch system. From the
very onset of the Constellation Program, the NASA design team insisted
on the application of a risk-informed design approach. That is, safety
risk members are included as integral parts of the Constellation design
team. They are chartered to develop risk-informed approaches for the
Ares I and Orion design concept refinement, and are included in all
trade studies that involved safety risk.
The skill mix of the NASA team includes not only the Failure Modes
and Effects Analyses, Integrated Hazard, and Probabilistic Risk
Assessment (PRA) disciplines traditionally found under the Safety and
Mission Assurance (S&MA) organizations, but also engineers with such
backgrounds as computational fluid dynamics (CFD), Aerospace, and
Physics disciplines. The team functions as a single group entitled Crew
Safety and Reliability (CSR) and has been given the clear direction to
work daily with the design engineers to provide expertise and feedback
via various assessments and analysis techniques throughout the design
maturation process. This investment continuously emphasizes a sincere
commitment to the CAIB findings.
Additionally, the primary modus operandi of past programs has been
to provide intermittent reviews of design ``drops'' at the prescribed
reviews. This limited meaningful insight into the systems development,
which was occurring in the everyday work environment where design
risks, nuances, trade studies, etc., are introduced. The Constellation
approach, by contrast, has fostered the development of a truly risk-
informed culture on a continuing and synergistic basis.
In parallel and in concert with the Ares I design development;
NASA's Constellation team is providing the resources for the
development of the supporting logical and phenomenological (or physics-
based) computer models and associated historical data sets. This allows
for the identification of all credible potential events that might
initiate an accident, the extant local external environmental
conditions as determined by aero-physics computer models, and internal
conditions, as determined initially by judgment and then later by motor
and engine physics computer models, at the postulated time in the
ascent trajectory that initiator was to occur. Then the global
environment is imposed upon the integrated ascending Ares I stack and
on the Orion crew module as determined by sophisticated computer models
replicating those environments seen as potentially assaulting the
vulnerabilities of Orion. Specifically, fragmentation fields,
propagated impulse and pressure fields, and thermal radiation fields
generated by the accident scenarios are initiated, forming the basis of
the `blast environment' that the Orion must escape from.
Currently the Ares I has an estimated AE of about 84%, which when
combined with its high heritage based inherent reliability makes it two
to three times safer than alternative launchers as shown in Table 1 and
in graphical form in Figure 1. This corresponds to a LOM of 1 in 200 in
ascent, which leads to LOC of about 1 in 1300 according to our
independent calculations.
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Meanwhile, examples of cases where the risk assessment and failure
analysis teams have provided input and/or impacted the outcome of
Constellation design issues, trades, or risks include the following.
Abort triggers study: Provided LOC and Abort
Effectiveness assessments, including engineering models and
timing, to determine what potentially catastrophic scenarios
warrant abort sensors and software algorithms.
Separation study (booster deceleration motors
(BDMs)): Hazard analysis combined with probabilistic design
analysis (PDA) led to the design decision to increase the
number of BDMs from 8 to 10.
The Hazards Team identified that the first stage and
upper stage designs failed to meet properly at the interface
flange (different number of bolts) and a re-design was
instituted. Hazards team provided assessment to Upper Stage
that resulted in clocking of the hydrogen and oxygen vents to
improve separation distance.
Orion and Ares systems architecture trades: risk
assessment and failure analysis teams have informed the active
mitigation of systems design vulnerabilities for both the
rocket and spacecraft.
Failure Modes and Effects Analysis teams:
J-2X FMEA was used to support redline sensor
selection in order to detect failure modes prior to
their propagation to a catastrophic condition.
Upper Stage Main Propulsion System (MPS) FMEA
identified need for modifications related to solenoid
valves to increase reliability and failure mitigation.
US Reaction Control System FMEA identified need for
additional temperature sensors to detect freezing of
hydrazine to support launch commit criteria.
US Flight Safety System (FSS) FMEA identified need
to relocate cryogenic helium line that was adjacent to
Flight Termination System (FTS) linear shaped charge.
FS Roll Control System was changed from bipropellant
to monopropellant due to significant reduction in
critical failure modes.
Summary
The Constellation design development process has, and continues to
employ, a continuous risk-informed design process adopted from the
outset of the program. This process has included both logical and
physical simulation models as appropriate in a way that has had a
synergistically beneficial impact on Orion and Ares I designs by
allowing them to be developed with an ``overriding priority'' given to
crew safety at every stage of the design and operational processes. I
believe that the Constellation development represents a successful,
pioneering application of a new approach to engineering design, a type
of engineering risk design, which will have multiple applications and
refinements in aerospace system designs in the future.
Closing
In closing, I would be remiss if 1 did not bring your attention to
a statement from the Augustine report that I believe to be problematic.
Specifically, on page 9 of their report the Committee states:
Can we explore with reasonable assurances of human safety?
Human space travel has many benefits, but it is an inherently
dangerous endeavor. Human safety can never be absolutely
assured, but throughout this report, safety is treated as a
sine qua non. It is not discussed in extensive detail because
any concepts falling short in human safety have simply been
eliminated from consideration. (Augustine 9)
I believe this statement to be problematic because I believe it to
be indicative of what I like to call a ``goal post'' mentality rather
than the proper safety mentality which should be ``As low as reasonably
achievable'', or ALARA. In the former case items are considered safe if
they meet the criterion, in this case ``human safety'', or not if they
don't. If they meet the criterion and are considered safe they are
retained, and if they don't they are considered unsafe and are
eliminated from consideration. It matters not if some alternatives just
miss the criterion, or they miss it by a mile, they are eliminated
nonetheless. And if they just make the criterion or they are much
better, they are all considered ``safe''. While it is certainly true
that safety cannot be assured in spaceflight and it is also true that
the safety level of concepts are uncertain this approach has led in the
past in other industries, such as the commercial nuclear power
industry, to a safety perspective that focused only on which concepts
or designs should be considered safe and which not. In this way the
safety bar is set to include the lowest acceptable rather than focusing
on which designs were as safe as achievable. There are always
uncertainties in every analysis, and risk analysis is no exception.
Still when solid, heritage-based analysis shows significant differences
in safety risk amongst alternatives it is questionable how an
investigation that claims safety as a sine qua non can fail to
highlight these discriminations.
Now it is true that the goal post approach will eliminate design
concepts that are clearly unacceptable, but it also fails to
discriminate designs that are clearly desirable among those that are
acceptably safe. It is my belief that the Ares I vehicle, because of
its inherent focus on being as safe as achievable from the very start,
has the best chance to be an outstandingly safe crew launcher. There is
no way to insure safety, and spaceflight will always be a risky
endeavor, but a launcher that is designed to be safe from the start, at
least to me, is a good way to begin.
Madam Chairwoman, I would like to thank you and the members of this
Subcommittee for the opportunity to express my ideas. I would be
pleased to respond to any questions that you or the other Members may
have.
Chairwoman Giffords. Thank you, Dr. Fragola.
General Stafford.
STATEMENT OF LT. GEN. (RET.) THOMAS STAFFORD, UNITED STATES AIR
FORCE
Lt. Gen. Stafford. Chairwoman Giffords, Ranking Member
Olson, distinguished members of the Committee, many old
friends, I am honored to be invited here to appear before you
today to testify on the matter of crew safety in human
spaceflight.
As a result of the Augustine Committee report, it is
imperative that the information and their observations that
resulted in recommendations be considered carefully before the
Congress directs or allows changes to be made to the program
that NASA has pursued and the Congress has approved over the
past years. Mr. Augustine invited me to be the first presenter
to the committee due to the fact that I presently chair the ISS
Independent Advisory Taskforce and previously had chaired the
Shuttle-Mir Taskforce. I had also chaired a yearlong study at
the direction of the Vice President on how NASA should return
to the moon and go on to Mars in a safer, better and a more
rapid timeframe at a minimum cost. The study was titled
``America at the Threshold'' and Mr. Augustine provided a copy
to all members of the committee prior to that first meeting
they had.
After the Columbia accident in 2003, I was asked by the
NASA Administrator to chair the Return to Flight Task Group to
review the Columbia Accident Investigation Board
recommendations to ensure that these recommendations are
carried out by NASA before the space shuttle return to light,
and today I want to acknowledge the work performed by the
Augustine Commission that covered these broad-based subjects in
a relatively short period of time. After my own extensive
examination of the committee's reports, I strongly agree with
the majority of their findings. However, on a few I disagree.
I would strongly agree that the NASA Administrator who is
assigned responsibility for the management of NASA needs to be
given authority to manage the agency. This includes
restructuring resources, the workforce and facilities to meet
the needs. The Augustine committee has pointed out to some of
the underlying concerns and all the deliberations on the future
of U.S. human spaceflight program are that NASA has been
inadequately funded for many years, and on this point I
strongly agree. I certainly hope that this year a satisfactory
appropriations bill for NASA will be passed.
I agree with the committee's recommendation that the
remaining space shuttle flights should be launched on a
schedule that is compatible with the normal procedures that are
used for safe checkout and test for launch operations and which
may extend to flights into 2011. We presently have a shuttle at
KSC standby on notice for rescue if required. If funding were
available, this shuttle should launch large cargo that could
enhance the viability of the ISS six-person crew capability.
The committee wisely recommended the continuation of U.S.
participation in the ISS to be extended to 2020. We must
remember that the United States cannot make a unilateral
decision to end and deorbit the International Space Station.
However, the ISS will never be fully and effectively utilized
unless researchers and all the ISS international partners have
confidence that the facility will be supported and sustained as
long as it is operationally viable and technically useful. To
effectively use this great international laboratory, the ISS
requires a guaranteed cargo and crew delivery to be available
as soon as possible after the space shuttle retirement. Yet the
committee suggested that the responsibility be removed from
NASA and offered to commercial contractors. It is feasible for
the U.S. industry to develop a commercial cargo crew delivery
system to the ISS. However, the cargo dimensions are somewhat
limited.
The commercial transport of government crews to the ISS has
major implications of which I have a very different view. I
would like to differentiate the two subjects: potential
commercial crew cargo delivery to the ISS and commercial crew
delivery to the ISS. NASA has incentivized and selected two
contractors to provide commercial cargo delivery to the ISS,
and for commercial cargo delivery, the first issue is
development of a reliable booster to low earth orbit. The
second issue is to develop an autonomous transfer vehicle to
transfer the cargo from the booster to the ISS in a safe manner
that would meet the ISS visiting spacecraft requirements, which
were recently complied with by the European Space Agency's ATV
and the Japanese HTV.
The development of a transfer vehicle is in itself a
significant challenge. The European Space Agency recently
delivered their first ATV payload approximately four years
later than their initial target delivery date. The Japanese
delivered their HTV some two years later than their initial
target date. Both government entities used considerable
resources to develop these individual transfer vehicles. I
certainly wish the two U.S. entities success in meeting their
NASA milestones for cargo delivery since the ISS is dependent
upon continued supply of cargo delivery by the partners.
With respect to commercial government crew launch delivery
to the ISS, I would like to recall my own experience. I flew on
two Gemini missions with a specially modified Titan II ICBM
booster and two Apollo missions, one on the small Saturn IB and
one on a giant Saturn V, and over the period of 13 years I
experienced and participated in development of high
reliability, human-rated boosters, human-rated spacecraft and
launch abort systems. I was the backup pilot for the first
manned Gemini flight and spent many months in the factory and
countless hours in the spacecraft as it was being built and
tested. I was then pilot of Gemini VI, the world's first
rendezvous mission, and on that the Titan II stage ignited and
then shut down at T0. Wally Schira and I had the liftoff
signals in the spacecraft and a fire broke out down below the
base of the booster. The special emergency detection system
that had been installed on that Titan II helped us resolve a
couple of critical failures and our own decisions prevented a
fatality. Had that not been modified and the decisions right, I
would not be here today, Madam Chairman, and you would have
been reading about me in the obituary column.
I was also backup commander for the second Block I Apollo
flight and had my crew performing a similar test in the sister
spacecraft at the same time the Apollo I accident occurred and
the Apollo I crew died in the fire at the Cape. I was a backup
commander on the first Apollo Block II spacecraft, Apollo VII,
and again spent considerable time in the factory as it was
undergoing tests and fabrication. At that time there were
numerous NASA engineers, inspectors, support technicians to
facilitate this effort.
I was then commander of Apollo X, the first flight of the
lunar module to the Moon and again I spent an inordinate amount
of time in performing the tests to check out the command and
the lunar module.
My fourth mission was commander of the Apollo-Soyuz Test
Program. Again, I spent considerable time in that spacecraft
and also a brief time in the Soyuz spacecraft for the first
flew we ever flew. These flights both as prime and backup crew
members were accompanied by thousands of hours of training in
different types of spacecraft simulators and mockups in which
numerous emergency situations were simulated and resolved.
Therefore, safe delivery of a government crew to the ISS
involves the human rating of a launch vehicle, the spacecraft,
the launch abort system, successful integration of all three
elements. The process of requirements, design and construction,
all these parts start with the NASA safety and mission
assurance requirements. There also has to be a process where
there is not excessive creep in these requirements which could
result in cost increases and launch schedule delay.
Unfortunately, the Augustine report gave just a very brief
mention of crew safety for launch, orbit and recovery
operations. The report had no in-depth discussion of these
vital issues of safe launch to orbit and return to Earth of
government crews. If NASA can provide incentive seed money, can
industry raise or finance the funds? What are the safety
requirements for commercial government crew vehicle? That must
be commensurate with other government operating crew transport
systems.
The commercial entities that propose to provide safe
government crew transport will require a guarantee of a certain
number of flights for a certain period of time and a price in
order to minimize or to recover the reoccurring investment and
have a satisfactory return.
A major issue is, who assumes liability for the safe
government crew delivery. If it is commercial, would insurance
be available and at what cost? If safe commercial flight
transportation for government crew does evolve, other questions
will arise. On page 72 of the committee report it states, ``It
is critical to the success of the program that multiple
providers be carried through to operational service,'' and that
statement in itself has a huge financial implication for both
the government and the commercial providers. If NASA is buying
a government crew ride rather than a spacecraft, then how, by
whom and to what standards will the government's equipment and
operations be certified? What entity other than NASA can
establish and verify appropriate standards for human
spaceflight? That question becomes very crucial.
Madam Chairman, thank you and the members of the
Subcommittee for the opportunity to express my opinions. I will
be glad to respond to any questions you or the other
distinguished members have. Thank you.
[The prepared statement of Lt. General Stafford follows:]
Prepared Statement of Lt. General Thomas P. Stafford
Chairwoman Giffords, Ranking Member Olson, and Members of the
Subcommittee, I am honored to be invited to appear before you today to
testify on the matter of crew safety in human spaceflight. In the wake
of the Augustine Committee report, it is imperative that the
implications of that Committee's recommendations be considered
carefully before this Congress directs, or allows, changes to be made
to the program NASA has pursued and the Congress has approved for more
than four years.
Before proceeding to answer your questions, I would like to make a
few observations concerning the Augustine Committee report.
The most important observation of that Committee, and the
underlying concern in all deliberations on the future of U.S. Human
Spaceflight, is that it has been inadequately funded for many years
now. The budget projected for NASA in the next decade and beyond is
inadequate to accomplish the core objectives with which NASA has been
charged. The funding is inadequate to build a timely replacement for
the Space Shuttle, to return our astronauts and other international
partner nations from the Space Station to the Earth and then to visit
the moon, near-Earth asteroids, and to develop the technology and
systems required for the first human voyages to Mars.
This plan for NASA has been approved by the Congress. It is a
program offering the strategic vision for human spaceflight that was
demanded by Adm. Gehman and the Columbia Accident Investigation Board.
It is a program worthy of our nation. The Augustine Committee notes
that at least three billion dollars per year must be added to NASA's
appropriation to accomplish the mission. Even more importantly, the
Committee notes that there is no other worthwhile program of human
spaceflight which could be accomplished for the amount of money
presently planned for NASA.
The choice is now plain: either we will provide the funding
necessary to accomplish worthy objectives in space, or this nation will
cede its leadership on the space frontier to others. I wish to add my
voice to those who say that this leadership, the result of five decades
of effort purchased at the cost of nearly a trillion of today's dollars
and many lives, some of them given by close friends of mine, must not
be allowed simply to drift away. As a nation, as a people, we must be
better than that.
Today, I want to acknowledge the intense work performed by the
Augustine Committee to cover these broad based subjects in such a
relatively short period of time. After extensive examination of the
Committee's report, I strongly agree with the majority of their
findings and recommendations. I also strongly agree that the NASA
Administrator, who has been assigned the responsibility for the
management of NASA, needs to be given authority to manage NASA. This
includes restructuring resources, the workforce, and facilities to meet
mission needs. However, on some of the Committee's findings, I have a
different opinion.
I agree with the Committee's recommendation that the remaining
Space Shuttle flights should be launched on a schedule that is
compatible with the normal procedures used for safe check out test and
launch operations, which may extend the flights into 2011. We presently
have a Shuttle at KSC on standby to launch on short notice, if
required. If funding were available this Shuttle could carry cargo
delivery that would enhance the viability of the ISS six-person crew
capability.
The Committee wisely recommends the extension of the International
Space Station past 2015 to at least the year 2020. However, the ISS
will never be fully and effectively utilized unless researchers in all
of the ISS partner nation have confidence that it will be supported and
sustained as long as it is operationally viable and technically useful.
To have and to use this great international laboratory requires a
guaranteed space transportation capability to be available as soon as
possible after Space Shuttle retirement. The Committee recommends that
this responsibility be removed from NASA and offered to commercial
providers.
I would like to differentiate the two subjects, Potential
Commercial Cargo delivery to the ISS and Potential Commercial
Government Crew delivery to the ISS. NASA has incentivized and selected
two contractors to provide commercial cargo delivery to the ISS. For
commercial cargo delivery, the first issue is the development of a
reliable booster to low earth orbit. The second issue is to develop an
autonomous transfer vehicle to transport cargo from the booster to the
ISS in a safe manner that would meet the stated ISS visiting spacecraft
requirements that were complied with by the European Union Space Agency
ATV and Japan's HTV. The development of this type of a transfer vehicle
is a major challenge. The European Space Agency recently delivered
their first ATV payload approximately four years later than their
initial target delivery date. Japan delivered their HTV some two years
later than their initial target date. Both government entities used
considerable resources to develop their individual transfer vehicles. I
certainly wish the two U.S. entities success in meeting their NASA
milestones for cargo delivery since the ISS is dependent upon a
continued supply of cargo deliveries by the partners.
With respect to commercial crew launch delivery to the ISS, I would
like to recall my own experience. I have flown two Gemini missions on a
modified TITAN II, ICBM, booster and two Apollo missions, one on the
Saturn IB and one on the giant Saturn V. Over a period of thirteen
years, I have experienced and participated in the development of high
reliability boosters, spacecraft, and launch abort systems. I was a
back-up pilot for the first manned Gemini spacecraft and spent many
months in the factory and countless hours of testing in the spacecraft
as it was being built and tested. I was then pilot of Gemini VI, the
world's first rendezvous mission. On that mission, the TITAN II first
stage engines ignited and then shutdown at T=0. Wally Schira and I had
the lift off signals and a fire broke out below the base of the
booster. The emergency detection system that had been installed on the
TITAN II helped us to resolve the two critical failures that we
experienced in that extremely short period of time.
I was the back-up commander for the second Block I Apollo flight
and had my crew performing a similar test, in the sister spacecraft, at
the same time that the Apollo I accident occurred and the crew died in
the spacecraft fire on the launch pad. I was then back-up commander of
the first Block II Apollo spacecraft, Apollo VII, and spent
considerable time in the command module which was being built and
tested. There were also numerous NASA engineers, inspectors and support
technicians at the factory to facilitate this effort. This support
effort was similar to the Gemini program, where numerous NASA
engineers, inspectors and support technicians participated in the
manufacturing and test at the factory. I was then the Commander of
Apollo X, the first flight of the Lunar module to the moon. Again, I
spent an inordinate amount of time in performing test and check-out in
the command module and the lunar module.
My fourth mission, I was commander of Apollo for the Apollo-Soyuz
Test Program. Again, I spent considerable time for the test and check
out of the Apollo spacecraft and a brief time in the Soyuz spacecraft.
These flights, both as a prime and as a backup crew member were
accompanied with hundreds of hours of training in different types of
spacecraft simulators and mockups where numerous emergency situations
were simulated and resolved.
Therefore, safe delivery of a government crew to the ISS involves
the human rating of the launch vehicle, the spacecraft, and the launch
abort system, and the successful integration of all three elements. The
process of requirements, design, and construction all begin with the
NASA safety and mission assurance requirements. There also has to be a
process where there is not an excessive creep in requirements that
would result in cost increases and launch schedule delays of the
vehicles. The Augustine Committee report gave just brief mention of
crew safety for launch, orbital, and recovery operations.
Unfortunately, there were no in-depth discussions of the vital issue of
safe launch to orbit and return to earth of government crews.
It may be that the complexity of developing a new government crew
space transportation capability, and the difficulty of conducting
spaceflight operations safely and reliably, it is not fully appreciated
by those who are recommending the cancellation of the present system
being developed by NASA, and the early adaptation of the presently non-
existent commercial government crew delivery alternatives. There seems
to be some belief that if NASA would ``step aside'', private
alternatives would rapidly emerge to offer inexpensive, safe, reliable,
dependable government crew delivery space transportation at an earlier
date.
Human spaceflight is the most technically challenging enterprise of
our time. No other activity is so rigorously demanding across such a
wide range of disciplines, while at the same time holding out such
harsh consequences for minor performance shortfalls. Aerodynamics,
aerospace medicine, combustion, cryogenics, guidance, and navigation,
human factors, manufacturing technology, materials science, structural
design and analysis--these disciplines and many more are pushed to
their current limits to make it possible and just barely possible at
that, to fly in space. Space is very, very hard.
We've learned a lot about human spaceflight in the last five
decades, but not yet nearly enough to make it ``routine'' in any
meaningful sense of the word. As Adm. Gehman and the CAIB outlined,
these flights in the past have been developmental flights and the
relatively small number in the future will be the same. Thus far, it
has been a government enterprise with only three nations yet to have
accomplished it. Development of new systems is very costly, operational
risks are extremely high, and profitable activities are elusive. It may
not always be this way, but it is that way at present.
Apart from questions of technical and operational complexity and
risk, there are business issues to be considered if the U.S. is to rely
upon commercial providers for government crew access to space. It is
not that industry is incapable of building space systems. Far from it.
It is American industry which actually constructs our nation's space
systems today, and carries out most of the day-to-day tasks to
implement flight operations, subject to the government supervision and
control which is required in managing the expenditure of public funds.
So the question is not whether industry can eventually develop
government crew delivery systems and procedures to fly in low Earth
orbit. It can. The relevant questions in connection with doing so
commercially are much broader than that of the relatively simple matter
of whether it is possible. Let us consider a few of those questions.
Absent significant government backing, will industry provide the
sustained investment necessary to carry out the multi-year development
of new commercial government crew delivery systems to LEO? Will
industry undertake to develop such products with only one presently
known customer, the U.S. Government? What happens if, midway through
the effort, stockholders or boards of directors conclude that such
activities are ultimately not in the best interests of the corporation?
What happens if, during development or flight operations, an
accident occurs with collateral damages exceeding the net worth of the
company which is the responsible party? A key lesson from the
development of human spaceflight is that safety is expensive, and the
failure to attain it is even more expensive. Apollo 1, Challenger, and
Columbia have shown that spaceflight accidents generate billions of
dollars in direct and collateral liabilities. Who will bear this risk
in ``commercial'' space operations? If the company, how much insurance
will be required, where will it be obtained, and at what cost? If
government indemnification is expected, upon what legal basis will it
be granted, and if the government is bearing the risk, in what sense
will the operation then be ``commercial''?
When commercial government crew delivery space transportation does
come about, other questions will arise. Will there be competition in
this new sector, or will there be a monopoly supplier? If NASA is to
contract with the first, or only, commercial government crew space
transportation supplier, and if there is no price ceiling established
by a government alternative, how do we ensure a fair price for the
taxpayer in a market environment in which the government is the only
customer for the products of a single provider? And how is a space
operation ``commercial'' if the government is both regulatory agency
and sole customer?
Leaving aside technical, operation, and business concerns, there is
the matter of the schedule by which these new commercial systems are
expected to come into being. The Augustine Committee has been
particularly pointed in its clams that, with suitable government
backing, such systems can be made before the comparable Constellation
systems, Ares 1 and Orion, could be ready. Page 71 of their report
offers such a claim.
Are such claims optimistic? Any launch system and crew vehicle that
can transport a half-dozen people to and from the ISS, and loiter on-
orbit for a six-month crew rotation period while serving as an
emergency crew return vehicle, is necessarily on the same order of
complexity as that of the old Saturn 1 and the Apollo systems. The
Saturn 1 conducted its first test flight, with a dummy upper stage, in
October 1961, and carried a crew for the first time in October 1968.
The Apollo VII spacecraft which carried that crew, of which I served as
back-up Commander, began its own development in 1962. Thus, the Earth-
orbital segment of the Apollo system architecture required a half-dozen
years and more to complete. These developments were carried out by
highly experienced teams with virtually unlimited development funds in
the cause of a great national priority.
If, in the fashion of airline travel, NASA is buying a ride rather
than a spacecraft, then how, by whom, and to what standards will the
company's equipment and operation be certified? How is NASA to
determine that the system is truly ready to fly? Does the government
merely accept the claims of a self-interested provider, on the basis of
possibly very limited flight experience by company pilots? We certainly
do not do that for military aircraft, and even less so is this the case
for civilian transport aircraft. Extensive development and hundreds or
even thousands of hours of flight testing followed by operational test
and evaluation by the government is required before a new military
aircraft is released into operational service; I've done that kind of
testing. Similarly, new civilian aircraft are subject to extensive
testing involving certification of systems and hundreds of flights to
exact certification standards before they are allowed to be put in
passenger service. Will we accept less for new, ``commercial'' space
systems which carry government astronauts, or those of our
international partners? In my opinion, the Congress should certainly
not accept less.
Yet, today, we do not even know what standards should exist for the
certification of commercial spacecraft to carry government crew members
into orbit. What entity other than NASA can establish and verify
appropriate standards for human spaceflight? I will tell you that from
my perspective and from the history that I have lived, these standards,
like airworthiness standards, are written in other people's blood. Some
of that blood was shed by friends of mine. We don't know enough, yet,
about human spaceflight to relax the hard-learned standards by which we
do it. And we certainly do not yet know enough to make the assumption
that new and untried teams can accomplish it on a schedule that is
better than was achieved during Apollo.
This takes me to another point. Some of you may recall that, a few
years back, I chaired a Task Force on International Space Station
Operational Readiness. This task force was charged with making an
independent assessment of our readiness to put crew on the ISS, and to
sustain it with the transportation systems, Russian and American, which
were necessary for cargo delivery and crew rotation. We did not take
this matter lightly. The ISS was new, and much smaller. We did not then
have the years of experience we have since accumulated in building the
ISS and flying on it. Our then-recent long-duration spaceflight
experience had mostly been accumulated during the Shuttle-Mir program,
and Russian experience in resupplying the Mir and the earlier Salyut
space stations was not unblemished. Numerous docking failures had
occurred over the lifetimes of these programs, resulting not only in
cargo which went undelivered but also, in one case, the collision of an
unmanned Progress resupply vehicle with the Mir. An in another instance
there had been a fire on Mir itself and the first crew to visit their
first very small space station Salyut died after performing the orbit
maneuver to reenter the atmosphere.
These indicants and accidents gave us pause. Not because we doubted
the capability of the team; the Shuttle had been flying for over
fifteen years by that time, and the Russians had accumulated decades of
experience in long-duration spaceflight. I've flown with them; I know
how capable they are. No, our concerns were heightened by our awareness
of just how careful one has to be in this most demanding of
enterprises. We cannot afford to relax that vigilance today as we go
forward into a new era of ISS utilization, and as we prepare once again
to voyage outward from Earth, first to the moon or the asteroids and
then beyond. There is a place in these plans for the contributions of
commercial government crew space transport entrepreneurs, but not yet
demonstrated, and not to the exclusion of NASA's own systems.
I have asked many questions in this testimony, questions which I
believe must be answered if commercial government crew human
spaceflight is to become viable. I believe that these questions and
others yet to come can and will be answered at some date. However,
America's continued leadership in space should not depend upon the
nature and timing of those answers. When commercial entities can
provide dependable transportation reliable, U.S. government crews as
well as partner nation crews, the government should buy it. But until
that time, there should be an assured government capability to
accomplish the task.
Thank you.
Chairwoman Giffords. Thank you, General.
I want to thank all of our witnesses today, and we are
really blessed to have such a star-studded group of individuals
with lifetimes worth of knowledge and expertise.
We are going to begin our round of questions now. I am
going to start with 5 minutes, and because we have so many
members, I will try to really make sure that we all speak for
five minutes including cutting myself off.
Safety of Launch Systems
Let me begin with something that Dr. Fragola had put in his
testimony and touched on it with his slides. You had stated
that it was your belief that the Ares I launch vehicle because
of its inherent focus on being as safe as achievable from the
very beginning has the best chance to be outstandingly safer in
terms of it being a crew launcher. You talked about that as a
good way to begin from just the very start. Given the fact that
we are under enormous budget constraints here in the Congress
and that funds available for NASA's human spaceflight and
exploration program are always going to be more constrained
than we would like, we need to think about how we prioritize,
and I would like to hear from I think General Stafford and Mr.
Marshall on how important a factor should the inherent safety
of the Ares I vehicle be for Congress to consider as we make a
decision on which launch system or systems to pursue in meeting
NASA's International Space Station and exploration needs. I
would also like to hear whether or not this should be the
inherent safety of the Ares I, should this be a significant
discriminator when choosing among alternatives and also who
should carry the burden of proof? General, let me start with
you.
Lt. Gen. Stafford. Madam Chairwoman, again it starts with
the requirements stated there by the NASA Safety and Mission
Assurance, and I noticed that the astronaut group had stated
their own requirements, that the reliability of the crew from
launch into orbit is three nines. In other words, you have had
a failure no more than one out of 10,000. I did my own review
and my best memory back from Apollo, and we were striving for
four nines at that time, Madam Chairman, 40 years ago, and just
to be sure that I had this right I checked with Dr. Chris
Kraft, who was there with the space task group and director of
mission operations and then was later center director, and he
said that they were striving for four nines, and in fact, Dr.
Kraft said he would like to give a few of his thoughts on his
how to distinguish reliability of boosters.
``Since the first time a pencil was put to paper, the
engineers and technicians are all responsible that the vehicle
be used to carry astronauts and others into space. They know
that the life of the individual depends on it. This is true of
the first-level engineer, the lead designer, the chief
engineer, the program manager and company executives. This is
also true of the machinists, the contract buyer, the piece part
selector and the safety, reliability and quality control
experts and the test engineers and eventually by the person who
has to stand up on launch day and say `go' when that launch
director asks.
``In my opinion, that is the case for the Ares I and Orion.
It is not the case for the COTS-crewed government vehicles. To
think that it is the large and dedicated oversight, you know,
group could provide the same amount of credibility and
reliability and safety and quality for a machine is to say that
the first paragraph was misunderstood and has probably not been
experienced.''
So it starts right from the very start. And I know from my
own experience that the Titan II had several dead zones in it.
That program in Titan Gemini was a high-risk demonstration
program only.
Chairwoman Giffords. Thank you, General.
Mr. Marshall?
Mr. Marshall. Well, first of all, as you have heard today
from this panel, I think everybody agrees that safety has got
to be an integral process of selection and enforcement of any
vehicle that is used in the future for human flight to provide
astronaut travel to any place in low earth orbit or beyond. So
I think that that is an absolute given that it has to be
fundamentally thought through from the very beginning. That
said, the ASAP has had the opportunity to look and observe the
evolution of the Ares process. We have challenged Jeff and his
team on numerous occasions and we have been very, very
impressed by the product and the processes that they have
employed. The commercial side is just now beginning, and as I
noted in my opening statement, we, the ASAP, believe actually
that NASA is behind because they haven't articulated what the
requirements are from a human ratings requirement. We find good
receptivity from the commercial providers thus far but the
truth is, if they are building vehicles today and we would
rather have had those rating requirements articulated so that
they could be integrated into the design processes at that
moment rather than let them transpire and move forward for
integration at some other time. So we are very concerned about
where the COTS-D program or the like or similar name is in this
process case, so the basic bottom line is, safety has to be a
primary consideration in any selection of any vehicle.
Chairwoman Giffords. Thank you, Mr. Marshall.
Next we will hear from Mr. Olson.
NASA--Commercial Industry: Sharing of Safety Standards
Mr. Olson. Thank you very much, Madam Chairwoman, and I
would like to follow up on Mr. Marshall's comments but with
you, Mr. O'Connor. I mean, that is one of the criticisms we
have heard about the COTS-D program, NASA's commercial space,
is that NASA is behind in getting the information to the
industry as to what they need to do to become human rated. And
so could you briefly explain how NASA uses its human rating
requirements to tailor the design of a particular crewed system
such as the Ares and the Orion, and again, following up on the
line of questioning of Mr. Marshall's comments, if the human
rating requirements are the top-level requirements, how would a
potential commercial provider gain the insight to design a
system that meets NASA's requirements? And one more question,
how did NASA get comfortable enough to finally certify the
Soyuz for human spaceflight?
Mr. O'Connor. Yes, sir, glad to answer those. The first
part of this is the commercial crew transport. Currently, there
is no formal start of that program. We have been talking about
it. We have asked for people to--commercial companies to give
us information on how they think that might go. We have made
our regulations, our policies, our requirements known. All that
have asked for them, we have made them available. As I
mentioned, even those things that are not yet transformed into
requirements and standards, the results of the survivability
study that we did in 2008, that has not yet been flowed into a
set of standards but we tried to make that available as well.
The human rating requirements document at the top level is 31
technical requirements, or what I call ``shall'' statements. It
is very limited. It is very top level. It is the kind of thing
that says that shall have an abort escape system, you shall
have failure tolerance in your design. But in the beginning of
that document it says that there are three pieces to this. The
first piece is that you are expected with your design to do all
the things in a NASA development that are required throughout
the whole set of standards and requirements, not just those 31
but all the mandatory standards and requirements are given
before you get into this human rating requirements document.
This is where tailoring comes in. We spent six to eight
months with the Constellation team and my team going over the
flow-down of all the safety and mission assurance requirements.
These requirements come in the form of documents that are
called mandatory standards or mandatory requirements. But in
order to know which of the ``shall'' statements that are
embedded in those things really apply, you have to go through a
pretty thorough flow-down activity and we did that with
Constellation. It took about 6 to 8 months to go through that
tailoring process to figure out for this particular concept,
for this particular mission, for this particular design which
of our ``shall'' statements would apply. We also invited the
team to come in with alternatives. There is a NASA standard but
there is also alternatives. Industry has some standards, for
example, on how to do soldering and so on. We start with the
NASA standard but we invite our contractors and our projects to
come in with alternatives if they think they can do it just as
well. This is part of that ``Yes If'' thing I was telling you
about earlier.
Now, as far as something that we don't design because our
NASA human rating requirements document is for a NASA
development. Now, in the past we said we would like to fly with
the Russians. We would like to fly one of our astronauts. Norm
Thagard back in 1995 flew on the Soyuz. The Soyuz was not built
to any given NASA standards of the day. It was built to Russian
standards back in the 1960s. The process for building and
assembling and launching the Soyuz was not to NASA standards.
It was to longstanding Russian procedures. To get to the
comfort level we needed to fly our person on their mission, we
spent about three years with some of our best engineers working
with the Russians to understand the equivalence of their
system. We know they don't do things exactly the way we do but
can we get confident about it, and we took some time and a lot
of good people to develop that confidence, and in the end we
got to the point where we believed that even though they may
not do things exactly the way we do, we are confident to the
same level that we would if we were flying them on one of our
systems. This business of acceptability of risk is part meeting
requirements. It is also part building the confidence where the
requirements don't exist or where they are someone else's
requirements. We need to do a risk-informed confidence-type
activity to get to where we feel comfortable doing it.
Mr. Olson. Well, thank you for that very thorough answer to
my question. I see my time is over. I yield back.
Mr. Marshall. Sir, may I make an addition if I may?
Chairwoman Giffords. Yes, Mr. Marshall, just briefly,
though.
Mr. Marshall. I just wanted to report that we have followed
up with NASA as to where they are. We received a detailed
briefing in November and are satisfied that the approach that
they are moving forward is now appropriate and timely.
Mr. Olson. Thank you, Mr. Marshall.
Chairwoman Giffords. Thank you, Mr. Olson.
Dr. Griffith, please.
Potential Impact of Constellation Program on Commercial Sector
Mr. Griffith. Thank you, Madam Chair, and thank the panel
for being here. We have been in numerous, numerous hearings
prior to the Augustine report and after the Augustine report.
Each time the Ares I comes to the top as a respected and well-
thought-out plan some four, five years in the making. The
successful test of Ares I-X was an achievement that we truly,
truly appreciated and with the 700 sensors that were mentioned
and the data that is going to be collected, it seems to me that
the commercial aspect of this was an introduction into the
Augustine report that was fascinating and it is greatly
discussed but it is not hard science as we have now today with
documentable evidence of safety. It is probably three, maybe
four or five years out and it seems that we could achieve our
commercial aspirations in space by developing the Ares I to the
point where it is reliable, consistent. Our solid fuel engine
is reliable. Our liquid fuel motor is reliable. Our Orion
capsule is going to be reliable. We have every reason to
believe that it is and it seems like our steppingstone into the
commercial venture is successful development of Ares where it
can be insured, where we can be confident that our human
spaceflight, our astronauts can be insured and it can be
successful.
My question is, why wouldn't we take the approach of asking
our government to fund the Constellation project with the idea
in 36 months or 48 months we could transfer much of that
information into the commercial sector with a great deal of
confidence and not delay the challenge that we are facing with
China, India and Japan? Mr. Alexander, would you address that,
please?
Mr. Alexander. First of all, I think it is important to
remember that Ares, Orion, particular Orion, is designed for
exploration beyond LEO. It is a spacecraft whose prime purpose
is to take--originally designed to take people to the Moon and
back and the space station if necessary if there were not
alternatives. As such, it is a more complex spacecraft and more
expensive spacecraft than I think what you would want to do
commercially. As for the Ares I rocket in terms of commercial
use, I think you also have an infrastructure, a per-flight cost
that would be prohibitive from a commercial perspective. That
being said, the Commercial Spaceflight Federation, you know,
takes no position over whether the Ares I program should
continue as is or should be changed or Orion for that matter. I
personally believe that, you know, this country needs an
exploration program and it needs a crew exploration vehicle
like Orion to go beyond low earth orbit. That is very important
for the Nation's human spaceflight program. But at the same
time, we don't need to be serving all missions with the same
vehicle because then you are not optimized for any one mission,
and I believe and I think the Augustine Committee found that
the capability or the technology, the knowledge is resident in
U.S. industry to do crew transfer and cargo transfer to low
earth orbit and that if NASA wants to get on with the business
of exploring beyond low earth orbit, it needs to transition
operational tasks like that to commercial sector so that it is
not continually taking on more obligations than it can afford
to take on.
Mr. Griffith. Thank you.
Human Rating for Commercial Sector
Mr. Hanley, the timeframe for human rating on Atlas or
Delta for the astronauts would be what? What would we look at
if we said today that we are going to develop commercial sector
with taxpayer-funded money and a commercially or human-rated
launch vehicle?
Mr. Hanley. Well, the work that we have done over this last
year, we had a study that was performed by the Aerospace
Corporation for NASA. They projected, and I am going on memory
now--we can get an answer for the record if I misstate this but
I believe it is on the order of six years from start to develop
a system that would have been derived off the Delta IV heavy
launch vehicle. That booster as Aerospace studied it would have
used the existing core stage and a new upper stage. Not
included in that study, of course, were the implications to the
Orion if Orion had to change at all, and that would be
something that would have to be further studied.
Mr. Griffith. Thank you.
Thank you, Madam Chairman.
Mr. Alexander. Could I follow up on that, please?
Chairwoman Giffords. Sure, Mr. Alexander.
Mr. Alexander. That study as described by Mr. Hanley was
talking about a Delta IV heavy vehicle that is for the Orion
spacecraft to low earth orbit, a 25-metric-ton spacecraft. It
did not address or at least in the comments did not address the
Atlas V version vehicle which has flown 19 times successfully,
which would be used to put commercial crew capsules that are on
the order of 8 to 12 metric tons up into low earth orbit. So it
is not an apples-to-apples comparison to talk about a six- or
seven-year human rating process for one vehicle when in the
commercial world we are talking about a different vehicle that
has already, you know, achieved a certain demonstrated
reliability, would go through a human rating process but is
certainly not at the six- to seven-year timeframe.
Mr. Griffith. But what would be your estimate other than
the six to seven years. Would you say three?
Mr. Alexander. I would say that. I think the capsule is
what is going to drive the timeline, not the human rating and
the launch vehicle.
Mr. Griffith. Lieutenant General?
Lt. Gen. Stafford. The experience we had with the Gemini
Titan, and that was an all-out push, was 39 months. It was over
three years. And we had some dead zones in that, and I don't
see how this could be any sooner. It will probably be longer.
One thing I might add about this gap, and I would rather not
transfer money to Russia just like anybody on this Committee
would, but I think one thing to look at that has occurred is
that the OMB to me in de facto has set space policy when they
came in and cut money back and said you will finish--first
originally came in just a person over there a second-level tier
said the Administrator will finish it, 15 flights 2008, they
said, but the President said we are going to complete the space
station, phase out the shuttle and said maybe so but this is
what it is. So to me, there needs to be an institution, someone
like the National Space Council used to have that would oversee
that so that second-level tier and groups like that would not
cut back. If the proper money, it is my understanding, sir, had
been applied, we would have had the Ares Orion flying in 2012
or 2013 so there would not have been too much of a gap. And I
don't know that the President ever really got the word back
because he had other major issues on his desk at that time like
Iraq and Afghanistan.
Mr. Griffith. Thank you, Madam Chair.
Chairwoman Giffords. Thank you, General Stafford. Thank
you, Dr. Griffith.
Next we will hear from Mr. Hall, please.
Program Management and Scheduling Issues Between Congress,
Administration, and NASA Over Time
Mr. Hall. Thank you, Madam Chairman.
General Stafford, you worked in the space program for many,
many, many years and you spanned a lot of days from Apollo to
the current shuttle program, and I think you are about as
knowledgeable as anyone I know, and you know we are looking for
a way to save the program that I guess the last four or five or
six Congresses have agreed on to pursue, and that involves
having to address that four-year gap in there, and if I may be
wrong, I probably am, but it seems like to me that we need
about $2 billion a year additional for about four years to make
that happen. And what that would do would preserve our
leadership in space, would preserve our space station, would
preserve our friendship with some partners that have been good
partners in space. What was your experience during the Apollo
program in working with Congress and the Administration on
program management and scheduling issues, and could you
highlight the major distinctions between then and now? It was a
lot easier then than it is now, and I think we just have to
keep insisting that the President either in the next address to
the Nation comes on in and recommends what we have all asked
for and what I think everybody on this Committee here wants, to
save our space station, save our position in space and not have
to rely on Russia for anything. You might just in a minute or
so if you can just kind of compare those times with today.
Lt. Gen. Stafford. Thank you, Mr. Hall. The President's
policy was carried out completely with the help and approval of
the Congress. The National Space Council that was chaired by
the Vice President helped oversee that and the OMB followed in
line, and as I mentioned just previously, it appears that in
certain cases the OMB in de facto is setting space policy, and
this is one of the real issues. Also, we have today Continuing
Resolutions that we didn't have in those days. But if the
President sets a policy, it should be carried out and the
funding you said would certainly do it, so we could have had
the Ares Orion flying in 2012 or 2013 so there wouldn't have
been much of a gap in this. Thank you, sir.
Mr. Hall. Any others want to make any comment on that? You
are all experienced and you have been around all a while. You
know, not too many years ago we almost lost the space program
by one vote in Congress, and that alerted everybody from
schoolchildren and everybody else that is interested in the
space program. It even caused a fine old man like Dr. DeBakey
to come and walk out all four of the floors here in the Rayburn
Building to talk to everybody, and a lot of them couldn't find
time to talk to him because they didn't want to tell him no.
But that following year I think we passed the program by
something over 100 votes, 120 or something, but then we all got
together on it. I am just wondering what kind of pressure we
can put on the President of the United States to come out with
a recommendation. Of course, back in those days, that is before
Katrina and before the vicissitudes of nature had set us back
in several of our states and 9/11 and 8, nine years of war. We
are in a little different situation. But you know, if you can
throw away $350 billion on AIG and not even know where it is
going or not ever receive an accounting for it, they can find
$2 billion a year for the next four years for us to save a
program like the space program. It is a lot harder to do now
but you six men are leaders and more knowledgeable than anyone
I know--this is the best panel I have seen up here in a long,
long time--to put your shoulder to the wheel and every chance
you get talk to the President, talk to the czar, talk to
whoever you have to talk to to get into it. But we need to save
this program. We need to go forward with this program and we
don't need to fall back behind or have to battle with China or
any other nation. We just have to assert ourselves some way and
find that money. If we are going to have all these bailouts,
this is an awfully good place for one right now. Save the
program. I have even thought about trying to alert all the
schoolchildren of America for write-ins to get them to write in
what they think about it because they are the real loser or
beneficiary of what you do and what this Congress is going to
do this year and next year with regard to the space program.
But you see a lot of difference in then and now, don't you,
Tom?
Lt. Gen. Stafford. Mr. Hall, I certainly do. It is a
different era. In the cooperation between the President, the
Congress, the OMB, it is completely different, sir. I wish it
could be like that. In fact, it could be possibly a
recommendation from me to this Committee to say that the OMB
should follow the policy of the President.
Mr. Hall. And then we want to talk to the President. I
yield back. I think I have used my time. Thank you, Madam
Chairman.
Chairwoman Giffords. Thank you, Mr. Hall.
One of the reasons why we have held so many hearings, two
hearings ago we had a fascinating panel of experts to talk
about tech transfer from NASA because in so many ways the
accomplishments of NASA go beyond just exploration or go beyond
what we can physically see up in space right now, but from the
airline industry to the medical industry, computers, it has
been extraordinary the gifts that NASA has given to our country
and to the world and so part of our job on the Subcommittee is
to make sure that the American people, the President, other
Members of Congress understand that as well.
Next we are going to hear from Ms. Edwards.
Implementation and Application of Safety Standards
Ms. Edwards. Thank you, Madam Chairwoman, and thank you to
the panel. Every time we have these hearings, I learn something
new. In my mid-20s I recall sitting in front of a monitor at
Goddard Space Flight Center, the elation of a launch in January
1986, the confusion thinking that there was something that we
had done wrong in our communications on that day, and then the
absolute silence of silence, unlike any I have ever heard over
our colleagues as we realized the disaster that had happened
with the Challenger. And I think at that time I think all of
us, no matter what we did believe, that we paid great attention
to safety and obviously the investigations that followed
demonstrated that there were huge gaps in safety, pockets where
there was a lot of attention to safety and other pockets where
there wasn't, and we even to this day and after the Columbia
disaster continue to point to some of those same gaps, and I
think, you know, safety has to be north, south, east and west
in NASA whether the services and work is being performed by a
contractor or internally at NASA and so I appreciate the
testimony today.
In looking at the Augustine report, there is really
actually very scant mention of safety in the report I think as
General Stafford pointed out and so one of the questions that I
have really is, and especially with the principles that I think
Dr. Fragola, you outline, how you would take those principles
today and actually even apply them to Challenger and to
Columbia to see whether, you know, these design systems, for
example, that had been, you know, launched--I don't know--25
times, I think when the Challenger disaster happened and we
would have described those as, you know, pretty reliable, but
whether those principles applied today would allow Challenger
and Columbia to meet the mark as you have indicated that
perhaps in the design and the concept of Ares you think that
that would meet the mark.
Mr. Fragola. The principal problem with the space shuttle
is a lack of abort system, the lack of being able to address
the recovery of the crew given an incident. The shuttle as a
launch vehicle is among the best, if not the best in the world
as a reliable vehicle but the shuttle points out very
dramatically the difference between reliability and safety. I
would also like to point out, having been involved in the
original shuttle competition, the reason--one of the reasons we
sought the shuttle was, we were concerned at the time about
recovery of the Apollo capsule. We had had one failure where we
lost one parachute and we were concerned about that system and
we were therefore interested in designing a system that would
address the failings of the past, and so we felt that a landed
system, a system with wings, would improve on the recovery, and
it certainly has improved on the recovery but it has increased
the vulnerability in ascent and increased the vulnerability in
other areas. So one of the things that I think we should learn
from this is that we can't anticipate all the unknown unknowns
in a system, and that is one of the reasons why it is essential
to have a robust and well-tested system that is able to survive
and abort safely. We didn't do that on the shuttle.
Ms. Edwards. So Mr. Marshall, I wonder if you would
describe for me how it is that we could apply a set of safety
standards and principles both within NASA and also in a
commercial environment given our experiences?
Mr. Marshall. Well, you heard earlier that the FAA ought to
be the licensing authority for commercial venue. We certainly
agree with that and we think that there is a need to really
aggressively develop that process. I am not an expert on that
and haven't participated but my understanding is that the
process is just beginning. Conversely, NASA establishes the
crew safety requirements, and this is what I was talking to
from a commercial venue. We, the ASAP, believe that NASA does a
great job for its own government-controlled programs but that
this process really needs to be accelerated from a commercial
perspective if there is going to be movement and direction in
that particular arena. So we think that it is a combination of
both the licensing authority and the user of that, which is the
NASA authorities, to aggressively develop the human rating
standards that are necessary to provide for the crew safety.
Ms. Edwards. Thank you.
Madam Chairwoman, I know my time is expired. I obviously
have tons more questions.
Chairwoman Giffords. Thank you, Ms. Edwards.
Next we will hear from Mr. Rohrabacher.
Mr. Rohrabacher. Thank you very much, Madam Chairman, and
again, thank you for your leadership in this Subcommittee.
Constellation Program: Human and Certification Options Concerns
First of all, let me just state, I am not opposed to the
Constellation concept. I think that from what I have seen, the
Orion and Ares system has a role to play. I am a bit worried
that what we have here, however, is a mindset that I have seen
before and a mindset that has failed before, and that is,
trying to have one system that will serve all needs and thus
actually bring down the chance of success of that mission or
the ability of that mission to actually do a very great job in
a specific area. I remember the Edsel car was supposed to be
something for everybody and it turned out to be nobody in
particular really wanted it because it was designed for
everybody. I remember the F-111, which was an aircraft that was
designed supposedly--I remember that during the early 1960s and
it was supposed to be something that could fulfill every
mission but then once they built it, none of the military
people really wanted it because it really didn't fulfill any of
the missions as well as they had hoped or what they wanted. I
would hope that with Ares Orion, we are not making that same
mistake trying to say that we have to have the same rocket and
transportation system for low earth orbit that we have to have
for other missions, later on the Moon, and I support the moon
mission. That is why I think maybe the Ares Orion system is
important in the long run but why in the short run do we have
to have it fulfilling the same needs that we could perhaps
serve--might be better served by making the Delta system, which
is a very good system, been very reliable, or the Atlas V
system, and just making them with the ability to carry people
then and they can, I guess, man certified I guess is the words
we are looking for. So why is it that we have to have--Mr.
O'Connor, why is it that we have to have Ares doing everything
rather than going with trying to do manned certification for
Delta and Atlas?
Mr. O'Connor. Well, sir, this is a decision that was made
some time back when we were looking at the vision and what we
wanted to do with human spaceflight, and in the context of the
mission, which was to have something that would take our
astronauts to the moon as a steppingstone to further out, the
concept included two different launch vehicles, one heavy and
one light, and the light one was carrying crew. And by
definition, the light system that carried the crew had to be
able to take the crew to low earth orbit. Now, the Orion was
designed----
Mr. Rohrabacher. Having to do that doesn't necessarily mean
it is the most cost-effective and the most efficient way of
doing it.
Mr. O'Connor. Right, and I agree. It had to do that as part
of the lunar mission, and if you simply said let us not worry
about the lunar mission, let us do something just to low earth
orbit, then you would start from scratch and say let us do
something that is just for low earth orbit, and you may not
have the Ares Orion system.
Mr. Rohrabacher. We spent a lot of money on the Delta and
Atlas systems over the years and they have proven themselves in
terms of actually launch systems. I don't know, we haven't put
people on them but they have proven very reliable in that.
Again, I don't--and by the way, I support the moon mission. I
think the moon mission is a good mission and that is why I
support the Ares Orion system but suggesting that we then have
to because that is going to be used for a later mission, we
have to use that rather than Delta or Atlas, I don't think it
makes sense. There is something that doesn't--I am going to
have to study this a little more. It just doesn't seem to come
together for me that that is a requirement.
Mr. O'Connor. Yes, sir. You know, when we looked at this--
and I am going to defer to the program manager on this because
he has looked at it harder than I have but just from my view as
the safety guy, it seemed to me that either one of those two
options was an F-111 equivalent. The Atlas and Delta are not
designed to carry people in space. They don't have the
structure for it. They were designed for cargo, and they are
very reliable but they would have to be significantly modified
in order to do----
Mr. Rohrabacher. Well, you know, reliability of cargo, what
we are talking about is human cargo, and I don't see that as
being in a totally different category. You just want to make
things a little bit adjusted for human beings.
Well, my time is up. Thank you very much, Madam Chairman,
and maybe we can have a second round if we have time.
Chairwoman Giffords. Indeed.
Mr. Hanley, would you like to comment?
Mr. Hanley. Just to address your concern with respect to
the exploration mission and Ares I, the underpinnings of the
Constellation's exploration architecture to go to the moon was
integral to the decision to choose Ares I or something quite
like it when those decisions were made. We began from the
process of the design of the Constellation system with the moon
in mind. The key driving requirements of Constellation, the
preponderance are for the lunar mission. So we selected it
because where we want to be taking our risk is on the lunar
surface, not in the first 100 miles. And we leveraged off of
the decision that we made on heavy lift, and because Ares I is
derived from the infrastructure we need for the big rocket, the
Ares V, you get it at sort of a marginal additional cost. The
design of the first stage solid and the design of the upper
stage engine on Ares I are the same assets that are used for
the Ares V, so the production capacity is common for those.
Chairwoman Giffords. Thank you, Mr. Hanley, Mr.
Rohrabacher.
Ms. Kosmas, please.
Ms. Kosmas. Thank you, Madam Chairman. Thank you,
gentlemen, for being here today. This is obviously an issue of
great importance to us here on the panel and also I think to
the American public as we move forward and make every effort to
maintain our leadership in space exploration for all the
reasons that are obvious to us and that we attempt on a regular
basis to make obvious to others, so we thank you for being
here.
ESAS Recommendations for Human Space Flight
No question about the fact that safety is a very important
concern. I want to chat with you a little bit about an article
that was in today's Orlando Sentinel. I am from central Florida
where the Kennedy Space Center is and so it is a big issue for
us in our district with regard to what the next phase of space
exploration will be, and also a great concern of course for the
gap, but nevertheless, safety of course is very important. The
story in today's Orlando Sentinel discusses the 2005
architecture study, ESAS, recommendation that after two test
flights, the first five flights of the new rocket and capsule
deliver only cargo to the International Space Station to
establish a record of reliability before putting humans on
board. The ESAS states it takes five flights in addition to the
two test flights to surpass the shuttle safety level of one in
100. If there were no cargo flights beforehand, the risk of the
first crewed flight after the two test flights would be
approximately one in 40, or approximately two and a half times
the shuttle. Adding cargo flights to ensure safety would only
seem to increase the gap in U.S. human spaceflight capability.
So the question I wanted to ask was beginning with Mr.
Hanley, I understand that the current plans propose putting
astronauts aboard Ares I and Orion after only a single unmanned
flight of the final rocket. Can you discuss this decision in
light of the ESAS original recommendation and what steps are
you taking to address this concern?
Mr. Hanley. Certainly. As part of the program's preparation
for its program preliminary design review that will be next
year, next calendar year, we are putting together our
integrated test and verification plan. The flight in which the
crew will launch will be informed by that plan and it requires
an understanding of the test program, and Joe talked about this
earlier, the test program that goes into verifying that these
systems will in fact perform the way that the designers believe
they will. There is a lot of variability in the methods one
might apply to try to use a crystal ball to predict how
reliable a particular system will be. Coming up with an
absolute number is very sensitive to the method or the
approach, the thought process that you use, and that is what we
see. So predominantly we use these risk numbers to compare
alternatives, not necessarily to inform some absolute number of
what the risk level really is. So with respect to the
assertions made in the ESAS study versus what we are doing
today, I would invite Joe to maybe comment because he was
integral to the ESAS study.
Mr. Fragola. And since I wrote that section that you
referred to, that is a great confusion. If they had only gone
to the page before, they would have seen that that statement
referred to an advanced engine on the Orion spacecraft using
LOX/methane. What we were trying to do was to enhance the
reliability, the mission reliability of the lunar missions with
a given performance. We were looking at LOX/methane because
LOX/methane was able to be carried through as a launch
propellant for Mars. What we wanted to show from a safety
standpoint was that there was a penalty in immaturity to the
system if we chose that LOX/methane option. So what you were
seeing there was that penalty. If we look at the Ares system,
Orion system today with the propulsion system that is now on
Orion, which is essentially the same that is on the space
shuttle OMS systems and has performed absolutely perfectly on
the OMS and was also on the lunar module descent engine and on
the command module serving as propulsion system, the immaturity
of the system drops to almost zero and now the immaturity of
the system is based on primarily the second stage of the Ares
system. And if you look at what it takes for that to get to the
equivalent of the shuttle, it is between one or two test
flights necessary to get the equivalent of the shuttle. It is
certainly not going to get to one in 1,000 at that point but we
are looking at trading off versus when does it get to the point
that the shuttle, which is what we are flying crew on today. So
the statement in the Sentinel is correct but it applied to an
option in the ESAS study, not the one that we are flying today.
Ms. Kosmas. Thank you. Unfortunately, I am afraid that
ended up using all my time, but thank you for the answer and I
will see to it that that information is passed along. Thanks.
Chairwoman Giffords. Thank you, Ms. Kosmas.
For the remaining member for our first round is Mr. Hill.
Mr. Hill.
Mr. Hill. Well, thank you, Madam Chairman. I got here
rather late so I need to get caught up on some of the
conversations you have been having for the last hour or so, so
I will pass on asking questions.
Chairwoman Giffords. Thank you, Mr. Hill. We are glad you
are here.
Availability and Economic Viability of Commercial Crew
Transport
We are going to begin a second round. We have not had votes
yet so it is our good fortune today, and while we have all of
you here we are going to take advantage of it, so I would like
to begin. I am going to ask everyone on the panel starting with
General Stafford if you could answer two questions. Taking
everything that we have learned today about safety and the
complexities of what it takes to build these vehicles, is the
timetable for availability of commercial crew transport truly
realistic? That is my first question. And the second is, given
the required steps of everything that factors into building
these vehicles, do our witnesses believe that would-be
commercial crew transport service providers be able to garner
sufficient revenues from non-NASA passenger transport services
to remain viable over this time period as well? So those are
the two questions that I have. I know that you gentlemen come
from different aspects and different angles of this industry.
You know, the backdrop of course is in light of the fact that
we have a diminished budget. I mean, if we had sufficient
budget to do everything, I am sure that all of us on this
Committee would agree that this is where we want to invest our
money, I mean, because the benefits that come from both the
private and public space sector is outstanding and much
underappreciated. But given the fact that we have finite
resources, I think that these are two important questions. I
would like to begin with you, General Stafford.
Lt. Gen. Stafford. Thank you, Madam Chairman. First, on the
safety for the commercial crew delivery for government crews,
the observations in the Augustine report said 2016. If they
would go to meet the requirements starting with safety and
mission assurance, I think that would be a very tough goal to
make it. They could possibly make it. But on the other hand,
when they said 2017 for the Ares Orion, I do not understand
that. It should be far sooner than that.
As far as other customers that the commercial crew delivery
corporation would deliver to, right now, other than the space
station, I know of no other ones that would be there at this
time.
Chairwoman Giffords. Thank you, General.
Dr. Fragola?
Mr. Fragola. Well, certainly the challenge is a potential
challenge that could be met by the commercial crew. It is a
question of what the uncertainty involved is, and from my
perspective based upon history, it would be very uncertain that
we could meet that kind of a date. Certainly the type of work
that has gone on in Ares since the time of ESAS to today to
ensure safety in that vehicle is equivalent to what you would
have to do on any vehicle, whether it would be a Titan or a
Delta or an independent commercial launcher.
I would like to go back to that one thing that I said
before to answer Mr. Rohrabacher. There is a big difference
between a crew payload and a payload that is not crew because
after the accident, the payload that is not crew doesn't care a
whit about what happened but the payload that is crew cares a
lot, so what we have to do is to design the abort system
integral to the failure mechanisms that are on that system and
that requires a much greater knowledge of your launcher than
they have today with commercial payloads or for Air Force
payloads.
Chairwoman Giffords. Thank you, Doctor.
Mr. Alexander.
Mr. Alexander. Thank you. I believe that the timetable as
laid out by the Augustine Committee is realistic. That is seven
years from now. Certainly I don't believe that the human rating
of the launch vehicle is the long pole in the tent. I believe
it is the development of a capsule to take people to the
station and back. There are companies that say they can do it
in significantly faster time than that and there are others
that say it will take at least that long, and I wouldn't, you
know, pretend to be the expert that is going to predict exactly
what it will take. However, I do know that it will take longer
if we do not start now. As I said before, I don't believe that,
you know, Ares Orion and commercial crew are competitive. I
think that you need to do both, so it is not about which one
gets there first necessarily but I do believe that because
servicing the station is a simpler mission, less complex, and
you can use demonstrated reliable launch vehicles that will
need modifications but not extensive modifications because they
have a track record of 19 successful launches or heritage of 19
launches, that that is a realistic timetable.
Second, as to whether there are viable revenues from non-
commercial or non-government sources, there is already a market
for private spaceflight participants that have been paying
between $25 million and $35 million to fly on the Soyuz. Those
people spent 6 months of their lives learning Russian, training
on Russian systems separated from their revenue-generating jobs
that they have. I believe that if the United States industry
were able to offer that capability, you would have a far
greater number of people willing to take that on and pay that
kind of money. Also, you know, with the hope that with
commercial, the price comes down, that market becomes bigger,
but there is also a market for other U.S. industries and other
activities, microgravity research, et cetera, in space that is
not efficiently served by NASA and the NASA process and I think
that commercial will be able to find additional revenues there.
They certainly will not be the bulk of revenues in the
beginning but there is a place for--or there is a demonstrated
market there now that will only grow.
Chairwoman Giffords. Thank you, Mr. Alexander.
Mr. Marshall.
Mr. Marshall. Regarding the two questions, is the timetable
realistic, in the ASAP's 2008 annual report, we made a
statement that said that there is no evidence to suggest that
the use of a commercial space industry vehicle can
significantly close the gap. We stand by that statement. We
have no evidence that would say otherwise. I think the term
that is of importance is ``significant.''
Orbital Sciences and SpaceX
The second is, given the steps, is there sufficient revenue
to provide survivability. I mentioned to you in my opening
statement that we have gone to both SpaceX and to Orbital
Sciences. We were at Orbital Science this week, and during the
presentation we asked their senior management if they had done
a market analysis to find other revenue sources that would
address this specific issue. The answer was no, we have not
done the market analysis because we see no viable commercial
requirement at this time. Now, I am not trying to put words in
their mouths. That is just the way I interpreted it. I would
think that that is a fairly accurate statement.
Chairwoman Giffords. Thank you, Mr. Marshall.
Mr. Hanley?
Timetable: Commercial Crew Transport
Mr. Hanley. With respect to timetable, I can really only
speak to what I would see as the challenges, and Joe has
touched on them. I think it is--and I would agree with Mr.
Alexander, I think it is about the spacecraft, it is about the
launch abort system as well as the rocket. Joe, I think, spoke
quite eloquently about how it is an integrated system. It needs
to be designed altogether as an integrated system to be able to
maximize crew safety, and I think that is where the real
challenges lie for other developers. That is certainly where
our focus has been for these four years, and so what kind of--
what that does to the timetable or not I really couldn't
comment, not having detailed knowledge of the plans and the
alternatives. So with respect to revenue, I hope to maybe live
to see the day when I can buy a ride, but as far as revenue, I
really don't have a comment.
Chairwoman Giffords. Thank you, Mr. Hanley.
Mr. O'Connor.
Mr. O'Connor. I haven't done an independent assessment of
these schedules but I can just tell you as a safety guy
watching program and project managers and contractors predict
schedules for years, as I watch that happen, I have seen that
sometimes they miss and some of the things that cause them to
miss schedules is the down time after failure. Another thing is
the lack of integration up front. If you don't do good
integration up front, then you pay for it later and it takes
time. I remember after Challenger we tried to retrofit an
escape system on the Challenger and we flat couldn't do it. So
it wasn't even a matter of schedule. It was just too hard. So
getting early, getting things done quickly in the front part of
a program that you are going to need later on can help with
schedule because it takes much longer to fix things than to do
it right in the first place, so that is all I can add to that,
and I really haven't looked at commercial revenue at all so I
wouldn't comment on that.
Chairwoman Giffords. Thank you.
Mr. Olson.
Ares Program: Safety and Future Impact
Mr. Olson. Thank you, Madam Chairwoman, and this is a
question for all of you or anybody who wants to comment, but I
want to get back to some of the issues, some of the concerns we
were talking about about the Ares program, and as you all know,
a couple of weeks ago we had a very successful test of Ares I-
X, a vehicle that had over 700 sensors on board to measure many
of the factors that that spacecraft was feeling as it went
through its ascent, and I just want to get some comments from
all of you. How does that level of technology that we have now,
how does that increase our ability to develop a vehicle safely
and not have necessarily the flight test that we had to have in
the past, and one sort of side question to that is, how does
development of Ares I help speed up the development of Ares V,
you know, basically the same system in many, many ways. Does
that allow us to accelerate the development of the Ares V? Mr.
Hanley, you first.
Mr. Hanley. Well, the way I think of it is that by
developing Ares I we are in fact developing parts of Ares V
today so we aligned our strategy purposefully back four years
ago. If you will recall, coming out of the Explorations System
Architecture Study, the Crew Launch Vehicle, as it was called
at that time, the Ares I was called, was a four-segment solid
plus an upper stage that utilized the space shuttle main engine
and we purposefully at the agency level made a decision to
change to the five-segment and J2-based upper stage because we
wanted to leverage the early investment of dollars we were
making toward building the heavy lift launch vehicle. So that
is the synergy between Ares I and Ares V that a lot of folks
miss. So we are building part of the Ares V rocket today with
the five-segment booster with the J2X engine. We even
purposefully will be looking to play forward the investment we
are making in the avionics that guide the rocket as well. The
hurdles that we face with building a larger rocket really focus
on the core stage, the massive core stage in that system, and
those are investments we have yet ahead of us.
Mr. Olson. Thank you for the answer, Mr. Hanley.
Any other panel member care to comment? Okay. Well, that
was my last question, Madam Chairwoman. I yield back the
balance of my time.
Chairwoman Giffords. Thank you, Mr. Olson.
Dr. Griffith, please.
COTS vs. Constellation Program
Mr. Griffith. Thank you, Madam Chair.
Some in NASA have suggested that by taking on the risk of
procuring maybe a commercial service to deliver astronauts to
the space station that we will lower our costs and provide
greater launch capability, yet the COTS program was to be a
proving ground for commercial sector to deliver cargo to the
station but to my knowledge, that has yet to happen. I don't
know that any of the commercial orbital transportation service
providers or the funding of that has been able to deliver what
we had hoped that it would. It seems that we should require our
commercial providers to prove their ability to deliver on these
contracts or on these ventures that taxpayer funds have funded.
And so my question is, and anyone can answer this, the
commercial orbital transportation services, what evidence do we
have, what hard evidence do we have that we can rely on them to
deliver manned spaceflight in a more timely way than we have
with our Ares I or Constellation project? Is there any
evidence?
Lt. Gen. Stafford. Mr. Griffith, as I said, I did extensive
examination of the Augustine report and I knew many of the
members and have talked to them, I told them I would be giving
testimony here today. In fact, this morning I talked to Dr.
Crowley twice on my cell phone on his idea of multiple
providers and his assumed cost on those commercial government
crew delivery vehicles, and then I checked with Mr. Hanley here
and so it was a wide variance between their assumptions and
what we have, and also I found that there was also, on the
Augustine Committee there was somewhat of a wide variance of
opinions among the committee members, sir.
Mr. Griffith. Thank you.
Mr. Alexander?
Mr. Alexander. Thank you. The question of whether to prove
cargo first, if you will, before putting people on top, I
certainly agree with that in terms of demonstrated reliability.
Those cargo systems that are being developed are being
developed right now and those will fly many times before people
are put on those rockets or any new system goes on an Atlas V
which already has a demonstrated reliable launch record. The
question of whether cargo has delivered, you know, the programs
has not been completed yet to first flight. They have not had
their demonstration flights yet. As Mr. O'Connor said, every
space program seems to have cost growth and schedule risk, or
schedule drift, if you will. I would put the record of those
cargo demonstration programs up against the record of
government space program developments in terms of cost growth
and schedule risk, and I think they would compare very
favorably. So whether they have met all their milestones
exactly as they originally planned four years ago, I am not the
expert to speak to that but they are certainly progressing well
as evidenced by the fact that NASA is paying on those
milestones and is in agreement that things are progressing
well. So I do believe that those programs are functioning well.
I believe that, you know, demonstrated launch vehicles and
cargo missions will happen before crew missions happen, and
again, as I said before, the longer we wait to start that
process of crew activities or commercial crew activities, the
longer it will take us in terms of shortening any gap or when
we actually would be able to deliver that service.
Mr. Griffith. Thank you, Mr. Alexander.
Risk Assessment: Commercial Vehicle
Dr. Fragola, are you involved in the risk assessment
whether it be the risk assessment of a commercial vehicle for
delivery of cargo or the development of a commercial vehicle
for the delivery of our astronauts?
Mr. Fragola. At this moment, I have no involvement in that.
However, as part of the review, the independent review, I did
look at the alternative launch vehicles, particularly Delta IV
heavy. As part of the ESAS study, we did look at the Atlas V
single core. By the way, it is important to point out as Mr.
Alexander has mentioned, the Atlas with the 19 successes is a
single-core vehicle with a rather limited payload capability to
orbit as compared to the payloads that we are talking about on
the Ares I. There is no doubt that the single-core vehicle
would be more reliable than a triple-core Atlas but a triple-
core Atlas doesn't exist today. We don't have an Atlas heavy.
The option would be a Delta IV heavy and that was evaluated and
seemed to be about a factor of two to a factor of three less
safe than the Ares. But one of the things I wanted to point
out, as I mentioned, immaturity is very important. One of the
arguments against the Ares is, well, the first stage of the
Ares is not equivalent to the SRB on the shuttles, it is a
five-segment booster. I would point out that we are recovering
the booster first stage. That is not going to occur on any of
the commercial alternatives and so the learning we can get from
inspection post flight is incredibly important to advancing the
maturity of the vehicle and to proving that we have carried
over the 255 successful launches of the SRB on the shuttle and
the Ares I.
Mr. Griffith. Thank you.
Thank you, Madam Chair.
Chairwoman Giffords. Mr. Hall, please.
Mr. Hall. Madam Chairman, I think you will leave the record
open for us to write and make inquiries if we need to. With
that understanding, I will yield my time to Mr. Rohrabacher.
Ares, Delta, Atlas: Comparison
Mr. Rohrabacher. Thank you very much. I just want to get
into this thing about making some comparisons in terms of the
alternatives that we have, and Dr. Fragola, I appreciate your
comments. I think we might disagree but I am really interested
in learning from you on this because you know much more about
it than I do. I understand that. But when you are suggesting to
us that we have to look at the many uses that have been put
through and the actual track record of the first stage of the
Ares, that really doesn't count, does it? Because the system
itself can't be certified as being reliable until the second
stage, which has never even been built yet, is put into the
system. Isn't that right? So with that type of analysis, there
is not even a comparison between the Delta and Atlas in
reliability because the Ares doesn't even have their second
stage built yet, which the system will fail if the second stage
doesn't work.
Mr. Fragola. That is correct. The second stage is the risk
driver and that is the reason why we chose a J2X system which
has heritage both in the RS-68 engine and in the J2 engine and
the J2-S engine. It is true that the stage and the engine as an
integral sum has not been----
Mr. Rohrabacher. You say risk driver, but that risk has
already been assessed in terms of Atlas and Delta. We have no
way to even assess whether that risk--what that risk is because
we haven't even built the second stage----
Mr. Fragola. Even----
Mr. Rohrabacher. --to get the system that you are talking
about.
Mr. Fragola. Again, the equivalent payload, even on the
Delta IV heavy, we would have to modify the second stage of the
Delta IV heavy. There is no way we can get the payload that we
get so we would have to have----
Mr. Rohrabacher. Well, that is if you want a payload that
big, but if you are having medium-sized payloads, it has
already been proven.
Mr. Fragola. If you were to decrease the requirements
significantly down to the payload like Mr. Alexander has spoken
to, then you would have to--you would be able to use the
existing second stage----
Mr. Rohrabacher. And you might want to have a few more
launches rather than having to launch everything on one rocket.
That doesn't--it doesn't make sense to me that you just have to
have everything in a big payload carrier.
Orion Space Craft
Let me get to beside the rocket, and I only have a couple
minutes left here. I would like to look at the actual
spacecraft, the Orion spacecraft, as compared to the
alternatives there as well, and again, I am not opposed to the
Ares Orion system because I do believe in the moon project. I
just think that if we try to do everything--the moon project
has to be the same thing that we rely on for a low earth orbit.
That may not be the best deal for the taxpayers and it may not
be as reliable and it may not be as far so that we can bring it
into play, but I understand Boeing--Boeing is in my district,
and I seem to remember that they are developing this other
spacecraft, and why is it that spacecraft--in terms of safety,
is it more--is the Orion safer than what Boeing is presenting
to us?
Mr. Fragola. I guess I am not familiar with the particular
Boeing spacecraft. I know some other spacecraft. Which one are
you referring to?
Mr. Rohrabacher. Well, it is in development right now. I
understand that it hasn't been flown yet, but I understand that
they are proposing this. Maybe I----
Mr. Fragola. I can't comment on a design I haven't seen. I
haven't seen that yet. If someone would present the design, I
could look at it.
Mr. Rohrabacher. And do the NASA people know anything about
a Boeing proposal on this? So I am wrong then, I have been
misinformed then that the commercial spacecraft companies are
actually proposing a spacecraft that would be similar to Orion.
Mr. Fragola. Well, we visited--similar to Orion, no, but we
did visit a few people who had mockups of vehicles, but mockups
of vehicles, we had them in ESAS four years ago. I mean,
between that and a real design is a far way to come.
Mr. Rohrabacher. And Mr. Alexander wants to mention
something here.
Commercial Crew Development Program
Mr. Alexander. If I might, I believe that Boeing has teamed
with Bigelow Aerospace to propose something under NASA's CCDev,
or commercial crew development program. So that is at this
point probably a concept----
Mr. Rohrabacher. It hasn't actually been designed out and--
--
Mr. Alexander. Right. They were one of the, you know,
finalists for the Orion Crew Exploration Vehicle. Lockheed
Martin ended up winning that program. I am sure that they
have--their current design has a lot of heritage to what they
were proposing for Orion but they were not the winner.
Mr. Fragola. By the way, we saw that vehicle and that
vehicle's design requirement requires you to rendezvous and
dock within the first orbit in order to meet the payload, and
that means that if you don't have proper rendezvous and you
don't dock the first time, you deorbit, and Bigelow was willing
to accept that because he was a commercial enterprise, but to
do that on the station, I don't know that that's something that
is prudent. If he does that, he limits the payload, limits the
design. He also doesn't have to carry the things to sustain the
crew for two or three orbits and that significantly reduces the
mass of the----
Mr. Rohrabacher. Thank you very much.
Thank you, Madam Chairman.
Chairwoman Giffords. Thank you, Mr. Rohrabacher.
Ms. Edwards.
Training for Commercial Space Operatives
Ms. Edwards. Thank you, Madam Chairwoman. I just have a
question and it goes to the testimony that you presented,
General Stafford, with regard to training and your indication
of how involved and important it is for the crew to really be
involved in training that simulates off nominal conditions and
also, you know, the number of hours that are spent with regard
to safety in every detail. And so I wonder if you could
actually speak to what you might identify as some of the
challenges presented for training with commercial space
operations.
Lt. Gen. Stafford. Ms. Edwards, to launch, rendezvous and
then dock with the International Space Station, you would have,
you know, working with the spacecraft simulator and mockups and
then you also have integrated simulations with the mission
control center that, you know, has control of the International
Space Station. So you would have to go through the
contingencies and so it would be a whole series of issues and
that would start with a whole series of just to start with,
using the launch abort system, the recovery, what action the
crew would take, egress from it. And so also on these vehicles
as they are being built, we are talking, I think,
approximately, Ms. Edwards, two and a half flights per year, if
I am correct, that the crew would probably be there at the
factory when the spacecraft was being built too to understand
it. But also in the simulations, it would be just repeat
simulations and there is a profile for this and it requires
really hundreds of hours.
Ms. Edwards. And do you think that that profile changes in
any respect with what are essentially sort of off, you know,
outside of NASA operations? And I also wonder if Mr. Alexander
could speak to this question.
Lt. Gen. Stafford. Well, if it is outside of NASA
operations, I would assume it would not go to the ISS because
the requirements, you know, you have to go to rendezvous and
dock with the ISS, a strict number of requirements. In fact, I
was involved with some of that, having worked with the
investigator with the Progress colliding with the Mir there on
the Shuttle-Mir program then. So I think NASA would be involved
there, and then you have, you know, particularly the commander
and the pilot would have to be deeply involved and go through
this and maybe people just along for the payload specialist or
mission specialist for the ride would not have to undergo near
that many but the one that is the commander and the pilot would
definitely have to undergo hundreds of hours on that.
Ms. Edwards. Mr. Alexander?
Mr. Alexander. Certainly a rigorous testing program and
training program would be instituted for any commercial crew
mission, whether it is a commercial mission just to low earth
orbit or whether it is carrying NASA astronauts to the space
station. So obviously everybody on board the vehicle is going
to have to go through a rigorous training program, and
certainly the pilot and commander would be much more rigorously
trained than anybody that is just simply a participant on the
flight.
I think in a broader context, you know, right now for any
U.S. human spaceflight mission throughout our history, it has
been a mix of government through NASA and industry, U.S.
industry, building things, and the relationship has been one of
a seamless, integrated relationship between NASA and industry,
you know, a certain contractual environment. What we are
talking about for a commercial crewed program that would fly
NASA astronauts is still going to involve an intimate
relationship between NASA and industry. Some of that
relationship will change based on historical patterns. But it
is certainly not one without the other, and I think it would be
a mistake to assume that from a commercial perspective we
expect to develop something, throw it over the transom and have
NASA just accept it. NASA is going to be there every step of
the way. They are going to be intimately involved and that
certainly will be true for training of NASA astronauts but will
also be true in the design, testing and production processes.
Ms. Edwards. So you don't envision any significant change
to training protocols and requirements with a venture towards
commercial operations?
Mr. Alexander. I am not an expert on what those are today
but there would certainly be rigorous training and there would
certainly be agreement between NASA and the private sector
about how that is going to happen and what is expected such
that by the time a NASA astronaut is on board that vehicle,
they are not only capable of flying it and capable of flying it
in off nominal conditions and abort scenarios but that NASA at
the highest levels all the way up to the Administrator and
through Bryan O'Connor have the confidence in that system and
the overall system capability including the people involved.
Ms. Edwards. Thank you, Madam Chairwoman.
Chairwoman Giffords. Thank you, Ms. Edwards.
Ms. Kosmas, please.
Soyuz Space Craft: Concerns Moving Forward
Ms. Kosmas. Thank you, Madam Chairman.
I wanted to chat with you all a little bit about the Soyuz
that is intended to be used during the gap. I know, Mr.
O'Connor, you spoke earlier about the history and the fact that
not that much combined testing was done early on and that we
made a decision as a Nation to send an astronaut anyway. But I
think we are a little more enlightened now perhaps. As you
know, following retirement of the shuttle, NASA is planning to
rely solely on the Soyuz for astronaut transportation to and
from the International Space Station, and this will probably
be, from discussions we are having right now, for at least five
years. So I would like to ask, General Stafford, you can answer
it or Mr. O'Connor, last year the Soyuz experienced a few rough
landings due to malfunctions, and can you discuss NASA's
assessments following these incidents whether they were
involved in the assessments following the incidents and the
decision to continue to use the Soyuz? The other question which
I will go ahead and ask now is, are we now--is the Soyuz now
required to meet our U.S. standards for quality, safety,
environment, wages of workers, financial accountability and
engineering practices? So are they accountable to us in the
same way that we would expect our commercial operations to be
or that we would expect NASA itself to meet? I would appreciate
if you could address that since it does appear that that is our
alternative during the five years. General?
Lt. Gen. Stafford. Thank you, ma'am. As the chairman of the
ISS Advisory Committee, we meet with our Russian colleagues at
least twice a year and they have conference calls once a week
concerning issues that would arise, and on that the Soyuz first
flew in 1967. There have been two fatalities, one in 1967 and
one in 1971. Since 1971 they have had 100 percent reliability.
The basic first stage flew 52 years ago. The second stage in
the Soyuz has been--is 42 years old. Since 1971 they have had
100 percent success. They did not meet all of our criteria. In
fact, I am the only one on the committee here who has been in
the Soyuz and I did that first one on the Apollo-Soyuz and we
had them change a couple of their systems before we would fly
with them and there has been follow-up since then, and I think
Mr. O'Connor has outlined the fact of what they do with their
safety and they are very attuned to it, and we are completely
informed about that. As far as the two reentries on the delay
of the service module, the separate and all that, they have
taken into account, explained that, and so to me, it should be
a situation that is solid again. I would rather have us fly on
our spacecraft, ma'am, as soon as possible and if we had the
budget we could do that.
Ms. Kosmas. Mr. O'Connor?
Mr. O'Connor. Ms. Kosmas, we were quite concerned with
these landings. In fact, Peggy Whitson was in one of those and
it was a pretty interesting ride for her, and would be for
anybody, and so we offered to help the Russians in their
investigation. They put together a commission to take a look at
it. General Stafford and his counterpart in Russia have a
committee that oversees the safety of the Soyuz flights and
they were interested. We were all asking questions. We did our
own independent assessment of what we thought might have
happened based on what we know about Soyuz' design and we
compared notes with the Russians. In the end, they didn't get
to the root cause the way they wanted to but they fixed all the
possible things that could be the real root cause of this thing
and they fixed those things to our satisfaction. They shared a
lot of information with us, way more than they used to in the
old days. There are some times when we and the Russians do not
agree on something like, for example, the relative risk of some
issue that has come up, but by and large they are very open,
and when we don't agree with one another, we lean back on their
demonstrated reliability, the quality of their workforce and
the relationship our engineers have with theirs over a period
of about 15 years now.
As for how we are planning to work with them in the future,
we don't retroactively assign all of our human rating or any
other kind of requirements on the Russians to participate with
them as partners. We have an MOU with them. We have signed up
to extend the MOU to fly our astronauts and those other
astronauts from Japan, Canada and Europe who depend upon us for
transportation. It is the Russian transportation that we will
be providing for them as well. So we take them under our wing.
We take our responsibility very seriously.
Ms. Kosmas. Thank you. Unfortunately, the time is up.
Chairwoman Giffords. Thank you, Ms. Kosmas.
Because we have a situation where we have time yielded to
Mr. Rohrabacher, we actually now will go back to Mr.
Rohrabacher, but I would like to introduce Ken Bowersox, an
astronaut who has experience in both shuttle and Soyuz. It is
good to see you today, sir. Welcome to our Committee.
Mr. Rohrabacher.
Addressing the Gap in Human Spaceflight
Mr. Rohrabacher. Thank you very much, Madam Chairman, and
we are in a little time bind here and I will try to be as quick
as I can. Let me get to some fundamental issues here.
The basic challenge that we are facing is to close the gap
that will be created when the shuttle is grounded as soon as
possible and with as less risk as possible, and that is the
challenge that we have. The challenge isn't going to the Moon.
Right now the challenge we face is closing that gap. In terms
of servicing the space station and low earth orbit, will the
Delta system and the Atlas system, those rockets as they are
now configured, will they be able to lift the payload necessary
to deliver either a payload or crew to the space station or we
will have to reconfigure those rockets? Anybody?
Mr. Alexander. Absolutely those vehicles as they are
designed now have the performance capability to take a capsule
for people or cargo to the space station.
Ares
Mr. Rohrabacher. Okay. When it comes to Ares Orion, they
need to have something else that is developed and which is
actually invented or, so to speak, a second stage or that
system cannot deliver a capsule to the space station. Is that
correct?
Mr. Fragola. If it were the Orion capsule, it could not do
that. For a degraded with payload that is much less than Orion
and we would do it on a single-core Atlas, we would have to use
probably an Atlas 431, which includes three solid rocket
boosters wrapped around a central core, and I doubt that that
would be able to pass snuff on safety because in the OSP days
when Bowman did his report, comprehensive report of
alternatives, they showed that wrapping solids around a liquid
core is----
Mr. Rohrabacher. Okay, but I am not talking about Atlas
here. I just want to get the information about the Ares. We are
going to have----
Mr. Fragola. The Ares payload is significantly better than
any of those alternatives.
Mr. Rohrabacher. Okay, but it depends on developing a
second stage that doesn't exist.
Mr. Fragola. You would need a second stage for the Delta IV
heavy as well to carry the payload. If you changed the payload
or you changed the----
Delta IV and Atlas
Mr. Rohrabacher. Does the Delta IV--you are saying that the
Delta IV cannot carry a payload to the space station without
something new being put onto the Delta IV? I am trying to get
at----
Mr. Fragola. Yeah, for the Orion spacecraft on the Delta IV
heavy, we would need a new upper stage. We would either have to
four RL-10s or----
Mr. Rohrabacher. We just heard the testimony from Mr.
Alexander----
Mr. Fragola. He is speaking of a much smaller payload.
Mr. Rohrabacher. Well, listen, I am not talking about--you
know, maybe we have to fly more missions to get the same level
of payload. I am just talking about getting an actual payload
to the space station. You might have to--it might actually be
less risky to fly three Delta missions there with a rocket that
currently we have than to rely on a rocket that has a heavier
lift but you have to build a whole new second stage which may
or may be able to be built. Until that thing flies, we don't
even know if it is going to function.
Mr. Fragola. I would respectfully suggest that history
shows us that the first-stage problem is the serious problem,
and on the Delta 431, which is the only single core that can
carry the payload that Mr. Alexander is talking about, you
would have not only a single core but you would have three
solid rocket boosters, and the Delta II accidents and the Delta
34D accidents show how important the interaction between the
solids and the liquids are in a survivable condition. You would
create a condition if you lost the solid, that would engage
the----
Mr. Rohrabacher. I have only got a couple more seconds. But
the Delta--from my understanding, the Delta and Atlas have a
very good track record, and what we are saying is, we have a
track record to actually get things to the station, close that
gap as compared to an Ares. If our strategy is to depend on
that, it is to depend on a second stage that hasn't been built
yet, and I will have to say from my experience, any time you
don't have a piece of technology that is built and functioning,
you can have the schedule go way back and the costs go way up
so we wouldn't be able to close that gap.
Mr. Hanley. And that is exactly why--you mentioned Boeing
earlier.
Mr. Rohrabacher. Yes.
Mr. Hanley. That is exactly why we have Boeing on contract
to be producing the upper stage for Ares because they have the
corporate knowledge and the heritage in producing such systems
of similar scale and they are bringing--doing a fantastic job
bringing their expertise----
Mr. Rohrabacher. It was a good decision to take Boeing----
Chairwoman Giffords. Mr. Rohrabacher, we only five minutes
left in the vote so I am going to have to cut you off.
Mr. Rohrabacher. Thank you very much.
Chairwoman Giffords. Mr. Hill, my apologies. Okay. We are
coming down to the minute. We are going to run over. I want to
thank our witnesses today. It was absolutely brilliant
testimony. I think we learned a lot. This won't be the first
time that we address safety. We will come back to this because
it is so critically important.
You know, I am sorry Mr. Hall can't be here for the end
because I really believe what he said initially is so
compelling and really reflects the sentiment of the Congress.
We are strongly committed to provide a safe way for our
astronauts to go to space and to travel back, and I have to say
that I find the level of safety that has been planned for Ares
and for Orion and the steps being taken to build safety into
this Constellation program from the very beginning to be
something that we have been proud to support for the last four
years. While I continue to have an open mind, I look to the
testimony of Mr. Marshall provided and I believe I quote you
here, ``The ASAP believes that if Constellation is not the
optimum answer, than any new other design system has to be
substantially superior to justify starting over.'' Based on
what we have heard today, and there is more in your written
testimony, I see no justification for a change in the direction
on safety-related grounds. Instead, I am in fact impressed with
the steps that have been to infuse safety into Constellation.
It is something that of course we are very proud as a country
we have been able to achieve this.
That being said, I don't intend, and I hope that people
don't think that is a competition of commercial versus NASA. It
is simply not that. We are all really excited and welcome the
growth of new commercial space capabilities in America. Like
Mr. Hanley, I too want to go to space and welcome the
opportunity to do that someday, not for $30 million but maybe
if the cost comes down. But currently I do not see those
capabilities as competition with, as Mr. Alexander talked
about, but rather complementary to our government systems that
are currently under development. Whatever the Congress may
decide to do with the question of additional incentives to the
commercial space industry, of course, in this time of
constrained budgets is something that really concerns all of us
and this is why this discussion today has been so important. It
is a question that needs to be decided on its merits, again,
not on passion, not on what ifs but the actual reality of what
is achievable and what can be documented. This is not a
substitute for a continued commitment to the Constellation
system that offers incredibly the safety benefits that we have
heard in the testimony today.
So thank you, gentlemen, for being here and to the Members
of Congress, of course, for being here. With that, I will bring
this hearing to a close by stating that the record will remain
open for two weeks for additional statements from the members
and for answers to any follow-up questions that the
Subcommittee may ask of the witnesses. The witnesses are now
excused and the hearing is now adjourned. Thank you.
[Whereupon, at 12:30 p.m., the Subcommittee was adjourned.]
Appendix:
----------
Answers to Post-Hearing Questions
Answers to Post-Hearing Questions
Responses by Mr. Bryan O'Connor, Chief of Safety and Mission Assurance,
National Aeronautics and Space Administration
Questions submitted by Chairwoman Gabrielle Giffords
Q1. In your prepared statement, you cite that NASA is beginning
development of a more concise set of human rating technical
requirements applicable to NASA developed crew transportation systems
as well as commercially-developed crew transportation systems or use by
NASA.
When do you envision these more concise human rating
technical requirements will be defined so that commercial
stakeholders can understand NASA's needs?
Is solely meeting these technical requirements the
litmus test NASA should use to determine if a commercial
transportation system is safe for its astronauts to use?
A1. NASA has formed a team to develop an implementation plan for human
rating of commercially-developed crew transportation systems. This plan
is based on NASA's approach to safety risk management and the existing
Agency human rating philosophy. This plan will clarify NASA
expectations, including technical requirements, and will be derived
from: NASA Procedural Requirements 8705.2 (Human-Rating Requirements
for Space Systems); Space Shuttle Program 50808 (ISS to Commercial
Orbital Transportation Services Interface Requirements Document); and,
other existing NASA requirements documents such as NASA Directives,
NASA Standards, NASA adopted standards, the Exploration Architecture
Requirements Document, the Constellation Architecture Requirements
Document, and the Constellation Human Systems Integration Requirements.
NASA released the preliminary plan using a NASA Request For
Information on May 21, 2010. Responses were due on June 18, 2010 and
NASA is in the process of reviewing and evaluating the responses. NASA
plans to finalize the Commercial Human-Rating implementation plan in
time to support an open-competition when NASA pursues the development
phase of commercial crew transportation systems.
Meeting NASA Human-Rating requirements is an important part of the
overall process but not the sole test NASA will use to determine if a
commercial transportation system is safe for NASA astronaut
transportation. Any system destined to operate in the proximity of the
ISS will be subject to the ISS ``Visiting Vehicle'' requirements, for
example.
NASA will define, as part of this plan, the appropriate level of
ongoing government visibility into the development, testing/engineering
analysis, production and operation of all launch vehicles and
spacecraft that carry NASA astronauts. NASA will also define its role
in hazard and risk analysis/acceptance, as well as design and
operational certification and flight readiness.
Q2. The Shuttle's operational costs have declined in the past few
years.
a. Do lower operational costs necessarily mean less safety?
b. What lessons learned from the way NASA is operating the
Shuttle may prove useful to how your office will oversee the
safety of future space transportation system, be they
government or commercially-provided?
A2. Although the overall annual Shuttle budget has declined over the
past few years, it should not be interpreted that the decline is in the
``operational costs'' of conducting Shuttle missions.
After the Columbia accident in 2003, the Shuttle Program budget was
significantly increased as NASA pursued parallel paths to address
findings and recommendations of the Columbia Accident Investigation
Board. The related costs for design, development, test and
certification peaked in the 2004-2005 timeframe, and have gradually
declined since.
As we approach the retirement of the Space Shuttle Program, NASA is
gradually closing out the Shuttle Program's production capabilities as
the last needed hardware and subsystems are making their way through
the production pipeline. This has led to a further reduction of cost.
These cost reductions have not and will not impact the focus on
safety by the Program for the remaining flights.
Once NASA has developed a strategy for acquisition of any new
launch, entry, and/or emergency deorbit capability or service, the
Agency must define its own role in ongoing management oversight and
technical insight, including certification of the design and operation,
and readiness of the team for flight, as well as ongoing role in
problem resolution, sustaining engineering, hazard and risk analysis/
acceptance. These decisions will be based on a number of factors, most
stemming from hard lessons learned during Apollo 204, Challenger and
Columbia mishap investigations and recovery. Examples include: a
respect by all involved for the inherent risks in human spaceflight,
not only in early development phases, but throughout the lifecycle; the
need for rigorous checks and balance between the developer and the
``owner'' of the technical requirements (Technical Authority); the need
for technical excellence among the development and assurance work
force, the need to include flight crew in system development as well as
flight test operations safety-critical decision-making; the necessity
of continually challenging past assumptions and engineering models as
part of the ongoing risk management process; and, the importance of
clear roles and responsibilities and good communications in all
directions as part of a healthy safety culture.
Questions submitted by Representative Pete Olson
Q1. Please explain with examples if possible. how NASA uses its human-
rating requirements to tailor the design of a crewed space system such
as Ares and Orion?
A1. NASA's Human Ratings Requirements document (NPR 8705.2B) applies to
the integrated flight/ground system, and is based on three key
principles:
1) Human-rating is the process of designing, evaluating, and
assuring that the total system can safely conduct the required
human missions.
2) Human-rating includes the incorporation of design features
and capabilities that accommodate human interaction with the
system to enhance overall safety and mission success.
3) Human-rating includes the incorporation of design features
and capabilities to enable safe recovery of the crew from
hazardous situations.
For instance, requirements associated with the first principle
drive a considerable focus on human factors aspects of the design, such
as proper layout of cockpit displays and controls, and environmental
factors such as adequate crew cabin temperature and humidity.
Separately, requirements associated with the third principle
stipulate that certain abort and or escape capabilities be present. To
implement this requirement, significant effort has gone into prelaunch
and post landing emergency egress capabilities and the design of a
launch abort system which would be used to pull the crew capsule away
from the launch vehicle and allow the crew to return to Earth should a
catastrophic event occur during launch. In light of the Presidential
direction for FY 2011, it is worth noting that the lessons that NASA
has learned from all past and present systems pertaining to human
rating with be utilized, to the best extent practicable, in the
development of any future vehicle.
Q2. If the human-rating requirements are the top level requirements,
how would potential commercial providers gain the necessary insight to
design a system that meets NASA's requirements? Similarly, how did NASA
get comfortable enough to finally certify the Russian Soyuz for human
space flight?
A2. NASA has formed a team to develop an implementation plan for human
rating of commercially-developed crew transportation systems. This plan
is based on NASA's approach to safety risk management and the existing
Agency human rating philosophy. This plan will clarify NASA
expectations including technical requirements, and was derived from
NASA Procedural Requirements 8705.2 (Human-Rating Requirements for
Space Systems); Space Shuttle Program 50808 (ISS to Commercial Orbital
Transportation Services Interface Requirements Document); and, other
existing NASA requirements documents such as NASA Directives, NASA
Standards, NASA adopted standards, the Exploration Architecture
Requirements Document, the Constellation Architecture Requirements
Document, and the Constellation Human Systems Integration Requirements.
NASA released the preliminary plan using a NASA Request For
Information on May 21, 2010. Responses were due on June 18, 2010 and
NASA is in the process of reviewing and evaluating the responses. NASA
plans to finalize the Commercial Human-Rating implementation plan in
time to support an open-competition when NASA pursues the development
phase of commercial crew transportation systems. Meeting NASA Human-
Rating requirements is an important part of the overall process but not
the sole test NASA will use to determine if a commercial transportation
system is safe for NASA astronaut transportation. Any system destined
to operate in the proximity of the ISS will be subject to the ISS
``Visiting Vehicle'' requirements, for example. Other considerations
are demonstrated reliability, the extent and quality of the developer's
design, test and evaluation processes as well as their production and
operations activities.
NASA will define, as part of this plan, the appropriate level of
on-going government visibility into the development, testing/
engineering analysis, production and operation of all launch vehicles
and spacecraft that carry Agency astronauts. NASA will also define its
role in hazard and risk analysis/acceptance, as well as design and
operational certification and flight readiness.
The first step in building confidence in Russia's human spaceflight
in the early 1990's was to review lessons from the Apollo Soyuz
program. Then NASA worked closely with the Russian Space Agency, now
ROSCOSMOS to develop technical and management relationships and to
understand each partner's roles and responsibilities for safety in the
program. Before NASA began flying NASA astronauts on the Russian Soyuz,
NASA performed several reviews of the Soyuz design, manufacturing,
operations and quality and safety process. Based on these reviews, the
trust stemming from our government to government relationships, as well
as the long operational history of the Soyuz (rocket, crew capsule and
ground systems), NASA developed the confidence to declare the Soyuz
system acceptable for US astronaut participation. In preparation for
potential use of the Soyuz design as a U.S. Space Station Freedom crew
rescue vehicle, and then later in preparation for the joint Shuttle-Mir
activity, NASA technical experts, including senior safety engineers,
spent a significant amount of time talking with Apollo-Soyuz veterans,
visiting with current Russian counterparts, and reviewing the long
history of Soyuz, Salyut, and Mir operations in an effort to understand
the Russian approach to human spaceflight safety. From this they were
able to determine acceptability by equivalence to, if not compliance
with, NASA technical standards. In March 1995, Norm Thagard became the
first U.S. astronaut to launch on the Soyuz. He and the other five
astronauts who spent time on Mir used the Shuttle for subsequent
transportation, but they all received training in Soyuz as their
primary escape system. The next American to launch on a Soyuz was Bill
Shepherd, the Commander of the first Space Station increment in October
2000. Since then, 14 different NASA astronauts have flown on Soyuz,
bringing the total NASA astronaut trips to 14 up, and 13 down, several
of which were made during the post-Columbia Return-to-Flight timeframe.
With over 15 years of joint operations NASA has gained confidence in
the Russians systems and operations, as well as their design and
development philosophy, including not just dependence on system
reliability but on crew escape and on their extensive system and
subsystem testing.
NASA has not certified, and does not intend to ``certify,'' the
Soyuz for human space flight relative to all NASA's technical
requirements. NASA continues to approve or clear its participation in
each flight by maintaining knowledge and insight into the on-going
Soyuz program, formally approving NASA and NASA-sponsored crewmember
participation in its own Flight Readiness Review process, and by
participating in the Russian General Design Review process, which is
similar to the Agency's Flight Readiness Review process. Additionally,
since 1995 a joint Russian and NASA committee, the Space Station
Advisory Committee (Stafford-Anfimov) advises both agencies on the
operational and safety status for each Soyuz flight.
Q3. Since Crew Escape Systems, including emergency detection and
launch abort systems, should be developed in conjunction with the
launch vehicle, how could NASA evaluate the overall safety of an as-
yet-to-be developed launch vehicle whether provided by a COTS provider,
United Launch Alliance, or an international partner?
A3. As suggested by the question, the evaluation of abort system
effectiveness, and human rating in general, requires an integrated
analysis of launch vehicle, crew capsule, crew, and the abort system
itself. Any launch vehicle has to be designed to provide critical
vehicle status and abort triggers to notify the crew vehicle and launch
escape system that an abort is required or to allow the crew to make an
abort decision. The design needs to take into account the launch
vehicle failure modes and the timely detection of these failures.
Transportation system developers would be required to design the
integrated vehicle to support the abort trigger requirements. The crew
escape system would have to be designed so that it can reliably and
safely pull the crew capsule from the launch vehicle given the failures
and resulting environments during the critical portions of the launch
vehicle's flight profile. An integrated safety analysis to review the
specific implementation would be conducted to assure that effective
crew escape capabilities are available to address critical failure
scenarios of the integrated system.
NASA has spent considerable effort in doing this kind of analysis
for the baseline architecture. Similar analyses will have to be
performed for other concepts.
Q4. From the Safety and Mission Assurance perspective, would you
elaborate on the potential to close the gap using EELV's, including
cost information if available?
A4. NASA doesn't human-rate individual components or elements of a
launch system, so in order to use an EELV that EELV would need to be
human-rated in combination with all of the flight and ground elements
needed to accomplish a specific reference mission. The EELVs in
combination with these other elements (spacecraft, abort/escape/egress
system, etc.) would need to be human-rated to ensure that collectively
they provide a sufficient level of safety, and particularly allow for
survivability of the crew during any potential hazardous situations.
In 2009, NASA commissioned a study performed by Aerospace
Corporation to study the feasibility of human rating current EELVs. The
study concluded that EELVs are ``human-ratable,'' however the cost to
do so is highly dependent on program requirements, specific
interpretation of and compliance with NASA's human-rating requirements
document (NASA Procedural Requirements 8705.2) and especially
noteworthy the integration of the EELV design with other elements of
the system. In addition, the study found that the gap between Shuttle
retirement and availability of a new crew transportation system to ISS
would not be reduced from the then-current Constellation target
milestone of March 2015 initial operating capability.
Q5. Since a significant portion of launch failures are due to human
error it is critical to have a strong safety culture. The Columbia
Accident Investigation Board reiterated again the importance of a
strong safety culture. Would a shift to commercially provided low-Earth
orbit launch vehicles disrupt that culture at NASA? Could that be cause
for concern?
A5. Depending on the acquisition approach, contracting with industry
for a new ISS crew transportation system could represent some changes
in NASA's traditional human spaceflight processes, including its
interactions with industry. NASA will ``own'' major NASA-related safety
requirements (visiting vehicle and human rating), and will establish an
appropriate forum for verification that the system has met them. To the
extent that NASA retains accountability for the safety of its employees
and contractors (crewmembers), it will play a role in technical
oversight/insight, as well as hazard analysis, and risk assessment and
acceptance. These processes and relationships, however, are only a part
of a strong safety culture, the remaining aspects being all about
communications in all directions. Especially important will be the
establishment and maintenance of a strong effective dissent and appeal
system on both the commercial and government side of the relationship.
NASA is committed to preserving a strong safety culture regardless of
the acquisition approach.
Questions submitted by Representative Marcia L. Fudge
Q1. In your prepared statement, you cite that NASA is beginning
development of a more concise set of human rating technical
requirements applicable to NASA developed crew transportation systems
as well as commercially-developed crew transportation systems or use by
NASA.
When do you envision these more concise human rating
technical requirements will be defined so that commercial
stakeholders can understand NASA's needs?
Is solely meeting these technical requirements the
litmus test NASA should use to determine if a commercial
transportation system is safe for its astronauts to use?
A1. NASA has formed a team to develop an implementation plan for human
rating of commercially-developed crew transportation systems. This plan
is based on NASA's approach to safety risk management and the existing
Agency human rating philosophy. This plan will clarify NASA
expectations including technical requirements, and will be derived
from: NASA Procedural Requirements 8705.2 (Human-Rating Requirements
for Space Systems); Space Shuttle Program 50808 (ISS to Commercial
Orbital Transportation Services Interface Requirements Document); and,
other existing NASA requirements documents, such as NASA Directives,
NASA Standards, NASA-adopted standards, the Exploration Architecture
Requirements Document, the Constellation Architecture Requirements
Document, and the Constellation Human Systems Integration Requirements.
NASA released the preliminary plan using a NASA Request For
Information on May 21, 2010. Responses were due on June 18, 2010 and
NASA is in the process of reviewing and evaluating the responses. NASA
plans to finalize the Commercial Human-Rating implementation plan in
time to support an open-competition when NASA pursues the development
phase of commercial crew transportation systems.
Meeting NASA Human-Rating requirements is an important part of the
overall process, but not the sole test NASA will use to determine if a
commercial transportation system is safe for NASA astronaut
transportation. Any system destined to operate in the proximity of the
ISS will also be subject to the ISS ``Visiting Vehicle'' requirements,
for example.
NASA will define, as part of this plan, the appropriate level of
ongoing government visibility into the development, testing/engineering
analysis, production and operation of all launch vehicles and
spacecraft that carry NASA astronauts. NASA will also define its role
in hazard and risk analysis/acceptance, as well as design and
operational certification and flight readiness.
Q2. The Columbia Accident Investigation Board (CAIB) recommended the
establishment of an independent Technical Engineering Authority
responsible for technical requirements and all waivers to them. In
response, NASA created the NASA Engineering and Safety Center's (NESC)
which operationally falls under the responsibility of your office. How
has that independent center enhanced the safety of human space flight?
A2. In response to recommendations from the CAIB, NASA formalized
Technical Authority (TA) roles for NASA's Safety and Mission Assurance,
Engineering and Health and Medical organizations establishing clear
authority and responsibilities related to the technical requirements
established by the TA organizations and waivers to those requirements.
The TAs are a key part of NASA's overall system of checks and
balances and provide independent oversight of programs and projects in
support of safety and mission success. Individuals fulfilling the TA
roles are embedded in their respective technical cadres and
organizations across the Agency, and are continuously engaged in
programmatic decision-making processes. They ensure that all opinions
are heard and engage with line management to ensure that the right
technical decisions are made with respect to requirements, non-
compliances, hazards, critical items, as well as ensuring work is
performed to a high standard.
The NESC was formed in response to CAIB criticism of the safety
organization's lack of technical depth. Its mission is to perform
value-added independent testing, analysis, and assessments of NASA's
high-risk projects to help ensure safety and mission success. The
organization has established a strong set of processes, technical
leaders and communities of practice across the Agency and access to key
technical experts and facilities outside of NASA to allow rapid
response with the best possible technical capability to the Agency's
most critical problems. In a typical year, the NESC performs in excess
of 50 independent assessments for a variety of customers, including,
but not limited to, the Agency's SMA organizations.
The Technical Authorities and the NESC operate across all of NASA
but are particularly important in addressing problems which arise in
connection with human space flight. The totality of the contributions
is too great to catalog here, but two examples are illustrative.
Between the time of STS-114, the return to flight after Columbia,
and the final preparations for the launch of STS-120 in the fall of
2007, anomalies with the Reinforced Carbon Carbon panels used on the
wing leading edges had come to light. All panels show cracking and
crazing after exposure to high temperatures with damage thresholds
established for repair or replacement but there was new test data
potentially indicating the need to repair or replace panels not
previously suspect.
The NESC was asked to quickly establish an independent team to
assess the problem in parallel with the ongoing work being performed by
the project team. The NESC team performed a great deal of high caliber
and ground breaking technical work in a short time and recommended both
a measurement methodology and quantitative threshold. The processes
established in support of the Technical Authority model for the flight
readiness reviews and leading to the Certification of Flight Readiness
ensured that the recommendations were fully considered and led to
adoption of both the recommended flight worthiness criterion for the
RCC and a longer term program to better understand the materials and
utilize nondestructive inspection techniques in support of improved
flight safety.
Data from the flight of STS-126 in November 2009 and post-flight
inspection of the hydrogen flow control valves showed that a large
piece of a valve poppet had liberated. This had never happened before
in flight and raised significant safety of flight concerns for STS-119
since there were multiple scenarios leading to catastrophic failures
during powered flight. The problem was extremely difficult and the
first round of reviews could not establish a rationale and supporting
data to allow a commitment to launch. In response, the Project team was
augmented with engineering and safety and mission assurance personnel
from across the Agency to establish and execute a combination of tests
and analyses to establish the basis for a safety of flight assessment.
The NESC brought its cadre to bear, both to directly support the
technical teams and also to provide independent assessments in critical
areas. Technical authority line managers were strongly engaged both to
ensure that all possible resources were brought to bear but also that
the many alternate technical opinions were appropriately heard and
considered and that a flight rational could be established on a sound
technical basis. As a result of an extraordinary quantity and quality
of work done in a very short time, not only was a sound decision basis
established for the safe launch of STS-119 but the understanding of the
flow control valve failure modes and effects and non-destructive
examination techniques were greatly improved. This in turn led to
greatly improved processes and criteria for all subsequent missions and
significant reduction in risk.
Q3. The Augustine Committee has done a commendable job of providing
options and alternatives for the U.S. Human Space Flight program for
consideration. However, changes to an ongoing development program carry
the real threat of major adverse impacts on cost and schedule,
increased risk and dislocations for the workforce. In this regard,
please comment on the safety impacts of two potential changes discussed
in the Summary Report: 1) Reducing Orion crew size; and, 2) Relying on
commercial crew-delivery service rather than continuing the development
of Ares 1.
A3. NASA looks at any significant change in architecture or performance
requirements with an eye toward safety impacts. The decision to reduce
the crew size from six to four had no direct or indirect adverse
safety. The primary rationale for the Orion crew size requirement
change was to simplify design activities and thereby reduce cost and
schedule challenges while improving mass margins during the Program's
early phases. Since the maximum crew size requirements were originally
established at the Constellation Systems Requirements Review in 2006,
Orion had been pursuing parallel designs for the Space Station six-
person and the Lunar four-person configurations. Therefore, Orion's
work included multiple designs for crew seat pallets and Environmental
Control and Life Support hardware, and multiple analyses for
consumables, stowage, and crew operations. By shifting to a common crew
size configuration for the Space Station and lunar missions, Orion's
team would be able to focus activities on a single design and analysis
set rather than two parallel design efforts.
The maximum crew size reduction for Orion ISS missions actually had
operational advantages that improve crew safety:
The free volume for the crew's on-orbit activities
and tasks could be increased by 20-25 cubic feet.
The nominal and emergency crew egress capability
would be improved.
More stowage volume and mass could be made available
for carrying mission equipment and bringing payloads and cargo
to the ISS.
The President's budget ``funds NASA to contract with industry to
provide astronaut transportation to ISS as soon as possible, reducing
the risk of relying solely on foreign crew transports.'' In response,
NASA will use an acquisition approach appropriate to the criticality of
and risk inherent in the mission. Included will be an acceptable mix of
NASA technical requirements and industry practices as well as NASA
technical insight and management oversight. These things, along with
the design, support and demonstrated reliability of the transportation
system, will allow NASA to determine when the system will be suitable
to carry NASA (and International Partner) crews to the ISS.
Q4. One of the Augustine Committee findings is that investment in a
well-designed and adequately funded space technology program is
critical to enable progress in exploration. NASA's space technology
budget has been severely reduced over time. Power, propulsion, in-space
refueling, communications and a host of other technologies will be
crucial for exploration. What safety-related considerations are
associated with investing in such technologies?
A4. Without new technologies, human exploration of the solar system
will likely be unaffordable and unsustainable. The safety implications
of new technologies, however, must be evaluated on a case-by-case
basis. While the use of new technologies can provide safety benefits,
e.g., by eliminating risks in existing systems and through increasing
safety margins, they also generally introduce risks due to immaturity
of and unfamiliarity with such technologies.
These impacts must be assessed as part of design and operational
trade studies. For example, technology development for in-space
refueling must weigh the safety impact of designs involving an initial
crew transportation system that fully relies on in-space refueling
against a crew transportation system that can take advantage of in-
space refueling after the refueling technology has been proven with
robotic missions.
However, new technologies are not necessarily used to improve
safety, and may instead be used to expand mission goals. For example,
weight savings in one area might be used to increase science/mission
payload or to increase propellant reserves or shielding. The investment
in developing and integrating new technologies is essential to ensuring
that our Nation's space program is engaged in innovations that will
help NASA find better and safer ways to explore the solar system.
Questions submitted by Representative Dana Rohrabacher
Q1. In the Launch Services Program NASA has generally required that a
launcher demonstrate multiple successful flights before being
considered for use launching science payloads and satellites. In some
cases, up to 14 successful flights of the rocket were required before
being used to launch a ``Class A'' satellite. By contrast, the
Constellation Program is currently planning (subject to review) only
one full-up test flight before placing astronauts aboard the Orion/Ares
I. I understand that these two parts of NASA--manned and unmanned--have
different requirements and operate with different rules, but in both
cases the overall mission success is a primary objective. Can you
please explain how these two systems of evaluating launch vehicles have
evolved so differently, what are the similarities, and in the above
example how NASA's Constellation program can comfortably accept a plan
that demands 92 percent fewer test flights than what was required for a
satellite program?
A1. The most important factor in determining when it is appropriate to
fly crewmembers on a new test vehicle is the level of confidence the
team has in safely conducting the test. In the case where NASA
validates the technical requirements, designs and manufactures the
flight and ground systems, writes the launch commit criteria and flight
rules, performs all number of ground tests and engineering analyses,
and conducts the reliability, safety and risk analyses, it has arguably
maximized its understanding of and associated confidence in the system.
Based on this, the team decides when to conduct its first crewed flight
test. As the distance between NASA and the design, development,
manufacturing, and operations increases, so does the Agency's reliance
on demonstrated reliability, and/or other government certifications
(i.e. Russia's ROSCOSMOS or the U.S.'s Federal Aviation
Administration). NASA has not come to a final determination on the
number of test flights that would be required prior to sending NASA
astronauts into space using the crew launch vehicle under the Program
of Record.
Regarding the comparison with the LSP, NASA has a range of options
available depending on the launch system's proven reliability, the
value of the payload, and the certification status of the provider. In
some cases, this program has little insight into, or oversight of, the
commercial launch providers. In those cases, NASA requires a
demonstration of 14 successful launches for certification of the launch
vehicle for high value payloads. This certification option, which is
rarely chosen, is predicated on an assumption of no prior knowledge
about launch vehicle performance, and limited government oversight into
the design and operation. Another option is to fly the NASA payload on
a relatively new system with as few as three flights (two successes in
a row), but with substantial NASA process requirements and insight into
the contractor's design, engineering and operations processes. For
lower value payloads with a higher risk tolerance, another
certification category is available. It only requires one successful
flight of the launch vehicle and a significant technical assessment.
NASA's ongoing human spaceflight program has established a host of
safety and mission assurance activities including (subsystem) tests,
verifications, and analyses, which would establish a level of
confidence in the vehicle's performance prior to the full-system test
launches. Decisions regarding the needed number of full-system test
launches should account for these assurance activities.
Q2. John Marshall from the Aerospace Safety Advisory Panel (ASAP) said
in his written testimony that, ``more than two years into the COTS
program, efforts to develop human rating standards for a COTS-D like
program have only just begun and no guidance thus far has been
promulgated. If COTS entities are ever to provide the level of safety
expected for NASA crews, it is imperative that NASA's criteria for
safety design of such systems immediately be agreed upon and provided
to current or future COTS providers.'' What steps is NASA taking to
address this concern and develop a process that can be used by
potential COTS-D competitors?
A2. NASA has determined that human rating requirements will apply to
any crew transportation systems used by the Agency to provide
transportation to low earth orbit. Consistent with the President's plan
to ``contract with industry to provide astronaut transportation to the
International Space Station as soon as possible, reducing the risk of
relying solely on foreign crew transports . . .'' NASA is using
American Recovery Reinvestment Act (P.L. 111-5) funds to develop
guidelines for acquisition and oversight/insight approach in FY 2010.
NASA's approach to human-rating a transportation architecture for a
specific mission starts with the initial design phase, and assumes all
pertinent NASA standards and requirements are followed throughout the
project. This task will define a minimum set of human rating
requirements and consolidate them into a single product using a
development team comprised of representatives from NASA's human space
flight programs, NASA technical authorities, and the NASA Astronaut
Office. In addition, NASA will define hazard and risk assessment
processes and goals and thresholds to support risk acceptability
decisions. NASA will seek the advice of interested industry
stakeholders to refine the human rating technical requirements.
More specifically, NASA has formed a team to develop an
implementation plan for human rating of commercially-developed crew
transportation systems. This plan is based on NASA's approach to safety
risk management and the existing Agency human rating philosophy. This
plan will clarify NASA expectations, including technical requirements,
and was derived from: NASA Procedural Requirements 8705.2 (Human-Rating
Requirements for Space Systems); Space Shuttle Program 50808 (ISS to
Commercial Orbital Transportation Services Interface Requirements
Document); and, other existing NASA requirements documents such as NASA
Directives, NASA Standards, NASA adopted standards, the Exploration
Architecture Requirements Document, the Constellation Architecture
Requirements Document, and the Constellation Human Systems Integration
Requirements.
NASA released the preliminary plan using a NASA Request For
Information on May 21, 2010. Responses were due on June 18, 2010 and
NASA is in the process of reviewing and evaluating the responses. NASA
plans to finalize the Commercial Human-Rating implementation plan in
time to support an open-competition when NASA pursues the development
phase of commercial crew transportation systems.
Q3. Dr. Fragola indicated during the hearing that a launch vehicle
with a liquid core and solid strap-ons was likely to present a more
dangerous, or a more difficult environment for crew escape in the event
of a launch catastrophe. What is the reason for this, and does it apply
evenly to shuttle derived concepts such as shuttle-C, or Jupiter Direct
type designs? Further, it has been reported that pursuant to the
Augustine committee report, NASA is studying the human rating of heavy
lift vehicle concepts (or their derivatives) as potential Orion launch
vehicles. Assuming any new Orion-carrying heavy lift vehicle would use
a combination of liquid core with solid strap-ons, how does that affect
the crew escape and Loss of Crew calculations?
A3. The reason that strap-on boosters in general represent a more
difficult environment for crew escape in event of a launch catastrophe
includes the following two factors. First, such configurations have
failure modes that would more readily propagate from one booster to
another, with the potential to lead to a more energetic post-accident
environment. Secondly, there is a much greater potential for thrust
imbalance, leading to greater aerodynamic stresses. These concerns
apply to Shuttle-derived concepts.
A better understanding of the specifics and absolute values of the
relative risks of the various configurations would require simulations
of the post accident environment and system responses similar to those
already performed on the Ares I configuration. If Orion and the launch
abort system remain the same, it would be expected that in the heavy
lift configuration the factors mentioned above would cause a higher
risk to the crew than in the Ares I configuration.
At the same time, compared to side-mount options, this
configuration would cause the crew to be further removed from the first
stage, which would actually reduce risk to the crew due to failures of
the solid/liquid first stage combination. The increased launch
capability of a heavy lift configuration would further allow for
modifications to Orion and the launch abort system that enhance crew
survival capabilities.
Answers to Post-Hearing Questions
Responses by Mr. Jeff Hanley, Program Manager, Constellation Program,
Exploration Systems Mission Directorate, National Aeronautics
and Space Administration
Questions submitted by Chairwoman Gabrielle Giffords
Q1. What is the basis of NASA's determination that the Ares I/Orion
combination should be ten times safer than the Shuttle? How confident
are you that you can achieve that level of safety?
A1. With regard to your questions about the current program of record,
NASA's Constellation Program was developed with the goal of increasing
astronaut safety tenfold relative to Shuttle missions based on two key
directives:
The May 2004 Astronaut Office Position on Future
Launch System Safety, which stated that office's belief that an
order of magnitude reduction of risk during the ascent phase of
a crewed space mission was possible. This position was written
with regard to the Orbital Space Plane booster selection, and
in response to the Columbia Accident Investigation Report, and
it serves as a goal for increasing system safety during this
critical phase of flight.
The Exploration Systems Architecture Study (ESAS) of
November 2005, which suggested that ``. . . crew missions to
the ISS may be at least 10 times safer than the Shuttle . . .''
While risk estimates for various phases of flight (e.g.,
ascent, docking, re-entry, landing) and spacecraft components
(e.g., service module) are constantly undergoing review the
Constellation Program's Loss-of-Crew (LOC) requirements were
derived from the ESAS.
Probabilistic Risk Analysis (PRA) is a tool used to analyze system
risks and understand a systems probability of problems and the
magnitude of impacts due to the problems. Program managers use PRAs to
assess designs in an effort to judge merits of technical trades.
Additionally, NASA communicates risks to project, engineers and the
outside world using PRAs. PRA numbers fluctuate over time as designs
mature and system trades are accepted.
From the very beginning, Constellation has been committed to
building an architecture that effectively balances the use of critical
design commodities to achieve the optimal safety and mission success
capability. Therefore, at the time of my testimony, NASA believed its
ultimate goal of increasing safety tenfold via the utilization of the
Ares I/Orion combination, while seemingly daunting, would have been
achievable. However, based on current data, NASA believes the Ares I/
Orion combination overall would be about five times safer than the
Shuttle. These numbers, however, are averaged estimates and not the way
that NASA calculates or tracks the PRA of specific vehicles.
In terms of Ares I/Orion, the current PRA for the integrated stack
for the Ascent Phase shows a 1 in 1,877 probability LOC. It also
greatly exceeds the challenging 1 in 1,000 LOC Ascent Phase
requirement. This is due to both the projected reliability of the Ares
I launch vehicle and a robust Launch Abort System. For the On-Orbit
Phase, the current Constellation Program PRA results in a 1 in 521 for
a 210 day mission. This phase is heavily dominated by the
micrometeoroid and orbital debris risk to both vehicles. For the entry
phase, as we have seen through history, is just as demanding as the
ascent phase. Because of this, NASA has the same challenging 1 in 1,000
LOC requirement as for the ascent phase. Unlike ascent where there will
be abort capabilities; there is no easy way to gain significant
improvement for the entry phase. The risk is dominated by parachute and
thermal protection system contributions. These systems are currently a
priority for design improvements as well as a comprehensive test
program.
In comparison, the purpose of the Shuttle PRA is to provide a
useful risk management tool for the Space Shuttle Program to identify
strengths and possible weaknesses in the Shuttle design and operation.
Currently, the mean PRA for an entire Space Shuttle mission to the ISS
(including the ascent, on-orbit and re-entry phases) is 1 in 89, with a
range of 1:63 to 1:130 (representing the 5th and 95th percentiles). The
equivalent PRA figure for Constellation is 1 in 406, representing a 4.6
factor of improvement over the Shuttle risk assessment for the
equivalent 5 day docked ISS mission.
As with any PRA of a large, complex, and engineered system, the
Shuttle PRA is developed for a defined scope, and reasonable
engineering judgment is used to make assumptions where necessary.
Therefore, limitations exist as to its use, and the per-mission ratio
should not be seen as a single-point estimate, but merely the mean
number in a range of risk. The PRA can be useful in comparing different
systems (assuming they are calculated using similar bases), and not as
an absolute risk number. For these and other reasons, it is difficult
to compare Constellation risk estimates to the Shuttle PRA; NASA has a
far higher level of knowledge about the Shuttle system and the PRA
methodologies for operational systems are different from the risk
estimation methodologies for systems in development.
Q2. You are having to human-rate the Constellation launch vehicle and
spacecraft system. How involved a process is that? Is it simple
compliance with a set of itemized requirements, or is it something more
involved?
A2. Regarding human-rating, the launch of any spacecraft is a very
dynamic event that requires a tremendous amount of energy to accelerate
to orbital velocities in a matter of minutes. There also is significant
inherent risk that exposes a flight crew to potential hazards. Through
a very stringent human rating process, NASA attempts to eliminate
hazards that could harm the crew, control the hazards that do remain,
and provide for crew survival even in the presence of system failures.
Human rating is a process that involves more than a simple set of
design requirements. The process intertwines with the acquisition
process, starting with initial concept design and progressing through
all phases of the program. Its progress is checked and reported to
Agency management at each major acquisition milestone. It includes not
just requirements compliance, but also consideration of hazards,
failure modes, escape system effectiveness and limitations, failure
tolerance, and other safety risks both in flight and on the ground. The
requirements are all applicable mandatory standards used in designing
and operating our most important unmanned mission systems, with the
addition of human crew unique requirements dealing with life support,
human factors, crew escape/abort and survivability. The scope and
magnitude of the process is dependent upon the Agency's risk tolerance
for the particular mission, as well as the complexities and hazards
associated with the vehicle design and its assigned mission profile. As
written, NASA's human rating process is structured specifically for
NASA developed systems, where the NASA program manager is the design
decision and risk acceptance authority, and the NASA Engineering,
Safety and Mission Assurance, and Health and Medical Technical
Authorities have cognizance of the associated standards and
requirements. However, Agency policy allows some or all of its human
rating process and requirements to be applied, as it sees fit, to
systems developed by other organizations or entities as conditions for
clearance to fly NASA or NASA sponsored crew/passengers.
For NASA developed systems, human rating certification includes:
validation by the technical authorities that the design requirements
are properly tailored to the program; verification that the design
meets those design requirements (by ground test, analysis, and flight
test as appropriate); and full-up flight demonstration of an
appropriate level of system reliability prior to manned flight test and
prior to full mission clearance. Finally, NASA human rates an entire
system, including ground elements and operational procedures
(fundamentally, anything about the flight or ground system that impacts
flight crew/passenger safety). This means that it looks at integrated
safety issues and accident scenarios, not just failures at the
subsystem level.
Given that safety is NASA's first core value, the Constellation
Program, had incorporated safety into the Constellation design process
from the very beginning. In doing so, the Constellation program chose
to tightly interweave the design and safety team members into the
decision process, including Engineering, Safety and Mission Assurance
and Health and Medical technical authorities, so that each have a role
in the Agency's human rating process. The team has actively worked with
the design engineers to provide expertise and feedback via various
assessments and analysis techniques throughout the design maturation
process.
Human rating a spaceflight system is not as easy as following one
document. Instead, it is an intricate, continuing process, involving
the translation of specific mission requirements into designs that can
be built, tested, and certified for flight and an understanding of
risks with mitigation approaches in place. Additionally, before any
system can be human rated, it must meet all other Agency standards and
requirements applicable to a specific mission and type of system.
Therefore, part of the challenge to projects such as Ares I and Orion
has been that there is currently no single document that spells out
what they should do to receive a human rating certification from the
Agency. In turn, this is partly why NASA is investing FY 2009 Recovery
Act funds to develop a more concise set of NASA human rating technical
requirements.
Although NASA does not yet have one consolidated document for human
rating, the Constellation Program has depended heavily on NASA
Procedural Requirement 8705.2B, in designing its spaceflight vehicles.
This document is based on three key tenets:
1) Human-rating is the process of designing, evaluating, and
ensuring that the total system can safely conduct the required
human missions. The mission will have certain mission
objectives and system performance requirements that must be
met. The mission will also expose the crew to potential hazards
that must be considered early in the design process. During the
design process, a careful examination of the potential hazards
and design features that prevent hazards--known as ``hazard
controls''--is undertaken. Hazard controls are features
incorporated into the system during the design phase to prevent
the occurrence of a hazard. These can take many forms such as
incorporating redundant or backup systems and components,
application of system margins to ensure function of the system
even under the most extreme conditions, proper selection of
technical standards for design and construction, and rigorous
process controls from early material and component selection
through final assembly and checkout operations. Mission
objectives and performance requirements may need to be re-
evaluated to reduce the risk for human spaceflight missions.
The balance between system performance and crew safety would be
weighed among Engineering, Safety and Mission Assurance, and
Crew Health and Medical technical authorities. The outcome of
the design will be a balance between maximizing mission
objectives while minimizing risk to the flight crew.
2) Human-rating includes the incorporation of design features
and capabilities that accommodate human interaction with the
system to enhance overall safety and mission success. This
tenet includes all the aspects of flight crew performance
necessary for the crew to successfully carry out their mission,
without imposing undo risk to the flight crew. Crew situational
awareness, crew commanding, cockpit display design and
spacecraft environmental factors all are critical factors that
affect a crewmember's performance. For example, proper layout
of controls, adequate crew cabin temperature and humidity, and
proper mission workload planning all factor into the
crewmember's ability to safety operate the system and increase
the likelihood of mission success. The same rigor and balance
in design trades utilized in tenet one is applied also in tenet
two to arrive at the best working environment for the crew that
maximizes the probability of mission success, while minimizing
the risk to the flight crew.
3) Human-rating includes the incorporation of design features
and capabilities to enable safe recovery of the crew from
hazardous situations. Launch of a crew has significant inherent
risks, so even with all the care that goes into system design
and development, the system must be designed to accommodate
failure. Sometimes failure can be dealt with by designing
redundant systems that would allow mission continuation. In
some cases, however, mission continuation is no longer possible
and steps must be taken to safely return the crew--an event
that is usually referred to as a mission abort. In the case of
a launch failure, an abort could involve an emergency return of
the crew. The Orion vehicle, for example, will have a launch
abort system which could be used to pull the crew capsule away
from the Ares I launch vehicle and allow the crew to
immediately return to Earth should a catastrophic event occur.
An abort also can be an operational decision to stop the
mission and return the crew if, for example a system has
degraded to a point that mission continuation exposes the crew
to an increased probability of a catastrophic hazard.
The President's FY 2011 budget request includes significant
investments to spur the development of commercial crew and further
cargo capabilities, building on the successful progress in the
development of commercial cargo capabilities to-date. A key early step
to enable commercial crew transport is establishing a concise set of
NASA human rating technical requirements that would be applicable to
NASA developed crew transportation systems for Low Earth Orbit (LEO) as
well as commercially-developed crew transportation systems for use by
NASA. NASA is investing Recovery Act funds to begin development of
these requirements. A NASA team has completed an initial set of
commercial crew human rating requirements documents and commercial
human systems interface requirements document and the documents are
currently in the preliminary review cycle. A Request for Information
will be issued within the next few months to seek industry feedback on
related human-rating documents. In addition to the human rating
requirements, NASA is developing an insight/oversight model that will
contribute to the safe flight and safe return of NASA crew members on
commercial space vehicles. NASA's years of experience and lessons
learned with respect to human rating of space systems will help shape
future systems to be developed in as safe a manner as possible.
Questions submitted by Representative Pete Olson
Q1. Although the Ares I-X test flight was not an exact replica of the
Ares 1, it involved a significant effort by the launch team to modify
the facilities and develop the launch processing requirements and
procedures to perform a successful test flight. In addition, Ares I-X
was instrumented with over 700 sensors relaying information about the
flight. To what extent do test flights improve safety and reliability
by reducing overall risk? If adequate funding were available would more
test flights allow you to accelerate the development and achieve an
earlier crewed flight to shorten the gap?
A1. In general, a comprehensive flight test program is essential to
understanding the integrated vehicle systems in the actual flight
environment. Flight test provides engineers with the confidence in and
understanding of the flight systems. Flight tests can and will reveal
many of the ``unknown unknowns'' which remain hidden in analysis and
subsystem (not integrated) testing, thus allowing engineers to solve
problems before committing high-value payloads or crews to flight.
Flight tests also enable engineers to better calibrate models so that
they are more accurate in predicting worst case loads on the vehicle,
responses of the vehicle's structure, and other parameters that
ultimately affect final designs for safety,. Furthermore, flight tests
enable retirement of risks that cannot be fully mitigated through
ground testing only. Demonstrating factors such as vehicle
controllability, abort effectiveness, and re-entry and landing
performance under integrated real-world conditions must occur before
crewed flight. Flight tests prove these and other critical systems are
therefore essential to attaining an acceptable risk posture for crewed
flight.
Even flight tests of vehicles that are not identical to the final
operational configuration still provide valuable data, though for
obvious reasons, the closer the test article can be to final
configuration, the more useful the test results. For example, NASA's
Ares I-X test flight afforded NASA the opportunity to collect data that
would be used to refine computational models and subscale test
techniques that would be used by Ares I, thus allowing reduction of
conservatism incorporated into initial models. Other test events, such
as the recent firing of an Ares first stage development motor,
designated ``DM-1'', and subsequent static test firings, also
contribute to analytical model validation and refinement. Such tests
provide additional real data to anchor analytical models used to
predict vehicle physics, such as thrust oscillations, specific to Ares
I. While additional test flights for the program of record could help
achieve additional risk reduction, NASA will ensure that all future
cargo and crew systems adequately test all flight systems prior to
operational use.
In terms of the Constellation Program, the addition of more test
flights would not allow NASA to achieve an accelerated first crewed
flight. Acceleration is not merely a funding matter; the potential for
acceleration is also influenced by hardware development and system
testing schedules, and NASA has reached the point where the development
schedule for most systems could not be accelerated due to testing needs
and limits on the ability to further accelerate procurements. The
``long pole'' in getting to human flight is completing the system
qualification testing, and the associated procurements, fabrication,
and assembly for the qualification vehicle and hardware. To be clear,
flight testing is different than qualification testing. Qualification
testing exercises hardware through the full range of conditions it
might experience (such as maximum and minimum operating temperatures).
Flight tests, on the other hand, validate integrated real-world
performance at a single set of conditions. Additional flight testing
would not accelerate the Constellation Program's development schedule
asgiven the long pole lies with qualification testing.
Q2. Moving NASA beyond low Earth orbit will require a heavy lift
launch vehicle. Ares 1 is developing many of the components needed for
the heavy lift vehicle such as 5 segment solids, and the J-2X engines.
Please comment on the role Ares 1 plays as a risk reduction program for
the ultimate heavy lift launcher?
A2. Although the President's FY 2011 budget request does not include
the Ares vehicles, the budget request includes three new robust
research and development programs that will enable a renewed and
reinvigorated effort for future crewed missions beyond LEO. One of the
three programs is a Heavy Lift and Propulsion Technology Program, for
which $559M is requested in FY 2011 and a total of $3.1B, is requested
over five years. This aggressive R&D program will focus on the
development of new engines and propellants, advanced engine materials
and combustion processes that would increase our heavy-lift and other
space propulsion capabilities and significantly lower operations costs,
with the clear goal of taking us farther and faster into space.
The specific risk reduction achieved by the Ares I work will depend
on the architecture chosen for a new heavy lift vehicle. However, the
lessons learned from Ares I will serve to inform those decisions. With
regard to the current program of record, NASA's Constellation
architecture was designed to have two lift vehicles--the Ares I Crew
Launch Vehicle and the Ares V Cargo Launch Vehicle (heavy-lift
vehicle). The Ares I launch vehicle enabled early design and test of
critical elements and subsystems that would be required by the later
Ares V heavy-lift vehicle. Such common elements include the J-2X Upper
Stage engine, solid rocket motor, avionics and software and other
systems.
The Ares I vehicle took Ares V needs into consideration during
development of the J-2X engine. The J-2X was planned to function as the
Ares V Earth Departure Stage engine with only minor modifications to
the Ares I engine. These modifications would be implemented via engine
modification kits. Likewise, reductions were made to the Ares I/V solid
rocket motor risks such as motor and nozzle design, materials selection
and testing, recovery system (parachutes) testing and operations, and
motor manufacturing.
Lastly, designing the Ares I allowed NASA to make an important
technology leap in the design process. By transitioning from a 2-D,
paper-based vehicle design and verification process to a 3-D model-
based design environment, NASA was able to gain valuable experience
with a new design system that can reduce costs while also increasing
system reliability.
The Program is working to capture all of the knowledge learned from
development efforts, including test flights. The Program has spent
significant time recently focusing on its Preliminary Design Review
(PDR) elements of which concluded in March. NASA believes that
completing the Constellation PDR will support not only the close-out
process for Constellation, but also will ensure that historical data
from Constellation work is documented, preserved and made accessible to
future designers of other next-generation U.S. human spaceflight
systems.
Questions submitted by Representative Dana Rohrabacher
Q1. In the Launch Services Program NASA has generally required that a
launcher demonstrate multiple successful flights before being
considered for use launching science payloads and satellites. In some
cases, up to 14 successful flights of the rocket were required before
being used to launch a ``Class A'' satellite. By contrast, the
Constellation Program is currently planning (subject to review) only
one full-up test flight before placing astronauts aboard the Orion/Ares
I. I understand that these two parts of NASA--manned and unmanned--have
different requirements and operate with different rules, but in both
cases the overall mission success is a primary objective. Can you
please explain how these two systems of evaluating launch vehicles have
evolved so differently, what are the similarities, and in the above
example how NASA's Constellation program can comfortably accept a plan
that demands 92 percent fewer test flights than what was required for a
satellite program?
A1. The most important factor in determining when it is appropriate to
fly crewmembers on a new test vehicle is the level of confidence the
team has in safely conducting the test. In the case where NASA
validates the technical requirements, designs and manufactures the
flight and ground systems, writes the launch commit criteria and flight
rules, performs all number of ground tests and engineering analyses,
and conducts the reliability, safety and risk analyses, it has arguably
maximized its understanding of and associated confidence in the system.
Based on this, the team decides when to conduct its first crewed flight
test. As the distance between NASA and the design, development,
manufacturing, and operations increases, so does the Agency's reliance
on demonstrated reliability, and/or other government certifications
(i.e. Russia's ROSCOSMOS or the U.S.'s Federal Aviation
Administration). NASA has not come to a final determination on the
number of test flights that would be required prior to sending NASA
astronauts into space using the crew launch vehicle under the Program
of Record.
Regarding the comparison with the LSP, NASA has a range of options
available depending on the launch system's proven reliability, the
value of the payload, and the certification status of the provider. In
some cases, this program has little insight into, or oversight of, the
commercial launch providers. In those cases, NASA requires a
demonstration of 14 successful launches for certification of the launch
vehicle for high value payloads. This certification option, which is
rarely chosen, is predicated on an assumption of no prior knowledge
about launch vehicle performance, and limited government oversight into
the design and operation. Another option is to fly the NASA payload on
a relatively new system with as few as three flights (two successes in
a row), but with substantial NASA process requirements and insight into
the contractor's design, engineering and operations processes. For
lower value payloads with a higher risk tolerance, another
certification category is available. It only requires one successful
flight of the launch vehicle and a significant technical assessment.
NASA's ongoing human spaceflight program has established a host of
safety and mission assurance activities including (subsystem) tests,
verifications, and analyses, which would establish a level of
confidence in the vehicle's performance prior to the full-system test
launches. Decisions regarding the needed number of full-system test
launches should account for these assurance activities.
Answers to Post-Hearing Questions
Responses by Mr. John C. Marshall, Council Member, Aerospace Safety
Advisory Panel, National Aeronautics and Space Administration
Questions submitted by Chairwoman Gabrielle Giffords
Q1. As you know, the Augustine Committee projected that commercial
crew transportation could be available by 2016. It does not appear that
this projection reflected the time needed for all of the milestones
that must be met prior to the point at which NASA would be able to use
such services to fly its astronauts to the ISS such as the time needed
to get Congressional authorization and appropriation of funds;
agreement on human-rating and other safety standards and means for
verifying compliance; development of a regime for certification; and
contract competition, negotiation and award of contract (S), and
potential protest(s) by losing bidders. These are no small tasks, and
it is not obvious that any of them could be skipped if the government
is to make use of those services.
a. In your opinion, what are currently the largest technical
challenges or hurdles that potential commercial crew
transportation providers are facing that might cause delays to
their projected initial operating dates?
A1, 1a. The milestones that you mention are all important. The process
for enabling the current commercial cargo providers to provide crew
transportation has not yet been initiated to any significant extent.
Although there has been considerable discussion about this topic by
some manufacturers' leaders, and most recently by the Augustine
Committee, the ``COTS-D'' portion in the current agreements still
remains a potential add on to the commercial cargo delivery
demonstration projects. Thus, the ``projected initial operating dates''
that might be achieved with the current designs are unclear. This said,
the two NASA contractors currently in the program have stated that
their designs could be adapted to human transport. However, they have
made these statements without having the detailed requirements for the
necessary safety certifications. This is because NASA has neither
developed those requirements nor provided them to the contractors.
Clearly, the single most important technical challenge to
commercial crew transportation that remains is developing the standards
by which the suitability for human transport will be judged. Likewise,
the process and authority for validating that those standards have been
met--initially in the capability of the design and then through the
construction and maintenance of the vehicle for its entire life cycle--
also must be developed. Without firm performance criteria and the
definition of the certification process for these criteria, the
contractors' abilities to meet any initial operating dates for the
current designs remains speculative.
Key hurdles to achieving certifiable crew transportation capability
include:
1. Clear technical criteria for the vehicle's design
performance and capability must be established and provided to
all entities wishing to vie for providing the service.
2. The process for overseeing the design's development and
validation must be created.
3. The technical details for the necessary data submissions,
design reviews, analysis, testing, and validation of results
must be established and instituted via contract with the
manufacturers.
4. The process and authority for overseeing that the necessary
safety is maintained through proper maintenance and support
throughout the vehicle's life cycle must be developed,
approved, and instituted.
b. How confident can the Congress be that a commercial crew
capability can be operational in 2016 while still having to
carry out all of the activities that need to be completed
before the first NASA astronaut can safely ride on an
operational vehicle to the International Space Station?
A1, 1b. NASA recently has begun to develop definitive standards for
assessing design capability for crew transport. The criteria for safely
docking vehicles with the ISS is already published and has been
provided to the current commercial cargo contractors; however, it must
be clear that this is only for protection of the ISS and does not
provide any safety considerations for either humans or cargo inside the
vehicle. If things move steadily and the Agency receives funding to
contract for necessary activities, six years seems an adequate period
to accomplish this objective. However, any effort to assess the
feasibility of the 2016 operational start date for current designs
would be premature since assessments of the current design developments
against the criteria have not taken place. This is principally because
the criteria necessary for that assessment are not yet fully
determined. As a reference point, it took 10 years from program
initiation to first flight for the space shuttle, and 10 years to reach
the Moon with Apollo. Therefore six years duration, since we are
building on the foundation of the existing cargo programs, seems like a
reasonable time period.
However, there are many variables that can have a profound effect
on the duration, three of which are particularly noteworthy. First,
these vehicles and their launch systems have to demonstrate that they
are capable of reaching LEO and safely delivering cargo to ISS.
Obviously, success in this endeavor would be a large risk mitigator for
extending the use of these vehicles to human transport. Second, the
current designs have to be assessed against the previously described
criteria, which will in no doubt drive needed design changes or
additions. These modifications must be within the vehicle's design
concept, i.e., technically feasible to incorporate into the design
without causing the approach to be altered fundamentally. Third, these
changes will have to be described in contractual documents and placed
in an RFP. That RFP will result in a priced proposal that must be
negotiated and funded. It has to be presumed that the funding needed to
incorporate these changes/modifications/certifications will be
provided.
Q2. You make it clear in your prepared statement that the ASAP Panel
recommends that NASA be ``hands-on'' in its approach. Why do you think
NASA needs to be ``hands-on'' in its involvement?
A2. Without direct involvement in planning, design, testing, and
validating the design, NASA cannot state with assurance that the
necessary safety level has been achieved. NASA must stay engaged in the
entire process to ensure the level of safety is achieved.
Q3. ``In your written testimony, you state that it is the ASAP
position that ``NASA is best qualified to be the oversight body for
each of these actions (demonstration, verification, and certification
prior to NASA's use for crew transport) as today only NASA has the
competence in hand to effectively audit the complex technical work
required.'' Can you elaborate on why the ASAP believes that?''
A3. While NASA currently has no explicit safety requirements for crewed
COTS systems and will have to tailor the existing processes
significantly, it is the only agency in the US Government that has a
knowledge base for the complex tasks necessary to determine whether a
given space vehicle is safe enough to carry US astronauts. This
knowledge base includes the myriad technical standards that hard won
experience has shown to be essential to ensure inherent safety for the
hardware. It also includes the test and evaluation capabilities and
human rating process capabilities (noted previously) that validate
proposed designs as safe for these astronauts. Please note that mission
safety approval for NASA crew member transport to LEO, ISS docking and
return is not the same as safety approval for private launches, for
which the FAA is, and should remain, responsible.
Q4. In the ASAP's 2008 Annual Report, the panel notes that ``NASA has
an important one-time opportunity to better interweave safety as a
consistent and more powerful operating parameter by hardwiring safety
into the fabric and procedures of the new flagship exploration program,
Constellation.''
How would NASA infuse a similar strong safety culture into the
agency if NASA were to purchase crew services from a commercial
provider in lieu of developing the Constellation launch system?
A4. In our 2008 Annual Report regarding Constellation safety
opportunities, the ASAP wrote: NASA should institutionalize safety
programs, systems, processes, and reporting procedures including:
Robust, well-publicized safety programs that mirror
industry best practices, including using current world-class
systems and incentives as models
A safety management system that tracks accidents,
mishaps, close calls, audit results, lessons learned, and data
trends for these and other leading indicators
Consistent methodologies to identify hazards and to
manage, articulate, and reduce risks
Defined, timely process for investigating, analyzing,
and reporting on accidents
More rapid and thorough determination of root causes
Standardized accident report format, timeline,
database, and metrics
Timely, possibly Web-based distribution of lessons
learned to prevent mishap recurrences
Most of this still applies with little or no modification. However,
the structure NASA will use to gain the insight and / or oversight to
implement a safety program for commercial providers remains to be
determined. Certainly, the U.S. Department of Defense (DoD) and the
aerospace industry have learned how to work together to benefit safety
when DoD engages in contracts with private industry for both weapon
systems and critical services. Perhaps the DoD approach offers a good
model.
In the ASAP's opinion, a sufficient safety program cannot be
established in a ``hands-off' contractual relationship.
Questions submitted by Representative Pete Olson
Q1. Since a significant portion of launch failures are due to human
error it is critical to have a strong safety culture. The Columbia
Accident Investigation Board reiterated again the importance of a
strong safety culture. Would a shift to commercially provided low-Earth
orbit launch vehicles disrupt that culture at NASA? Could that be cause
for concern?
A1. The ASAP believes that a good safety culture is advisable for any
organization, regardless of its work, and ideally is present due to
ethical leadership, good systems, and the correct ``tone at the top.''
The ASAP continues to assess NASA's safety culture, and while progress
has been made since the CAIB report, our reports contain additional
recommendations relative to safety culture. It is difficult and rare
for an organization to achieve a ``perfect'' safety culture, and it is
even more difficult to maintain one over time.
In this regard, NASA will need to ensure that any organization that
may provide a crewed vehicle in the future actually will value a strong
safety culture. Role modeling and ensuring a strong safety culture
among NASA's contractors and potential partners will remain a
difficult, yet doable, leadership task. Establishing a good safety
culture in one's own organization is hard work. Fostering it within
another organization, where one does not have complete control, is even
more difficult. NASA has experience working with many contractors and
has been vigilant in establishing good safety partnerships with them.
It is the Panel's expectation that the current emphasis on contractor
safety would continue if firms were contracted for Low Earth Orbit
(LEO) launches, and that NASA would continue to work to improve its own
safety culture and the safety culture of those firms.
Questions submitted by Representative Dana Rohrabacher
Q1. What does the Aerospace Safety Advisory Panel believe are the most
important steps to enable NASA to seriously consider, evaluate, and
possibly implement a commercial crew competition?
A1. On numerous occasions, the ASAP has addressed the urgent need for
establishing the human rating requirements, airworthiness criteria, and
certification requirements for a possible commercially developed
vehicle that may be used to transport NASA crew. It is essential that
these requirements be considered and, as appropriate, incorporated into
the on-going design phase as early as possible. However, the scope of
this question extends beyond the preparedness activities that are
needed to ensure that an acceptable level of safety is achieved. To a
large extent, it is equally important to ensure that the program's
budgeting and planning process is initiated quickly. With this in mind,
the ASAP notes the following serious challenges that will need to be
met to successfully implement a commercial crew competition and offers
the following observations:
A. NASA has not yet committed to developing a commercial crew
transportation capability. If NASA elects to proceed in that
direction, a strong message needs to be communicated publicly
that commercial crew transportation is a priority NASA mission
and the mission's requirements and objectives must be clearly
stated. NASA should take steps to ensure that the impending
Administration's decision for Exploration (based on the review
of the Augustine's human spaceflight study) re-affirms the need
for NASA to assist in developing a commercial crew transport
capability.
B. It is not yet known which organization within NASA would
assume responsibility for developing and implementing this
program. Therefore, NASA will need to identify the Program
Manager and provide adequate resources to address the
performance, technical, schedule, and cost requirements and
analyses in formulating the overall program plan.
C. NASA has not developed a program, acquisition strategy,
budget, or initiated the legislative process necessary to
obtain authorization for a COTS-D vehicle. Currently, NASA only
has an option to exercise a COTS-D (crew transport) program
under the Commercial Cargo and Crew Transportation Program.
Space X currently has an unfunded Space Act Agreement option to
demonstrate a COTS-D program. While NASA may also conduct a new
competition for one or more crew demonstration partners, plans
for implementing these options cannot go forward without
authorized funding.
D. NASA needs to determine to what extent and how it will be
involved in the commercial providers' processes and activities
for defining the appropriate oversight and insight to ensure
astronaut safety so that potential commercial partners can be
informed.
E. NASA needs to determine to what extent it may provide
enabling technologies and capabilities, including actual
hardware or designs (such as that for the Orion), so that
potential commercial partners can be informed.
Q2. During the Q&A period, you mentioned that the ASAP had visited
with Orbital Sciences regarding their COTS development program, and
stated that they did not see any existing commercial market for cargo
(and potentially crew) delivery to ISS. Did you ask the same
questions(s) of SpaceX, and what was their response?
A2. The original question by Chairwoman Giffords was ``. . . do our
witnesses believe that would-be commercial crew transport service
providers be able to garner sufficient revenues from non-NASA passenger
transport services to remain viable over this time period as well?'' My
response to this question where I noted that we asked Orbital Science
if they had done a market analysis to find other revenue sources was
directly to the issue of crew transport services, not commercial cargo
markets. This said, SpaceX management was not asked this question.
Neither did they indicate whether alternative markets have been
identified for their vehicle.
Answers to Post-Hearing Questions
Responses by Mr. Bretton Alexander, President, Commercial Spaceflight
Federation
Questions submitted by Chairwoman Gabrielle Giffords
Q1. What is the industry's understanding of NASA's human-rating and
safety requirements, both technical and operational? Is there an
expectation by the industry that finalized requirements will be
developed in conjunction with NASA?
A1. The Aerospace Safety Advisory Panel correctly points out that NASA
has not yet developed standards and processes for human-rating
commercial vehicles. Until such time as commercial human-rating
standards are determined, industry continues to develop vehicle
hardware based on the only standards available: those NASA established
for its own vehicles, known as NPR (NASA Procedural Requirement)
8705.2B, effective May 06, 2008.
Early dialogue between NASA and the commercial spaceflight sector
on the nature of human-rating requirements for commercial systems is
crucial, with demonstrated reliability, robust test flights, and a
reliable crew escape system being key. To work with NASA and the FAA,
US. industry has established a Commercial Orbital Human Spaceflight
Safety Working Group, under the leadership of the Commercial
Spaceflight Federation. The goal of the effort is to develop industry
consensus on principles for safety of commercial orbital human
spaceflight. Consensus has been reached among a number of companies on
fundamental principles that will form the basis for our engagement with
the FAA and NASA, but much more work remains to be done.
Q2. During the hearing, Mr. Marshall said that some entities might not
agree to a ``hands-on'' NASA role. Have federation members discussed
what activities and level of scrutiny by a federal entity would amount
to a ``hands-on'' relationship with which they could not agree? Can you
provide examples of the types of activities and level of scrutiny that
would create an unacceptable ``hands-on'' relationship? What level of
NASA involvement would be acceptable?
A2. The commercial spaceflight industry believes strongly in the
importance of a close relationship with NASA. The level of oversight
and insight shared between NASA and FAA is a critical topic that is
being addressed by, among other bodies, the Commercial Orbital Human
Spaceflight Safety Working Group. Since NASA, FAA, and commercial
spaceflight providers are just beginning their dialogue, it is not yet
possible to state whether any specific requirement will be a subject of
dialogue or discussion between the stakeholders.
As NASA Administrator Charles Bolden stated February 1: ``Now, as
50 years ago when we upgraded existing rockets for the Gemini program,
NASA will set standards and processes to ensure that these commercially
built and operated crew vehicles are safe. No one cares about safety
more than I. I flew on the space shuttle four times. I lost friends in
the two space shuttle tragedies. So I give you my word these vehicles
will be safe.'' The commercial spaceflight industry will work closely
with Administrator Bolden and others to make sure that this objective
is realized.
Q3. Your prepared statement does not directly address how experience
in reentry and landing will be obtained by potential commercial
providers. By what means and in what timeframe will the commercial
space transportation industry secure such experience?
A3. Reentry and landing is a critical portion of human spaceflight that
is essential to safety. It is our expectation that commercial providers
will not place astronauts on an untested capsule, but rather these
systems will have gained flight experience with reentry and landing
before commencing manned flights with NASA astronauts aboard. In
addition to full orbital flight tests, commercial providers may also
conduct suborbital tests, either as part of a subscale test launch or
as a test of the launch abort system, which will therefore provide
additional experience with the reentry and landing phases of the
mission profile. As no provider agreements for a full Commercial Crew
program have yet been signed, the exact timeframe is yet to be
determined on a per-company basis. Further, US. aerospace companies
have been a part of every US. human spaceflight since the program began
and have substantial technical expertise in reentry and landing systems
and environments.
Q4. In your prepared statement, you state that in addition to FAA's
existing regulatory authority as codified in U.S. law, industry will
satisfy customer-specific requirements levied by NASA in partnership
with industry. With regards to your reference to existing FAA
authority, are you proposing that NASA astronauts fly under ``informed
consent'', which is the existing regulatory framework?
A4. The Federal Aviation Authority's Office of Commercial Space
Transportation currently levies different requirements for different
categories of individuals, which include ``crew'' and ``space flight
participants.'' The exact nature of the regulatory framework that would
apply to NASA astronauts will require dialogue between NASA, the FAA,
and the commercial space industry. Through the Commercial Orbital Human
Spaceflight Safety Working Group, industry stands ready to engage in
this dialogue and determine the best path forward. However, it is
vitally important for the viability of future commercial human
spaceflight providers that launches be conducted under the same legal
and regulatory framework, regardless of whether the customer is the
U.S. government or a private entity.
Questions submitted by Representative Marcia L. Fudge
Q1. The discussion of safety requirements for crew and passengers on
commercial transportation systems has, up to now, primarily focused on
suborbital flights. Has the commercial space transportation industry
identified any additional safety-related R&D requirements to enable
future orbital flights by commercial crewed transportation systems?
A1. As compared to suborbital flights, orbital flights have more
demanding engineering requirements in specific areas, such as: higher
heat loads on re-entry, more powerful and longer engine firings,
additional risk due to micrometeroid impact, more involved
communications downlink to Earth, additional attitude control
requirements, more complex abort scenarios, etc. Since the commercial
crew program could be seen as commercializing accomplishments similar
to those of the 1960s Gemini program, none of these problems require
new technology to solve, but they would all benefit from additional R&D
to improve capability, reduce risk, and reduce costs.
Q2. Are there any R&D efforts currently underway at NASA's Glenn
Research Center that would have applicability to potential commercial
human space transportation systems? Does the commercial space
transportation industry have suggestions on how NASA's Center R&D
programs could contribute to enhancing the safety of potential
commercial human space transportation systems?
A2. Yes, there are multiple R&D efforts currently underway at Glenn
Research Center that would be useful for commercial human space
transportation providers. Facilities such as the Plum Brook Station
(PBS), which has significant capability for full-scale upper-stage
engine testing under simulated high-altitude conditions, would be
useful to commercial providers. Plum Brook has the Space Power Facility
as well as a hypersonic wind tunnel and cryogenic test facilities.
Research in the fields of combustion, reacting flow systems, fluids,
and materials testing of structures for atmospheric and vacuum/space
environments are some of the areas of interest to the industry. Other
R&D efforts underway at Glenn's Zero Gravity Drop Tower and the
Spacecraft Propulsion Research Facility will also help enable future
innovation for commercial space launch providers. Some ways in which
NASA's Center R&D programs could contribute to commercial spaceflight
safety is through easier access to government test facilities, as well
as enhanced interchange of technical information from NASA.
Q3. If NASA were to use commercial transportation systems to fly its
astronauts to the International Space Station, would the commercial
space transportation industry envision these astronauts being
passengers or crew members? What sort of training would the industry
envision as needed for these astronaut passengers? If spacecraft are
piloted by provider crew members, how would their training differ from
that received by NASA's astronaut passengers?
A3. The exact regulatory framework that would apply to NASA astronauts
will require dialogue between NASA, the FAA, and the commercial space
industry. Through the Commercial Orbital Human Spaceflight Safety
Working Group, industry stands ready to engage in this dialogue and
determine the best path forward for the FAA, NASA, and commercial
industry.
Questions submitted by Representative Pete Olson
Q1. In preparation for commercial attempts to deliver cargo to the
International Space Station, the COTS providers have been working
closely with NASA to evaluate whether they can comply with NASA's
Visiting Vehicle requirements that govern proximity operations around
the ISS. Is there anything preventing NASA from working with potential
commercial providers, whether COTS companies or United Launch Alliance,
to establish the safety requirements processes and identify the
modifications that would be required for those vehicles to meet NASA's
human-rating requirements?
A1. We do not believe at this time that there are any obstacles to
cooperation between NASA and commercial companies in the development of
safety requirements processes and identification of needed
modifications to vehicles. The Aerospace Safety Advisory Panel recently
stated that NASA should ``accelerate the level of effort underway'' to
develop these commercial requirements. The commercial spaceflight
industry is ready to work with NASA on these critical issues, and in
fact has already begun engaging with NASA through the Commercial
Orbital Human Spaceflight Safety Working Group. While the Commercial
Spaceflight Federation has taken the lead in organizing the effort, the
working group includes representatives from a broader spectrum of
companies, including several of the major aerospace primes and more
traditional government space contractors. The goal of the effort is to
develop industry consensus on principles for safety of commercial
orbital human spaceflight. So far, we have met among industry and have
begun to engage NASA and the FAA.
Q2. Recently there seems to be a great deal of interest among the
potential commercial space providers to enlist the government as the
primary buyer of space systems. Presumably, this is because the
government is currently the only known market for these services,
although the industry is hopeful that non-governmental buyers will
emerge. If no outside commercial market materializes, as was the case
with early claims that a backlog of commercial satellites would help to
reduce the cost of the development and operations of EELVs, wouldn't
the governments' costs ultimately be higher since it would eventually
have to pay for all the development and operational costs?
A2. The Augustine Committee stated the following findings in its final
report:
``During its fact-finding process, the Committee received
proprietary information from five different companies
interested in the provision of commercial crew transportation
services to low-Earth orbit. These included large and small
companies, some of which have previously developed crew systems
for NASA. The Committee also received input from prospective
customers stating that there is a market for commercial crew
transportation to low-Earth orbit for non-NASA purposes if the
price is low enough and safety robust enough, and from
prospective providers stating that it is technically possible
to provide a commercially viable price on a marginal cost
basis, given a developed system.
None of the input suggested that at the price obtainable for a
capsule-plus expendable-launch vehicle system, the market was
sufficient to provide a return on the investment of the initial
capsule development. In other words, if a capsule is developed
that meets commercial needs, there will be customers to share
operating costs with NASA, but unless NASA creates significant
incentives for the development of the capsule, the service is
unlikely to be developed on a purely commercial basis.''
That is, the Augustine Committee found that non-NASA customers for
commercial crew services did exist, but not in sufficient quantity for
the business cases of private companies to close if they had to fund
the development entirely on their own. On the other hand, if private
industry and NASA share the development costs, then all parties will
benefit. In particular, one additional market has been proven on a
small scale, which is private citizens paying to travel to space. Over
$150 million has been already paid by seven private citizens to travel
on a Russia Soyuz to the International Space Station, at a steady rate
of about one mission a year. In fact, the demand for this service has
continued to increase despite an almost doubling of price from under
$20 million per seat to now over $35 million per seat. Furthermore,
when Commercial Crew taxi services begin in the United States, demand
will rise because would-be travelers, who are often business leaders
running companies, will no longer have to spend six months training in
Russia with limited contact with the outside world. Since American
services will not require overseas training of that duration, will not
require learning the Russian language, and will likely undercut the
Russians in per-seat cost, the market is likely to increase for private
space travelers.
Other, not yet proven, markets for additional flights of the
capsules include: (a) sovereign clients, in which other countries
purchase seats on American vehicles rather than the Russian Soyuz, and
(b) industrial clients: since as Commercial Crew reduces the cost and
increases the frequency of access to space, there could be increased
interest in on-orbit industrial applications.
When considering the potential of other markets, it is important to
note that all Commercial Crew providers will use launch vehicles that
already exist, such as the Atlas V, or in the late stages of
development, such as the Taurus II and Falcon 9, and all of these
vehicles will launch satellites and cargo before putting astronauts on
board. Accordingly, it is already the case that a proven commercial
market exists for at least the launch vehicle portion of each rocket-
and-capsule system. Spreading the costs of a commercial system between
the cargo, satellite, and crew markets will reduce the burden for each
customer (NASA, DoD, and commercial customers).
Q3. Given that the emerging commercial providers appear to believe
strongly in an evolutionary approach to design and safety innovation to
be achieved through flight experience gained from revenue flights
undertaken without any prior safety certification regime, wouldn't
premature reliance on the government as the dominate or only customer
inhibit the ability of the emerging commercial providers to sustain the
innovation they believe is essential to their long-term commercial
success?
A3. As the Augustine Committee stated the following findings in its
final report: ``unless NASA creates significant incentives for the
development of the capsule, the service is unlikely to be developed on
a purely commercial basis.'' With NASA as a significant early customer,
commercial industry will still be able to more rapidly incorporate
innovations and technology upgrades than under a government program
designed to for a 20-to-30 year operating lifetime.
Q4. What do potential commercial crew transportation services
providers consider to be an acceptable safety standard to conform to if
their space transportation systems were to be chosen by NASA to carry
its astronauts to low Earth orbit and the ISS? Would the same safety
standard be used for non-NASA commercial human transportation missions?
A4. Safety is paramount for the commercial spaceflight providers.
Indeed, commercial vehicles such as Atlas V and Delta IV, developed
with substantial private funding and engineering expertise, are already
trusted to launch key government national security assets upon which
the lives of our troops overseas depend. Since probabilistic risk
assessment calculations account for part failure, and do not account
for most of the root causes of accidents historically, such as human
error or design flaws, and since even reliable vehicles have
historically suffered a period of ``infant mortality,'' the commercial
spaceflight industry believes that they will in fact achieve higher
safety than that of government systems that intend to put human beings
aboard on early orbital flights of the system. Commercial industry
believes safety must include the following:
Demonstrated reliability through multiple orbital
unmanned flights of the full system
Not placing crews on initial flights, since early
flights are historically most risky
A highly reliable crew escape system
Standards-driven design and operations
Industry believes that the safety of commercial spaceflight must be
significantly greater than that of the space shuttle in order to be
successful. In addition to the FAA's existing regulatory authority, as
codified in U.S. law, industry will satisfy customer-specific
requirements levied by NASA in partnership with industry. This process
has already begun with the cooperation of the stakeholders involved.
NASA and FAA will be there every step of the way, and will have
oversight during design, testing, manufacturing, and operations.
Answers to Post-Hearing Questions
Responses by Dr. Joseph Fragola, Vice President, Valador, Inc.
Questions submitted by Chairwoman Gabrielle Giffords
Q1. The Augustine Committee's report cited five basic questions that
could for the basis of a plan for the U.S. space flight program, but
``how could crew safety be dramatically improved'' was not one of them.
Should it have been? And if so how would it have informed their
deliberations?
A1. It is my opinion that the question of how could crew safety be
dramatically improved should have not only been one of the five basic
questions for the basis of a plan of the U. S. space flight program,
but that it should have been the primary question. In fact it is
difficult for me to understand how a committee could, on the one hand
state that crew safety was the sine qua non of their work, and yet not
include crew safety as a primary question. I believe if they had
included it as a primary question they would have understood better how
deliberately during ESAS, and subsequent to ESAS in the development of
the Ares I vehicle design the thrust of all decision making was toward
the development of a dramatically safer crew launcher than heritage
systems such as the Space Shuttle or commercially available systems,
such as Atlas or Delta.
Q2. Reliability and safety seem to be used interchangeably by some
when discussing crew safety. Are they really the same thing, and if not
what is the distinction? How important a distinction is it?
A2. There is a lot of confusion in the meaning of the term safety. The
definition varies and to some, particularly those in the systems safety
community, safety includes any significant loss. Those in the risk
assessment community include only losses of life. However neither
community would accept the fact that the terms reliability and safety
are interchangeable when it comes to loss of life. The important issue
to recall as it relates to launch vehicles is that reliability is
indistinguishable from safety for unmanned spacecraft payloads, but the
two are crucially different for manned space vehicles. This is because
of the important distinction between relatively benign vs. catastrophic
failure modes, and because of the existence of an abort system.
These distinctions mandate that safety consider the additional
probability of the crew surviving conditioned on a mission failure.
This latter conditional probability depends on the severity of the
initiating mission loss accident and the robustness of the abort
system. A good example would be Apollo 13. The mission failed in such a
severe way that not only was the Command and Service Module disabled,
but all the services in the service module were destroyed. This implied
that the abort system, the Lunar Module, had to be robust enough not
only to perform the electric power functions of the CSM, but also to
provide all the other life sustaining functions until the Command
Module could be employed for re-entry. A less severe accident, say a
benign engine failure of the Service Module engine, would have not
required the additional risk of conversion of the CO2
extraction system for example. The point is that the abort system must
be robust enough to address the full spectrum of post accident
conditions and allow the crew to survive them. So the conditional
probability of an effective abort given a LOM event is an important
distinction between reliability and safety.
Q3. How does one calculate meaningful safety characteristics such as
loss of crew for vehicles that have not yet entered the hardware phase?
A3. Crew safety can never be guaranteed even with a vehicle that has
been built and has had a significant record of mission success. However
this does not mean that designs that include certain features are not
more likely to produce a safer design than those that are not. In
particular in my testimony I provided four rules that I believe would
enhance the safety of a new launcher:
1. Make it as inherently safe as possible. That is, make it
reliable AND select a design with benign failure modes.
2. Separate the crew from the likely source of failure. That
is, put them on top of the stack where ``God meant them to
be''.
3. Establish credible abort triggers balancing warning time
with the threat of false positives.
4. Include an abort system tested and verified for robustness
for safe escape and recovery.
To calculate meaningful safety characteristics for vehicles that
have not entered the hardware phase one uses historical operational
data from heritage systems to establish a ``surrogate'' model of the
new design to estimate the inherent safety, that is mission
reliability, and the spectrum and post incident environments likely for
credible mission loss events. A surrogate is constructed for a new
launcher much in the same way that an opening price is established for
a new initial product offering in the marketplace. That is, in the case
of an IPO the analyst looks at comparables that are in the market,
their product lines, and their associated market prices, and constructs
a ``shadow price'', by reflecting the product line of comparables onto
the product line of the IPO and adjusting for competitive distinctions.
This shadow price becomes the opening market price. In the case of a
safety surrogate, the analyst reviews all type comparables, in this
case launchers, their historical heritage launch reliabilities and risk
driving features, and constructs a ``shadow risk'' reflecting these
features and associated risks onto the features in the new launcher
adjusting for differences that make a difference in the risk driving
elements of the new launcher design.
Once the surrogate is established each of the credible incident
environments are simulated to determine the physical impact of the
radiative, impulse pressure wave, and fragmentation environments on the
crew safe abort given the stack geometry, launch abort system design
and crew module fragilities, throughout the ascent trajectory. The
combination of the geometry, post accident insult environment and the
fragilities of the crew module forecast the overall abort effectiveness
of the configuration given the inherent reliability of the launcher
once deployed.
This approach is distinguished from the more traditional launch
reliability approach used in the past by its reliance on historical
data, the establishment of a vehicle surrogate from the top down, that
is on a functional not component basis, so as to capture the primary
causes of historical failures, and the use of first principles physics
codes to establish the post accident environments and the corresponding
abort effectiveness.
It is believed that employing such an approach provides estimates
of loss of crew probabilities, within reasonable uncertainty bounds, so
as to allow for discrimination of the crew safety potential among
proposed designs.
Q4. What are the key determinants in designing an effective abort and
escape system? What compromises should be avoided?
A4. The most important determinants in designing an abort system are
the balancing of escape acceleration and acceptable g load on the crew
so as to provide for maximum separation distance from the approaching
hazards without endangering the crew further during the abort and the
avoidance of false positives that would cause aborts from an acceptable
system. What should be avoided is to use the abort system as a crutch
against unacceptable inherent safety for example, by claiming
indefensibly high levels of abort effectiveness.
Q5. What safety considerations should guide the Congress' evaluation
of the implications of NASA relying solely on commercially provided
crew transport and ISS crew rescue services?
A5. As was mentioned, even a significant record of mission success is
not enough to ensure safety at dramatically higher levels than those
currently provided by the shuttle. Congress should require that NASA
become involved in a wholesale evaluation of the design features of
each proposed design including that of the crew module. and the launch
abort system. This evaluation should include the heritage of those
features in terms of their historic performance especially as it
relates to the post incident conditions that would be imposed on the
crew. Congress should require that NASA impose strict first principles
physics based simulations to establish a credible estimate of the abort
effectiveness to be applied to the integrated crew launch stack,
including the launcher, the launch abort system, and the crew module.
Congress should also require that NASA establish resident inspectors at
the production facilities of all the major manufacturers of the launch,
crew module, and launch abort system. It also should require process
control and inspection during manufacturing and testing, and the
identification and close out of anomalies including design and or
process changes implemented and their effectiveness. Finally Congress
should require that NASA impose a strict and challenging ground and
flight test program for the proposed launch abort system, including a
full up flight test of the system to ensure its robustness.
Q6. The Augustine Committee's report mentioned that a leading
objective of the ESAS effort was to minimize the gap between the last
shuttle flight and that of the new vehicle. You were a member of the
study. Were there any other major objectives?
A6. Yes there were. The most important major objective, and the one
that I was most intimately involved in, was to ensure that the CAIB
recommendation that the replacement crew launcher for the shuttle would
be an order of magnitude safer than the shuttle. Other major objectives
were to fit into the funding profile, to allow for payload performance
objectives to be met, and to ensure that the architecture chosen was
capable of enabling a path forward to a crewed lunar and eventually a
crewed Mars mission.
Q7. How meaningful are the distinctions between the Loss of Crew
figures for different options contained in the Exploration Systems
Architecture Study (ESAS)?
A7. The ESAS, as its name implies, was directed at the selection of an
architecture to enable exploration beyond low earth orbit. The focus
was therefore on discriminating among the suggested alternative
architectures, and associated elements, so that the most effective one
would be selected to be carried forward. In this regard the Loss of
Crew estimates made at the time of ESAS were directed at highlighting
differences that made a difference among the alternatives. The
estimates were not intended to represent the absolute Loss of Crew risk
of any of the alternatives but rather to distinguish among them. In
particular, estimates of the abort effectiveness of the various
alternatives were based upon rough estimates of the post accident
physics, and not on the more detailed first principles physics code
results subsequently obtained for the Ares I vehicle as it has
progressed through development.
Q8. Having been on the ESAS effort, you have a unique perspective on
what would be needed to replicate similar analyses of alternatives your
team did not consider. If NASA was to be directed to perform a similar
safety analysis on another alternative, what is the rough estimate of
the cost and time it would take to perform the physics based analysis
that was done for the recommended launch alternatives--those that
resulted in Ares I and Ares V.
A8. First I have to correct two impressions that seem to be included in
the question that are not precisely correct. The ESAS team considered
many of the alternatives that have been subsequently suggested
including the shuttle side-mount, and the EELV alternatives of the
Atlas V and Delta IV families, we just did not consider them in the
detail that we subsequently did for the selected Ares I alternative.
Also, we did not, at least at the last of my involvement, consider the
detailed physics analysis that we had performed on Ares I on the Ares V
vehicle because subsequent to ESAS we were not considering it as a
potential crew launcher.
The performance of a similar analysis to another alternative would
depend on how much of the work we have done so far could be used and
how readily available finite element models of the alternative would
be. The physics work would have to be done on a massively parallel
computational system such as the Pleiades project at the NASA Advanced
Supercomputing (NAS) Division at Ames. This Supercomputer is dedicated
to the Exploration program so a cost is not available. We do know that
it took 5 million hours of equivalent CPU time for the Ares I analysis.
These estimates assume the availability of a basic understanding of the
aerodynamics, trajectory information of any of the alternate vehicles,
which are generated as a matter of course in the design process by the
aero analysis teams at MSFC and ARC. That is, this information would
have to be generated in order to perform a meaningful evaluation of
abort effectiveness. NASA JSC has already completed some exploratory
work on the side-mount. If this work not sufficient additional
exploratory CFD would have to be performed whereas existing Orion abort
trajectory/aerodynamic information for Ares I could be used to arrive
at a first order approximation for other in-line concepts.
The calendar time estimated for the side-mount would be 6 months if
extra work were required and 4 months for each of the other concepts.
The labor costs would vary depending on the concept, but a rough
estimate of the cost would be between $250-350K per concept. However
the actual cost would have to be negotiated between NASA Ames and its
chosen contractor and work could be done in parallel if multiple
concepts are to be considered.
Q9. In your opinion, what would be required in practice to implement
the Augustine Committee's suggestion that NASA exercise a strong
oversight role in assuring commercial vehicle safety?
A9. To a degree this question has already been answered in the answer
to question 5, but a summary of what would have to be done is mentioned
here. Firstly NASA would have to appoint a team of people to sit down
with the proposed commercial supplier and learn the launch vehicle from
top to bottom. Then the team would have to develop an understanding of
the relationship of the various systems and components implementing the
various critical functions on the proposed launcher and that of the
historical heritage of launchers. The NASA team would then have to
develop a surrogate of the proposed launcher by relating its critical
functional implementation and associated failure modes to the
historical heritage data set. The former analysis would attempt to
establish the mission reliability of the proposed launcher in a crew
application. (Note: This would be different from the launcher mission
reliability in a payload application due the integration impact of the
crew module and support systems module and the launch abort systems and
due to modifications of the launcher systems, such as the addition of
red lines on the engines and abort triggers on the vehicle.) The latter
would establish the post accident conditions that would need to be
modeled using the first principles physics simulations to establish the
abort effectiveness.
Then, if the launcher is seen to have met the minimum conditions
for consideration as a crew launcher, NASA would have to establish an
on site inspection team at the facility of the manufacturer of all the
major elements of the design. The contractor would be required to
involve NASA in all the major tests performed on the vehicle and the
associate launch abort system and crew module and its support systems
module, review all anomalies and work with the contractor to close them
out by design or manufacturing process changes. In short NASA would
have to perform the same investigation it has had to perform on the
Russian Soyuz, plus the additional manufacturing and process inspection
that it has been unable to conduct on Soyuz in order to ensure that the
launcher has been developed as an equivalent to a NASA developed
vehicle.
Questions submitted by Representative Pete Olson
Q1. Part of NASA's rationale for selecting a solid rocket motor for
the first stage of the Ares 1 is that it is inherently a simpler design
with few moving parts. But other U.S. systems using liquid propulsion
have been highly reliable as well. Taking into account their entire
lifecycle, can you comment on the overall safety records of solids vs.
liquid rocket motors and whether this should be a factor in the overall
architecture? If a proposed commercial crew system relies on liquid
boosters, or a combination of liquid and solid, how does that affect
the Loss of Crew calculations.
A1. There is no doubt that liquid propulsion systems, especially those
that have been proposed prior to the Ares I, have been shown to be
highly reliable. In fact the work performed prior to and during the
ESAS study indicated that a single core liquid would be an equivalent
approach with the Atlas V being slightly preferred to the Delta IV from
a safety perspective. The problem was that the payload of these
vehicles was so limited that it was considered unacceptable as a crew
replacement for the shuttle for either the lunar or ISS mission. The
only single core alternative that had the thrust. capable of carrying
the required payload was the 2.5 million pound thrust shuttle solid,
(now about 3.0 million pounds with the 5th segment added). To compete
with this capability the heavy EELV alternatives versions had to be
considered and it is the addition of the two strap-on liquid core
boosters that made the alternatives significantly more risky than the
single core solid. In addition to the simple multiplication of engines
and propulsion systems, which have been shown historically to be launch
vehicle risk drivers, there were the additional fuel load and the
potential for thrust imbalance problems. In addition, for the Delta IV
heavy, the only heavy currently in operation, has flame pit H2 burn-off
problems at liftoff. All of these contribute to the post accident risk
consequences. It is the combination of the increased mission risk of
the triple core heavy lift launcher and the post accident abort
environment that causes the EELV alternatives to be forecasted to have
almost three times the launch risk of the Ares I as I mentioned in my
testimony.
So if a single core liquid booster would be able to lift the
required six passenger Orion to the ISS, especially if it were the
Atlas V, it would be a competitor to the Ares I, but we would have to
fly at least two, and possibly three Atlas Vs to meet the payload
requirement. Even though the Atlas V might expose the crew to an
individual launch risk equal to that of the Ares I, the cumulative risk
of multiple launches would again be significantly higher than a single
Ares I launch even without considering the benign failure impact of the
dominant solid booster failure modes. Therefore if crew safety is to be
a significant discriminator among alternatives then it should be a
factor in the overall architecture, and if it is the sine qua non as
the Augustine report indicates then it should be the most critical
factor.
Strap-on boosters in general represent a more difficult environment
for crew escape in event of a launch catastrophe because they increase
the probability of involvement of greater amounts of fuel in the post
accident environment. This is true for both liquid and solid tandem or
barreled boosters. However since liquid engines can be monitored and
shut-down and since a significant portion of a liquid booster risk is
in benign shutdown the impact on Loss of Crew risk is not as severe as
with solids. When solids are used as either strap-ons (either tandem or
barreled) to the central core booster the predominant historical
failure modes of the solid, case breach or soft-goods (as in the case
of the Challenger accident) or nozzle burn through, interact with the
liquid core if the hot gas jet impinges upon the core as in the case of
Challenger and the Delta II and Titan 34D accidents. The probability of
this occurring is higher with a barreled solid because of its closer
proximity to other solids and the liquid core so the solid angle of
impingement is greater. However with tandem boosters there is the
additional problem of thrust imbalance. That is the imbalanced thrust
from one side to the other of the stack can cause significant abnormal
additional loads on the stack that can cause aerodynamic breakup even
if the hot gas plume does not impinge on the central core. This is
particularly a problem when the tandem solid boosters are large and
represent a major portion of that boost thrust as is the case for the
shuttle and the Titan 34D. In fact post flight analysis of the
Challenger accident indicated that the thrust imbalance was such that
aerodynamic breakup would have probably occurred without impingement.
This post-accident interaction effect was known well before ESAS
and was documented as part of the previous OSP investigations contained
in the Bullman Report that I am unable to attach because of ITAR
restrictions, but which has been supplied to the Subcommittee staff. In
fact the Bullman participants were so aware of this fact that they
recommended that solids not be used in a configuration of any future
crewed vehicle. Specifically they recommended:
R8.2-2 Unless the Program is able to generate new data that
demonstrates that SRM explosions are ``abortable,'' the program should
not plan to use ELV configurations with strap-on SRMs for crewed
flights of the spacecraft. In addition to the stack explosion issue,
the inability to terminate SRM thrust and its affects on separation
profile must be assessed. Refer to the report reliability discussion
for a quantitative discussion.
Thus, in answer to the second part of the question, yes the post
accident impact of strap-on boosters would be felt for all cases and
this is one of the reasons why, independent of the increased risk of
additional hardware, a single core booster, either solid or liquid, is
to be preferred to any configuration that would use strap-ons. Now the
degree to which the incorporation of strap on boosters impacts the Loss
of Crew risk depends on the type of strap-on and the overall
configuration. In general liquid strap-ons have less of an impact than
solids, and configurations with the crew on top have less of an impact
than side-mount configurations. This can be seen in the comparative
analysis chart given in my testimony where the liquid strap on
configurations are slightly less risky than the solids, and the in-line
Ares V crewed configuration is less risky than the shuttle derived
side-mount. This figure can be used to grossly estimate the relative
risk of the various strap-on configurations and explains why any of
them, solid or liquid, in line or side-mount, would be expected to be
more risky than the single core solid Ares I configuration. However, to
understand the specifics and absolute values of the relative risks of
the various configurations would require detailed post accident
physical simulations similar to those already performed on the Ares I
configuration.
Questions submitted by Representative Dana Rohrabacher
Q1. During the Q&A period, you seem to be explaining that in order to
get the performance necessary to loft a crew capsule on an Atlas-class
vehicle would require an Atlas 431 (or equivalent) with three strap-on
boosters. Would you please explain the design and safety considerations
associated with crew escape using existing or modified EELVs?
A1. The safest configurations, whether solid or liquid, are single core
vehicles. This is not only because of the simpler design but also
because of the limited fuel load and the elimination of potential
interaction impacts subsequent to mission failure all of which increase
the hazard potential of the post failure environment that the abort
system must negotiate.
So if a single core liquid booster would be able to lift the
required six passenger payload to the ISS, especially if it were the
Atlas V, it would be a competitor to the Ares I, but we would have to
fly at least two, and possibly three Atlas Vs to meet the payload
requirement. Even though the Atlas V might expose the crew to an
individual launch risk equal to that of the Ares I, the cumulative risk
of multiple launches would again be significantly higher than a single
Ares I launch even without considering the benign failure impact of the
dominant solid booster failure modes.
Strap-on boosters in general represent a more difficult environment
for crew escape in event of a launch catastrophe because they increase
the probability of involvement of greater amounts of fuel in the post
accident environment. This is true for both liquid and solid tandem or
barreled boosters. However since liquid engines can be monitored and
shut-down and since a significant portion of a liquid booster risk is
in benign shutdown the impact on Loss of Crew risk is not as severe as
with solids. When solids are used as either strap-ons (either tandem or
barreled) to the central core booster the predominant historical
failure modes of the solid, case breach or soft-goods (as in the case
of the Challenger accident) or nozzle burn through, interact with the
liquid core if the hot gas jet impinges upon the core as in the case of
Challenger and the Delta II and Titan 34D accidents. The probability of
this occurring is higher with a barreled solid because of its closer
proximity to other solids and the liquid core so the solid angle of
impingement is greater. However with tandem boosters there is the
additional problem of thrust imbalance. That is the imbalanced thrust
from one side to the other of the stack can cause significant abnormal
additional loads on the stack that can cause aerodynamic breakup even
if the hot gas plume does not impinge on the central core. This is
particularly a problem when the tandem solid boosters are large and
represent a major portion of that boost thrust as is the case for the
shuttle and the Titan 34D. In fact post flight analysis of the
Challenger accident indicated that the thrust imbalance was such that
aerodynamic breakup would have probably occurred without impingement.
This post-accident interaction effect was known well before ESAS
and was documented as part of the previous OSP investigations contained
in the Bullman Report that I am unable to attach because of ITAR
restrictions, but which has been supplied to the Subcommittee staff. In
fact the Bullman participants were so aware of this fact that they
recommended that solids not be used in a configuration of any future
crewed vehicle. Specifically they recommended:
R8.2-2 Unless the Program is able to generate new data that
demonstrates that SRM explosions are ``abortable,'' the program should
not plan to use ELV configurations with strap-on SRMs for crewed
flights of the spacecraft. In addition to the stack explosion issue,
the inability to terminate SRM thrust and its affects on separation
profile must be assessed. Refer to the report reliability discussion
for a quantitative discussion.
Thus, in answer to the second part of the question independent of
the increased risk of additional hardware, a single core booster,
either solid or liquid, is to be preferred to any configuration that
would use strap-ons because it presents a less hazardous post mission
failure escape environment. Now the degree to which the incorporation
of strap on boosters impacts the Loss of Crew risk depends on the type
of strap-on and the overall configuration. In general liquid strap-ons
have less of an impact than solids, and configurations with the crew on
top have less of an impact than side-mount configurations. This can be
seen in the comparative analysis chart given in my testimony where the
liquid strap-on configurations are slightly less risky than the solids,
and the in-line Ares V crewed configuration is less risky than the
shuttle derived side-mount. This figure can be used to grossly estimate
the relative risk of the various strap-on configurations and explains
why any of them, solid or liquid, in line or side-mount, would be
expected to be more risky than the single core solid Ares I
configuration. However, to understand the specifics and absolute values
of the relative risks of the various configurations would require
detailed post accident physical simulations similar to those already
performed on the Ares I configuration.
Answers to Post-Hearing Questions
Responses by Lt. Gen. (Ret.) Thomas Stafford, United States Air Force
Questions submitted by Chairwoman Gabrielle Giffords
Q1. As you know, the Augustine Committee projected that commercial
crew transportation could be available by 2016. It does not appear that
this projection reflected the time needed for all of the milestones
that must be met prior to the point at which NASA would be able to use
such services to fly its astronauts to the ISS such as the time needed
to get Congressional authorization and appropriation of funds;
agreement on human-rating and other safety standards and means for
verifying compliance; development of a regime for certification; and
contract competition, negotiation and award of contract(s), and
potential protest(s) by losing bidder(s). There are no small tasks, and
it is not obvious that any of them could be skipped if the government
is to make use of those services.
In your opinion, what are currently the largest
technical challenges or hurdles that potential commercial crew
transportation providers are facing that might cause delays to
their projected initial operating dates?
How confident can the Congress be that a commercial
crew capability can be operational in 2016 while still having
to carry out all of the activities that need to be completed
before the first NASA astronaut can safely ride on an
operational vehicle to the International Space Station.
Q2. What was the extent of the testing and analyses performed on the
Gemini spacecraft and Titan launch vehicle before NASA was comfortable
with system's safety? How ``simple'' was it to build safety into
Gemini.
Q3. I understand that training for off-nominal operations is an
important facet of crew training. Astronauts are acquainted with how to
identify these off-nominal operations and apply ways to respond to
them. During your illustrious career in human space flight, how
important was training for off-nominal operations to enhance safety?
What level of training would need to be performed to fly NASA
astronauts on commercial transportation systems?
Q4. Do you have any concerns regarding the option of canceling Ares I
to go to the ISS and relying on a new set of would-be commercial
providers? Is there a risk of being in a situation where those emerging
enterprises are deemed ``too important to fail'' and we end up having
to support them at whatever cost and time it takes?
A1, A2, A3, A4. Chairwoman Giffords--With respect to your first
question, I agree that the projections from the Augustine Committee did
not reflect the time needed for milestones and issues that must be met
for a certified rocket and a certified spacecraft before NASA
astronauts would be launched to the International Space Station. As
described in my testimony a human-rate launch vehicle and spacecraft
must start from the first time drawings are put together. All of the
issues you outlined can add a considerable length of time to the
process. I have great confidence that to ``really certify human-rated
spacecraft with a launch vehicle will not be ready any sooner by any
proposed commercial vehicles than those by NASA.'' Ares I Orion would
have flown in 2013, but funds were taken to fly the Space Shuttle and
complete the ISS due to the OMB not allowing NASA to request the
adequate funding. As I outlined in my testimony, I doubt that the
President was aware of the gap that OMB was causing in the schedule by
not allowing NASA to request adequate funding and would require our
crews and international partner crews to pay to fly on Russian launch
vehicles and spacecrafts. I agree that this is no small task and do not
see any items skipped if the government uses a commercial provider.
My opinion is that there are large technical challenges for
potential commercial crew provided rockets and spacecrafts to meet the
NASA Office of Safety and Mission Assurance requirements to meet
initial operational dates. In response to your second point, as I
expressed, due to experience in the Gemini and Apollo, I flew on three
different types of vehicles and four different types of spacecraft and
I do not feel that Congress can be confident that a commercial crew
vehicle will be operational in 2016 and carry out all of the activities
to be completed before a NASA crew is launched.
With regard to your second question, NASA required 39 months of
testing and analysis on the Titan II launch vehicle and similar time on
the Gemini spacecraft prior to the first launch. The major Titan II
components, tanks, and structures for the Gemini spacecraft were built
at the Martin Denver plant then shipped to a separate controlled
assembly line at Martin's Baltimore plant. Here modifications were made
to the booster and a series of safety modifications, including the
Emergency Detection System, were installed on the booster. Most people
today do not realize that there was a completely separate assembly line
for the Gemini Titan II launch vehicle. The first and second stage
Aerojet engines powered the Titan and were built in Sacramento under
the special quality conditions; then shipped with an escort to the
Martin plant where they were installed on the vehicle. These escorts
stayed with the engines all the way through to Launch Pad 19 until
launch.
With regard to your third question, to the four prime missions that
I flew and three back-up crew missions that I was a member of, we
literally spent hundreds of hours in the factory for each mission. We
also spent hundreds of hours in the spacecraft processing, testing, and
checkout before launch. For simulations we worked hundreds of hours and
ran all of the nominal and off nominal operations and all emergency
situations. Many of the simulations were integrated with the Mission
Control Center. The level of training needed to fly astronauts on
commercial transport systems should be no less than our previous
experience.
With regard to your fourth question, I do not have concerns that
Ares I, which has been designed from every piece part up onward to meet
the NASA Mission and Safety Assurance and human rated factors similar
to what we did on the Apollo program. With commercial providers, I know
that none will start from the beginning design of the launch vehicle
for human rated requirements. As I pointed out, the Gemini Titan
Program was a high risk demonstration program. We knew that certain
areas of launch from the time of ignition throughout the launch profile
and into orbit, would be hazardous if not fatal, if failure occurred.
With respect to the latter part of your fourth question, ``Is there
a risk of being in a situation where those emerging enterprises are
deemed `too important to fail' and we end up having to support them at
whatever cost and time it takes'', the answer is emphatically yes. Once
the program starts and encounters major technical and cost difficulties
it is very difficult to stop unless the program is cancelled.
Questions submitted by Representative Pete Olson
Q1. In your testimony you spoke briefly about the relationship between
the President, the OMB, and the Congress in setting and carrying out
our space programs. Would you please elaborate on what you see as the
strengths, weaknesses, and potential problems impacting our nation's
ability to carry out effective space policies?
A1. Ranking Member Olson--In answer to your question in relation to the
President, OMB, and Congress in a setting to carry out the US Space
program, the political forces have been very visible in the last 18
years vs. what is experienced from the start of the human space flight
program. In the many times that I have testified in front of
Congressional bodies (Senate and House), the most important issue I
have emphasized is that we need is a long range strategic plan that the
country can follow with only slight modifications. This fact was
brought out vividly by the Columbia Accident Investigation Board.
My first recommendation to the Augustine Committee was to
reestablish the National Space Council since it was written into law
with the efforts of Senate Majority Leader, Lyndon Johnson, in 1958.
Under this law, the President can enact the council and it worked
extremely well during the Mercury, Gemini, and Apollo programs. It was
also effective for four years under President George W. H. Bush.
Without a strategic oversight group such as the National Space Council,
you will have second level tier individuals like those in the OMB who
makes major acts on programs. For example, I am sure that the President
did not recognize at the time that an individual in 2004 told NASA that
they have 15 flights to finish the Space Shuttle project by 2008 and
this was during the time that the Space Shuttle was still grounded
after the Columbia accident, which would result in the US buying
launches from the Russians for many years. This is the same second tier
level individual, at the OMB, who arbitrarily set the date at 2015 for
the termination of US funding of this great international multi-partner
laboratory and spacecraft, the ISS.
Questions submitted by Representative Dana Rohrabacher
Q1. There have been suggestions that a smaller, simpler vehicle
designed just to access low Earth orbit and the International Space
Station could be developed faster and less expensively than Orion.
Furthermore, such a vehicle might be more easily lofted using either
existing or modified EELV's. From your experience aboard the two-person
Gemini spacecraft, do you see any reason why a smaller version of a
capsule would be any simpler or less expensive to certify as human-
rated?
A1. Mr. Rohrabacher--To provide a safe launch of a spacecraft on a
rocket booster to orbit a human crew is always a major disciplined
task. Whether you go beyond LEO or not, the same discipline would have
to be followed whether the spacecraft is to fly to the moon or Mars, or
only operate in only LEO, would require the same discipline to achieve
LEO and safely return. A larger more complex spacecraft naturally costs
more than a smaller spacecraft. We do not need as extensive systems and
fuel as for a Mars spacecraft would require as compared to LEO.
My recommendation would be for the development of a crew module in
a block series (i.e. Block I, II, III), LEO, Moon, or Mars mission. The
smaller version would be only somewhat less expense to certify safety
for a crew.