Slashdot Mirror
Poor Pilot Training Blamed For Virgin Galactic Crash
astroengine writes: SpaceShipTwo co-pilot Michael Alsbury was not properly trained to realize the consequences of unlocking the vehicle's hinged tail section too soon, a mistake that led to his death and the destruction of the ship during a test flight in California last year. Responsibility for the accident falls to SpaceShipTwo manufacturer Scaled Composites, a Mojave, Calif., company owned by Northrop Grumman Corp, the National Transportation Safety Board (NTSB) determined at a webcast hearing on Tuesday (PDF). Poor oversight by the Federal Aviation Administration, which oversees commercial spaceflights in the United States, was also a factor in the accident, the NTSB said.
Chrysler got hit, now Northrop?
If there was a criteria for safe unlocking of the hinged tail section then why wasn't it interlocked until the criteria was satisfied?
A bigger error here is reliance on operator training. It's the least reliable form of ensuring a certain outcome.
I'm no expert on pilot training... far from it.
But if I were learning to fly a spaceship, the first question out of my mouth would be "what all could kill me?"
From the report:
The unlocking of the feather during the transonic region resulted in uncommanded feather operation because the external aerodynamic loads on the feather flap
assembly were greater than the capability of the feather actuators to hold the assembly in the unfeathered position with the locks disengaged.
So maybe the copilot thought that he was preparing for the future feathering operation by unlocking it, and he did not think he was initiating the feathering. Usually an "unlock" switch is only a permissive, and it does not initiate the actual operation.
It's interesting as the unique tail section was actually touted as a "safety feature" by the company. I'm not necessarily saying it can't be the case, but like any feature, even a safety feature (see: exploding airbags), defects or improper use can cause more harm than in it's absence.
The moveable booms are intended to provide a fail-safe mechanism for positioning SpaceShipTwo during the fiery re-entry into the atmosphere. Scaled pilots were well aware of what could happen if they unlocked the feather too late, but training about its early release were ignored, accident investigations found.
It's a bit strange, as it seems like such a fundamental error - not some obscure feature that could be overlooked. What pilot would say to himself "Hey, I know I'm supposed to unlock the tail at time X, but what the hell, why not just do it now?" It seems really strange that they wouldn't have precise procedures for this, since it's such a critical part of the entire design.
It's a hard way to learn a lesson like this.
Irony: Agile development has too much intertia to be abandoned now.
You're an experienced test pilot of a rocket powered ship and you have to be specifically trained to anticipate the effects of slamming on the brakes while traveling at supersonic speed?
I suspect he knew full well the likely outcome but just had a brain fade. Probably what was missing was some kind of hardware interlock so that this couldn't have happened, or else it required both pilots acting at once to enable it.
But if I were learning to fly a spaceship, the first question out of my mouth would be "what all could kill me?"
Almost everything. The question I hear astronauts apparently ask is "what is going to kill me next?" It seems to be about 90%+ of their training. Trying to figure out all the ways they can die and how to mitigate the chances of it actually happening.
Perhaps that's one reason other spacecraft use names that are very specific. I always wondered why they would, say, command the pilot to "disengage the IVVIM (Intra-Vehicular Visual Illumination Mode)" instead of telling them to "turn the light out". If the unlock switch had some god-awful name describing exactly what it did, then maybe the pilot wouldn't have thought "let's unlock this now so we'll be ready".
His ignorance covered the whole earth like a blanket, and there was hardly a hole in it anywhere. - Mark Twain
Comment removed based on user account deletion
If the unlock switch had some god-awful name describing exactly what it did, then maybe the pilot wouldn't have thought "let's unlock this now so we'll be ready".
You mean like "self destruct button"?
It appears that unlocking it just allowed dynamic forces outside the craft to move the feather without being commanded to. The external forces simply overcame the mechanical system that was holding it retracted. A transonic slipstream exerts a hell of a force.
In my view this is a dual failure- a failure by the pilot who (apparently) wasn't trained on when not to unlock the system, and an engineering failure as well- it seems a common-sense thing to lockout potentially (or positively) fatal mis-operations. I'm sure that one or more existing sensors could have been used to prevent unlocking the feather if current conditions could/would cause a catastrophe.
And yes, I'm playing Monday-morning quarterback, and yes, I have the benefit of hindsight, but still- foreseeing the "what could go wrong" possibilities is what good engineering is all about.
Just cruising through this digital world at 33 1/3 rpm...
It appears that deploying the feather was a multi-step operation. The flap covering the feather is unlocked, then the flap is opened, then the feather is deployed. The pilot probably knew that the feather could not be deployed at the speed they were going, but did not know/understand that the flap could not stay closed if unlocked at the speed they were going. Thus, the pilot unlocked the flap, and from there, whatever other latch that made step 2 work broke, the flap opened and the feather deployed on its own.
Maybe the button will be renamed "Remove Restraints Holding Feather Flap Closed During Transonic Region".
Nobody likes to "get behind the airplane". I execute checklists as soon as practical and get things set up for the next phase of flight as soon as possible so we're ready. Exceptions being things in the class of the feather on the ship in question: Flaps, landing gear, mostly airspeed and aerodynamics dependent items.
- A commercial pilot
I have read the NTSB Executive Summary. As far as I have seen, the full report has not yet been made available.
The claim made by the report is the accident was the result of human error because one of the pilots unlocked the feather prematurely and that the actuators that control movement of the feather were overcome by aerodynamic forces (while going through trans-sonic speeds) and the feather moved. Deploying the feather is a two-step process, unlocking, which one pilot can do, and commanding it to move, which require both pilots to take action.
What I didn't see in the Executive Summary was whether Scaled Composites expected the actuators to be able to control movement of the feather while the vehicle was going trans-sonic.
Just after the accident, there were statements attributed to Scaled that the actuators should have been able to hold the feather in position after it was unlocked. If the people working on and with the vehicle thought this, how could it be human error for the feather to be unlocked when it was?
If it turns out that those earlier statements were incorrect and Scaled knew that it was a bad idea to, say, unlock while going through trans-sonic, then the Executive Summary should have indicated that. I just find it odd that it doesn't say anything about what Scaled had communicated to its pilots about the capabilities of the actuators for the feather once it was unlocked.
Especially given than history is littered with examples of airplanes not being able to pull out of dives due to control surfaces not responding properly (or ripping off) in supersonic or transonic flow. Alsbury would have been intensely aware of these concepts.
Well it's not exactly like deploying flaps at high speed and having them rip off the plane and damaging stuff. He didn't deploy anything, he only unlocked it. He thought the motors would hold the feather in place and nobody at Virgin or Scaled drilled into his head that prematurely unlocking feather = DEATH. Quite possibly because they also didn't think the feather would move by itself just from air pressure and vibration. We know it NOW, but before?
Unlocking the feather while going up was part of the procedure. He did it too soon but was not adequately informed of the disastrous consequences of mistiming the unlock. So yeah, I do agree they're blaming the dead guy too much.
Also, Alsbury was an experienced pilot but not exactly a Chuck Yeager. As to whether pilots would think through all the possible consequences of every action in a cockpit jam packed with switches and levers and knobs, under a heavy workload, well it's easy to say while we're sitting in a desk but reality is not that sterile.
Keep in mind the SS1 was a scary ride and I assume SS2 is no cupcake either. When that rocket lights, it kicks your ass not just with monster acceleration but also crazy vibration and deafening noise. It scared Brian Binnie shitless and he was used to flying F-18s off carriers. Even Mike Melville who is about as cool a customer as they come (and an excellent, excellent pilot btw) was quite impressed shall we say. A good pilot would get used to it pretty quick I'm sure, after doing it a couple times. The first time? It would mentally compromise most anyone including experienced pilots and you'd have to have superhuman levels of the Right Stuff to function at 100% the first time you're on that crazy rocket ride.
Imma pushin' that button too.
"So long and thanks for all the fish."
Except this is, you know, "poor pilot training" (as well as other things listed). Perhaps you misunderstood (or I do)? Poor pilot training is, you know, not the pilot's fault but the fault of the trainer and not the trainee. It is as if I teach you how to solder components into a PCB and you follow my instructions and still do it wrong then it is not your fault but my own fault for having improperly trained you.
Your rant is nice, I will give credit where it is due, but does not have much to do with reality. Especially where the NTSB is concerned. The NTSB tries hard to not "blame" anyone. Instead they do not worry about blame at all and have a whole culture designed around this. What they look for is what went wrong and make recommendations as to how to avoid it in the future. They are actually very good at not blaming anyone but you probably get your information from news blurbs.
"So long and thanks for all the fish."
Wow... Two in a row?!?
Nobody, except you and the last guy, are blaming the pilot. Well, you two are specifically not blaming the pilot. If you read then you should be able to pick this up. They are blaming poor pilot training. That is not the pilots fault and nobody is saying that it is. Perhaps, in your zeal to seek a reason to be displeased, you failed to either read the article (or summary) or failed to comprehend it? The pilot did what they did because they were improperly trained. That is hardly the fault of the pilot and nobody is saying that it is their fault. NTSB works really damned hard to help in these situations and they work really damned hard at not assigning blame so much as they work to make things better in the future.
My only suggestion, if you wish to understand, is to stop taking regular media at face value and to actually spend some time learning about the NTSB and actually checking into their reports when they come out. They usually have an abstract which is easy enough for me to understand and I am purely a layman. The NTSB is not about blame, they are about preventing future disasters. They are one of the few US government agencies that actually still has value. They are so good that they are called in to help on things that they have absolutely no remand to do so. They help other countries with craft that have never even landed in our country or even flown over our territories. There is a reason for this - they are that good. They are like the Navy - so good that they are a leading model across the globe and highly sought after because of this.
"So long and thanks for all the fish."
Accusing the test pilot of being untrained and/or incompetent or whining about the risks of interlocks is both irrelevant and stupid. Single point operator failures should be designed out of any system that can cost a human life. That's why there are airbags, seat belts, and crumple zones in cars: because people fuck stuff up. If a new car that costs $15,000 can have these safety features then leaving equivalent features out of a spacecraft is engineering malpractice and possibly criminal negligence.
But no one will be held personally accountable. And whatever safety culture does result won't last. By the time there is a 20% staff turn over it will be completely gone. Why? Because: we're makin money here, if you don't get that then get the fuck out.
Just like in the Challenger disaster, when a technical person objects a manager will say "Take off your engineering hat and put on your management hat." And people will die and nothing will change.
Why is Snark Required?
Just want to highlight the quick mention you made of the Navy. The US Navy's safety programs are mature and thorough enough that NASA has several meeting with Navy personnel about their SUBSAFE program after the Columbia disaster to improve the NASA programs. It says a lot about the Navy's SUBSAFE program that the best rating stops at merely "satisfactory."
I spent a wee bit of time on a ship and guarded a detention facility for a while. I was in the Marines at the time (obviously) and was impressed. "They run a tight ship." They are, hands down, the model for a blue water navy and safety is paramount. Look at their firefighting as well. US Navy, taking shit seriously since the start. They also have a very strict culture about adhering to rules (and have good rules in place for a reason).
"So long and thanks for all the fish."
Like every test pilot at Scaled, Mike was a competent engineer in his own right, in addition to being a test pilot. I guarantee that everyone knew that if the loads were high enough the feather would move if it was unlocked, including the pilots. Like I said in another comment, I also guarantee that Mike flew the procedures on that test card plenty of times on the simulator and threw the feather unlock at the Mach 1.4 callout correctly every time. But in a high workload environment, no matter how much training you go through, sometimes the muscle memory that you're trying to train can fail you and you end up doing steps out of order.
You can't design out *all* the failure modes. If you try to, you end up with computer flying the plane and you still end up with some failure modes you can't work around. You can argue that's why spacecraft shouldn't be human piloted, but in this case, there were pilots there for a reason. Developing all that software for the computers takes time and money to write and to design out those failure modes. Scaled is good at flying experimental planes, and good at training pilots to do so. They applied that experience to spacecraft pretty successfully over the course of 17 flights for SpaceShipOne and 54 flights for SpaceShipTwo and did so much more quickly and cheaper than it would have been done if it were all controlled by computers.
You must be fun in elevators.
His ignorance covered the whole earth like a blanket, and there was hardly a hole in it anywhere. - Mark Twain
Good answer. Here's a fish.
His ignorance covered the whole earth like a blanket, and there was hardly a hole in it anywhere. - Mark Twain