Accident at Koehn Dry Lake, California, 31 Oct 2014 (N339SS)

Accident narrative

On October 31, 2014, at 1007:32 Pacific daylight time, the SpaceShipTwo (SS2) reusable suborbital rocket, registration N339SS, broke up into multiple pieces during a rocket-powered test flight. The vehicle impacted terrain over a 5-mile area near Koehn Dry Lake, California. Operated by Scaled Composites LLC, the flight resulted in fatal injuries to the copilot and serious injuries to the pilot. The vehicle was destroyed, but no one on the ground was injured by falling debris.

**The flight** Scaled Composites was developing SS2 for Virgin Galactic. The design mission involved an air launch from a carrier vehicle, WhiteKnightTwo (WK2), followed by a rocket-powered boost phase, a coast to apogee, and a "feathered" reentry. The feather system rotated a flap assembly with twin tailbooms upward to 60 degrees to stabilize the vehicle's attitude and increase drag during reentry into the atmosphere. The system used actuators to extend and retract the feather, and locks to keep it retracted when not in use.

The accident flight was SS2's fourth powered flight test (PF04). The pilot and copilot were highly experienced test pilots; the pilot had 2,980 hours of total flying time, and the copilot had 2,154 hours. WK2, carrying SS2, departed Mojave Airport at 0919:30.

At 1007:19.1, SS2 was released from WK2 at an altitude of about 46,400 feet. The pilot commanded the copilot to fire the rocket motor, which ignited at 1007:21.6.

During the boost phase, the flight test data card required the copilot to make a callout at 0.8 Mach to alert the pilot of an impending transonic "bobble." After the pilot trimmed the horizontal stabilizers, the copilot was required to unlock the feather system when the vehicle reached 1.4 Mach. Unlocking the feather during the boost phase was intended to mitigate the hazard of a locked feather during reentry, allowing the crew time to abort the flight if the locks failed to release.

At 1007:26.9, the copilot called out 0.8 Mach. Just 1.5 seconds later, at 1007:28.4, the copilot stated "unlocking." Cockpit video showed him moving the feather lock handle to the unlocked position. The vehicle's speed was about 0.82 Mach. Telemetry data confirmed the feather locks transitioned to not locked at 1007:29.5.

At 1007:30.6, the feather started to move uncommanded. Neither pilot had moved the separate feather handle required to deploy it. At 1007:31.4, the pilot stated "pitch up," followed by the same comment from the copilot. The vehicle's structural breakup began at 1007:32.13 in the aft end near the feather flap hinges. The vehicle essentially folded in half and broke apart.

**Survival and emergency response** The pilot was thrown from the vehicle while restrained in his seat. He recalled a violent pitch up, a loud bang, and signs of rapid depressurization before losing consciousness. He awoke in free-fall, unfastened his seat belt, and separated from the seat. His parachute deployed automatically. He attempted to activate his emergency oxygen system multiple times but received no flow. The copilot was found restrained in his seat with the cockpit wreckage.

The emergency response was delayed. A local fire department helicopter designated for off-airport response was not prepositioned at Mojave Airport, unlike during previous powered flights. Another helicopter with advanced life support was at the airport but had not been placed on standby. The first helicopter arrived at the pilot's location 45 minutes after the accident.

**What the investigation found** The recovered components showed no evidence of structural, system, or rocket motor failures before the breakup. The feather lock system operated as commanded by the copilot. However, the aerodynamic and inertial loads on the vehicle in the transonic region resulted in an opening moment greater than the closing moment provided by the feather actuators. Once unlocked, the external aerodynamic loads forced the feather to extend.

The Board concluded that the copilot incorrectly unlocked the feather early. The boost phase was highly dynamic, requiring tasks to be recalled from memory under time pressure. The copilot also lacked recent experience with the vibration and loads of powered flight, which were not replicated in the simulator. The Board concluded he experienced high workload, increasing the opportunity for errors.

Scaled Composites' systems safety analysis had identified uncommanded feather operation during boost as a catastrophic hazard. However, the analysis assumed pilots would correctly operate the system every time. Scaled did not account for the possibility that a pilot might prematurely unlock the feather, nor did the vehicle have a design barrier to prevent it. The Board concluded Scaled missed opportunities to identify design or operational requirements that could have mitigated this human error.

Scaled operated SS2 under an experimental permit from the Federal Aviation Administration's Office of Commercial Space Transportation (AST). The Board found that the FAA/AST evaluated the permit applications and determined that Scaled's hazard analysis did not comply with software and human error regulatory requirements. The FAA/AST later issued waivers for software and human error hazard analysis requirements, relying on mitigations like simulator training without verifying their effectiveness against a single catastrophic human error. The Board also noted that pressure to approve permits within a 120-day review period, and a lack of direct communication between FAA/AST technical staff and Scaled technical staff, interfered with the FAA's ability to thoroughly evaluate the applications.

Post-accident testing of the pilot's emergency oxygen system showed it required about 57.8 pounds of force to activate, which could not be done with one hand. Furthermore, the pilot's oxygen hose was found disconnected from his harness fitting, meaning oxygen would have vented to the atmosphere even if he had successfully activated it.

**Probable cause** The National Transportation Safety Board determined that the probable cause of this accident was Scaled Composites’ failure to consider and protect against the possibility that a single human error could result in a catastrophic hazard to the SpaceShipTwo vehicle. This failure set the stage for the copilot’s premature unlocking of the feather system as a result of time pressure and vibration and loads that he had not recently experienced, which led to uncommanded feather extension and the subsequent aerodynamic overload and in-flight breakup of the vehicle.