Federal investigators looking into the 2014 crash of Virgin
Galactic LLC's experimental rocket ship are poised to highlight
safety lapses during flight preparation, according to people
familiar with the matter, while internal company documents and
interviews with former engineers indicate that project managers
were warned about separate technical shortcomings long before the
accident.
Engineers over the years had complained about excessive risk and
questionable flight controls, with one even urging a halt to flight
tests and asking regulators to step in. Those alleged problems,
however, have no apparent connection with the sequence of events
that culminated in the crash, according to government and industry
officials. Yet they do underscore what were nagging concerns among
some engineers about inadequate safety margins and a haste to
fly.
Richard Branson's Virgin Galactic has made various design and
production line changes since the crash, according to people
familiar with the matter.
At a public meeting Tuesday, the National Transportation Safety
Board is expected to highlight training weaknesses and inadequate
crew coordination as part of its likely determination that pilot
error led to the high-profile crash of a vehicle being developed by
Virgin Galactic, according to the people familiar with the matter.
A test pilot died in the crash of SpaceShip Two last October, which
sent shock waves through the nascent space-tourism industry.
The safety board's staff, these people said, also has raised
questions about design criteria and manufacturing standards, as
well as the Federal Aviation Administration's limited oversight
authority.
Closely held Virgin Galactic's experience—after investing more
than $400 million in the rocket-powered plane over nearly a
decade—highlights the technical and management challenges of making
the transition from prototype vehicles to production models
intended to routinely carry paying passengers to the edge of the
atmosphere.
Six months prior to the accident, a flight-control expert and
veteran engineer brought in to vet the system urged high-level
project managers that SpaceShip Two "be grounded until such time
that upgrades are made to comply with FAA…requirements that would
head off a potential catastrophic event," according to a company
test report reviewed by The Wall Street Journal. His concerns
aren't apparently connected to what investigators believe led to
the accident.
Company officials declined all comment on the safety board's
focus or findings. But in an email Monday, Virgin Galactic said an
enhanced engineering and safety team has "gone back over all the
designs and we have every confidence that we have left no analysis
undone."
The official report, slated to be completed at Tuesday's
session, according to these people, also is expected examine Virgin
Galactic's past reliance on partner Scaled Composites, a Northrop
Grumman Corp. unit renowned for developing one-of-a-kind
experimental vehicles flown only by test pilots. In this case,
Scaled had the lead in building and testing a spaceplane intended
to carry the general public. A new vehicle with safety enhancements
could start ground tests later this year, but commercial operations
are now likely delayed until at least 2017.
A spokesman for Northrop Grumman declined to comment.
In October, while SpaceShip Two was breaking the sound barrier
some 10 miles above the Earth, a movable tail surface designed to
safely control the craft for descent deployed prematurely, breaking
the vehicle apart. Government investigators have determined that
co-pilot Michael Alsbury, who died, manually unlocked the critical
section at the wrong time, without receiving any command or
verbally indicating his intentions as typically required.
Today, a unit of Virgin Galactic, which has Abu Dhabi's Aabar
Investments as an investor, is in charge of all manufacturing and
testing. In earlier years production was overseen by an entity
jointly owned by Scaled Composites and Virgin Galactic. People who
worked for the joint venture, known as the Spaceship Company, or
TSC, argued among themselves over safety standards, according to
several former engineers.
In the email, Virgin Galactic said it works hard to listen to
employees "express their opinions on the vehicle," and relies on
senior management "to make the right decisions."
As part of efforts to accelerate output in the summer of 2013,
Joe Brennan, TSC's director of operations, sought a way to
alleviate what he called "concerns and hesitancies" of various
engineers to sign off on certain parts, according to a memo
reviewed by the Journal. Engineers believed there were safety
problems with some parts already in use on an existing prototype,
and were uncomfortable vouching for their safety on a second craft,
several former engineers said.
Management directed them to sign off on building those parts,
though without blessing them for flight, according to the memo.
Mr. Brennan's memo in August of 2013 described a novel
redefinition of the approval process, allowing engineers to approve
parts for production but not use in the air. "Our tolerance of risk
for production is not the same as our tolerance for risk" when it
comes to flight, the memo said. It added that a signoff "does not
imply that the part or assembly design has been confirmed to meet
performance requirements."
Virgin Galactic said in Monday's email that the practice "is
certainly common in the aerospace industry" and "we accepted the
risk of parts needing to be reworked while the final touches were
put on the engineering analysis," adding it was "a risk in
schedule, not in flight safety."
Such procedural changes, which apparently aren't connected to
the crash, are occasionally used on large-scale aerospace projects
to accelerate work amid pressing production deadlines. But the move
illustrated the tension between the spacecraft's experimental roots
and the need to come up with a production passenger vehicle design
incorporating higher reliability for essential safety systems.
The analyses revealed that SpaceShip Two fell far short of
standards historically used for many spacecraft, according to a
veteran former project engineer, with some critical systems
potentially failing in thousands of flight hours, rather than
hundreds of thousands of hours as typically tolerated.
"Time and money is needed to fix all that," the engineer added.
"It becomes a much more expensive and much more exhaustive program
than what [Virgin Galactic leadership] originally bought in
to."
In its statement, Virgin said it is building a safety culture in
which "risks are understood and their causes and controls [are]
well evaluated."
The push to fly coupled with a lack of federally mandated safety
standards hampered redesign of key systems, according to Frank
Mayo, a veteran flight-controls engineer, who joined TSC in March
2013.
Mr. Mayo said he flagged his specific concerns to TSC leadership
a year later. Testing showed that if the flight controls on either
side of the vehicle jammed, both pilots pulling or pushing to free
them would likely buckle the healthy side, potentially causing a
loss of control, he wrote in an engineering report reviewed by the
Journal. As a result, he said he urged the craft be grounded
pending a redesign, though. His concerns apparently aren't
connected to the events that investigators believe contributed to
the crash.
In an interview, Mr. Mayo said soon after he raised his concerns
his contract wasn't renewed and he left TSC in April 2014. In
August, he sent an email to the FAA laying out his concerns and to
the NTSB following the accident. The FAA had no immediate
comment.
According to Virgin Galactic, "a small redesign" resolved a
concern related to the one expressed by Mr. Mayo.
Mr. Mayo in an interview disputed Virgin's claim, and said the
earlier small redesign of a broken bracket didn't address the
concerns he brought to senior management.
Write to Andy Pasztor at andy.pasztor@wsj.com and Jon Ostrower
at jon.ostrower@wsj.com
Subscribe to WSJ: http://online.wsj.com?mod=djnwires