Mayday (2013) s18e06 Episode Script
Deadly Mission
Fire.
Pitch up! Flight Director: Abort! Abort! An aircraft disintegrates over the California Desert.
It hits hard when you end up having an accident where you lose a close crew member.
Investigators struggle to find out why.
That's the big question that every pilot has.
How did this happen? There was a lot of questions in regards to how the motor performed.
Everything started shaking pretty bad.
I couldn't breathe.
The stakes could not be higher.
It's a massive setback.
We need to find out what went wrong.
Flight Director: Release.
Any time you take an object and you push it through space, there's going to be risk.
The future of commercial space travel hangs in the balance.
The Mojave Air and Space Port in Southern California is the site of some of the world's most advanced aerospace research.
Today, a select group of visitors is getting the rare chance to watch a revolutionary new aircraft soar to incredible heights.
It's called SpaceShipTwo.
System booting.
The spaceship is designed by American aerospace company Scaled Composites.
Showing green across the board.
There are only two test pilots aboard today's flight, but the company hopes this unique craft will soon be carrying paying customers to the edge of space and back.
Beginning pre-launch checklist.
Copy that.
The project is the brainchild of multi-billionaire Sir Richard Branson.
Together we can make space accessible in a way that has only been dreamt of before now.
Three, two, one.
Whoa.
He sees a bright future in space tourism with adventure seekers willing to pay 250,000 for a seat on a 70-mile journey past the gravitational bonds of Earth.
Well it's a thrill ride.
And you get to experience three to four minutes of weightlessness.
You get to float around the cabin.
You get a snapshot of what it's like to be an astronaut.
Hundreds of customers have already booked a flight.
But they won't get their thrill ride until Scaled Composites can prove the technology is safe.
And that's taking much longer than expected.
They're seven years behind schedule.
They really didn't understand just how difficult it was going to be.
By 2014, there may have been a sense of urgency.
We better get on with this.
Otherwise, we might start losing customers and people will lose their faith in us.
The pressure is on.
The future of the entire program rests on the shoulders of these two test pilots.
Forty-three-year-old Peter Siebold is an award-winning engineer.
He's piloted eleven different types of experimental aircraft.
His co-pilot, 39-year-old Mike Alsbury, is also a seasoned test pilot and an aeronautical engineer.
They've spent almost nine months training for this mission.
These guys are test pilots, uh very, very experienced pilots.
These are the best of the best of the best.
Their rocket-powered spaceship is suspended from a jet-powered plane with a 140-foot wingspan.
The launch plane is called WhiteKnightTwo.
SpaceShipTwo communications check.
WhiteKnightTwo Captain: SpaceShipTwo, WhiteKnightTwo copies.
You're loud and clear.
The pilots of WhiteKnightTwo will take the spaceship up to 46,000 feet.
At that extreme altitude, SpaceShipTwo will detach from the airplane, fire its rocket motor and climb almost another one hundred thousand feet higher, to the edge of space.
It will then glide back to earth.
The big advantage of an air launch is it gets you up into the atmosphere 40,000 feet or more prior to starting out, and that that's a huge advantage versus having to push your way up there off the ground.
Monitoring today's test is a flight director.
He's in constant communication with a team of flight engineers, as well as with all four pilots.
He has the authority to call off the mission if something goes wrong.
We're getting an intermittent caution on the battery current.
It's just showing a negative.
Point-zero-one.
WhiteKnightTwo Pilot: I think until pylon power turns off, it's not going through that.
Base, is that correct? Flight Director: That is correct.
There's a higher potential so it just uses the pylon current.
It's like a miniaturized version of the mission control room that you see at Johnson Space Center.
There's a lot of data coming down from that spacecraft and so they can see the health of the spacecraft and how it's performing at any, at any given time.
Today's mission is the 36th test flight for SpaceShipTwo, but only its fourth powered flight.
They're just gonna go a little bit higher and burn the engine a little bit longer than the last flight, powered flight three.
They're testing a new rocket motor that burns an experimental nylon fuel designed to push the spacecraft to an altitude of 140,000 feet.
Pre-launch checks complete.
Copy.
WhiteKnightTwo, SpaceShipTwo, pre-flight complete.
WhiteKnightTwo Co-Pilot: Copy that.
Base, we are ready.
At 9:20 am Flight Director: WhiteKnightTwo, you are go.
.
.
the flight director clears the pilots for takeoff.
WhiteKnightTwo and its spaceship cargo accelerate down the runway.
Takeoff speed is 150 knots.
There's a huge internal pressure you put on yourself as you head into one of these tests.
There's a feeling like I want to maximize my return on this investment.
I want to give as much data back to the engineers as I can.
From takeoff to landing, the flight will take about an hour.
Captain Siebold will take the control column while co-pilot Alsbury monitors performance and configures the craft for its landing.
How's the pressurization system controller doing? As they climb towards the launch altitude Whoa.
one of the cockpit's multifunction displays goes dark.
But only for a moment.
There you go.
Base, we just had a uh, sensor MFD failure moving the lower right small knob.
Flight Director: Base copies.
We're seeing it re-booting on the screen now.
I think that's a first.
At least in the airplane.
All right.
30,000-foot checks.
Ready for that? Ready.
Back on the ground, the excitement builds.
Space flight has always been sexy.
It's always been about boundaries, and it's always been about adventure, and that's what attracts people to it, I think.
WhiteKnightTwo Captain: SpaceShipTwo is two minutes from release.
You are clear to arm the pylon release.
I'll call fire.
In the final minutes before launch, the pilots review the critical tasks they're about to perform.
Call pitch-up, pitch-down, trim feather, unlock one-point-four.
Things happen very, very, very quickly.
They do not have the time physically to go and pull out the checklist and read the checklist because these things are happening second after second after second.
Flight Director: Glide trim's good.
Green for release.
The Flight Director clears SpaceShipTwo for launch.
Okay.
Here we go.
WhiteKnightTwo Co-Pilot: All right.
Stick.
Stick is forward.
Captain Siebold moves the control yoke forward to ensure they'll fly down and away from WhiteKnightTwo after release.
Armed.
Yellow light.
Any time you take an object and you push it at the speeds we're talking about through space and then bring it back, there's going to be risk.
It's almost impossible to make it completely safe.
Flight Director: And five, four, three, two, one.
Release.
Release.
Release.
Clean release.
SpaceShipTwo detaches from WhiteKnightTwo exactly as planned.
Now comes the true test.
Can this revolutionary craft take the crew to the edge of space and safely back to Earth? As SpaceShipTwo drops from its carry plane Fire.
Mike Alsbury arms the experimental rocket motor.
Armed.
Fire.
Sixty thousand pounds of thrust propels them towards the speed of sound.
Good light.
SpaceShipTwo, its top speed is close to 3 Mach so uh three times the speed of sound, over two thousand miles per hour.
It's very, very fast.
Yee-haw.
It's a very, very rough ride.
So you think about the worst turbulence you've been in an aircraft liner and then magnify that by ten.
The main thing they were testing was the longer burn time on the rocket engines.
It was supposed to be a 38-second burn of the engine.
But just 14 seconds after ignition, one of the flight engineers notices some highly troubling data coming from the spacecraft.
Flight Director: Knock it off! Abort! The flight director issues a desperate order for the crew to abort.
But it's too late.
Flight Director: Emergency procedures now in effect.
Red card two.
Witness: My husband was watching through binoculars.
He said that doesn't look good.
And then we saw two pieces falling from the sky.
I have some pretty close friends who were out there.
I wondered about them.
Who was flying? What happened? And that, that's the big question that every pilot has when you hear about a mishap: How did this happen? Flight Director: Emergency procedures now in effect.
Red card 2.
WhiteKnightTwo Captain: Initiating search protocol, WhiteKnightTwo.
Remarkably, Captain Pete Siebold has managed to parachute to safety.
He's injured but alive.
There's no emergency escape system.
Uh there's no egress capsule.
There's nothing like that.
Basically there's not much they can do apart from hope that parachutes open.
That's the risk.
Co-pilot Mike Alsbury is not so lucky.
Trapped in the cockpit during the break-up, he dies in the crash.
Everybody wants to see the goal of commercial space.
They wanna see the goal of uh this new aircraft, this new vehicle being successful.
And it, it hits hard when you end up having an accident where you lose a close crew member and someone that you've probably worked with day-in and day-out throughout the whole program.
Good evening.
And we begin this Friday night with the deadly mid-air explosion at 50,000 feet over the Mojave Desert.
And major questions over how this could have happened.
Wreckage is strewn over five miles of desert.
Emergency responders spot Pete Siebold's parachute and rush him to hospital.
It was a heart wrenching moment.
It's horrendous for the families of the test pilot.
It's a horrible day for Virgin Galactic, for, for commercial space travel.
Um it's a massive setback.
We need to find out what went wrong and fix it.
That job now falls to the National Transportation Safety Board.
Investigating space accidents is nothing new for the NTSB.
Okay.
In the wake of the Space Shuttle Columbia disaster in 2003, more than 50 NTSB employees helped identify the cause of the break-up.
Working with a commercial space accident as compared to a commercial airline or a general aviation accident is very similar.
A lot of the engineering principles are the same.
The actual devices that are used are slightly different because of the environments that they're intended to operate in, but the basic scientific principles stay the same.
Let's start with the rocket motor.
All right.
The NTSB's Lorenda Ward is the investigator in charge.
She sends her team in search of components from the spacecraft's newly designed engine.
What we look for is any evidence of a in-flight fire, or post-crash fire, and we didn't really have a lot of fire in itself.
Mike Bauer is an NTSB investigator and systems group chairman.
It's his job to search the wreckage for any sign of an onboard systems failure.
I worked closely with the propulsion engineer, and we discussed some of the items that could have helped cause the in-flight breakup that might have been propulsion related.
SpaceShipTwo is powered by a new rocket motor that burns an experimental hybrid fuel, a combination of nitrous oxide and nylon.
The advanced power plant is more efficient, pushing the spacecraft to extreme altitudes while burning less fuel.
But the improvements come with a risk.
The new engine is more likely to blow up if the fuel doesn't ignite properly.
Is that what happened in the skies over the Mojave Desert? We had a list of items that we were concerned with that we wanted to take a closer look at.
We would be on our hands and knees going through, very finely looking for valves, fittings, components for some of the smaller items that we were looking at, including some of the data storage units.
I'm not seeing any scorching on the rocket motor.
The team searches for any evidence that the motor blew up in flight.
This is a composite-type vehicle, but it's still painted so you would see like the blistering of the paint.
You could also see melting of materials.
And we did not have that.
There's no explosion or fire.
One of the things that we were able to tell by being on scene was that the motor was not an issue as to why the vehicle broke up.
Ruling out one possible cause is a step forward for investigators.
But they know they could be facing a very long road ahead in their search to figure out why this crucial test flight went so horribly wrong.
Flight Director: Abort! The wreckage that now litters California's Mojave Desert has put the future of commercial space travel in doubt.
The NTSB needs answers.
What happened to SpaceShipTwo during its short high-speed flight? Were there any signs of trouble before the accident? Flight Director: Oh, there was a data warning.
Knock it off.
Can we see the video from the external cameras? Flight Director: See here? The tail boom folded in on the aircraft along the hinge of the feather system.
It went into feather mode? Feather mode refers to the defining feature of SpaceshipTwo's design.
The craft actually changes shape during flight.
After reaching maximum altitude, the pilots pivot the wings upward into the feather position.
This increases drag and slows their descent.
The craft can then drop safely back into Earth's atmosphere, before gliding to a runway.
You're guaranteeing a solid attitude.
That's the position of the spacecraft coming back into the atmosphere.
At the same time, you're increasing drag so you can actually stabilize that position even more.
Investigators have instant access to everything that happened onboard the spaceship thanks to a cockpit video camera.
So he unlocked the feather system.
Flight Director: Correct.
But did he actually deploy it? Flight Director: No.
And that's the weird thing.
No one touched the handle.
There are two steps to feathering the spaceship.
First, the pilots unlock the feather system so the tail boom can pivot when commanded.
Second, the pilots must pull the feather handle to actually deploy the tail boom.
So those were the two things that we were trying to connect.
So we have the video of the co-pilot unlocking but we never see him actually operate the feathers, but we know from external video that the feathers moved.
So we knew that we had a performance or a dynamic issue.
Somehow the system designed to slow the craft on descent deployed while the crew was accelerating towards the speed of sound.
Pitch-up! Pitch-up! If the reason why can't be found, Richard Branson's bold vision for the future of space travel may never be realized.
Ward and her team set up a makeshift headquarters to catalogue and examine components recovered from the desert.
What about the actuators? A system of actuators hold the tail boom in place until the pilots are ready to deploy it.
The actuators then extend and move the tail boom into the feathered position for re-entry.
Just right here.
The devices are critical to the proper functioning of the spacecraft.
What we wanted to look at was to make sure that there were no pre-existing failures within the actuators that could lead to either the feather actuators not being able to hold the feather down in an unfeathered configuration, or cause some uncommanded movement to the feathered position.
It looks like the casing's damaged.
They study the part closely looking for evidence of when it became damaged before or after the mid-air break up.
They soon have an answer.
Some of the damage that we noticed we could find particles from the desert floor in it, which was indicative of it happening post-event.
Impact damage.
Seeing a lot of impact damage to the actuators and some of the other components was starting to lead us down the fact that we didn't have a pre-existing failure of the feather system prior to the actual feathering of the vehicle.
Let's have a look at the rest of the system.
We started to wonder: How could we get the feather system to operate without a failure within the system? It was a lot of research into the data.
We had a wealth of data at our, at our fingertips.
Let's pull this up here.
Okay.
Let's have a look at the speed and altitude.
Investigators now study the telemetry data from the flight.
Like a flight data recorder in an airplane, the telemetry reveals both how the spacecraft was performing and what the pilots were doing during the flight.
Stop.
SpaceShipTwo is released here, and the engine fires.
Everything looked okay.
Next, we need to look at the pilot inputs after ignition.
We were able to use the data and look and compare it with the video.
So we had to match up and do a time correlation between the video itself and then also with other data that came down.
Wait a second.
The feather actuator was unlocked about eight seconds after the engine lit and then four seconds later SpaceShipTwo broke apart.
The data makes it clear that after release, the pilots performed a series of critical tasks in a very short period of time.
Armed.
But did they perform those tasks in the right order? And how accurate was their timing? Those answers are now crucial.
Okay.
Here we go.
The precise timing of events in the cockpit could be a key to understanding the sudden mid-air break-up of SpaceshipTwo.
Investigators are determined to learn more.
Armed.
Yellow light.
They turn to engineers from Scaled Composites, the firm that designed the spacecraft.
Uh you can set up right here.
Do you want to help him clear the table? With any accident investigation, we rely on the parties to the investigation to help us because they have the expertise needed to help us understand what the pilots were doing at the time or should have been doing at the time of the accident.
Great.
So when is he supposed to unlock the feather system? Between Mach one-point-four and one-point-eight.
Do you want to play that? Yee-haw.
Point-eight.
Unlocking.
Pause.
He unlocked the feather at Mach zero-point-eight.
That's too early? We then looked at the video and were able to see that the co-pilot had actually unlocked the feather system early.
Isn't it safer to unlock it at lower speed? No, ma'am.
That can be catastrophic.
This is when upward forces on the tail are greatest.
Ward learns that when the spacecraft is well below the speed of sound, aerodynamic forces push downward on the tail, keeping it in place.
As it approaches the speed of sound, the forces change, pulling upward on the tail.
Finally, when the craft moves beyond the speed of sound, the forces once again hold the tail in place.
That's why pilots are trained to unlock the system in the final stage of the ascent.
Good light.
In the transonic phase, you've got a huge amount of upward force on the tail boom, on the tail of the spacecraft.
And the feather system was not designed to deal with that sort of load.
So when he unlocked it early, the actuators couldn't hold the tail in place.
Investigators have discovered that it was catastrophic to unlock the tail boom at a lower speed.
Aerodynamic forces pulled the tail into the deployed position, which tore the aircraft apart.
Pitch up.
Pitch up.
It was a catastrophic destruction of the vehicle and you can't come back from that.
Like they can't, you know, try to lock the feathers again.
There's nothing they can do in the cockpit to save the vehicle.
The co-pilot unlocked the system early.
But why would an experienced test pilot like Mike Alsbury unlock the tail boom at the deadliest possible moment? Flight Director: Abort! Abort! Searching for an answer, they look into his flight records.
They learn that Alsbury had over 2100 flight hours.
He'd done eight previous flights on SpaceShipTwo.
In addition to being a test pilot, he was a flight instructor and an award-winning project engineer at Scaled Composites.
Both of these test pilots were extremely qualified.
Their pilot ratings exceeded the minimum qualifications required by the FAA.
In addition, they flew multiple aircraft at Scaled Composites.
They also participated in the SpaceShipOne project and also flew the WhiteKnightTwo.
Let's talk to the man in the cockpit with him.
Peter Siebold was badly injured in the accident.
Lorenda Ward wants to know if he can shed any light on why his co-pilot unlocked the feather system 16 seconds before he should have.
On your flight, do you remember when Mike unlocked the feather? No.
No, I didn't see anything, no.
When did you know something had gone wrong? When everything started shaking pretty bad after the engine lit.
Fire.
And there was this really violent pitch-up.
Pitch-up.
Pitch-up.
And, and G forces just went through the roof.
I couldn't breathe.
Was there anything else? Actually, yeah.
Um the display rebooted during the flight.
That's never happened before.
A malfunctioning display could be an important clue.
Whoa.
They actually had the display reboot in flight.
The information that was put on that display helps the crew understand the health of, let's say, the feather system, the electrical system, even the propulsion system.
So it was of a concern that if the display was not functioning properly the crew could be presented with erroneous information, which could cause them to make improper decisions during the flight.
There you go.
Right here.
Perfect.
Investigators connect a spare display with the flight's telemetry data to recreate the conditions after the reboot.
Scaled had an exact duplicate of the display, and we were able to use that data and back drive the display to see what the crew would have been seeing during the accident sequence.
If the speed data was faulty, and the pilots thought they were flying at Mach one-point-four when really they were flying at only Mach point-eight, it could explain the co-pilot's decision to unlock the feathers early.
It's displaying everything correctly.
It seems the information the pilots were receiving was completely accurate.
They were not the victims of a faulty display.
Good light! Investigators still don't understand the co-pilot's fatal action.
The NTSB hopes to learn whether the pilots understood the dangers of unlocking the tail boom too soon.
They pore over Scaled Composites' training materials and operating handbooks.
We need to figure out what they were told about unlocking the feather system early.
Unlock.
They find no mention of the deadly scenario.
There's no warning about unlocking after separation.
What does the flight test data card say? All right.
30,000-foot checks.
Ready for that? Ready.
For every test mission, pilots get a flight test card.
It includes information on the test vehicle, the mission being conducted, and what the pilots need to do during each phase of the flight.
It's the Bible of any test flight.
Feather unlock one-point-four.
Unlock the feather once the vehicle reaches one-point-four Mach.
But nothing about not doing it earlier than that.
There was no note that said if you open early it could be a catastrophic failure to the vehicle.
So there was nothing to say if you were to unlock early, you could lose the vehicle.
When was this? They discover just two written references to the dangers of unlocking the feather early.
An e-mail from 2010 and a presentation slide from 2011.
That's it.
All they could find was one e-mail and one PowerPoint presentation.
That's four years ago.
So this wouldn't have been uppermost in the minds of the pilots.
It's possible they really didn't understand the risks.
The NTSB's Dr.
Katherine Wilson specializes in human performance analysis.
One thing that was concerning to investigators was the fact that the catastrophic nature of this type of error was not emphasized in training or in manuals.
Investigators have some questions for the people who designed the spacecraft.
Why is there no failsafe mechanism for the feather lock? We didn't think we needed one.
From talking with some of the engineers, we found out that they didn't even consider the human limitations when designing the system, and so therefore didn't build in any redundancies that would prevent a single-point human error that would lead to a catastrophic outcome.
These guys should know the mission inside out.
They kind of hold them to a higher standard than a normal pilot, or a commercial or general aviation.
They felt that a flight test pilot would be able to perform perfectly every time.
No wonder they didn't expect mistakes.
Training records show that the co-pilot flew a total of 112 simulator runs for this mission.
Point-eight Mach.
Trimming? The simulator training was extremely important for these pilots.
It allowed them to run through the scenarios, get comfortable with the scenarios prior to getting into the actual aircraft.
These pilots particularly were in the simulator about 14 times in the few months leading up to the accident.
So they were extremely familiar with what the test card read and the procedures that they were to follow.
Never once did the co-pilot unlock the feather early.
Hold on now.
The records reveal that while Alsbury never made the deadly mistake in training, he did on one occasion make a different mistake.
He unlocked the feather too late.
Twelve degrees.
Simulator: Feather unlock.
Fourteen degrees.
Simulator: Mission abort.
Mission abort.
In order to ensure that the feather system works properly, the mission would be aborted if it wasn't unlocked by Mach one-point-eight.
If they didn't unlock by one-point-eight they would have had aborted the flight, and we had seen in the simulator session data that the co-pilot had unlocked late.
So he has to do it before reaching Mach one-point-eight.
If he's late, the mission is aborted.
Aborting a mission is not fatal.
But investigators wonder, did this error in training from months ago somehow play a role in the crash? Simulator: Mission abort.
Mission abort.
Fire.
Could it help explain what went wrong aboard SpaceShipTwo? Fourteen seconds from rocket ignition to total destruction.
How did the SpaceShipTwo test flight go so wrong so quickly? The NTSB reviews the pilots' checklist, searching for clues.
Call out zero-point-eight Mach.
Call out stabilizer trim settings.
L minus four.
Checks complete.
I'll call fire.
Trim, feather unlock one-point-four.
It's clear that both pilots had their hands full throughout the short flight.
Check your attitudes.
The pressure that you have to always do the right thing at the exact optimum time, you think okay, I want to be ahead of the vehicle.
Reset trim to Meaning not being behind trying oh, I need to do that.
Like, no, I'm going to need to throw this switch in X amount of time so I'm ready to do it right now.
It's that pressure to do things at the exact right time that leads you to try and prepare, which might end up having you do something early, or inadvertent.
Investigators believe time pressure may be one reason Mike Alsbury decided to unlock the feather system early.
If they don't unlock the feather mechanism by Mach one-point-eight then the flight is aborted.
So obviously that's gonna be weighing on the co-pilot's mind.
You want to get that out of the way.
Then, they make another discovery.
Can I see that simulator video again? It's hardly the same environment.
The training simulator did not replicate the actual sensation of a powered flight.
It didn't vibrate or simulate G forces.
So it is different being in the real vehicle than the simulator, and while you think you're back in the sim but as you're launched, you realize it's different, and you're being moved around differently.
Good light.
These vibrations and loads may have impacted the co-pilot's decision-making on that day and added additional pressure to him in terms of wanting to complete his tasks in a timely manner.
Yee-haw! The co-pilot, his last powered flight was April 2013, so he hadn't actually been in a powered flight for 18 months.
Even if you're a very, very good test pilot that has to be a little bit unnerving to get all this vibration and G-loads and speed and everything else.
Investigators finally understand what happened.
It was an unfamiliar environment.
He had a lot to do.
He made a decision to unlock early, perhaps not realizing the deadly implications.
Just because these are test pilots does not mean that they are not human, that they will not make mistakes.
It is possible and we have to take all of these limitations of our pilots into consideration.
The NTSB faults Scaled Composites for not ensuring that their pilots understood the consequences of unlocking the feather system early and not taking steps to prevent it from happening.
Pitch up! If they would have thought a little bit more about how they could have prevented that early unlocking versus just relying on the pilots' training and performing perfectly every time Unlocking.
Even just having a sensor that physically prevents them from unlocking until it passes the appropriate threshold would have prevented this accident.
Flight Director: Abort! In its final report, the NTSB states that the probable cause of the test flight disaster was a failure on the part of design engineers to protect against the possibility that a single human error could lead to catastrophe.
Whenever you uh put humans in the loop, you have the potential for human error.
It's always gonna be the case.
No matter how well you design the system, um, that's always gonna be the case.
Like I say, we're talking about some of the best pilots in the world and uh he made a mistake.
You know, we used to say uh the Navy manual for operating the F-14 was kind of written in blood because every time there was an accident somebody realized oh, we should have told people about this, and we didn't so now we will.
And you learn those lessons the hard way.
We learned from this situation and we will um build a second spaceship.
We'll make sure it's a hundred per cent safe and we will complete what we started and I think we're gonna make a, a radical difference to this world.
Pitch up! Flight Director: Abort! Abort! An aircraft disintegrates over the California Desert.
It hits hard when you end up having an accident where you lose a close crew member.
Investigators struggle to find out why.
That's the big question that every pilot has.
How did this happen? There was a lot of questions in regards to how the motor performed.
Everything started shaking pretty bad.
I couldn't breathe.
The stakes could not be higher.
It's a massive setback.
We need to find out what went wrong.
Flight Director: Release.
Any time you take an object and you push it through space, there's going to be risk.
The future of commercial space travel hangs in the balance.
The Mojave Air and Space Port in Southern California is the site of some of the world's most advanced aerospace research.
Today, a select group of visitors is getting the rare chance to watch a revolutionary new aircraft soar to incredible heights.
It's called SpaceShipTwo.
System booting.
The spaceship is designed by American aerospace company Scaled Composites.
Showing green across the board.
There are only two test pilots aboard today's flight, but the company hopes this unique craft will soon be carrying paying customers to the edge of space and back.
Beginning pre-launch checklist.
Copy that.
The project is the brainchild of multi-billionaire Sir Richard Branson.
Together we can make space accessible in a way that has only been dreamt of before now.
Three, two, one.
Whoa.
He sees a bright future in space tourism with adventure seekers willing to pay 250,000 for a seat on a 70-mile journey past the gravitational bonds of Earth.
Well it's a thrill ride.
And you get to experience three to four minutes of weightlessness.
You get to float around the cabin.
You get a snapshot of what it's like to be an astronaut.
Hundreds of customers have already booked a flight.
But they won't get their thrill ride until Scaled Composites can prove the technology is safe.
And that's taking much longer than expected.
They're seven years behind schedule.
They really didn't understand just how difficult it was going to be.
By 2014, there may have been a sense of urgency.
We better get on with this.
Otherwise, we might start losing customers and people will lose their faith in us.
The pressure is on.
The future of the entire program rests on the shoulders of these two test pilots.
Forty-three-year-old Peter Siebold is an award-winning engineer.
He's piloted eleven different types of experimental aircraft.
His co-pilot, 39-year-old Mike Alsbury, is also a seasoned test pilot and an aeronautical engineer.
They've spent almost nine months training for this mission.
These guys are test pilots, uh very, very experienced pilots.
These are the best of the best of the best.
Their rocket-powered spaceship is suspended from a jet-powered plane with a 140-foot wingspan.
The launch plane is called WhiteKnightTwo.
SpaceShipTwo communications check.
WhiteKnightTwo Captain: SpaceShipTwo, WhiteKnightTwo copies.
You're loud and clear.
The pilots of WhiteKnightTwo will take the spaceship up to 46,000 feet.
At that extreme altitude, SpaceShipTwo will detach from the airplane, fire its rocket motor and climb almost another one hundred thousand feet higher, to the edge of space.
It will then glide back to earth.
The big advantage of an air launch is it gets you up into the atmosphere 40,000 feet or more prior to starting out, and that that's a huge advantage versus having to push your way up there off the ground.
Monitoring today's test is a flight director.
He's in constant communication with a team of flight engineers, as well as with all four pilots.
He has the authority to call off the mission if something goes wrong.
We're getting an intermittent caution on the battery current.
It's just showing a negative.
Point-zero-one.
WhiteKnightTwo Pilot: I think until pylon power turns off, it's not going through that.
Base, is that correct? Flight Director: That is correct.
There's a higher potential so it just uses the pylon current.
It's like a miniaturized version of the mission control room that you see at Johnson Space Center.
There's a lot of data coming down from that spacecraft and so they can see the health of the spacecraft and how it's performing at any, at any given time.
Today's mission is the 36th test flight for SpaceShipTwo, but only its fourth powered flight.
They're just gonna go a little bit higher and burn the engine a little bit longer than the last flight, powered flight three.
They're testing a new rocket motor that burns an experimental nylon fuel designed to push the spacecraft to an altitude of 140,000 feet.
Pre-launch checks complete.
Copy.
WhiteKnightTwo, SpaceShipTwo, pre-flight complete.
WhiteKnightTwo Co-Pilot: Copy that.
Base, we are ready.
At 9:20 am Flight Director: WhiteKnightTwo, you are go.
.
.
the flight director clears the pilots for takeoff.
WhiteKnightTwo and its spaceship cargo accelerate down the runway.
Takeoff speed is 150 knots.
There's a huge internal pressure you put on yourself as you head into one of these tests.
There's a feeling like I want to maximize my return on this investment.
I want to give as much data back to the engineers as I can.
From takeoff to landing, the flight will take about an hour.
Captain Siebold will take the control column while co-pilot Alsbury monitors performance and configures the craft for its landing.
How's the pressurization system controller doing? As they climb towards the launch altitude Whoa.
one of the cockpit's multifunction displays goes dark.
But only for a moment.
There you go.
Base, we just had a uh, sensor MFD failure moving the lower right small knob.
Flight Director: Base copies.
We're seeing it re-booting on the screen now.
I think that's a first.
At least in the airplane.
All right.
30,000-foot checks.
Ready for that? Ready.
Back on the ground, the excitement builds.
Space flight has always been sexy.
It's always been about boundaries, and it's always been about adventure, and that's what attracts people to it, I think.
WhiteKnightTwo Captain: SpaceShipTwo is two minutes from release.
You are clear to arm the pylon release.
I'll call fire.
In the final minutes before launch, the pilots review the critical tasks they're about to perform.
Call pitch-up, pitch-down, trim feather, unlock one-point-four.
Things happen very, very, very quickly.
They do not have the time physically to go and pull out the checklist and read the checklist because these things are happening second after second after second.
Flight Director: Glide trim's good.
Green for release.
The Flight Director clears SpaceShipTwo for launch.
Okay.
Here we go.
WhiteKnightTwo Co-Pilot: All right.
Stick.
Stick is forward.
Captain Siebold moves the control yoke forward to ensure they'll fly down and away from WhiteKnightTwo after release.
Armed.
Yellow light.
Any time you take an object and you push it at the speeds we're talking about through space and then bring it back, there's going to be risk.
It's almost impossible to make it completely safe.
Flight Director: And five, four, three, two, one.
Release.
Release.
Release.
Clean release.
SpaceShipTwo detaches from WhiteKnightTwo exactly as planned.
Now comes the true test.
Can this revolutionary craft take the crew to the edge of space and safely back to Earth? As SpaceShipTwo drops from its carry plane Fire.
Mike Alsbury arms the experimental rocket motor.
Armed.
Fire.
Sixty thousand pounds of thrust propels them towards the speed of sound.
Good light.
SpaceShipTwo, its top speed is close to 3 Mach so uh three times the speed of sound, over two thousand miles per hour.
It's very, very fast.
Yee-haw.
It's a very, very rough ride.
So you think about the worst turbulence you've been in an aircraft liner and then magnify that by ten.
The main thing they were testing was the longer burn time on the rocket engines.
It was supposed to be a 38-second burn of the engine.
But just 14 seconds after ignition, one of the flight engineers notices some highly troubling data coming from the spacecraft.
Flight Director: Knock it off! Abort! The flight director issues a desperate order for the crew to abort.
But it's too late.
Flight Director: Emergency procedures now in effect.
Red card two.
Witness: My husband was watching through binoculars.
He said that doesn't look good.
And then we saw two pieces falling from the sky.
I have some pretty close friends who were out there.
I wondered about them.
Who was flying? What happened? And that, that's the big question that every pilot has when you hear about a mishap: How did this happen? Flight Director: Emergency procedures now in effect.
Red card 2.
WhiteKnightTwo Captain: Initiating search protocol, WhiteKnightTwo.
Remarkably, Captain Pete Siebold has managed to parachute to safety.
He's injured but alive.
There's no emergency escape system.
Uh there's no egress capsule.
There's nothing like that.
Basically there's not much they can do apart from hope that parachutes open.
That's the risk.
Co-pilot Mike Alsbury is not so lucky.
Trapped in the cockpit during the break-up, he dies in the crash.
Everybody wants to see the goal of commercial space.
They wanna see the goal of uh this new aircraft, this new vehicle being successful.
And it, it hits hard when you end up having an accident where you lose a close crew member and someone that you've probably worked with day-in and day-out throughout the whole program.
Good evening.
And we begin this Friday night with the deadly mid-air explosion at 50,000 feet over the Mojave Desert.
And major questions over how this could have happened.
Wreckage is strewn over five miles of desert.
Emergency responders spot Pete Siebold's parachute and rush him to hospital.
It was a heart wrenching moment.
It's horrendous for the families of the test pilot.
It's a horrible day for Virgin Galactic, for, for commercial space travel.
Um it's a massive setback.
We need to find out what went wrong and fix it.
That job now falls to the National Transportation Safety Board.
Investigating space accidents is nothing new for the NTSB.
Okay.
In the wake of the Space Shuttle Columbia disaster in 2003, more than 50 NTSB employees helped identify the cause of the break-up.
Working with a commercial space accident as compared to a commercial airline or a general aviation accident is very similar.
A lot of the engineering principles are the same.
The actual devices that are used are slightly different because of the environments that they're intended to operate in, but the basic scientific principles stay the same.
Let's start with the rocket motor.
All right.
The NTSB's Lorenda Ward is the investigator in charge.
She sends her team in search of components from the spacecraft's newly designed engine.
What we look for is any evidence of a in-flight fire, or post-crash fire, and we didn't really have a lot of fire in itself.
Mike Bauer is an NTSB investigator and systems group chairman.
It's his job to search the wreckage for any sign of an onboard systems failure.
I worked closely with the propulsion engineer, and we discussed some of the items that could have helped cause the in-flight breakup that might have been propulsion related.
SpaceShipTwo is powered by a new rocket motor that burns an experimental hybrid fuel, a combination of nitrous oxide and nylon.
The advanced power plant is more efficient, pushing the spacecraft to extreme altitudes while burning less fuel.
But the improvements come with a risk.
The new engine is more likely to blow up if the fuel doesn't ignite properly.
Is that what happened in the skies over the Mojave Desert? We had a list of items that we were concerned with that we wanted to take a closer look at.
We would be on our hands and knees going through, very finely looking for valves, fittings, components for some of the smaller items that we were looking at, including some of the data storage units.
I'm not seeing any scorching on the rocket motor.
The team searches for any evidence that the motor blew up in flight.
This is a composite-type vehicle, but it's still painted so you would see like the blistering of the paint.
You could also see melting of materials.
And we did not have that.
There's no explosion or fire.
One of the things that we were able to tell by being on scene was that the motor was not an issue as to why the vehicle broke up.
Ruling out one possible cause is a step forward for investigators.
But they know they could be facing a very long road ahead in their search to figure out why this crucial test flight went so horribly wrong.
Flight Director: Abort! The wreckage that now litters California's Mojave Desert has put the future of commercial space travel in doubt.
The NTSB needs answers.
What happened to SpaceShipTwo during its short high-speed flight? Were there any signs of trouble before the accident? Flight Director: Oh, there was a data warning.
Knock it off.
Can we see the video from the external cameras? Flight Director: See here? The tail boom folded in on the aircraft along the hinge of the feather system.
It went into feather mode? Feather mode refers to the defining feature of SpaceshipTwo's design.
The craft actually changes shape during flight.
After reaching maximum altitude, the pilots pivot the wings upward into the feather position.
This increases drag and slows their descent.
The craft can then drop safely back into Earth's atmosphere, before gliding to a runway.
You're guaranteeing a solid attitude.
That's the position of the spacecraft coming back into the atmosphere.
At the same time, you're increasing drag so you can actually stabilize that position even more.
Investigators have instant access to everything that happened onboard the spaceship thanks to a cockpit video camera.
So he unlocked the feather system.
Flight Director: Correct.
But did he actually deploy it? Flight Director: No.
And that's the weird thing.
No one touched the handle.
There are two steps to feathering the spaceship.
First, the pilots unlock the feather system so the tail boom can pivot when commanded.
Second, the pilots must pull the feather handle to actually deploy the tail boom.
So those were the two things that we were trying to connect.
So we have the video of the co-pilot unlocking but we never see him actually operate the feathers, but we know from external video that the feathers moved.
So we knew that we had a performance or a dynamic issue.
Somehow the system designed to slow the craft on descent deployed while the crew was accelerating towards the speed of sound.
Pitch-up! Pitch-up! If the reason why can't be found, Richard Branson's bold vision for the future of space travel may never be realized.
Ward and her team set up a makeshift headquarters to catalogue and examine components recovered from the desert.
What about the actuators? A system of actuators hold the tail boom in place until the pilots are ready to deploy it.
The actuators then extend and move the tail boom into the feathered position for re-entry.
Just right here.
The devices are critical to the proper functioning of the spacecraft.
What we wanted to look at was to make sure that there were no pre-existing failures within the actuators that could lead to either the feather actuators not being able to hold the feather down in an unfeathered configuration, or cause some uncommanded movement to the feathered position.
It looks like the casing's damaged.
They study the part closely looking for evidence of when it became damaged before or after the mid-air break up.
They soon have an answer.
Some of the damage that we noticed we could find particles from the desert floor in it, which was indicative of it happening post-event.
Impact damage.
Seeing a lot of impact damage to the actuators and some of the other components was starting to lead us down the fact that we didn't have a pre-existing failure of the feather system prior to the actual feathering of the vehicle.
Let's have a look at the rest of the system.
We started to wonder: How could we get the feather system to operate without a failure within the system? It was a lot of research into the data.
We had a wealth of data at our, at our fingertips.
Let's pull this up here.
Okay.
Let's have a look at the speed and altitude.
Investigators now study the telemetry data from the flight.
Like a flight data recorder in an airplane, the telemetry reveals both how the spacecraft was performing and what the pilots were doing during the flight.
Stop.
SpaceShipTwo is released here, and the engine fires.
Everything looked okay.
Next, we need to look at the pilot inputs after ignition.
We were able to use the data and look and compare it with the video.
So we had to match up and do a time correlation between the video itself and then also with other data that came down.
Wait a second.
The feather actuator was unlocked about eight seconds after the engine lit and then four seconds later SpaceShipTwo broke apart.
The data makes it clear that after release, the pilots performed a series of critical tasks in a very short period of time.
Armed.
But did they perform those tasks in the right order? And how accurate was their timing? Those answers are now crucial.
Okay.
Here we go.
The precise timing of events in the cockpit could be a key to understanding the sudden mid-air break-up of SpaceshipTwo.
Investigators are determined to learn more.
Armed.
Yellow light.
They turn to engineers from Scaled Composites, the firm that designed the spacecraft.
Uh you can set up right here.
Do you want to help him clear the table? With any accident investigation, we rely on the parties to the investigation to help us because they have the expertise needed to help us understand what the pilots were doing at the time or should have been doing at the time of the accident.
Great.
So when is he supposed to unlock the feather system? Between Mach one-point-four and one-point-eight.
Do you want to play that? Yee-haw.
Point-eight.
Unlocking.
Pause.
He unlocked the feather at Mach zero-point-eight.
That's too early? We then looked at the video and were able to see that the co-pilot had actually unlocked the feather system early.
Isn't it safer to unlock it at lower speed? No, ma'am.
That can be catastrophic.
This is when upward forces on the tail are greatest.
Ward learns that when the spacecraft is well below the speed of sound, aerodynamic forces push downward on the tail, keeping it in place.
As it approaches the speed of sound, the forces change, pulling upward on the tail.
Finally, when the craft moves beyond the speed of sound, the forces once again hold the tail in place.
That's why pilots are trained to unlock the system in the final stage of the ascent.
Good light.
In the transonic phase, you've got a huge amount of upward force on the tail boom, on the tail of the spacecraft.
And the feather system was not designed to deal with that sort of load.
So when he unlocked it early, the actuators couldn't hold the tail in place.
Investigators have discovered that it was catastrophic to unlock the tail boom at a lower speed.
Aerodynamic forces pulled the tail into the deployed position, which tore the aircraft apart.
Pitch up.
Pitch up.
It was a catastrophic destruction of the vehicle and you can't come back from that.
Like they can't, you know, try to lock the feathers again.
There's nothing they can do in the cockpit to save the vehicle.
The co-pilot unlocked the system early.
But why would an experienced test pilot like Mike Alsbury unlock the tail boom at the deadliest possible moment? Flight Director: Abort! Abort! Searching for an answer, they look into his flight records.
They learn that Alsbury had over 2100 flight hours.
He'd done eight previous flights on SpaceShipTwo.
In addition to being a test pilot, he was a flight instructor and an award-winning project engineer at Scaled Composites.
Both of these test pilots were extremely qualified.
Their pilot ratings exceeded the minimum qualifications required by the FAA.
In addition, they flew multiple aircraft at Scaled Composites.
They also participated in the SpaceShipOne project and also flew the WhiteKnightTwo.
Let's talk to the man in the cockpit with him.
Peter Siebold was badly injured in the accident.
Lorenda Ward wants to know if he can shed any light on why his co-pilot unlocked the feather system 16 seconds before he should have.
On your flight, do you remember when Mike unlocked the feather? No.
No, I didn't see anything, no.
When did you know something had gone wrong? When everything started shaking pretty bad after the engine lit.
Fire.
And there was this really violent pitch-up.
Pitch-up.
Pitch-up.
And, and G forces just went through the roof.
I couldn't breathe.
Was there anything else? Actually, yeah.
Um the display rebooted during the flight.
That's never happened before.
A malfunctioning display could be an important clue.
Whoa.
They actually had the display reboot in flight.
The information that was put on that display helps the crew understand the health of, let's say, the feather system, the electrical system, even the propulsion system.
So it was of a concern that if the display was not functioning properly the crew could be presented with erroneous information, which could cause them to make improper decisions during the flight.
There you go.
Right here.
Perfect.
Investigators connect a spare display with the flight's telemetry data to recreate the conditions after the reboot.
Scaled had an exact duplicate of the display, and we were able to use that data and back drive the display to see what the crew would have been seeing during the accident sequence.
If the speed data was faulty, and the pilots thought they were flying at Mach one-point-four when really they were flying at only Mach point-eight, it could explain the co-pilot's decision to unlock the feathers early.
It's displaying everything correctly.
It seems the information the pilots were receiving was completely accurate.
They were not the victims of a faulty display.
Good light! Investigators still don't understand the co-pilot's fatal action.
The NTSB hopes to learn whether the pilots understood the dangers of unlocking the tail boom too soon.
They pore over Scaled Composites' training materials and operating handbooks.
We need to figure out what they were told about unlocking the feather system early.
Unlock.
They find no mention of the deadly scenario.
There's no warning about unlocking after separation.
What does the flight test data card say? All right.
30,000-foot checks.
Ready for that? Ready.
For every test mission, pilots get a flight test card.
It includes information on the test vehicle, the mission being conducted, and what the pilots need to do during each phase of the flight.
It's the Bible of any test flight.
Feather unlock one-point-four.
Unlock the feather once the vehicle reaches one-point-four Mach.
But nothing about not doing it earlier than that.
There was no note that said if you open early it could be a catastrophic failure to the vehicle.
So there was nothing to say if you were to unlock early, you could lose the vehicle.
When was this? They discover just two written references to the dangers of unlocking the feather early.
An e-mail from 2010 and a presentation slide from 2011.
That's it.
All they could find was one e-mail and one PowerPoint presentation.
That's four years ago.
So this wouldn't have been uppermost in the minds of the pilots.
It's possible they really didn't understand the risks.
The NTSB's Dr.
Katherine Wilson specializes in human performance analysis.
One thing that was concerning to investigators was the fact that the catastrophic nature of this type of error was not emphasized in training or in manuals.
Investigators have some questions for the people who designed the spacecraft.
Why is there no failsafe mechanism for the feather lock? We didn't think we needed one.
From talking with some of the engineers, we found out that they didn't even consider the human limitations when designing the system, and so therefore didn't build in any redundancies that would prevent a single-point human error that would lead to a catastrophic outcome.
These guys should know the mission inside out.
They kind of hold them to a higher standard than a normal pilot, or a commercial or general aviation.
They felt that a flight test pilot would be able to perform perfectly every time.
No wonder they didn't expect mistakes.
Training records show that the co-pilot flew a total of 112 simulator runs for this mission.
Point-eight Mach.
Trimming? The simulator training was extremely important for these pilots.
It allowed them to run through the scenarios, get comfortable with the scenarios prior to getting into the actual aircraft.
These pilots particularly were in the simulator about 14 times in the few months leading up to the accident.
So they were extremely familiar with what the test card read and the procedures that they were to follow.
Never once did the co-pilot unlock the feather early.
Hold on now.
The records reveal that while Alsbury never made the deadly mistake in training, he did on one occasion make a different mistake.
He unlocked the feather too late.
Twelve degrees.
Simulator: Feather unlock.
Fourteen degrees.
Simulator: Mission abort.
Mission abort.
In order to ensure that the feather system works properly, the mission would be aborted if it wasn't unlocked by Mach one-point-eight.
If they didn't unlock by one-point-eight they would have had aborted the flight, and we had seen in the simulator session data that the co-pilot had unlocked late.
So he has to do it before reaching Mach one-point-eight.
If he's late, the mission is aborted.
Aborting a mission is not fatal.
But investigators wonder, did this error in training from months ago somehow play a role in the crash? Simulator: Mission abort.
Mission abort.
Fire.
Could it help explain what went wrong aboard SpaceShipTwo? Fourteen seconds from rocket ignition to total destruction.
How did the SpaceShipTwo test flight go so wrong so quickly? The NTSB reviews the pilots' checklist, searching for clues.
Call out zero-point-eight Mach.
Call out stabilizer trim settings.
L minus four.
Checks complete.
I'll call fire.
Trim, feather unlock one-point-four.
It's clear that both pilots had their hands full throughout the short flight.
Check your attitudes.
The pressure that you have to always do the right thing at the exact optimum time, you think okay, I want to be ahead of the vehicle.
Reset trim to Meaning not being behind trying oh, I need to do that.
Like, no, I'm going to need to throw this switch in X amount of time so I'm ready to do it right now.
It's that pressure to do things at the exact right time that leads you to try and prepare, which might end up having you do something early, or inadvertent.
Investigators believe time pressure may be one reason Mike Alsbury decided to unlock the feather system early.
If they don't unlock the feather mechanism by Mach one-point-eight then the flight is aborted.
So obviously that's gonna be weighing on the co-pilot's mind.
You want to get that out of the way.
Then, they make another discovery.
Can I see that simulator video again? It's hardly the same environment.
The training simulator did not replicate the actual sensation of a powered flight.
It didn't vibrate or simulate G forces.
So it is different being in the real vehicle than the simulator, and while you think you're back in the sim but as you're launched, you realize it's different, and you're being moved around differently.
Good light.
These vibrations and loads may have impacted the co-pilot's decision-making on that day and added additional pressure to him in terms of wanting to complete his tasks in a timely manner.
Yee-haw! The co-pilot, his last powered flight was April 2013, so he hadn't actually been in a powered flight for 18 months.
Even if you're a very, very good test pilot that has to be a little bit unnerving to get all this vibration and G-loads and speed and everything else.
Investigators finally understand what happened.
It was an unfamiliar environment.
He had a lot to do.
He made a decision to unlock early, perhaps not realizing the deadly implications.
Just because these are test pilots does not mean that they are not human, that they will not make mistakes.
It is possible and we have to take all of these limitations of our pilots into consideration.
The NTSB faults Scaled Composites for not ensuring that their pilots understood the consequences of unlocking the feather system early and not taking steps to prevent it from happening.
Pitch up! If they would have thought a little bit more about how they could have prevented that early unlocking versus just relying on the pilots' training and performing perfectly every time Unlocking.
Even just having a sensor that physically prevents them from unlocking until it passes the appropriate threshold would have prevented this accident.
Flight Director: Abort! In its final report, the NTSB states that the probable cause of the test flight disaster was a failure on the part of design engineers to protect against the possibility that a single human error could lead to catastrophe.
Whenever you uh put humans in the loop, you have the potential for human error.
It's always gonna be the case.
No matter how well you design the system, um, that's always gonna be the case.
Like I say, we're talking about some of the best pilots in the world and uh he made a mistake.
You know, we used to say uh the Navy manual for operating the F-14 was kind of written in blood because every time there was an accident somebody realized oh, we should have told people about this, and we didn't so now we will.
And you learn those lessons the hard way.
We learned from this situation and we will um build a second spaceship.
We'll make sure it's a hundred per cent safe and we will complete what we started and I think we're gonna make a, a radical difference to this world.