October 2014 

NASA/TM2014-218538 (Corrected Copy) 

NESC-RP-14-00957 

 

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident 

Cornelius J. Dennehy/NESC 

Langley Research Center, Hampton, Virginia 

Jeb S. Orr 

Draper Laboratories, Huntsville, Alabama 

Immanuel Barshi, and Irving C. Statler 

Ames Research Center, Moffett Field, California 
NASA STI Program . . . in Profile

Since its founding, NASA has been dedicated to the 

advancement of aeronautics and space science. The 

NASA scientific and technical information (STI) 

program plays a key part in helping NASA maintain 

this important role. 

The NASA STI program operates under the 

auspices of the Agency Chief Information Officer. 

It collects, organizes, provides for archiving, and 

disseminates NASA’s STI. The NASA STI 

program provides access to the NASA Aeronautics 

and Space Database and its public interface, the 

NASA Technical Report Server, thus providing one 

of the largest collections of aeronautical and space 

science STI in the world. Results are published in 

both non-NASA channels and by NASA in the 

NASA STI Report Series, which includes the 

following report types: 

x TECHNICAL PUBLICATION. Reports of 

completed research or a major significant phase 

of research that present the results of NASA 

Programs and include extensive data or 

theoretical analysis. Includes compilations of 

significant scientific and technical data and 

information deemed to be of continuing 

reference value. NASA counterpart of peerreviewed formal professional papers, but 

having less stringent limitations on manuscript 

length and extent of graphic presentations. 

x TECHNICAL MEMORANDUM. Scientific 

and technical findings that are preliminary or of 

specialized interest, e.g., quick release reports, 

working papers, and bibliographies that contain 

minimal annotation. Does not contain extensive 

analysis. 

x CONTRACTOR REPORT. Scientific and 

technical findings by NASA-sponsored 

contractors and grantees. 

x CONFERENCE PUBLICATION. 

Collected papers from scientific and 

technical conferences, symposia, seminars, 

or other meetings sponsored or cosponsored by NASA. 

x SPECIAL PUBLICATION. Scientific, 

technical, or historical information from 

NASA programs, projects, and missions, 

often concerned with subjects having 

substantial public interest. 

x TECHNICAL TRANSLATION. 

English-language translations of foreign 

scientific and technical material pertinent to 

NASA’s mission.

Specialized services also include organizing 

and publishing research results, distributing 

specialized research announcements and feeds, 

providing information desk and personal search 

support, and enabling data exchange services. 

For more information about the NASA STI 

program, see the following: 

x Access the NASA STI program home page 

at http://www.sti.nasa.gov

x E-mail your question to help@sti.nasa.gov

x Fax your question to the NASA STI 

Information Desk at 443-757-5803 

x Phone the NASA STI Information Desk at 

443-757-5802

x Write to: 

 STI Information Desk 

 NASA Center for AeroSpace Information 

 7115 Standard Drive 

 Hanover, MD 21076-1320
National Aeronautics and 

Space Administration 

Langley Research Center 

Hampton, Virginia 23681-2199 

 

October 2014 

NASA/TM2014-218538 (Corrected Copy) 

NESC-RP-14-00957 

 

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident 

Cornelius J. Dennehy/NESC 

Langley Research Center, Hampton, Virginia 

Jeb S. Orr 

Draper Laboratories, Huntsville, Alabama 

Immanuel Barshi, and Irving C. Statler 

Ames Research Center, Moffett Field, California 
Available from: 

NASA Center for AeroSpace Information 

7115 Standard Drive 

Hanover, MD 21076-1320

443-757-5802 

Acknowledgments 

The authors would like to thank the NESC Technical Discipline Teams (TDTs) 

that facilitated this research, in particular the GN&C and Human Factors TDTs 

chaired by Mr. Neil Dennehy and Dr. Cynthia Null, respectively. The authors 

appreciate the insight of the numerous flight mechanics, flight control, and flight 

safety practitioners that have contributed to this work, including, but not limited 

to Mr. Michael Ruth (Orbital Sciences Corporation), Dr. Benjamin Lane (Draper 

Laboratory), Dr. Ken Lebsock (Orbital Sciences Corporation), Mr. Jim Less 

(Armstrong Flight Research Center (AFRC)), Colonel Terry Virts (Johnson Space 

Center), Mr. John Wall (Dynamic Concepts, Inc.), Mr. Steve Jacobson (AFRC), 

Mr. Curtis Hanson (AFRC), Dr. Irene Gregory (Langley Research Center 

(LaRC)), Mr. Carey Buttrill (LaRC), Mr. Steven Gentz (Marshall Space Flight 

Center (MSFC)), Mr. Charles Hall (MSFC), Dr. Kevin Wise (The Boeing 

Corporation) and Dr. Eugene Lavretsky (The Boeing Corporation). In addition, 

the support of the late Mr. David Mellen (Honeywell, retired) was invaluable in 

the development of this report. 

The assistance of MSFC summer interns Mr. Eamonn Moyer and Ms. Lauren 

Massey in the analysis and reconstruction of the X-15 flight data is gratefully 

acknowledged. 

The authors are particularly indebted to the Redstone Scientific Information 

Center and the AFRC libraries for their assistance in locating critical documents 

related to the X-15 program. 

The use of trademarks or names of manufacturers in the report is for accurate reporting and does not 

constitute an official endorsement, either expressed or implied, of such products or manufacturers by the 

National Aeronautics and Space Administration.
ERRATA 

NASA/TM‒2014-218538 

Issue Date: 01/12/2015 

Cover and Title Page: Location spelling corrected; “Moffet” to “Moffett.”
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

1 of 107

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

September 4, 2014

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

2 of 107

Report Approval and Revision History

NOTE: This document was approved at the September 4, 2014, NRB. This document was 

submitted to the NESC Director on September 26, 2014, for configuration control.

Approved: Original Signature on File 9/29/14

NESC Director Date

Version Description of Revision Office of Primary 

Responsibility Effective Date

1.0 Initial Release Cornelius J. Dennehy, 

NASA Technical 

Fellow for Guidance, 

Navigation, and 

Control (GN&C), 

GSFC

9/4/14

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

3 of 107

Table of Contents

Technical Assessment Report

1.0 Notification and Authorization..................................................................................................... 6

2.0 Signature Page................................................................................................................................ 7

3.0 Team List ........................................................................................................................................ 8

3.1 Acknowledgements............................................................................................................. 8

4.0 Executive Summary....................................................................................................................... 9

5.0 Introduction.................................................................................................................................. 11

5.1 Accident Summary ........................................................................................................... 12

5.2 Motivation......................................................................................................................... 13

5.3 Sources ............................................................................................................................. 13

5.4 Report Structure................................................................................................................ 14

6.0 The X-15 Research Aircraft ......................................................................................................... 15

6.1 Design Overview .............................................................................................................. 15

6.2 Trajectory.......................................................................................................................... 16

6.3 Flight History.................................................................................................................... 17

6.4 Instrumentation ................................................................................................................. 18

6.4.1 Stable Platform and Inertial Flight Data System (IFDS) ...................................................19

6.4.2 Rate Gyros ........................................................................................................................ 20

6.4.3 Flow Direction Sensor ...................................................................................................... 20

6.4.4 Accelerometers ................................................................................................................. 21

6.5 Flight Control System....................................................................................................... 21

6.6 Emergency Egress System................................................................................................ 25

6.7 Pilot Interface.................................................................................................................... 25

6.7.1 Control Inceptors .............................................................................................................. 27

6.7.2 Flight Instruments............................................................................................................. 27

7.0 Accident Detail ............................................................................................................................. 30

7.1 Flight Plan......................................................................................................................... 30

7.2 Timeline............................................................................................................................ 30

7.3 Data Reconstruction.......................................................................................................... 33

8.0 Failure Analysis............................................................................................................................ 34

8.1 Traverse Probe Experiment Failure .................................................................................. 35

8.2 IFDS Computer Failure .................................................................................................... 37

8.3 Servo Transient Anomaly ................................................................................................. 38

8.4 Yaw Rate Gyro Channel Disconnect ................................................................................ 39

8.5 MH-96 Large-Amplitude Limit Cycle.............................................................................. 40

8.5.1 History ............................................................................................................................. 40

8.5.2 Mode of Failure ................................................................................................................ 42

8.5.3 The Role of Adaptive Control........................................................................................... 45

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

4 of 107

9.0 Human Factors............................................................................................................................. 47

9.1 Critical Events................................................................................................................... 47

9.2 Causal and Contributing Factors....................................................................................... 50

9.2.1 Causal Factors................................................................................................................... 50

9.2.2 Contributing Factors ......................................................................................................... 53

9.2.3 Alternative Hypotheses..................................................................................................... 57

10.0 Findings, Observations, and NESC Recommendations ...........................................................60

10.1 Findings ............................................................................................................................ 61

10.2 Observations ..................................................................................................................... 62

10.3 NESC Recommendations ................................................................................................. 63

11.0 Alternate Viewpoint..................................................................................................................... 66

12.0 Other Deliverables ....................................................................................................................... 66

13.0 Lessons Learned........................................................................................................................... 66

14.0 Recommendations for NASA Standards and Specifications....................................................66

15.0 Definition of Terms...................................................................................................................... 66

16.0 Acronym List................................................................................................................................ 67

17.0 References..................................................................................................................................... 68

18.0 Appendices.................................................................................................................................... 71

List of Figures

Figure 5.0-1. X-15 56-6672 in Flight (USAF photo) ............................................................................. 11

Figure 6.1-1. X-15 Research Aircraft Internal Layout (NASA)............................................................. 16

Figure 6.2-1. X-15 Altitude Design Reference Mission (NASA) .......................................................... 17

Figure 6.4-1. RCS Jet Flow-field Interaction with Flow Direction Sensor at 3 psf, 240,000 feet, 

Mach = 4.4 ........................................................................................................................ 21

Figure 6.5-1. X-15 Flight Control Effectors ........................................................................................... 22

Figure 6.5-2. MH-96 Adaptive Concept................................................................................................. 23

Figure 6.5-3. MH-96 Typical Gain Variation......................................................................................... 24

Figure 6.7-1. X-15-3 Original Panel (1960–1965) ................................................................................. 26

Figure 6.7-2. X-15-3 Vertical Tape Panel (1965+) ................................................................................ 26

Figure 6.7-3. X-15-3 Attitude Director Indicator ................................................................................... 29

Figure 7.3-1. X-15 3-65 Reconstructed Flight Data (attitude angles) ....................................................34

Figure 8.1-1. Paschen Curve for 400 Hz Potential at 300 degrees Kelvin .............................................36

Figure 8.5-1. Surface Actuator Models Used in Design......................................................................... 42

Figure 8.5-2. X-15 Power Actuator under Rate Saturation, 15-degree Amplitude ................................43

Figure 8.5-3. X-15 3-65 MH-96 Servo Actuator LCO (simulated) versus Flight Data..........................44

Figure 9.1-1. 3-65 Event Timeline ......................................................................................................... 48

Figure 9.1-2. AFCS Gain Variation during Flight 3-65 ......................................................................... 49

Figure 9.2-1. Time History of Precision Attitude Tracking Task at Peak Altitude................................57

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

5 of 107

List of Tables

Table 6.7-1. Sources of Aircraft Dynamic State Information Available to Pilot, Flight 3-65

Configuration.................................................................................................................... 28

Table 9.2-1. Pilot Flight and Simulator Experience.............................................................................. 60

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

6 of 107

Technical Assessment Report

1.0 Notification and Authorization

The November 15, 1967, loss of X-15 Flight 3-65-97 (hereafter referred to as Flight 3-65) was a 

unique incident in that it was the first and only aerospace flight accident involving loss of crew 

on a vehicle with an adaptive flight control system (AFCS). In addition, Flight 3-65 remains the 

only incidence of a single-pilot departure from controlled flight of a manned entry vehicle in a 

hypersonic flight regime. Both the advent of small, commercially developed entry vehicles and a 

renewed interest in the use of adaptive control to improve performance and flight safety have 

necessitated a thorough analysis of the causal and contributing factors in this accident. 

To mitigate risk to emerging aerospace systems, the NASA Engineering and Safety Center 

(NESC) proposed a comprehensive review of this accident. The goal of the assessment was to

resolve lingering questions regarding the failure modes of the aircraft systems (including the 

AFCS) and thoroughly analyze the interactions among the human agents and autonomous 

systems that contributed to the loss of the pilot and aircraft.

Mr. Cornelius J. Dennehy, NASA Technical Fellow for Guidance, Navigation, and Control 

(GN&C) was selected as the NESC lead, with Dr. Jeb S. Orr assigned as the technical lead. 

The key stakeholders for this assessment were Mr. Garry Lyles, Space Launch System (SLS)

Program Chief Engineer; Mr. Kurt Jackson, SLS Program Integrated Avionics and Software 

Discipline Lead Engineer; Mr. Mark West, SLS Vehicle Management Discipline Lead Engineer;

the Human Exploration and Operations Mission Directorate; and the Commercial Crew Program.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

7 of 107

2.0 Signature Page

Submitted by: 

Team Signature Page on File – 10/07/14

Mr. Cornelius J. Dennehy Date

Significant Contributors:

Dr. Jeb S. Orr Date Dr. Immanuel Barshi Date

Dr. Irving C. Statler Date

Signatories declare the findings, observations, and NESC recommendations compiled in the 

report are factually based from data extracted from program/project documents, contractor 

reports, and open literature, and/or generated from independently conducted tests, analyses, and 

inspections.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

8 of 107

3.0 Team List

Name Discipline Organization

Core Team

Neil Dennehy NESC Lead GSFC

Jeb Orr NESC Deputy Lead MSFC/Draper Laboratory

Immanuel Barshi Research Psychologist ARC

Irving Statler Ames Associate (Retired) ARC

Patricia Pahlavani MTSO Program Analyst LaRC

Administrative Support

Jonay Campbell Technical Writer LaRC/NG

3.1 Acknowledgements

The authors would like to thank the NESC Technical Discipline Teams (TDTs) that facilitated 

this research, in particular the GN&C and Human Factors TDTs chaired by Mr. Neil Dennehy 

and Dr. Cynthia Null, respectively. The authors appreciate the insight of the numerous flight 

mechanics, flight control, and flight safety practitioners that have contributed to this work, 

including, but not limited to Mr. Michael Ruth (Orbital Sciences Corporation), Dr. Benjamin 

Lane (Draper Laboratory), Dr. Ken Lebsock (Orbital Sciences Corporation), Mr. Jim Less 

(Armstrong Flight Research Center (AFRC)), Colonel Terry Virts (Johnson Space Center), 

Mr. John Wall (Dynamic Concepts, Inc.), Mr. Steve Jacobson (AFRC), Mr. Curtis Hanson 

(AFRC), Dr. Irene Gregory (Langley Research Center (LaRC)), Mr. Carey Buttrill (LaRC), 

Mr. Steven Gentz (Marshall Space Flight Center (MSFC)), Mr. Charles Hall (MSFC),

Dr. Kevin Wise (The Boeing Corporation) and Dr. Eugene Lavretsky (The Boeing 

Corporation). In addition, the support of the late Mr. David Mellen (Honeywell, retired) was

invaluable in the development of this report.

The assistance of MSFC summer interns Mr. Eamonn Moyer and Ms. Lauren Massey in the 

analysis and reconstruction of the X-15 flight data is gratefully acknowledged.

The authors are particularly indebted to the Redstone Scientific Information Center and the 

AFRC libraries for their assistance in locating critical documents related to the X-15 program.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

9 of 107

4.0 Executive Summary

The X-15 program operated three hypersonic, high-altitude rocket-propelled single-pilot aircraft 

from 1959 until 1968. The third aircraft, X-15-3, was involved in a fatal accident on November 

15, 1967. X-15-3 was the most advanced aircraft flown during the program and carried a variety 

of sophisticated instrumentation and electronics, including the MH-96 adaptive flight control 

system (AFCS).

The X-15-3 aircraft was destroyed during atmospheric entry after entering uncontrolled flight at 

an altitude of 230,000 feet and a velocity near Mach 5. The pilot, United States Air Force 

(USAF) Major Michael J. Adams, was incapacitated by the aircraft accelerations and was killed 

either during the ensuing breakup or upon ground impact.

To better understand the risks to emerging aerospace systems incorporating advanced 

technologies such as adaptive flight control, the NASA Engineering and Safety Center (NESC) 

organized a comprehensive assessment of this fatal accident in light of almost 50 years of 

accumulated experience in flight operations, human factors, and flight control. The report of the 

1968 NASA/United States Air Force Accident Investigation Board (AIB) was used as a point of 

departure for the present assessment. The goal of the study was to characterize the causes of the 

loss of life, as well as to determine, at a level of detail not addressed in the original report, the 

exact role of the MH-96 AFCS in the accident.

The NESC assessment confirmed that the root cause of the accident was an electrical disturbance 

originating from an experiment package using a commercial-off-the-shelf (COTS) component 

that had not been properly qualified for the X-15 flight environment. Notably, the risks of 

accelerated and/or limited flight qualification of COTS components have been highlighted in 

other recent assessments by the NESC. These assessments are referenced in the final report.

The performance of the pilot was found to be commensurate with his experience and 

qualifications. As noted by the 1968 AIB, spatial disorientation (SD) may have contributed to 

pilot workload. However, the NESC assessment found no conclusive evidence to support the 

hypothesis that SD was a causal factor. On the contrary, the evidence suggests that poor design 

of the pilot-aircraft interface and ineffective operational procedures prevented the pilot and 

ground control from recognizing and isolating the numerous failures before the aircraft’s 

departure from controlled flight was inevitable.

The MH-96 AFCS limit cycle oscillation (LCO) that contributed to the breakup of the aircraft 

was analyzed in detail by the NESC team. Using nonlinear simulation and frequency-domain 

analytical methods, the NESC analysis determined that the LCO was caused by a design 

oversight in a control system notch filter that was installed only on the X-15-3 aircraft. This 

notch filter was used to stabilize an unstable structural resonance but introduced a latent failure 

mode that only appeared in severe off-nominal conditions. The notch filter design issue was not 

identified in the 1968 AIB report. The MH-96 failure mode was shown to be independent of the 

adaptive control law. This key NESC finding highlights the fact that the implementation of the 

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

10 of 107

adaptive control hardware, not the underlying theory of adaptive flight control, was the 

contributing factor in the loss of X-15-3.

Finally, the NESC assessment highlighted several programmatic and cultural themes 

contributing to the accident, including continued flight operations in the presence of multiple 

unexplained anomalies and an insufficient focus on the risks of subsystem-level interactions.

This NESC final report documents a total of 10 findings and 18 recommendations, which are 

directed to the key stakeholders for this assessment.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

11 of 107

5.0 Introduction

The X-15 research aircraft (Figure 5.0-1) is widely regarded as one of the most successful 

high-performance flight research platforms ever developed. Although it encountered numerous 

technical and programmatic challenges over the course of its development, the X-15 eventually 

became a test bed for validating numerous concepts that were fundamental enabling technologies 

for other programs, including the Apollo program and the Space Transportation System. During 

the X-15’s operational lifetime, the breaking of new records of speed and altitude for manned 

flight became almost routine, and the program continued successfully in spite of several severe,

nonfatal accidents. Many advances in the modern understanding of hypersonic flight mechanics, 

including thermal protection, structural design, shock-impingement heating, air-data sensing, and 

hypersonic propulsion can be directly attributed to research performed using the X-15 platform. 

Many research pilots and astronauts contributed substantially to the success of the program 

during its 199 flights and nearly 10-year operational history [ref. 4].

Figure 5.0-1. X-15 56-6672 in Flight (USAF photo)

Owing to its diverse mission capabilities and the relative immaturity of autonomy in aerospace 

engineering at the time, the X-15 from its inception was designed to be a piloted aircraft. Only 

later in the design process did nontraditional approaches to guidance, navigation, and control 

(GN&C) begin to enter the design space. These approaches were, in all respects, conservative 

and motivated primarily by functionality and engineering practicality. These included, most 

notably, an AFCS that eased pilot workload by automatically adjusting the gains of the aircraft’s 

aerodynamic control surfaces in response to changing flight conditions. This experimental flight 

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

12 of 107

control system, designated the MH-96 AFCS, experienced a relatively successful deployment on 

X-15-3 (serial number 56-6672) [refs. 5 and 6].

In addition, the X-15-3 was considered a test bed for development of advanced GN&C 

technologies, and along with the advanced flight control system, included an advanced inertial 

system, a boost guidance and energy management computer, and advanced pilot displays. The 

other two aircraft (X-15-1 and X-15-2) used a conventional, pilot-selectable fixed-gain stability 

augmentation system (SAS) and conventional instruments. Erratic behavior of the AFCS during 

Flight 3-65 was a key factor in the subject accident and will be discussed in detail in the coming

sections.

In the course of its operation at the NASA Flight Research Center1 (FRC), all three X-15 aircraft 

underwent numerous field modifications, upgrades, and equipment retrofits. This practice of 

adapting the aircraft capabilities to meet mission needs was a key enabler in the X-15’s agility as 

a science platform. However, this placed a substantial demand on the pilot-engineers that 

managed the X-15 during its highly dynamic missions.

5.1 Accident Summary

On November 15, 1967, X-15-3 was destroyed in flight due to a structural load exceedance 

precipitated by a loss of control [ref. 3]. The research pilot, USAF Major Michael J. Adams, did 

not survive the event. The flight (denoted 3-65-97) was the 65th flight of X-15-3 and the 

191st flight of the X-15 program.

The causes of the accident are complex, beginning with an electrical anomaly associated with an 

experiment motor that had not been properly qualified for the space environment. This electrical 

anomaly led to a series of electrical and instrumentation failures that required continuous 

attention from the pilot to diagnose and troubleshoot. Ground controllers, lacking adequate 

aircraft information displays and believing the pilot would effectively manage the emergency, 

did not inform the pilot of the multiple subsystem anomalies or recommend that the mission be 

discontinued.

In the already high-demand environment of the ballistic hypersonic flight regime, the excessive 

workload contributed to the pilot’s apparent loss of spatial and instrument mode awareness. The 

pilot, apparently mostly unaware of the condition of the aircraft systems, provided control inputs 

that allowed the aircraft to enter a hypersonic spin that evolved into an inverted dive. The dive 

may have been recoverable, but a persistent high-amplitude flight control system LCO 

originating in the MH-96 AFCS prevented the pilot from regaining control of the aircraft. The 

LCO also contributed to the airframe load exceedances that eventually caused the aircraft to 

break up at approximately 60,000 feet.

1 Later Dryden Flight Research Center (DFRC), and now Armstrong Flight Research Center (AFRC).

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

13 of 107

5.2 Motivation

A concern has recently arisen within the aerospace community as to the implications of the 

X-15-3 accident for the design of emerging manned hypersonic vehicles, launch vehicles, and 

spacecraft. For example, the renewed interest in boost-glide concepts for transportation and 

suborbital space tourism necessitates the use of ballistic trajectories that are not unlike those 

experienced by the X-15 [ref. 5]. In addition, orbital space planes whose nominal entry 

trajectories differ substantially from the X-15’s often encounter conditions similar to an 

X-15 entry in the event of a powered abort. While avionics, sensing, and autonomy technologies 

have advanced by orders of magnitude in the last 50 years, the fundamental challenges 

associated with hypersonic ballistic flight remain largely unchanged. Insofar as it relates to the 

ability of a flight crew to successfully manage a space plane through the highly dynamic phases 

of boost, suborbital coast, entry, and glide, the lessons learned from the X-15-3 accident lend 

insight as to potential requirements for flight control design, vehicle instrumentation, crew 

spatial/situational awareness, and abort modes. These lessons are relevant and applicable even if 

vehicle manual or semi-manual control is implemented only as a backup to a fully automatic 

guidance and control system.

In addition, in recent years some aspects of the anomalies experienced on Flight 3-65 have been 

incorrectly reported in the literature, probably owing to the limited availability of the flight test 

data and failure report outside the NASA community [refs. 7 and 8]. No comprehensive account 

of the accident exists in the open literature that treats the issue at a system level and discusses the 

human factors, flight controls, and other subsystem anomalies simultaneously. The present 

report attempts to bridge the gap in the accident understanding by examining in detail the 

relevant systems (i.e., instrumentation and flight control) and the programmatic and cultural 

factors that led to this fatal accident.

5.3 Sources

Several excellent references exist regarding X-15 program history, design, engineering, 

operation, and subsystems. Many of the technical data are in original program documents and 

technical reports with several available in the open literature; these are referenced where 

appropriate. The most complete historical accounts are those of Jenkins [refs. 4 and 9]. These 

works provide a comprehensive look at the evolution of the program and the aircraft, with many 

first-hand accounts by participants in the X-15’s design and operation.

The January 1968 report of the joint NASA/USAF Accident Investigation Board (AIB) 

[ref. 3] that reviewed the causes of the destruction of the X-15-3 is a primary source for the 

present discussion. This report is extensive, and while it contains technical data in the attached 

appendices, some of the references therein are unfortunately lost. For various reasons, 

reference 3 is not available outside the NASA community as of the time of this writing. While 

the NASA/USAF AIB report contains the most comprehensive assessment of the accident 

available, it is limited in depth and self-contradictory in some respects. Importantly, the report 

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

14 of 107

lacks detail, especially with respect to the AFCS function. After an extensive search, many 

important references were identified that provide additional insight into the operation of various 

aircraft subsystems.

Much of the critical design data on the X-15 has been lost. This issue is complicated by the fact 

that much of the design and engineering work was performed across disparate organizations. 

While the X-15 program as a whole was effective at documenting research results [ref. 10], 

design data were rarely consolidated and maintained for future use. In the event design data 

were consolidated, their self-consistency is often questionable since the vehicle configurations 

varied widely over the program’s 10-year lifespan [ref. 4]. Various surviving documents related 

to the flight control system are dispersed among NASA, the Department of Defense (the USAF 

and the United States Navy (USN)), and contractor archive libraries, owing to the diverse 

heritage of the AFCS as an incrementally developed technology with its origins in the USAF

research organizations.

A careful and concerted effort has been undertaken to assemble a picture of the aircraft and 

systems configuration at the time of the accident. Given the substantial changes in the vehicle 

design that occurred during its development and operation, as well as the lack of a single source 

that details its final configuration, it is surprisingly easy to draw erroneous conclusions about the 

operational vehicle’s characteristics from the data available in the open literature. The authors 

have attempted to construct a cohesive and self-consistent description of the X-15-3 aircraft as 

flown in November 1967 through careful checking and cross-referencing of numerous reports 

and technical data.

It is important to note that the formal assessment of the appropriateness or correctness of the 

original AIB recommendations is not within the scope of the present study. While some findings 

and recommendations of this study both supplement and extend, and in some cases, contradict,

the findings of the AIB report, the present study was conducted considering all of the available 

objective evidence, with more than 45 years of human factors, flight control, and flight test 

operations experience accumulated since the end of the X-15 program.

Finally, it is with full cognizance that the present report appears at a time when residual “tribal 

knowledge” associated with the X-15 program is sparse. The number of living persons having 

direct engineering development and test experience with the X-15 program is likely less than a 

few dozen. This is a solemn reminder that current and future aerospace vehicle development 

programs must include a strong emphasis on retaining a documentation tree focused on 

requirements and specifications, and on the corresponding design motivation, underlying 

reasoning, and innovations.

5.4 Report Structure

The structure of this report is as follows. In Section 6, a systems-level overview of the 

X-15 aircraft and its mission profile is provided. Various aspects of the pilot instrumentation and 

flight control system are discussed to aid in understanding the phenomena that were present at 

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

15 of 107

the time of the accident. In Section 7, a timeline of Flight 3-65 is provided with detailed 

information as to the aircraft state throughout the trajectory based on an analysis of the available 

flight data.

Section 8 provides a detailed look at the fundamental subsystem failure modes that contributed to 

the accident. In Section 9, the human factors, programmatic, and engineering culture aspects of 

the accident are discussed. Summary conclusions and the NASA Engineering and Safety Center 

(NESC) recommendations are presented in Section 10. Finally, a comprehensive simulation 

analysis was conducted in an effort to better characterize and understand the conditions under 

which the MH-96 AFCS could exhibit behavior commensurate with that which contributed to the 

accident. While the results are summarized in Section 8, a detailed description of the modeling 

methodology appears in Appendix A. Supplementary information, including detailed plots of 

reconstructed flight data, appears in Appendix B.

6.0 The X-15 Research Aircraft

The X-15 was a piloted, single-seat rocket-propelled hypersonic research aircraft developed 

under cooperative funding and program management from the USAF, the USN, and NASA. 

Initial design concept engineering was completed in the early 1950s, and a prime contract for 

three aircraft was awarded to North American Aviation in September 1955. The first of three 

airframes was completed in October of 1958. The charter of the X-15 program was primarily to 

provide a platform for high-speed aerothermodynamic and high-altitude aeromedical research, 

and the design approach followed a capability-driven model anchored to specific performance 

targets expressed in terms of speed, altitude, and flight duration. Military interest in the X-15

development by the USAF and the USN stemmed from the applications of manned hypersonic 

systems for reconnaissance and strategic weapon delivery. The ill-fated X-20 Dyna-Soar skipentry bomber program, being developed in parallel to the X-15, was to have adopted numerous 

technologies from the X-15 had it not been cancelled in late 1963. In fact, several mature 

technologies from the canceled X-20 (e.g., a version of the inertial navigation system) were used 

on the X-15 [ref. 11].

6.1 Design Overview

The X-15 aircraft was a reusable winged space plane with a launch mass of about 33,000 lbm, 

depending on the particular airframe and equipment loadout [ref. 4]. By 1967, all X-15s were

powered by a single, regeneratively cooled YLR99-RM-1 throttleable rocket engine providing a 

thrust at altitude of 57,000 lbf with a specific impulse of 265 seconds and a total burn time 

capability of 180 seconds [ref. 12]. The X-15 structure was comprised primarily of Inconel® X, 

a high-strength nickel-steel alloy that was capable of withstanding the high aerothermal loading 

and peak temperatures of approximately 1,300 degrees Fahrenheit in the stagnation regions 

[ref. 10]. The airframe volume was occupied by integral pressure-stabilized propellant and 

oxidizer tanks containing anhydrous ammonia and liquid oxygen, with ullage and purge 

pressures maintained via an integral helium supply. Liquid nitrogen was stored for cooling and 

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

16 of 107

cabin pressurization, and a hydrogen peroxide supply provided propellant for the two auxiliary 

power units (APUs) used to supply electrical power and run the hydraulic systems. A separate 

hydrogen peroxide supply was used for the ballistic control system (BCS) monopropellant 

thrusters in the nose, now commonly referred to as a reaction control system (RCS). A third 

hydrogen peroxide supply in the aft compartment, cross-strapped to the RCS and APU tanks, 

was used to provide power to the YLR-99 turbopumps that supplied propellants to the main 

propulsion system [ref. 13].

An internal layout drawing of the X-15 is shown in Figure 6.1-1. The X-15 cockpit consisted of 

a single seat aft of the RCS compartment and forward of the equipment bay. The cockpit used a 

canopy having two planar windows, and pilots reported that despite the small windscreen the 

outside view during approach and landing was acceptable [ref. 14].

Figure 6.1-1. X-15 Research Aircraft Internal Layout (NASA)

Aft of the pilot station was an equipment bay containing most of the research instrumentation. 

Each X-15 airframe was extensively instrumented, and a large portion of the research and flight 

instrumentation data (about 90 distinct measurements) was telemetered to the ground. The 

remainder was recorded onboard using a combination of film oscillographs and tape recorders. 

Each aircraft was instrumented with approximately 1,000 aerodynamic and aerothermal 

transducers, thermocouples, and pressure taps [ref. 15]. 

6.2 Trajectory

The X-15 was carried to a launch altitude of 45,000 feet by a NASA NB-52 carrier aircraft on a 

launch pylon below the starboard wing, and nominally flew a ballistic or depressed high-altitude 

trajectory with a launch point 200 to 300 nautical miles uprange of the landing site. Trajectories 

were generally flown along an azimuth southwest from the launch point along a fixed magnetic 

heading toward the landing site. Most X-15 flights lasted about 10 minutes from carrier aircraft 

launch to touchdown [ref. 4].

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

17 of 107

The X-15 mission profiles and target flight conditions varied substantially based on specific 

research objectives but were generally classified into the two major categories of altitude and 

speed profiles. Altitude profiles, such as the design reference mission shown in Figure 6.2-1,

consisted of a ballistic atmospheric exit to an altitude exceeding 200,000 feet after experiencing 

an engine burn of 80–100 seconds and a peak axial acceleration nearing 4 g.

The X-15 altitude trajectory consisted of an immediate engine ignition and throttle up after 

separation from the NB-52 carrier aircraft, followed by a 2- to 2.5-g pull-up to maintain a 

prescribed angle of attack (Į) or pitch attitude, typically around 12 or 32 degrees, respectively. 

The aircraft velocity during the propulsive phase increased from Mach 0.7 at launch to 

approximately Mach 5. The aircraft was stabilized after atmospheric exit using the RCS system 

throughout the trajectory, with the aircraft experiencing about two minutes of 0-g before a rapid 

onset of dynamic pressure associated with atmospheric reentry. The aircraft was stabilized at a 

predetermined entry Į and decelerated at a nominal normal load of 5 g before being recovered 

into an equilibrium glide at a high supersonic Mach number. Energy management procedures 

were then executed to null entry dispersions and preparation for a landing on 

Rogers Dry Lake, California [ref. 10].

Figure 6.2-1. X-15 Altitude Design Reference Mission (NASA)

6.3 Flight History

The X-15 program conducted 199 research flights over a period of nearly 10 years. The first 

unpowered drop test was conducted on June 8, 1959, and the final powered flight was completed 

October 24, 1968. During this period, the program routinely set altitude and speed records for 

a piloted aerospace plane and ultimately held the record for the highest altitude (354,200 feet; 

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

18 of 107

August 22, 1963) and highest Mach number (Mach 6.7; October 3, 1967). These official records 

persisted until the orbital reentry of Space Shuttle STS-1 in April 1981.

The X-15 program was not without frequent anomalies and several serious accidents. This era of 

flight research was characterized by a fast pace of system and mission development, quick 

advancement of envelope expansion, and relatively poor hardware reliability compared with 

currently acceptable standards for safety-critical components. Aborts due to subsystem 

malfunctions were commonplace, but safety precautions were a regular facet of mission planning

(e.g., trajectories were designed such that abort-to-landing capability was available with 

sufficient energy at all points in the mission profile). While the acceptance of risk during flight 

test operations was a common feature of the X-15 program, numerous test and checkout 

procedures were employed prior to flight, and go/no-go criteria were established for critical 

subsystems. However, owing to the short flight duration, the generally poor radio 

communications between the flight controllers and the X-15 pilots, and a high reliance on the 

research pilot to troubleshoot subsystem issues, the pilot’s role in mitigating the effects of 

component failures was paramount. In nearly all cases where major subsystem anomalies 

threatened the safety of flight, direct action by the pilot successfully prevented a catastrophic 

accident [ref. 4].

The X-15 program suffered four major accidents, three of which were in-flight with only one 

occurring at a high altitude and Mach number. In the only major ground accident, a propulsion 

system malfunction caused an explosion in the X-15-3 airframe during ground operations in June 

1960 but caused no major injuries.

In November of 1959, the first serious landing accident resulted in a structural failure on 

X-15-2 when it landed heavy after an abort. The pilot sustained no major injuries. In the second 

nonfatal flight incident in November of 1962, the pilot made an emergency landing in the same 

airframe. The aircraft again landed heavy and the wing flaps failed to deploy, causing a collapse 

of the left main landing skid upon touchdown. The vehicle tumbled, and the pilot was seriously 

injured, but recovered after several weeks [ref. 10]. The only fatal accident of the program, the 

subject of the present report, occurred in November 1967.

6.4 Instrumentation

Instrumentation aboard the aircraft, excluding supplemental research instrumentation, was used 

to measure the aircraft dynamic states for the purposes of flight control and pilot display. All 

three X-15 aircraft were similar in terms of instrumentation subsystems. Flight instrumentation 

onboard the X-15-3 aircraft available to the AFCS and the pilot included an inertial measurement 

unit (IMU), a dual-redundant rate gyro package, an aerodynamic flow direction sensor, and flight 

control accelerometers.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

19 of 107

6.4.1 Stable Platform and Inertial Flight Data System (IFDS)

The stable platform was a three-axis IMU contained in the forward equipment bay. In the initial 

design, the stable platform was a Sperry FRC-66 3-axis IMU coupled to an analog navigation 

computer. Together, the sensor package and its navigation hardware were referred to as the 

IFDS (inertial flight data system). In 1964-65, the FRC-66 package on X-15-1 and X-15-3 was 

replaced with the digital X-20 IFDS, which provided better computational accuracy at the 

expense of degraded gyro drift and higher mass [ref. 11].

As a gimbaled platform, the attitude solution was available directly from the IMU gimbal 

resolvers. The attitude director indicator (ADI) “ball,” the pilot’s primary attitude instrument, 

was slaved directly to the IMU output [ref .11]. The ADI could be operated in a gross attitude 

mode or one of two selectable precision indicator modes. One of the precision modes, called 

precision attitude indicator (PAI), used horizontal and vertical needles on the display to indicate 

fine pitch and roll error in place of the usual Į and sideslip (ȕ) error.

The stable platform was a four-gimbal system designed to avoid attitude singularities 

(“gimbal lock”). IMU data were available for use in attitude (roll, pitch, and heading) hold 

modes, which were provided by the MH-96 AFCS [ref. 16]. At low dynamic pressure of less 

than 50 psf, the IFDS could provide Į based on velocity and attitude for use in the MH-96

Į hold mode in place of the measured Į from the flow direction sensor [ref. 2].

The IFDS was used to derive inertial estimates of altitude, altitude rate, and velocity magnitude. 

Experience showed that the inertial estimates of the velocity and altitude were acceptably 

accurate for about 300 seconds of flight [ref. 17] but were expected to drift following entry and 

thus were seldom relied upon for ranging decisions [refs. 11, 18, and 19].2 While the IFDS was 

the primary source of pilot information during the boost trajectory phase, it was not considered 

mission critical for two reasons. First, flight planning relied on reaching a particular burnout 

velocity, and with engine performance relatively well characterized, pilots flew to a specified 

burn time (or burned all propellant available) rather than attempting to meet a velocity constraint 

[ref. 18]. Secondly, the availability of more accurate radar velocity data communicated from 

ground control supplanted the use of inertially derived measurements.

In progress at the time of the Flight 3-65 incident was the development of a boost and entry 

guidance capability by Ames Research Center, related to work that had been performed in 

support of the canceled X-20 program [refs. 20 and 21]. This supplemental guidance computer 

(AN/AYK-5), referred to as ALERT, was installed on X-15-3 with an advanced instrument panel 

having vertical tape displays versus the conventional instruments [ref. 4]. The ALERT system 

was installed on X-15-3 at the time of the accident, and its boost-guidance mode was used for 

pitch steering cues during the power-on phase [ref. 3].

2 Based on flight data, the digital IFDS exhibited a 1-ıDOWLWXGH error of approximately 5,000 feet at 500 seconds 

[ref. 11].

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

20 of 107

6.4.2 Rate Gyros

While the stable platform contained a triad of rate gyros used in maintaining the platform 

orientation, a separate set of body-fixed (“strapdown”) gyros were used for flight control rate 

damping [ref. 16]. The flight control rate gyros were located in the aft equipment bay, and were 

packaged into two identical three-axis assemblies to support the MH-96 AFCS’s dual-channel 

redundant configuration. The other X-15 airframes had only one gyro package. One notable 

feature of the flight control rate gyro was its failure monitor circuit, which was intended to 

mitigate failure effects that could be manifested as a full-scale output. In the event that the gyro 

output rate exceeded 22.5 degrees/second, the failure monitor was tripped and the input from the 

gyro to the flight control system was zeroed. Reset was automatic upon reduction of rate below 

the critical threshold. No indication of this behavior was provided to the pilot [ref. 3].

6.4.3 Flow Direction Sensor

The innovative X-15 “ball nose” air data system, or Q-ball, was a hypersonic flow direction 

sensor mounted in the aircraft nose [ref. 22]. Using a servo feedback loop on an articulated 

spherical differential pressure sensor, accurate estimates of Į and ȕ at high Mach number could 

be provided to the pilot to a dynamic pressure of approximately 50 psf. Below 50 psf, estimates 

of Į and ȕ were generally accurate except during RCS pulses from the nose jets [ref. 23]. Usable 

measurements were available to a dynamic pressure as low as 3.5 psf.3 The flow-field 

interaction near the nose corrupted the measurements, but the effect was transient and pilots were 

aware of the phenomenon (Figure 6.4-1). However, the transient behavior precluded the use of 

measured data for Į-hold at low dynamic pressure. A calibrated measurement of dynamic 

pressure was provided by the ball nose and was considered accurate within 2 percent above 

Mach 2.5 [ref. 17].

3 The 3-65 flight plan called for the pilot to establish and hold Į at 7 psf.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

21 of 107

Figure 6.4-1. RCS Jet Flow-field Interaction with Flow Direction Sensor at 3 psf, 

240,000 feet, Mach = 4.4 [ref. 1]

6.4.4 Accelerometers

Separate from the IFDS IMU was an accelerometer package collocated with the AFCS hardware 

in the forward equipment bay. While lateral acceleration feedback was used to augment 

directional stability in the early design, it was removed with yaw rate to roll feedback by late 

1963 to be consistent with the deletion of the ventral fin [ref. 19]. Normal acceleration 

measurements were used primarily in the pitch control loop and to provide a normal load 

limiting function in the MH-96. This limiting function provided nose-down feedback as the 

normal acceleration approached 5.5 g [refs. 1 and 2]. The pilot’s display of normal acceleration 

was provided by a separate, self-contained accelerometer mounted in the instrument panel 

[ref. 17].

6.5 Flight Control System

The X-15 flight control system configuration differed based upon the airframe. On all three 

vehicles, aerodynamic control surfaces consisted of a vertical stabilizer with an all-moving 

rudder surface and an all-moving horizontal tail with differential actuation for roll control 

[ref. 24]. Three-axis attitude control during exoatmospheric flight was provided by dual string of 

RCS monopropellant peroxide jets in the nose and wingtips [ref. 25]. Wing trailing surfaces 

included landing flaps that were deployed on final approach but were unused during powered, 

ballistic, or entry flight. Aft speed brakes were available for energy management after engine 

shutdown. The jettisonable lower ventral fin was used to increase lateral-directional stability 

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

22 of 107

above Mach 6, but after determining that aircraft stability characteristics were improved during 

high-altitude reentries without the fin, it was removed from the X-15-3 after 1963 [ref. 26].

Aerosurface motion control (Figure 6.5-1) was provided by a set of power-boost hydraulic 

actuators supplied by a dual-redundant hydraulic system. The interface to the hydraulic 

servocylinders was mechanical and was interlinked to the pilot inceptors via a set of pushrods 

and cables with spring bungees and nonlinear gearing for artificial feel [ref. 24].

Figure 6.5-1. X-15 Flight Control Effectors

X-15-1 and X-15-2 (serial numbers 56-6670 and 56-6671) used a pilot-selectable “fixed-gain”

three-axis SAS with rate gyro feedback having a range of ten preset gains in each axis available 

for pilot selection during flight [ref. 24]. The fixed-gain system design was consistent with 

systems conventionally deployed on research aircraft at the time, and as such, pilots were 

familiar with the process of adjusting SAS gains during flight to maintain acceptable handling 

qualities. Until the ventral fin removal in 1963, the SAS was required for entry from most flight 

conditions due to an unstable lateral-directional (“dutch roll”) mode exhibited by the X-15 at 

high Mach numbers and moderate Į [ref. 26]. The SAS stabilized the unstable airframe in this 

flight regime to allow the pilot to safely complete the entry. Exoatmospheric stabilization was 

provided by manual inputs on the left-hand controller, or a rate-damping reaction augmentation 

system (RAS). The RAS used one-half (one string) of the reaction control authority in each axis 

[ref. 27] to damp body rates during the ballistic coast.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

23 of 107

X-15-3 used a substantially more advanced experimental flight control system, the MH-96

[ref. 28]. The MH-96 was referred to as a “self-adaptive” flight control system. The MH-96

AFCS provided better reliability and fail-safety than the basic SAS through the use of a 

dual-redundant architecture with extensive internal failure monitoring. A principal function of 

the MH-96 was to enable automatic blending of the reaction controls and aerosurfaces during the

atmospheric exit and entry transition phases. For this reason, X-15-3 was preferred for extended 

high-altitude trajectories due to the improvement in controllability, decreased pilot workload, 

and reduced RCS propellant expenditures [ref. 5].

The MH-96 aerodynamic control function was based upon a sophisticated adaptive approach that 

maintained a small-amplitude limit cycle in the aerodynamic control surface servoactuators via 

the modulation of the forward gain in the inner loop (Figure 6.5-2). In essence, the system was 

designed to bring the gain of the aerodynamic control to its maximum permissible value at all 

times, thus operating the system at its upper stability limit. Since the servoactuator limit cycle 

frequency was approximately invariant with respect to flight condition, the MH-96 gain changer 

electronics were able to maintain a nearly constant aircraft dynamic response over the entire 

flight envelope as the dynamic pressure and control surface effectiveness changed. Since these 

parameters were highly uncertain and not believed to be reliably measurable with the air data 

system, the adaptive approach provided an effective method of decreasing sensitivities to the 

time-varying aircraft parameter variations (Figure 6.5-3).

Figure 6.5-2. MH-96 Adaptive Concept

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

24 of 107

Figure 6.5-3. MH-96 Typical Gain Variation [ref. 2]

The MH-96 designers recognized that since the adaptive gain was inversely proportional to the 

control surface effectiveness, the adaptive gain could be used to determine the necessity of 

supplemental reaction control. To that effect, the MH-96 incorporated an attitude-rate RCS 

phase plane controller4 with an “R/C AUTO” mode that automatically engaged and disengaged 

the RCS based upon the value of the sum of the adaptive gains in all three axes. RCS was 

enabled when the adaptive gains reached 90 percent of their maximum sum, and RCS was 

disengaged at 75 percent of the maximum sum5 [ref. 29]. RCS control with the MH-96 was 

provided through the right-hand control inceptor used for aerodynamic surfaces, such that the 

pilot was not required to transition to the left stick during atmospheric exit. Manual RCS 

engage/disengage for the MH-96 and the left-hand inceptor was provided in addition to the 

“R/C AUTO” mode, but manual control was seldom needed during high-altitude flights with the 

MH-96.

4 The MH-96 RCS actuators were solenoid valves, providing on-off control authority in contrast to the proportional 

control authority available on the left hand manual controller. The designers of the left-hand controller implemented 

proportional control when exoatmospheric piloting technique was in its infancy, and it was later recognized that 

pilots exclusively used the left-hand control in an on-off pulsed mode.

5 The reported values vary. These are taken from the contractor final report in the post acceptance-test configuration

[ref. 29].

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

25 of 107

Detection of the desired limit cycle to adjust the gain relied upon a filtering operation, or 

frequency-domain discrimination (the MH-96 gain modulation element was configured to 

respond to changes only in a narrow portion of the frequency spectrum of the sensed control 

signal, which was taken at the output of the servocylinder). The assumption was that only the 

limit cycle activity would be present in this narrow frequency range and, thus, would be isolated 

from other signals below (i.e., rigid-body control motions) or above (i.e., structural flexibility) 

this band. A more extensive discussion of the MH-96 AFCS design and operation appears in 

Appendix A.

6.6 Emergency Egress System

Cockpit egress was enabled by a rocket-propelled ejection seat that was developed specifically in 

support of the X-15 aircraft. The seat was a necessarily complicated, but functional design that 

included a deployable stabilization system to ensure the seat would not tumble after separation 

from the aircraft. The canopy was jettisoned during the ejection sequence using a separate 

pyrotechnic system, or it could be actuated manually.

The ejection seat was certified for operation to approximately Mach 4 and 120,000 feet altitude. 

While it was qualified to a limited extent using rocket sled tests, it was never demonstrated in 

conditions of high Mach number or high dynamic pressure. In the event of a high-altitude or 

high-Mach malfunction, pilots planned to stay with the aircraft as long as possible or until 

flight conditions allowed ejection [ref. 4]. The ejection system was never used during the 

X-15 program, although the canopy jettison mechanism was actuated by the pilot during the 

November 1962 landing accident.

6.7 Pilot Interface

The X-15 cockpit layout was relatively conventional for aircraft of the era, with the exception of 

having three control inceptors and vertical-tape displays for several instruments. Panel changes 

were frequent throughout the program. Panel modifications were incorporated, to some extent, 

into the simulator using interchangeable modules such that simulated missions could be flown 

using a panel similar to that in the aircraft [ref. 4]. While the X-15-3 originally had a cockpit 

layout nearly identical to the other two aircraft, an updated panel was installed in the fall of 

1965, primarily to include instrumentation for the experimental boost and entry guidance 

systems (see Figures 6.7-1 and 6.7-2) [ref. 4].

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

26 of 107

Figure 6.7-1. X-15-3 Original Panel (1960–1965)

Figure 6.7-2. X-15-3 Vertical Tape Panel (1965+)

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

27 of 107

6.7.1 Control Inceptors

A conventional center stick directly actuated the control surface servocylinders and was 

mechanically connected to a right-hand side stick controller. The right-hand controller provided 

hydraulically boosted inputs to the center stick, such that the center stick tracked the side stick 

and vice-versa. The side stick was intended for high-G operation. In addition, the RCS manual 

control inceptor was positioned on the pilot’s left side. This mechanical stick was directly 

connected to metering valves that drove the RCS jets.

In normal operation with the MH-96, the right-hand stick was used to provide rate commands to 

the autopilot. The left-hand stick, as a mechanical override, was not used without first disabling 

the automatic system [ref. 2]. The autopilot was responsible for responding to the rate 

commands using an automatically blended combination of the aerosurfaces and the RCS jets.

The left-hand manual controller drove both RCS jet strings in parallel, while the automatic 

system commanded only a single string. In this arrangement, the pilot had double the control 

authority of the automatic system, such that commands issued by the automatic system could be 

force-overridden by the pilot. This was not without consequence, in that opposing a rate 

damping command from the automatic system would expend three times the RCS propellant per 

unit time while the automatic and manual jets fired simultaneously.

6.7.2 Flight Instruments

The primary instruments available to the pilot for deducing the aircraft state included the ADI 

“ball,” a set of attitude deviation needles with selectable reference, a ȕ indicator, a selectable 

heading/roll rate indicator, and a set of navigated state outputs (e.g., altitude, altitude rate, and 

velocity). Dynamic pressure and normal acceleration were displayed primarily for use during 

the entry and pullout maneuver.

The instrument configuration and operation and the pilot interface was primarily driven by 

engineering need and functionality, and lacked a formal approach to human-machine integration. 

This is evidenced by the exceptionally complicated procedures associated with subsystem status, 

enable, disable, and reset functionality. Several instruments had multiple modes, one of which 

was of critical importance during the accident.

A summary of the instrumentation that was intended to be functional and presented to the pilot 

on Flight 3-65 is summarized in Table 6.7-1. An attempt has been made to detail each 

instrument’s functional status during Flight 3-65.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

28 of 107

Table 6.7-1. Sources of Aircraft Dynamic State Information Available to Pilot, 

Flight 3-65 Configuration

Display Data Source Limitations Malfunctioned?

ADI Aircraft inertial roll, 

pitch, and heading 

(׋șȥ)

IFDS IMU None applicable No

Attitude 

indicator 

deviation needle 

(vertical)

ȕ or roll error (׋e), 

depending on PAI 

mode

Ball nose flow 

direction sensor or 

IFDS computer 

(depending on 

computed Ƚ/ȕ

mode); IFDS IMU 

(in PAI mode)

Ƚ/ȕ from ball 

nose inaccurate 

due to RCS jet 

interaction below 

50 psf

Yes

Attitude 

indicator 

deviation needle 

(horizontal)

Ƚ or pitch error (șe), 

depending on PAI 

mode

Same as above Same as above Yes

Sideslip 

indicator

ȕ Ball nose flow 

direction sensor or 

IFDS computer 

(depending on 

computed Ƚ/ȕ

mode)

Same as above Yes

Precision 

heading 

indicator

Heading error (ȥe), 

roll rate (߶ሶ) depending 

on roll rate mode

IFDS IMU None applicable No

Dynamic 

pressure vertical 

tape

Dynamic pressure (ݍത) Ball nose Accuracy 

degraded below 

Mach 2.5

No

Velocity vertical 

tape

Earth-relative velocity 

magnitude (V)

IFDS computer Accuracy 

degraded after 

~300 sec due to 

navigation error

Yes

Altitude vertical 

tape

Inertial altitude with 

respect to reference (h)

IFDS computer Same as above Yes

Altitude rate 

vertical tape

Inertial altitude rate 

(݄ሶ)

IFDS computer Same as above Yes

Normal 

acceleration 

vertical tape

Normal acceleration 

Nz (g)

Self-contained None applicable No

In normal operation, the X-15 pilot’s ADI in the center of the control panel (Figure 6.7-3) was a 

standard freely rotating sphere called the “8-ball.” The sphere was bisected into white and black 

areas representing sky and earth, respectively. The ADI was a critical instrument because the 

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

29 of 107

typical X-15 ballistic flight profile prevented pilots from seeing Earth’s horizon until reentry and 

the degree of precision flying required by the mission demanded constant reference to flight 

instruments until landing. Moreover, the pilot was dependent on the ADI to perform the 

experimental maneuvers with the required precision. Normally, the needles labeled “8a” and 

“8b” in Figure 6.7-3 indicated Į error from preset and ȕ error from zero, respectively. Needle 

“8c” displayed error from a ground preset of the pitch attitude desired during climb. Needle 

“8d” indicated error from a ground preset heading.

Figure 6.7-3. X-15-3 Attitude Director Indicator

However, the ADI in the X-15-3 aircraft was modified to an alternate display configuration, 

called the PAI, which was needed to perform scheduled experiments with the desired precision. 

Switches on the display panel upper right section controlled the functions of the horizontal and 

vertical needles independently (in the PAI mode, they indicated pitch- and roll-attitude errors, 

respectively, rather than pitch and yaw). This was a major design departure for a performance 

instrument considered critical to maintaining controlled flight. This design was incorporated

because the X-15 instrument panel had limited area available.

An additional complexity of the ADI in either of its modes was that the standard ball nose air 

data system, which provided a measurement of Į and ȕ, was not reliable at dynamic pressures 

less than about 50 psf. When the pilot received the displayed information that the dynamic 

pressure was less than 50 psf, he was expected to use a switch to change the source of Į and 

ȕ data for the ADI displays from the ball nose to an inertially computed source.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

30 of 107

7.0 Accident Detail

Flight 3-65 on November 15, 1967, was planned as an altitude flight. The pilot was conducting 

his seventh X-15 flight and his third flight in X-15-3. The flight was attempted 2 weeks earlier 

on October 31, 1967, but was aborted prior to launch due to a propulsion system issue.

The two flights immediately preceding Flight 3-65 were high-altitude flights and were made with 

the aircraft in nearly the same configuration. The only configuration exceptions were that, for 

purposes of performing additional aerothermal and aerodynamic experiments on Flight 3-65, a 

panel of ablative material was added to the left-hand upper speed brake to test the adhesive and 

insulating properties of a material proposed for use on the Saturn launch vehicle, and a traversing 

probe experiment was added to the starboard wing pod.6

7.1 Flight Plan

The flight plan for this altitude flight was similar to prior altitude flights. X-15-3 was to launch 

from Delamar Dry Lake, Nevada, at an altitude of 45,000 feet and depart southwest toward 

NASA FRC on a heading of 216 degrees magnetic (232 degrees true). There were eight primary 

science objectives, including boost guidance evaluation, solar spectrum and plume measurement 

experiments, the traversing probe experiment, micrometeorite collection, ablative materials 

testing, and several instrumentation tests. Orienting the aircraft during the ballistic coast 

involved use of a PAI mode of the ADI display to perform a tracking task at or near peak altitude 

such that the solar spectrum experiment located in the aft experiment compartment could be 

oriented toward the sun. The flight plan called for a maximum velocity of 5,100 fps, a maximum 

altitude of 250,000 feet, and a maximum entry dynamic pressure of approximately 820 psf. 

Emergency procedures and landing sites were established for major subsystem failures, including 

premature engine shutdown.

7.2 Timeline

The pilot entered the cockpit at approximately 08:15 Pacific Standard Time (PST), and the 

NB-52 carrier aircraft departed Edwards Air Force Base for the launch lake at 09:12 PST. The 

carrier aircraft was enroute approximately 1 hour and 15 minutes before making the final turn to 

align with the launch azimuth. All captive-carry systems checkout procedures were normal, 

except for a peroxide leak from a yaw RCS jet, which was determined to be of no consequence 

prior to launch. Most X-15 instrumentation and systems, including the traverse probe 

experiment, were activated prior to launch. The traverse probe experiment was powered on at 

10:27:20 PST with the flight data recorders.

6 Wing pods were not part of the original X-15 design, but had been aerodynamically qualified for use and were 

safely demonstrated on several flights prior to Flight 3-65 and on the X-15-1 and X-15-3 airframes.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

31 of 107

Launch from the NB-52 took place at 10:30:07 PST with all systems operating normally. 

Ignition occurred at 10:30:08 PST (mission elapsed time (MET) +0 seconds)7. During the final 

40 seconds of the power-on phase, a gradual ȕ to about 5 degrees nose left was noticed by

ground control. This deviation was considered normal and was attributed to engine 

misalignment.8

Radio communications throughout the flight were reported to be poor, but this was not 

considered unusual during high-altitude missions [ref. 3]. However, in this case communications 

with the pilot were intermittent throughout the entirety of the powered flight phase and did not 

become intelligible until after the end of the powered flight phase.

At 10:31:28 PST (MET + 80 seconds) just prior to engine shutdown, which occurred at 

10:31:30 PST (MET + 82 seconds) and at about 140,000 feet altitude, the IFDS computer and 

instrument malfunction lights illuminated, indicating an IFDS malfunction. Eight seconds later, 

the pilot attempted to reset the system, but malfunction light stayed on. The IFDS continued to 

malfunction, and the warning light could not be reset.

At 10:31:34 PST (MET +86 seconds) and about 154,000 feet altitude, the pilot received ground 

control instruction to switch the ADI to the PAI mode. Due to poor radio communication 

conditions, this message was relayed via the NB-52 crew. The pilot had switched the ADI into 

PAI mode at 10:31:33 PST (MET + 85 seconds) in accordance with the flight plan, even though 

that mode was not required until the precision attitude-tracking task later in the flight.

At 10:31:42 PST (MET + 94 seconds) ground control called for the wing-rock maneuver, 

which the pilot had initiated at 10:31:37 PST (MET +89 seconds). At 10:31:58 PST

(MET + 110 seconds), the pilot reported the computer and instrument malfunction lights were 

on. Ground control acknowledged the pilot’s report.

The wing-rock maneuver was completed at 10:32:20 PST (MET + 132 seconds), at which time 

the aircraft had started a slow yaw drift to the right.

Although ground control had acknowledged that the IFDS computer was malfunctioning, at 

10:32:09 PST (MET + 121 seconds) and about 220,000 feet altitude, the pilot was instructed to 

perform the computed Į/ȕ-check maneuver using the display of IFDS computed Į and ȕ when 

the altitude reached 230,000 feet. The pilot performed this maneuver immediately following 

completion of the wing-rock maneuver at 10:32:20 PST (MET + 132 seconds). During the 

maneuver, the RCS did not respond normally to pilot inputs. The pilot delayed depressing the 

computed Į/ȕ switch for several seconds, possibly due to his attention to the control malfunction. 

The pilot selected IFDS Į/ȕ at 10:32:23 PST (MET + 135 seconds). At this time, the aircraft was 

7 For clarity, the present report adopts the convention that MET + 0 seconds coincides with ignition. The AIB report 

uses range clock time only.

8 The ventral fin had been designed in part to reduce ȕ due to thrust misalignment, but the program elected to fly 

high-altitude flights without the ventral fin after fall of 1962, which probably increased the ”expected” power-on ȕ.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

32 of 107

sideslipping approximately 6 to 8 degrees nose right, as displayed by the precision heading and 

ȕ indicators. The aircraft roll attitude was nearly wings level and the ADI vertical wand 

displaying roll in PAI mode did not indicate any significant error.

By 10:32:25 PST (MET + 137 seconds), the negative side ȕ slip deviation had increased to 

off-scale nose right as displayed by the cockpit precision heading and ȕ indicators. At this time, 

lacking a control room indication of heading information, ground controllers were not aware of 

the heading error.

Immediately after selecting IFDS Į/ȕ, the MH-96 AFCS disengaged automatically at 

10:32:26 PST (MET + 138 seconds), illuminating a caution light. The pilot recognized that the 

light was on and immediately reset the MH-96 while concurrently reporting to ground control 

that the pitch and roll stability augmentation channels had disconnected. The MH-96 was 

re-engaged by the pilot at 10:32:31 PST (MET + 143 seconds).

At approximately 10:32:50 PST (MET + 162 seconds), the pilot initiated the Precision Attitude

Tracking Task in accordance with instructions from ground control. At this time, the ȕ angle had 

increased to 20 degrees. The RCS momentarily resumed normal operation, arresting the positive 

yaw rate. However, due to a lack of normal response from the AFCS right-hand reaction control 

inceptor, at 10:33:05 PST (MET + 177 seconds) the pilot elected to use the left-hand manual 

control inceptor. The pilot did not disable the AFCS, although normal procedures for transition 

to manual control would have required this action. By the time the pilot began to use the manual 

control inceptor, the aircraft had rolled left through zero bank angle and the precision roll 

indicator needle called for the aircraft to be rolled to the right. However, the pilot applied 

manual right-yaw reaction control, further increasing the deviation from the planned heading.

At 10:33:14 PST (MET + 186 seconds) and about 258,000 feet altitude, ground control 

instructed the pilot to check the status of the pitch and roll dampers. The pilot reset them 

manually at 10:33:21 PST (MET + 193 seconds).

The aircraft entered a spin at approximately 10:33:30 PST (MET + 202 seconds) at an altitude of 

250,000 feet and a velocity of 5,000 fps. At 10:33:39 PST (MET + 211 seconds) and about 

240,000 feet altitude, the pilot reported that the aircraft control seemed “squirrelly.” At 

10:34:01 PST (MET + 233 seconds), the pilot transmitted, “I’m in a spin.” At that time, the 

aircraft had reached peak altitude and was in a descent through 210,000 feet. The aircraft 

attitude was approximately 40 degrees above the horizon and was approximately 90 degrees 

right of the planned heading with a roll rate of 20 degrees per second. The aircraft had 

completed one yaw revolution. The dynamic pressure in this flight condition was increasing 

through approximately 1.5 psf. At this time, reaction controls were still required. The pilot 

reported the spin a second time at 10:34:16 PST (MET + 248 seconds).

The aircraft continued uncontrolled motion until about 10:34:34 PST (MET + 266 seconds),

where at an altitude of approximately 130,000 feet, the spin was arrested by a combination of 

automatic and manual reaction controls, aerodynamic controls, and inherent aerodynamic 

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

33 of 107

stability. At this point, the aircraft had a velocity of about 4,700 fps and was subject to a 

dynamic pressure of about 200 psf.

At about 10:34:37 PST (MET + 269 seconds), within seconds after the aircraft came out of the 

spin and went into an inverted dive, the MH-96 AFCS entered into a divergent limit-cycle 

oscillation in the pitch axis with the stabilators moving at their maximum rate of about 

26 degrees per second. As dynamic pressure increased during rapid descent, the horizontal 

stabilizer motions produced rapidly increasing accelerations that exceeded structural limits. 

By-products of the MH-96 AFCS limit-cycle instability in pitch were rolling and yawing 

oscillations that produced excessive structural loads.

At 10:34:54 PST (MET + 286 seconds) at an altitude of 62,000 feet and a dynamic pressure 

exceeding 1,300 psf, a catastrophic buckling of the fuselage occurred and the aircraft 

disintegrated into several large fragments. The pilot did not successfully eject and was killed 

during the breakup or upon ground impact.

7.3 Data Reconstruction

Reconstructed flight data depicting key events with respect to the aircraft attitude angles are 

shown in Figure 7.3.1. These data were derived from filtered measurements of the IMU resolver 

angles recovered from the original stripchart recordings. The correctness of the IMU angle data 

was verified by the post-accident investigation team via correlation of the estimated attitude with 

a known solar angle in recovered film footage from onboard cameras [ref. 3]. The remaining 

trajectory data appear in Appendix B.

In Figure 7.3-1, MET is referenced to ignition, which occurred at 10:30:08 PST. The onset of 

spin entry at approximately 10:33:30 PST (MET + 202 seconds) was based on the rapid increase 

in yaw rate and the observation of the first traversal of the sun across the instrument panel as 

seen from the cockpit camera. Note that the aircraft was tumbling after approximately 

MET + 215 seconds, and the attitude resolver angles wrap through 360 degrees, but are masked 

by noise filtering.

Based on the assumption the pilot recognized the spin entry about 31 seconds prior to reporting it 

(when the sun traversed the instrument panel), just over 1 minute elapsed during the pilot’s 

attempts to regain control until the aircraft was destroyed.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

34 of 107

Figure 7.3-1. X-15 3-65 Reconstructed Flight Data (attitude angles9 )

8.0 Failure Analysis

In the following subsections, analyses of individual subsystem failures and their effects will be 

detailed. These include the failure of the traverse probe experiment; the subsequent 

instrumentation, RCS control, and display anomalies; and the development of the MH-96 largeamplitude limit cycle. In Section 9.0, an analysis of the human factors related to the accident 

9 Although not indicated in the original flight data, based on [ref. 11] it is assumed the Euler angles are referenced to 

a geodetic north, east, down (NED) frame centered at the landing site. The Euler sequence is unknown, but was 

probably 3-2-1.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

35 of 107

will be detailed, with a focus on piloting performance and the role of ground control in the 

incident.

8.1 Traverse Probe Experiment Failure

The traverse probe contained in the starboard wing pod consisted of a servo-controlled pressure 

boom whose design was such that it would oscillate across the bow shock boundary, providing a 

measurement of the shock location. The traverse probe relied on power from the aircraft and 

was interfaced to the primary 115V (volt) 400-Hz (Hertz) alternating current (AC) power bus 

supplied from the aircraft APU generators. The traverse probe experiment had been flown on

two prior missions in 1963, although neither achieved an exceptionally high altitude [ref. 4]. 

Flights 1-35-56 and 1-36-57 on the X-15-1 airframe reached maximum altitudes of 124,200 and 

111,800 feet, respectively. No anomalies related to the traversing probe were noted on these 

flights.

Post-flight tests of the reconstructed traversing probe hardware concluded that below pressures 

corresponding to approximately 90,000 feet pressure altitude, a starting capacitor associated with 

the traverse probe drive motor would first develop a corona discharge and then exhibit arcing to 

ground across an approximately 0.25-inch gap between the capacitor terminal and the 

experiment chassis. Continued testing revealed this behavior would persist until power supply 

line fuses, rated at 2 amps, interrupted the power to the traverse probe motor. This interruption is 

consistent with the cessation of the electrical disturbance prior to the pilot and aircraft loss 

during Flight 3-65, and it was verified the flight fuses recovered from the wreckage exhibited 

characteristics consistent with the fuse burn-through reproduced on the ground [ref. 3].

Dielectric breakdown in low-pressure gases is a known phenomenon in high-voltage systems 

[refs. 30–32]. Dielectric breakdown phenomena obey the semi-empirical Paschen’s Law, which 

describes the minimum breakdown potential (in V) associated with a parallel plate electrode 

configuration as a function of the product of pressure and gap distance (pd). The breakdown 

voltage approaches a minimum at a specific value of the pressure-gap product and increases 

elsewhere (see Figure 8.1-1, reproduced from data appearing in reference 32).

Paschen’s Law implies, for a fixed gap distance and potential, the likelihood of breakdown 

increases until reaching a maximum at a specific absolute dielectric pressure and then decreases 

as the dielectric pressure approaches zero. The result is counterintuitive, but is driven by the 

physics of the underlying electron transport phenomena and ionization processes. The shape of 

the Paschen curve for a given dielectric depends on the gas composition and its temperature. 

Breakdown may be influenced by electrode composition and contaminants, and particularly in 

space environments, by electrons liberated by incident radiation.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

36 of 107

Figure 8.1-1. Paschen Curve for 400 Hz Potential at 300 degrees Kelvin [ref. 32]

Even at the critical pd value, quiescent breakdown in air generally will not occur below 300V. 

However, deviations from the basic Paschen law result from various factors, including the 

presence of nonuniform or oscillating electric fields (e.g., conductors with sharp radii and AC

potentials, respectively). In the latter case, 400 Hz AC potentials as were used in the X-15

AC power bus reduce the threshold to about 230V. Unknown to the traverse probe experiment

developers, the commercial-off-the-shelf (COTS) AC motor selected from existing inventory 

contained a transformer circuit that multiplied the 115V input by a factor of about 4, yielding a 

peak potential in the experiment exceeding 630V. Under reduced-pressure conditions, arcing 

was practically guaranteed across uninsulated gaps of modest spacing. As the design was not 

thoroughly reviewed for environmental compatibility or tested in simulated altitude conditions 

prior to installation on the aircraft, the breakdown phenomena was first seen in flight. The 

investigating board theorized that during the relatively short exposure to the high-altitude 

environment on the previous two flights, arcing may have occurred, but could have gone 

undetected as no particularly sensitive electronics were installed on the other X-15 aircraft 

[ref. 3].

The effects of the traverse probe electrical disturbance during the accident flight were severe. 

Post-accident laboratory testing indicated that 30 μs transient spikes of at least 300V would 

appear on the aircraft power bus and would be transmitted to all common-ground electrical 

components. Systems that operated on 28V direct current (DC) power and/or had robust power 

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

37 of 107

supply electronics (e.g., the IFDS IMU) were not substantially impacted. However, the majority 

of the electronic and electromechanical systems, including the servoactuators, MH-96 AFCS 

gain changer electronics, IFDS computer, and telemetry and voice transceivers, were affected.

8.2 IFDS Computer Failure

The IFDS installed on the X-15-1 and X-15-3 airframes consisted of a digital inertial computer 

and an analog stable platform (IMU) that was originally designed and environmentally qualified 

for the X-20 program. The digital component of the IFDS contained the mechanization of the 

navigation equations and was used to accumulate (integrate) velocity data from the stable 

platform and transform this information into a coordinate frame suitable for use by the pilot and 

the boost guidance algorithm. The principal IFDS outputs were the altitude, altitude rate, and 

Earth-relative velocity magnitude. In addition, body-relative velocity vectors were used to 

establish estimates of Į and ȕ.

By 1960s-era accuracy standards, the IFDS IMU was a coarse aviation-grade instrument with a 

gyro bias in the range of 3.0 deg/hr, and an acceleration sensitivity of approximately 10 μG. 

As such, it was shown to be useful only during the boost and ballistic phases of flight, after 

which accumulated errors tended to yield estimates of aircraft state too inaccurate for use in 

safety-critical ranging decisions. However, while range radar was relied upon for determining 

energy during and after entry, the use of IFDS for pilot situational awareness was common. 

During Flight 3-65, the accuracies of the computed Į and ȕ were being experimentally evaluated.

Nevertheless, flight planning called for the IFDS to replace the air-data derived indications of 

these quantities on the pilot display panel at dynamic pressures below 50 psf.

At the onset of the Flight 3-65 electrical disturbance, the IFDS began a series of resets. In each 

case, transient upsets to the power supply induced as a result of the traverse probe breakdown 

phenomena caused the IFDS to temporarily halt integration of the navigation equations and 

resume shortly thereafter. This event occurred at least 61 times [ref. 3] during the less than 

3 minutes of electrical disturbance. Due to the loss of integrated velocity during the halt period, 

a substantial error, on the order of 100,000 feet and 1,000 fps, accumulated in the IFDS estimates

of the altitude and velocity. Importantly, the failure in the IFDS did not affect the ADI ball.

Therefore, the pilot’s indications of gross and fine (PAI) attitude were correct throughout the 

flight. The same telemetered indications of the aircraft attitude, derived from the IMU resolver 

angles, were independently used to drive the ADI ball servos [ref. 11] and were unaffected by the 

IFDS dropouts. This conclusion can be verified by comparing the sun and shadow angles in the 

cockpit with the position of the ADI ball, and by noting that the IFDS GROSS failure indicator 

was not illuminated in the cockpit film [ref. 3].

The principal effects of the IFDS failure were erroneous indications of altitude, altitude rate, total 

velocity, Į, and ȕ on the pilot displays. While the aircraft control was lost in part due to an 

unrecognized ȕ deviation at a point in time that the IFDS was selected as a source of ȕ

information, and while the timeline reveals that the data was likely in error, the IFDS output was 

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

38 of 107

off-scale and with the correct sign at the time the pilot selected it. Thus, the erroneous data from 

the IFDS do not appear to be a direct contributor to the vehicle loss of control. However, the 

deteriorating state of the IFDS displays, especially in that the altitude and velocity tapes were 

substantially different from the expected values, combined with repeated warnings from the 

IFDS error annunciator suggests that the pilot was suspect of any data originating from the IFDS.

This may have contributed to a loss of spatial orientation, which is discussed in further detail in 

Section 9.0.

The susceptibility of the digital IFDS computer to power supply transients was a known 

problem, but regrettably, it had been considered benign and/or unlikely since it had apparently 

only occurred on X-15-1 and was suspected to have been due to a particularly high electrical 

load. As of July 1968, the problem on X-15-1 was still unresolved, but under investigation 

[ref. 11].

8.3 Servo Transient Anomaly

An anomaly highlighted in the 1968 NASA/Air Force AIB report was the presence of servo 

transients whose behavior could not be reconciled with any known cause [ref. 3]. Servo 

transients were considered a benign behavior, but due to the nature of the MH-96 AFCS, any 

uncommanded, rapid servo motion could be interpreted as an excessively high servo limit cycle, 

thus triggering a momentary drop in gain. The AIB reported the X-15 had operated for some 

time with the servo transient issue and the momentary gain reduction (on the order of 5 to 

10 seconds) was often unnoticed by the pilot.

The X-15 servoactuator assembly was a two-stage hydraulic power-boosted design operated in 

series with direct pilot mechanical inputs to the aerodynamic surface power actuators [ref. 24]. 

The servocylinder torque motor and servocylinder feedback electronics had a relatively high 

electrical sensitivity to current transients [ref. 29]. Given the extent of the electrical anomaly 

caused by the traverse probe failure, the most plausible explanation for the excessive servo 

motion is that a known and poorly characterized sensitivity to electrical interference in the servo 

was exacerbated by the severe electrical noise.

Servo transients during Flight 3-65 had two distinct and equally problematic effects. First, the 

aforementioned coupling with the gain changer electronics caused the MH-96 to interpret the 

occasional servo motions as excessive servo limit cycles, and the MH-96 correctly responded by 

rapidly decreasing the gain to recover stability. In doing so, the hysteresis logic associated with 

the automatic RCS blending was activated, and the RCS was disengaged. The pilot was not 

notified of the disengagement.

Second, the MH-96, similar to the other X-15 SAS designs, included a failure monitor circuit on 

each servocylinder to protect for hardover failures. Hardover failures were considered credible 

anomalies and were protected for, when detected, by a complete disengage of the associated roll, 

pitch, or yaw axis [ref. 24]. Both systems used a simulated servocylinder model implemented 

using analog electronics. In the baseline SAS, the hardover detection circuit consisted of an 

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

39 of 107

absolute travel error monitor that was triggered when the expected value of the servo position 

exceeded the measured value by more than 10 percent. In the MH-96, detection was triggered 

when the rate of the servo travel differed in sign from the expected rate. In the event of a 

“damper reset,” two lights were illuminated on the panel to notify the pilot, and pilot action was 

required to re-engage the failed channels by returning the damper select switches to the “up” 

position.

To reduce the potential for supercritical operation in the event that the MH-96 was disengaged at 

a low dynamic pressure condition and re-engaged at a high dynamic pressure condition, the gain 

changer electronics were configured to reset the gain to minimum following any reset. Under 

normal conditions in exoatmospheric flight, the adaptive gain would return to maximum in 

10 to 20 seconds. A reset would interrupt access to the RCS during that time.

During Flight 3-65, a servo monitor disengage, precipitated by a large servo transient, occurred 

simultaneously in the pitch and roll channels at 10:32:26 PST (MET + 138 seconds). This 

condition was immediately recognized and reset by the pilot in about 4 seconds. However, since 

the yaw channel was severely affected by the traverse probe electrical noise, the sum of adaptive 

gains did not return to a value sufficient to reactivate the RCS for nearly 20 seconds after the 

channels were reset [ref. 3]. A similar disengage manually triggered by the pilot occurred about 

1 minute later when the pilot was asked by ground control to “check [his] dampers.” This 

manual action interrupted access to the RCS.

8.4 Yaw Rate Gyro Channel Disconnect

In addition to the hardover monitor responsible for the pitch and roll axis disengage, each of two 

redundant channels of each axis in the MH-96 architecture included a rate hardover monitor on 

the flight control rate gyro. An ability to recover from a flight control rate gyro fault was a 

requirement of the MH-96 design, but a simultaneous failure of both gyros in a single axis was 

not considered credible. Thus, the architecture was designed so a single failure could be 

accommodated by disconnecting the failed gyro, in which case the total adaptive gain (i.e., the 

sum of both channels) would automatically increase to return the total system gain to a normal 

range [ref. 29]. Unlike the case of a servo failure detection, the adaptive channels were not 

disengaged.

The flight envelope provided to the MH-96 designers specified the range of angular rates in each 

axis would not exceed 20 degrees per second, and the gyro output amplifiers were designed to 

saturate at 30 degrees per second. As such, the hardover monitor threshold in pitch and yaw was 

empirically set to a value of approximately 22.5 degrees per second.10 The roll channel used a 

differential trigger, but essentially operated the same way.

10 The exact value of the threshold differs. This value is taken from the MH-96 engineering documentation, 

WADD-TR-60-651 Part VII, whereas the AIB report specifies 30 degrees per second, which was probably confused 

with the gyro saturation limit.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

40 of 107

During Flight 3-65, the onset of a spin brought the true body yaw rate above the hardover-failure

disconnect threshold simultaneously in both yaw channels, which were operating normally. As 

designed, both channels simultaneously disconnected, essentially opening the yaw damper loop 

and providing no yaw rate feedback from approximately 10 seconds after spin entry until 

10:34:29 PST (MET + 261 seconds) when the disconnect circuits reset and re-enabled both 

channels. No indication of the open condition in the loop was provided to the pilot. Lacking any 

closed-loop feedback, the MH-96 total gain in yaw increased to maximum and remained there so 

that RCS control was available to the pilot so long as the pitch and yaw gains were near 

maximum. However, regardless of the RCS state, the pilot had transitioned to the left-hand stick 

and RCS yaw rate damping was unavailable due to the lack of rate gyro inputs. The primary 

effect of this failure was to exacerbate spin development with no rate damping augmentation.

8.5 MH-96 Large-Amplitude Limit Cycle

The AIB report provides little detail regarding the MH-96 LCO that contributed to the aircraft 

breakup. To isolate the most probable cause of the MH-96 instability, an extensive analysis was 

undertaken to gain insight into the exact mode(s) of failure (see Appendix A). The AIB report 

indicated the rate-limited power actuator was a contributor, and it appeared the large-amplitude 

LCO could be sustained in the event of rapidly increasing dynamic pressure, as was seen during 

the entry of Flight 3-65. However, a review of the trajectory data revealed the maximum 

dynamic pressure rate of change was less than seen on previous flights, and the MH-96 adaptive 

gain law provided sufficient response to maintain gains below supercritical operation in these 

conditions. Furthermore, it appears the presence of supercritical gains in the MH-96 would 

seldom lead to a loss of rigid-body stability, but rather to an excitation of the servo-limit cycle 

mode to a higher, but nondestructive amplitude.

The present analysis revealed the AFCS, coupled to the X-15-3 airframe at a fixed flight 

condition above approximately Mach 3.0, could exhibit two distinct oscillation modes. The first 

was dominated by the desired limit cycle associated with small-amplitude surface motion at the 

critical forward gain with no rigid body motion. The second was a divergent large-amplitude 

LCO11 involving the rigid body, but not directly involving the adaptation dynamics. The 

presence of the divergent LCO appears to have been the result of a latent design oversight in a 

structural notch filter installed on the MH-96 configuration.

8.5.1 History

In May 1960, a severe high-frequency LCO in the baseline (fixed-gain) stability augmentation 

system was discovered during a X-15-2 flight, which involved a 12- to 13-Hz oscillation in a 

stabilator resonant mode at certain flight conditions [refs. 1, 6, 24, and 33].

11 “Divergent” LCOs are oscillations that grow to sufficient amplitude to cause divergent (destructive) aircraft 

dynamics before reaching their theoretically limiting behavior.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

41 of 107

The NASA FRC maintained the fixed-gain SAS for X-15-1 and X-15-2, and underwent a 

redesign of the fixed-gain SAS filters to mitigate the high-frequency LCO. The FRC 

engineering personnel were aware of the nonlinear saturation and rate limiting characteristics of 

the power actuators, and incorporated these features in their design model when developing the 

filter modifications [ref. 34]. The modified filter was verified through hardware-in-the-loop 

simulation and installed on both fixed-gain SAS airframes, where flight tests confirmed the 

elimination of the high-frequency LCO. No further issues were seen on the fixed-gain system.

In late 1960, a basic model of the problematic structural mode was sent to the MH-96 contractor 

for evaluation. At the time, the contractor was in the late stages of preparing the MH-96 for 

flight qualification tests, which were scheduled to begin in the fall of 1961. The contractor 

reviewed the structural model and concluded that a notch filter would be needed in the rate

damping loop to mitigate the issue. An appropriate filter was designed, fabricated, and 

incorporated into the MH-96 design [ref. 35].

The redesigned MH-96 was installed and tested at FRC in the Hardware in the Loop (HWIL)

facility and in September 1961 was installed on the aircraft for ground testing.12 During ground 

aircraft testing, an additional unstable inertial-servoelastic coupling effect appeared in the 

closed-loop dynamics. The designers were challenged by the appearance of an additional 

adverse structural-mode limit cycle caused by the notch filter due to the additional lag at higher 

frequency. Additional filter modifications were made, with a reduction in authority of the 

adaptive gains and the installation of a deadband, to ensure that the small-amplitude oscillation 

would not appear in flight [ref. 35].

Due to facilities problems and other practical limitations, the HWIL and ground testing was not 

extensive, and the modified MH-96 was moved forward to begin preparation for initial flight 

tests in only a few months. The first flight test was conducted on December 20, 1961. 

Notwithstanding a yaw channel oscillation at approximately 12 Hz caused by excessive gain in 

the lateral acceleration loop, the filter modifications proved successful in mitigating the risk of a 

high-frequency limit cycle caused by the stabilator dynamics.

However, while NASA FRC had used a nonlinear model of the servo and power actuator with 

more extensive HWIL simulation to verify the filter design, the contractor apparently did not 

have access to the same type of model data and used a simple first-order lag model with 

hysteresis only (Figure 8.5-1). As such, a latent design sensitivity was introduced into the inner 

loop of the MH-96 SAS that would allow the SAS rate loop to become unstable in the presence 

of actuator rate saturation.

12 X-15-3 had been rebuilt following the catastrophic propulsion test failure.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

42 of 107

Figure 8.5-1. Surface Actuator Models Used in Design [refs. 34 and 35]

8.5.2 Mode of Failure

The transition from the desirable small-amplitude LCO to the large-amplitude destructive LCO 

was an artifact of the rate-limited power actuator with its semi-integrating servo loop. A known 

effect of power actuator rate limits is the introduction of an amplitude-dependent equivalent 

phase lag in the inner loop, which plays an important role in the sensitivity to pilot-induced 

oscillations (PIO). As can be seen in Figure 8.5-2, the presence of rate limits severely degrades 

the equivalent nonlinear frequency response of the X-15 actuator. The severe landing PIO 

encountered on X-15 Flight 1-1-5 was an effect of the same rate-limited actuators, albeit in a 

different failure mode [ref. 36].

The adverse high-amplitude limit cycle behavior was not directly related to the AFCS adaptation 

dynamics, but to the SAS loop linear filter design, which differed from the linear filters used in 

the fixed-gain SAS on the other X-15 aircraft. Since the MH-96 required special loop shaping to 

attain the desired LCO conditions, the AFCS’s high-order notch filter induced substantially more 

phase lag near the rigid body short period frequencies. The mechanism by which a destructive 

limit cycle could be introduced involved an abrupt maneuver at relatively high forward gain, 

where the power actuator would reach rate saturation while inducing large angular acceleration 

on the rigid body. If this event occurred at a flight condition where the rigid-body short period 

NASA FRC Model of Power Actuator (excluding servo)

Contractor Model

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

43 of 107

damping was particularly low, as it did during Flight 3-65, then the rigid-body oscillation was 

divergent, even with fixed adaptive gains.

Figure 8.5-2. X-15 Power Actuator under Rate Saturation, 15-degree Amplitude

During entry, the X-15 bare airframe exhibited a short-period pitch mode of approximately 

0.5 Hz with a damping ratio of less than 10 percent while at a flight condition between 

Mach 4.5 and 5.0 [ref. 37]. In an environment of increasing dynamic pressure, especially rapid 

entries, the system gains were often supercritical for a few seconds until the desired limit cycle 

was established and the MH-96 gain changer reduced the gain. This unfortunately meant that 

rapid inputs at these flight conditions were accompanied by large servo commands that could 

saturate the power actuators. This was especially true for combined pitch-roll maneuvers due to 

the shared stabilator authority. While the adaptation dynamics were not directly involved in the 

LCO phenomenon, the limiting circuitry associated with the MH-96 adaptive loop could be 

saturated by large DC signals [ref. 33]. If this occurred, then the gains would ramp to maximum 

in an effort to reestablish the desired high-frequency limit cycle. This behavior further amplified 

the large-amplitude limit cycle, leading to a loss of rigid-body control.

A comparison of the reconstructed rigid body limit cycle appears in Figure 8.5-3. Using fixed 

aerodynamic parameters consistent with the onset of the LCO at M = 4.7 and the entry dynamic 

pressure profile from reconstructed flight data, the LCO can be triggered by a large or abrupt 

control surface motion. This occurs during normal adaptation behavior that otherwise does not 

lead to adverse oscillations. The resultant motion is divergent and couples with the rigid body at 

a frequency of about 0.5 Hz. phase response (deg) magnitude response (dB)

10

0

í10

í20

í30

nonlinear exact DF 1st order 

linear

í2 í1

10 10 0 110 10

frequency (Hz)

0

í50

í100 í2 í 0 1

10 10 10 10

frequency (Hz)

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

44 of 107

Figure 8.5-3. X-15 3-65 MH-96 Servo Actuator LCO (simulated) versus Flight Data

The presence of this adverse operation mode apparently went unnoticed until Flight 3-39 on 

January 13, 1965, when the LCO appeared during the flight boost phase [ref. 3]. It quickly 

attenuated due to decreasing dynamic pressure, which decoupled the rigid body from the loop. 

The MH-96 contractor conducted a study, which concluded that the adverse LCO could be 

avoided if such abrupt inputs in the pitch axis were avoided while dynamic pressure was rapidly 

increasing. This recommendation is consistent with the failure mode identified through the 

present analysis. Pilots and engineering staff were briefed of the possibility of such adverse 

behavior and cautioned regarding its effects [ref. 3]. The contractor report stated: surface response (deg) pitch rate (deg/sec)

;ííí/&2RQVHW0 GHJVXUIDFHVHFSXOVH

20

0

í20

60 65 70 75 80 85 90

time (sec)

20

0

í20

60 65 70 75 80 85 90

time (sec)

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

45 of 107

The MH-96 adaptive system can continue flying without modification if the 

following precautions are observed: avoid planning flights where large, rapid 

angle-of-attack changes might be encountered while simultaneously rolling the 

vehicle when at Mach numbers greater than 3.0; brief pilots on the potential 

consequences of abrupt control motions, especially when in the flight conditions 

described above. If the above precautions are considered too restrictive, the 

nonlinear stability (pitch limit cycle) of the MH-96 pitch axis can be improved 

through modification.

Replication of this behavior in simulation is non-trivial, as it requires a high-fidelity model of the 

power actuator, servocylinder, servo feedback, valve dynamics, and associated nonlinearities.

The semi-analytical methods used in Appendix A to predict the instability were known in the 

1960s, but could not be exercised at the level of detail now available using rapid numerical 

simulations. However, there is some evidence suggesting this behavior had been encountered in 

HWIL simulation before it appeared in flight, as a brief report [ref. 38] contains plots of a 

large-amplitude roll oscillation that reappear in the 1971 report [ref. 33] commissioned by the 

AIB. Therein, an X-15 controls engineer remarks:

When a large...command is made, rate limiting occurs and causes [a] greatly 

deteriorated response...nonlinearities in system components cannot be ignored in 

high-gain control systems.

It is reasonable to expect the X-15 flight control team, having had recent experience with a 

rate-limited PIO during the first piloted flight, could postulate the existence of a rate-limited 

large-amplitude LCO in the pitch axis. However, it seems this knowledge was not 

communicated to the program, or it was thought not to be a credible failure in flight, since 

according to the AIB it came as enough of a surprise in 1965 that a contract was issued to study 

its implications [ref. 3]. However, by the time of the accident, this behavior seems to have been 

known. A control room MH-96 monitor engineer remarks in a witness statement [ref. 3]:

...the limit cycle operation which occurred...is a rarely seen characteristic of this 

system which is undesirable and did prevent the pilot from having full...control 

capability.

8.5.3 The Role of Adaptive Control

The investigation following the 3-65 accident concluded from simulation studies that the adverse 

LCO could have been avoided had the pilot disabled the MH-96 and reverted to fixed-gain 

operation prior to entry. However, the AIB noted the pilot would have been unfamiliar with the 

LCO since he had not experienced it in the simulator [ref. 3]. Although the existence of this 

failure mode was known, it may have been difficult to reproduce on the ground since the HWIL 

simulation facility was seldom operated at full flight hydraulic pressures [ref. 5].

It is unlikely that disabling the adaptive mechanism per se successfully recovered stability, but 

rather that the fixed-gain mode in X-15-3 reverted to the lowest acceptable gain, which was 

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

46 of 107

below the threshold that would sustain rate limiting. While the adaptive mechanism exacerbated 

the problem by increasing the system sensitivity to large or spurious inputs, it is likely that an 

alternate filter design would not have been susceptible to this phenomenon. Pilots executing 

high-altitude reentries using the fixed-gain SAS typically did so with a pitch gain preset at 

40 to 60 percent of the maximum gain in that axis [ref. 19]. Had the same structural filter been 

installed on the X-15 aircraft with the fixed-gain SAS, whose inner loop was functionally 

identical to the adaptive inner loop, the fixed gain controller may have exhibited the same 

unstable behavior at a higher dynamic pressure.

Following the accident, the AIB concluded that a detailed failure mode analysis was 

unnecessary, since the only example of the MH-96 system in a flight configuration had been 

destroyed [ref. 3]:

The destruction of the only X-15 airplane equipped with an adaptive control 

system makes detailed recommendations in this area unnecessary.

The AIB recommended that a report be released summarizing the general experience with 

adaptive flight control technology within 90 days [ref. 3]. However, the report was released 

more than 3 years later in March 1971 [ref. 33]. While this brief summary mentioned the 

severity of the pitch-and-roll axis limit cycle instability and its relationship to the actuator rate 

limits, it did not adequately discuss the contributions of the AFCS to the Flight 3-65 accident:

An example of gain reduction caused by electrical noise is shown...in this 

particular instance, the performance of the AFCS became so poor that the pilot 

resorted to the use of the manual reaction control system, rather than continue to 

use the poorly performing AFCS blended reaction controls...

...when these [pilot] commands were large or rapid, the effect on the gain 

changer was serious. In each flight incident, the gain changer was misled by the 

direct-current or low-frequency signals which were large enough to saturate the 

electrical limits, thus masking signals within the bandpass frequency range. The 

gain increased to values exceeding the critical gain, and the servoactuator loop 

became unstable...

...saturation in one axis resulted in complete loss of control in the other axis. 

This problem occurred immediately following recovery from a high-altitude spin 

in the last flight of the X-15 airplane with the AFCS.

The report refers the reader to an earlier document [ref. 6], which does not appear to have 

received widespread dissemination. The present authors conjecture that this critical lack of detail

may have led to the commonly held misconceptions about the root causes of the Flight 3-65

failure.

It is regrettable that the role of the adaptation law in the development of the adverse limit cycle 

behavior has been largely misunderstood in the modern flight controls community and has been 

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

47 of 107

incorrectly reported in the literature [refs. 7, 8, and 39]. In the cited examples, the X-15 airframe 

and controller models were used to simulate a loss of control, but excepting magnitude 

saturation, the nonlinear actuator was not modeled, and the destructive limit cycle oscillation 

shown did not involve rate limiting. In these models, the failure was induced by simulating an 

80-percent asymmetry in stabilator control surface effectiveness (control surface damage), an 

event that is completely unrelated to the Flight 3-65 accident.

9.0 Human Factors

From a human factors perspective, for Flight 3-65 the design of the pilot interface, the interaction 

of the pilot with the aircraft and with ground control, and the conduct of the program at the time 

of the accident were important aspects of the event and are addressed in detail in this section.

9.1 Critical Events

Figure 9.1-1 illustrates the timeline of the major events leading to the loss of the pilot and the 

aircraft, and diagrams the sequence of key events during the 3 minutes following the initial 

traverse probe electrical disturbance. Note that the timeline in Figure 9.1-1 ends at about 

10:34:17 PST (MET + 249 seconds), or about 37 seconds before breakup. The time history of 

the MH-96 AFCS gains is shown in Figure 9.1-2.

Beginning at 10:31:07 PST (MET + 59 seconds), the electrical disturbance caused erratic 

fluctuations in the automated gain control from maximum to minimum as seen in Figure 9.1-2,

which caused the pilot’s access to the RCS through the right side stick to be intermittent 

throughout the 2-minute, 46-second duration of the electrical disturbance.

At 10:31:00 PST (MET + 52 seconds), all three input gains to the aerodynamic controls were at 

their maximums so that the MH-96 had automatically enabled RCS inputs and the pilot’s right

side stick was operational at that point. Seven seconds later, the total gain of the three 

aerodynamic controls had decreased below 75 percent of its maximum, so access to the RCS was 

closed by the MH-96. From then on, the pilot’s right side stick RCS control was intermittent 

because of the erratic fluctuations in the automated gain controls due to the continuing electrical 

disturbance. The pilot was unable to detect the intermittent RCS control for nearly 3 minutes. 

Cockpit indicators showed that the engagement of the pitch and roll dampers was also 

intermittent during the electrical disturbance.

At 10:31:58 PST (MET + 110 seconds), the pilot reported the IFDS computer- and the 

instrument-malfunction lights had come on and could not be reset. Ground control 

acknowledged the pilot’s report.

At 10:32:09 PST (MET + 121 seconds), ground control instructed the pilot to perform the 

scheduled experiment of the computed Į/ȕ-check maneuver, which required the use of the 

display of IFDS computed Į and ȕ, even though the flight controller had acknowledged the 

pilot’s prior reports that the IFDS computer was malfunctioning.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

48 of 107

Figure 9.1-1. 3-65 Event Timeline

At 10:32:27 PST (MET + 138 seconds), the pilot reported that the pitch and roll dampers had 

tripped out.

Despite the indications of aircraft system malfunctions, ground control seemed unaware of the 

pilot’s severe situation. At 10:33:01 PST (MET + 173 seconds), the flight controller told the 

pilot that he was looking “real good.”

However, at 10:33:05 PST (MET + 177 seconds), the pilot apparently noticed for the first time 

the aircraft’s lack of responsiveness due to the intermittent, and ultimately the deactivation of, 

access to the RCS through the right side stick and switched to direct control bypassing the AFCS 

using the left side stick. Normally, the procedure for switching to direct manual control would 

have involved deactivating the RCS “auto” mode or disabling the MH-96, but the pilot did not 

execute this step and continued to try to perform the precision attitude-tracking task.

At 10:33:25 PST (MET + 197 seconds), the flight controller again assured the pilot that he was 

“a little bit high,” but “in real good shape.” 

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

49 of 107

However, 14 seconds later, at 10:33:39 PST (MET + 211 seconds) and about 240,000 feet, the 

pilot reported that the aircraft control seemed “squirrelly.” Twenty-two seconds later at 

10:34:01 PST (MET + 233 seconds), the pilot said, “I’m in a spin.” Ground control did not 

acknowledge either of these transmissions. The pilot repeated, “I’m in a spin,” at 10:34:16 PST 

(MET + 248 seconds). At 10:34:17 PST (MET + 249 seconds), the flight controller said, “Say 

again.” At 10:34:17 PST (MET + 249 seconds), the aircraft was in descent at 184,000 feet with 

a velocity of 5,100 fps. The aircraft would begin to break apart 37 seconds later.

Figure 9.1-2. AFCS Gain Variation during Flight 3-65

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

50 of 107

9.2 Causal and Contributing Factors

As in most accidents, the destruction of the X-15-3 during Flight 3-65 was due to a confluence of 

latent and proximate factors. This review of the events from the human factors perspective 

identified latent, proximate causal, and contributing factors. The contributing factors were those 

that exacerbated the causal factors. Although unlikely, it is conceivable that if certain 

contributing factors had not been present, then the pilot might have been able to recover control 

of the aircraft and effect a safe landing.

9.2.1 Causal Factors

A latent causal factor in the Flight 3-65 accident was the installation of experimental equipment 

(i.e., the apparatus for the traversing-probe experiment) without adequate certification. The 

consequences of the traversing-probe motor arcing on Flight 3-65 show that the procedures for 

designing and testing X-15 experimental flight equipment were incomplete.

A proximate causal factor was the confluence of aircraft subsystem failures and of ground 

control to alert the pilot to the possibility of control problems and of erroneous data as soon as 

indications of malfunctions were observed. The AFCS design, the pilot’s interface, and the 

ground control procedures contributed to the pilot’s illusion that his aircraft was operating 

properly during almost 3 minutes when the electrical systems were malfunctioning. The pilot 

and ground control should have recognized that the inability to reset the IFDS computer and 

instrument malfunction lights was an indication of a major subsystem failure, but it seems the 

system (including the pilot and ground control) tended not to consider the IFDS to be critical. 

While there was an indicator of the failure of the IFDS computer on the pilot’s display and while 

the MH-96 could detect and alert the pilot to numerous types of major component failures, there 

was no display to indicate that the MH-96 gain control was erratic. If the pilot had been alerted 

so that he could have changed to direct manual control and reverted to the fixed-gain mode of the 

MH-96 in a timely manner (e.g., when ground control observed indications of control problems 

during the wing-rock maneuver), then he may have been able to recover control. Therefore, the 

failure of the system to alert the pilot to the problem in the aircraft’s control and displays was a 

causal factor in the accident.

The failure in the system design was that there were no provisions for alerting the pilot to the 

erratic behavior of the automated flight control system, or to the erroneous information on 

aircraft Į, ȕ, altitude, and altitude rate generated by the malfunctioning IFDS computer. Also, 

the intermittent aspect of the access through the AFCS to the RCS, which is an inherently 

on/off system, caused the pilot to assume that the system was operating properly for several 

minutes. As the AIB report [ref. 3] states, access to the automated RCS was “propitiously” 

operating during the few brief instants when the pilot moved the right side stick control as he 

performed the first two tasks (i.e., the wing-rock maneuver and the computed Į/ȕ-check 

maneuver) and as he initiated the precision attitude tracking task. The report states:

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

51 of 107

Since the MH-96 provides no visual indication to the pilot of reaction control 

system status, i.e., whether or not the system has been automatically selected, the 

pilot must rely on being able to detect rocket operation by sound, visual exhaust 

observation, or control response to determine if the reaction controls have been 

properly selected. Since no attitude-rocket firing occurred during the initial 

11-second engage time of the MH-96 reaction controls on Flight 3-65, it would 

have been virtually impossible for the pilot to detect that the system had 

automatically engaged and then disengaged 11 seconds later.

Consequently, with no visual display of the failure, there was little possibility the pilot would 

have recognized the intermittency of his control based solely on aircraft response.

Ground control was a contributor to this proximate causal factor because its primary principle 

was not followed. The AIB report states:

The philosophy associated with X-15 research flights is to discontinue the 

research objectives when aircraft malfunctions impair safe recovery of the 

aircraft or when the pilot has become so overloaded with aircraft malfunctions 

and/or experiment tasks that he is unable to do either.

This is the proper philosophy for flight-testing, but did not appear to have been effectively 

implemented during Flight 3-65.

The AIB report states that ground control did not have access to all the information needed for 

effective and timely problem detection. If this was the case, then ground control was unable to 

perform its primary function of protecting pilot and aircraft safety in accordance with the 

philosophy the AIB had noted. It is hard to understand why the status of the critical automated 

RCS was not being monitored on the ground, whereas the aerodynamic control system 

servomotors were being monitored. The MH-96 AFCS should have been viewed as 

experimental equipment. In its key role as safety backup to the pilot in such an experimental 

flight, all critical flight information should be available to ground control regardless of whether 

or not it is available to the pilot.

However, regardless of the lack of certain key information, ground control had substantial 

evidence of Flight 3-65 problems. The continuing fluctuations in the telemetered data with the 

indications of the IFDS malfunction should have been sufficient evidence of problems to status 

the pilot and potentially abort the mission. Within 80 seconds after the start of the electrical 

disturbance, ground control had several indicators of serious aircraft problems. These include:

x At 10:31:07 PST (MET + 59 seconds), the telemetered data became and remained erratic

for several minutes. For example, ground control was aware of continuing anomalous 

servo transients from these telemetered data. The AIB report states:

The transient motion of the three servos was not due to pilot inputs or aircraft 

motion, but was apparently electrical and was of sufficient frequency content and 

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

52 of 107

amplitude to drive all three control gains well below their normal values for the 

particular flight conditions at which it occurred. The gain reduction in all three 

channels was great enough to cause the primary reaction controls to 

automatically disengage.

x Starting at 10:31:07 (MET + 59 seconds), the telemetered data on altitude and velocity 

differed from the radar data and was noted by ground control personnel.

x At 10:31:58 (MET + 110 seconds), the pilot reported the IFDS computer and instrument 

malfunction lights were on. The flight controller acknowledged the pilot’s report.

x About 20 seconds later, during the wing-rock maneuver, a member of the ground control 

team reported to the flight controller that the pilot was having a control problem based on 

his observations of larger than normal pitch-roll servo excursions.

x Simultaneously, the telemetered indication of ȕ data, which was monitored by the flight 

controller, was observed to deviate to off-scale nose right indicating the aircraft had 

undergone a large heading deviation.

x At 10:32:26 (MET + 138 seconds), disengagement of the pitch and roll dampers was 

reported by the pilot and acknowledged by the flight controller.

The proactive approach to safety is to advise the pilot of a problem as soon as there is any 

indication of that possibility. Such a warning is mandatory even if it may be redundant. The 

failure of ground control to notify the pilot of a possible control problem as soon as they had a 

suspicion of a problem was a causal factor in the loss of Flight 3-65.

Moreover, throughout the flight, ground control continuously assured the pilot that he was on the 

planned flight profile and instructed him to proceed with planned experiments despite the 

evidence of problems. Not only did ground control potentially delay the pilot’s recognition of 

the problem and cause him to discount the computer and instrument malfunction lights and the 

disengagement of the pitch and yaw dampers, but they also added to the pilot’s workload by 

instructing him to execute the experiments rather than focus on the problem. For example:

x During the wing-rock maneuver, it became apparent to ground personnel monitoring the 

telemetry records that something was amiss with the aircraft control. Nevertheless, the 

flight controller instructed the pilot to continue with the computed Į/ȕ-check maneuver. 

This experiment was a part of a continuing study to determine the highest altitude at 

which the ball-nose display could be considered reliable by comparing its indications of 

Į and ȕ with the values calculated by the IFDS computer. Ground control knew the 

IFDS computer was malfunctioning and there was a control problem, yet the pilot was 

instructed to proceed with this experiment that relied on the IFDS computed Į and ȕ.

After 190 successful flights, the ground control personnel for Flight 3-65 may have become 

complacent and may have chosen to ignore the reported evidence of a problem onboard the 

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

53 of 107

aircraft. The flight controller appears to have been unable to recognize the integrated 

significance of the several indications of problems that were reported by the pilot and groundcontrol personnel. Evidence of this failure is in the following testimony reported by the AIB 

[ref. 3]. A member of ground control during Flight 3-65 testified:

“The first problem indication was the computer malfunction light call from the pilot. 

I did not hear him call reset. The next thing was pitch-roll damper dropout, and reset. ...

With the apparent A/C problems I asked the controller to have the experiments closed.”

The flight controller did not request that the science objectives be terminated until at least 

2 minutes later, after the pilot had reported the development of a spin.

Another ground control member testified:

“Upon initiation of the planned roll maneuvers, the pilot appeared to have a roll 

control problem as evidenced by larger than normal pitch-roll servo excursions. 

.... stop to stop excursions continued on the pitch-roll servo traces. In addition, 

the ball nose ȕ indication moved off scale, showing the aircraft nose right. Ball 

nose Į and ȕ are not used for flight guidance during the ballistic portion of 

altitude flights.” 

The flight controller did not consider this evidence of continuing control problems. 

In addition, the flight controller continually assured the pilot that he was “on track” and “on 

heading.” The pilot and flight controller were aware that heading information could not be 

determined from radar track data. No display of heading information (e.g., telemetered IMU 

yaw data) was available in the control room. Although the ball nose data correctly indicated a 

large ȕ angle, it was discounted by the flight controller due to his past experience with unreliable 

ball-nose indications at low dynamic pressure [ref. 3]. 

For more than 2 minutes, until the pilot recognized that he had problems, ground control 

encouraged the pilot to operate the aircraft even though it was known that the control system was 

malfunctioning and that much of the displayed information on aircraft states was probably 

erroneous. These actions on the part of the flight controller and the ground control team were a 

causal factor in the accident.

9.2.2 Contributing Factors

During the nearly 3 minutes after the electrical arcing from the traversing probe that precipitated 

the events leading to the destruction of the X-15-3, there were several factors that exacerbated 

the causal factors. It is conceivable the pilot might have regained control of the aircraft and 

effected a safe landing had certain of these factors not prevailed at the time.

One contributing factor was the design that allowed a failure in the AFCS to interfere with the 

pilot’s ability to control the aircraft without any indication to the pilot of the failure other than a 

reliance on the pilot noticing a lack of response to his control inputs. In addition, each time the 

MH-96 adaptive gains were reset to minimums, either via external inputs or as a result of pilot 

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

54 of 107

action, there was a delay of several seconds before RCS could be reengaged so as to prevent 

startup transients if the adaptive channels were reset. While this aspect of the MH-96 design had 

merit for protection of the aerodynamic controls, the designers apparently failed to consider the 

negative impact of the delayed reengagement on controllability when the only control useful to 

the pilot was the RCS. The intermittency of this ineffectiveness was particularly insidious 

because, with no other signal of malfunction and the inherently on-off nature of RCS, the pilot’s 

recognition of the failure was obfuscated.

A second contributing factor was the complexity of the pilot’s interface to the MH-96. The

problem of understanding the functioning of the AFCS is exemplified by the following 

instructions in the pilot’s manual:

If the damper switches are down and the lights are out, power for the system is 

off. If the damper switches are down and the lights are on, the system is 

disengaged but in a state of readiness to be engaged. If the damper switches are 

up (DAMPER position) and the lights are out, the dampers are engaged. If the 

damper switches are up and the lights are on, only the fixed-gain portion of the 

dampers are engaged.

This type of design is conducive to human error. The procedure to switch from RCS control 

through the MH-96 to direct manual control was similarly complex. The pilot’s manual states 

that before the pilot switches to the left side stick for direct access to the RCS he must first turn 

off the MH-96 AFCS. Otherwise, the automated system would oppose the pilot’s commands. 

The pilot would be expected to take this action when he recognized that the AFCS has failed. 

When the MH-96 failed on Flight 3-65, the pilot would have had to rely on the aircraft response 

to recognize that the RCS was not being activated by his right side stick inputs. However, as was 

indicated and noted in the AIB report, the small control inputs required for the experiments and 

the intermittent effectiveness of control made it virtually impossible for the pilot to detect the 

failure. Further, had the pilot recognized that the AFCS was not functioning properly, it is 

questionable whether he could have identified and taken the necessary steps to disengage it under 

the stressful conditions and the aircraft motions that existed at the time he entered into the spin.

The procedure design did not take into account the operational context under which the 

procedure would be used.

A third contributing factor was the known tendency of the stability augmentation system to 

undergo large-amplitude limit cycle oscillation under some flight conditions. The possibility of 

this failure mode (having experienced it on a prior flight) should have resulted in a suspension of 

flight operations using the MH-96 until the design issue was resolved. While the previous failure 

incidence was of concern but caused no damage, in this case it destroyed the aircraft, leading to 

the loss of the pilot. Although this pitch control system instability resulted in the destruction of 

the X-15-3, it is considered a contributing factor because the instability would have been avoided 

if the pilot had disengaged the AFCS when he switched to direct manual control just prior to the 

spin.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

55 of 107

A fourth contributing factor was in the design of the pilot’s display that used the ADI in two 

different modes (i.e., normal mode and the PAI). Even though this instrument was flown 

successfully on previous X-15-3 flights, it was a fundamentally poor design from a human 

factors perspective. In its normal configuration, the horizontal and vertical needles of the ADI 

indicated Į and ȕ, respectively. When the ADI was switched to the PAI mode, the horizontal 

needle indicated the pitch angle, and the vertical needle indicated the roll angle. Using such a 

critical display in two different configurations without a clear and salient mode indication is 

conducive to mode confusion, especially when the pilot is under stress and high workload. The 

switch position was the only indication of the PAI mode.

A fifth contributing factor was that, during the time period and the altitudes at which most of the 

critical events occurred, information displayed came from the IFDS computer. The only other 

source, the ball nose, was known to be unreliable at these flight conditions. There was no 

provision for backup source of reliable information for the pilot at high altitude in case of failure 

of the IFDS computer.

When the dynamic pressure became less than about 50 psf, the normal procedure for the pilot 

was to push a switch on the display panel that changed the source of data for the Į and ȕ from the 

aerodynamic source of the ball nose to the IFDS computer. During Flight 3-65, the dynamic 

pressure fell below 50 psf at about 155,000 feet altitude at 10:31:35 PST (MET + 87 seconds),

by which time the IFDS computer had failed and the computer and instrument malfunction light 

had illuminated. Although the pilot did not make a verbal report, the post-accident examination 

of the cockpit film shows that after hesitating at the switch for several seconds he pushed the 

data-source switch as planned, despite the IFDS computer malfunction light. After switching the 

source, the ȕ indication was correctly indicating off-scale nose-right, but the Į information was 

erroneous. During Flight 3-65, the dynamic pressure did not increase above 50 psf until after the 

pilot reported he was in a spin. The cockpit film indicates that he never switched back to the 

aerodynamically driven source of aircraft data and may not have been able to switch once the 

aircraft entered into a spin.

Finally, the evidence in the AIB report was reviewed to ascertain what actions taken or not taken 

by the pilot during the critical 3 minutes may have been contributing factors in the X-15-3

accident.

It was not until 2 minutes after the access to the RCS through the right side stick had become 

intermittent that the pilot realized the aircraft was not responding to his inputs and switched to 

the left side stick control. Coincidentally, the controls worked when called upon during the 

wing-rock and the computed Į/ȕ-check maneuvers. This coincident response contributed to the 

deception that the controls were operating normally. It was not until the pilot was trying to 

maintain control for the precision attitude-tracking task that access to the RCS through the AFCS 

from his right side stick was determined to not be working. The delay in the pilot’s ability to 

recognize the failure contributed to the accident.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

56 of 107

The pilot failed to correct the error in yaw when he switched to direct RCS control through the 

left side stick. The AIB report attributes this failure to the pilot’s misinterpretation of the PAI 

after he earlier selected that mode for the ADI. However, the AIB report states:

Since it did not require excessive control inputs to keep the needle close to center, 

the pilot may not have realized his error until it was too late or he may never have 

realized his error, in that he could not or did not recognize any problem with his 

attitude control.

It is important the AIB recognized the pilot might not have been able to discern the aircraft had 

reached a large yaw error until he discovered that he had no control. The pilot’s failure to 

correct the yaw error, or his inability to detect it, contributed to the accident.

The evidence suggests the pilot forgot he was in the PAI mode when he switched to the left-hand 

stick RCS control. However, at the moment he switched control, he was performing the 

precision attitude-tracking task (Figure 9.2-1) and he continued to try to complete that task after 

he switched hands. It is difficult to believe that the pilot would have forgotten that he was in the 

PAI mode while he was in the process of performing the very maneuver for which the PAI mode 

was specifically designed.

The evidence indicates that the pilot did not disengage the MH-96 AFCS when he switched to 

the left side stick control. This was an important failure because the subsequent instability could 

have been avoided had the pilot had remembered to disengage the AFCS when he switched to 

direct manual control, and recovery from the dive might have been possible. While this action 

was practiced as part of the captive carry AFCS equipment checkout procedure, it does not 

appear on the Flight 3-65 radio transcript and may have been skipped to save time [ref. 3].

The pilot’s apparently impaired performance might be explained by the high stress and workload 

at the moment that he switched controls. By the time the pilot realized he had no control using 

the right side stick and changed to direct manual RCS control through the left side stick, he must 

have recognized that the aircraft had attained large attitude angles and angular velocities, the 

computer and instrument malfunction lights were on, and the displayed information was suspect. 

The pilot may have found himself trying to cope with an uncontrollable aircraft and questionable 

information just as he was starting into the critical descent phase. The aircraft was at an altitude 

at which the aerodynamic controls were ineffective and the AFCS was behaving erratically. 

Coping with these multiple problems could have demanded all of the pilot’s attention, possibly 

causing him to forget actions he had taken (e.g., switching the ADI mode to PAI) or should have 

taken (e.g., disengaging the AFCS).

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

57 of 107

Figure 9.2-1. Time History of Precision Attitude Tracking Task at Peak Altitude [ref. 3]

9.2.3 Alternative Hypotheses

The hypotheses appearing in this section are recognized as speculative and lack conclusive 

evidence but are provided since they cannot be discounted as possible contributing factors in the 

Flight 3-65 accident.

9.2.3.1 Hypoxia

A hypothesis considered by the AIB was that the pilot was hypoxic due to an unknown 

equipment malfunction [ref. 3]. The X-15 cabin was sealed, pressurized, and thermally regulated 

using gaseous nitrogen derived from the aircraft’s liquid nitrogen supply. The cabin temperature 

was maintained at a maximum of approximately 80 degrees Fahrenheit, and the cockpit and 

instrumentation bays were insulated to minimize heat transfer into the cockpit during high 

aerothermal loading conditions. A cabin pressure differential of 3.5 psi with respect to ambient

pressure was maintained by the cabin pressure regulator.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

58 of 107

By 1967, X-15 pilots wore a custom-fitted A/P22S-2 pressure suit containing anti-g bladders. 

The suit pressure and cockpit pressure were equalized, and breathing oxygen was supplied only 

to the face area by partitioning the helmet with a face seal. This design was primarily to mitigate 

the risk of fire associated with an oxygen-based cockpit pressurization system. Oxygen was 

supplied by self-contained seat-mounted bottles with a regulator that forced oxygen into the 

helmet at a differential pressure higher than the suit pressure, ensuring that normal breathing 

would not allow the pilot to inhale pressurization nitrogen. It was known that rapid deep 

inhalations could exceed the differential pressure maintained by the oxygen regulator and result 

in transient inhalation of nitrogen, and that pilots’ respiration rates increased precipitously during 

the boost phase [refs. 4 and 40].

It is possible that the pilot may have been experiencing hypoxia due to some equipment 

malfunction (e.g., a failure leading to low differential pressure) and that the situation may have 

been exacerbated during the boost phase as a result of rapid or deep breathing and increased 

stress. Limited testing was performed on the oxygen system components that survived the 

impact, and while the AIB concluded that those components had no direct evidence of failure, 

the pilot’s lactate levels were 10 percent higher than the threshold considered indicative of 

hypoxia at that time. However, results were inconclusive since several hours had elapsed before 

the laboratory analysis could be conducted [ref. 3].

9.2.3.2 Spatial Disorientation

A speculation of the AIB was the pilot’s susceptibility to Type-II spatial disorientation (SD),

which the AIB report refers to as “vertigo,” was a contributing factor in this accident. Despite 

the pilot’s and other X-15 pilots’ self-reported sensitivity to the somatogravic illusion during the 

boost phase, there is no direct evidence that the pilot’s performance was affected by SD during 

the boost phase and performance of the maneuvers, nor was there evidence that he was 

misinterpreting the PAI during these two experiments.

However, at the moment the pilot switched to direct manual control, he had just come “over the 

top” at about 266,000 feet and had been in a 0-g condition since the end of the engine burn. 

Under these circumstances, the pilot’s susceptibility to SD may have contributed to his forgetting 

to switch off the AFCS, especially as it seems he was still focused on completing the precision 

attitude-tracking task. As the AIB report states, “Vertigo [SD] could have coupled with the 

added workload of sorting the various malfunctions,” and perhaps caused his lack of recognition 

of the yaw attitude if he did in fact misinterpret the ADI in its PAI mode during his subsequent 

actions. Most of the pilot’s experience in the X-15 aircraft was with a normal ADI (i.e., with the 

vertical needle indicating yaw) when he used the left side stick for the RCS. When he switched 

to manual control, he was under stress and high workload, and it is a common human tendency 

under such conditions to revert to the basics in which one is most highly trained. Thus, the pilot 

may have mentally reverted to the normal ADI mode when he switched to manual control.

It is also possible the pilot was confused as to what to believe in the displays. Pilots are trained 

that the only way to overcome SD is to fly basic instruments and disregard the attitudes 

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

59 of 107

suspected by their physical senses. The pilot had been taught that the ball nose did not provide 

reliable information at dynamic pressures less than about 50 psf. He knew he had switched to 

the IFDS computer as the source of data to his displays when the panel display light indicated 

that he should do so, and he knew that the IFDS computer and instrument malfunction lights 

were on. However, the assurances from ground control and the instructions to perform 

experiments that relied on the IFDS computed data may have contributed to the confusion.

The AIB report states:

The pilot seemed unaware of a gross heading deviation in spite of three separate 

correctly reading instruments...He apparently was concentrating on a single 

instrument, the vertical needle of the ADI, as a pilot might do if he were trying to 

overcome vertigo [SD].

When some instruments are displaying erroneous information, it is difficult to determine which 

instruments are correct and which are not. When the pilot is focused on a specific instrument for 

the sake of the particular maneuver to be performed, other instruments receive lower priority.

With the added effect of the flight controller’s assurance the aircraft was “on heading,” the 

heading deviation may have gone unnoticed. Furthermore, tunneled attention and disregard for 

other displays, including audible alarms, are known tendencies of humans under high stress and 

workload, regardless of SD.

9.2.3.3 Egress System

Post-flight analysis of the aircraft emergency egress (ejection) system revealed the canopy 

jettison mechanism had been actuated at an altitude in excess of 60,000 feet and had operated 

abnormally. A detailed description of the anomalous canopy jettison activation appears in 

reference 3. The AIB noted that while it was contrary to the flight surgeon’s opinion, the 

physical evidence suggested that the pilot may have attempted to activate the ejection system and 

was unable to do so. A contributing factor may have been the pilot’s physical compatibility with 

the seat design:

One possibility would be that the pilot could have raised the ejection handles far

enough to fire the M-3 initiator [canopy jettison] but not far enough to fire the 

M-32 initiator [seat]... If the canopy jettison were the result of pilot action, which 

is contrary to medical opinion, the possibility that Major Adams was unable to 

complete the movement of the ejection handles to the locked position must be 

considered. It was known that Major Adams was large for the seat, and although 

he had successfully passed the egress training, he had some difficulty in moving 

the handles far enough to reach the locked position that must be attained for 

ejection to take place.

The noted difficulty in actuating the ejection mechanism [ref. 3] may have been amplified 

in a high-stress, time-critical situation.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

60 of 107

9.2.3.4 Pilot Training and Past Performance

The pilot was known to be an exceptionally proficient research pilot and had demonstrated his 

performance on a prior flight when a failed propulsion system mandated an emergency landing 

[ref. 4]. However, while the pilot was adequately qualified for the operation of the X-15-3, it is 

undoubtable that the additional complexity of the human-machine interface in the X-15-3 versus 

the other two aircraft contributed to the pilot’s apparent negative transfer that he exhibited under 

a high-workload and high-stress situation. Furthermore, the pilot had not, unlike more 

experienced pilots, been directly involved in the development and test of the experimental flight 

control system. Finally, the majority of the pilot’s flight and training experience was in the 

X-15-1 aircraft with conventional controls and instrumentation panel. Only 20 percent of his 

logged simulator time was flown in the X-15-3 configuration (Table 9.2-1).

Table 9.2-1. Pilot Flight and Simulator Experience

Flight Experience Simulator Experience

Flight Flight No. Airframe Date Airframe Logged Hours Fraction

(percent)

173 1-69-116 56-6670 (#1) October 6, 1966 56-6670 (#1) 165.2 ~69

176 3-57-86 56-6672 (#3) November 29, 

1966 56-6671 (#2) 25.5 ~11

177 1-70-119 56-6670 (#1) March 22, 1967 56-6672 (#3) 47.5 ~20

179 1-71-121 56-6670 (#1) April 28, 1967

182 1-72-125 56-6670 (#1) June 15, 1967

187 3-62-92 56-6672 (#3) August 25, 1967

191 3-65-97 56-6672 (#3) November 15, 

1967

10.0 Findings, Observations, and NESC Recommendations

The analysis of the fatal accident of X-15-3 Flight 3-65 has highlighted several recurring themes 

in the complex scenario leading to and during the flight that resulted in the loss of life. As is 

often the case in aerospace vehicle accidents, a confluence of latent failure modes and 

sensitivities was compounded by the unique flight circumstances. It is plausible that had one or 

more of these factors been mitigated prior to the flight, the accident would not have occurred or 

would have resulted in a serious but nonfatal mishap. The major themes contributing to the 

accident were:

1. Insufficient focus on characterizing risks associated with subsystem-level interactions.

2. Continued flight operations in the face of multiple unexplained system anomalies.

3. Inadequate documentation, communication, and analysis of failure effects.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

61 of 107

4. Ineffective design for human-machine integration.

5. Development of a complacent culture surrounding experimental systems and flight test 

operations. 

Specific findings, observations, and NESC recommendations are detailed in the following 

subsections.

10.1 Findings

The following findings were identified:

F-1. The X-15 3-65 accident was precipitated by an electrical failure in an experiment 

package using COTS components that had not been properly qualified for the X-15 flight 

environment. 

x The electrical isolation mechanism for the experiment package (line fuses) did not 

adequately protect the aircraft main power bus. The ensuing electromagnetic 

interference effects caused numerous subsystem failures, interrupted pilot access to 

the RCS, and led to an eventual loss of control.

F-2. The pilot’s inability to recognize and isolate the subsystem failures and safely regain 

control of the aircraft was largely caused by the lack of adequate display of safety-critical 

information to the pilot and to ground control, lack of communication of the status of the 

aircraft to the pilot, excessive reliance on the autonomy of the pilot, lack of redundant 

pilot information displays, and the flight controller’s decision to continue with the 

mission despite multiple indications that the safety of flight was compromised.

F-3. A principal cause of the aircraft destruction was a large-amplitude divergent limit cycle 

oscillation in the MH-96 AFCS caused by a latent design error in the structural notch 

filter that did not account for the nonlinear behavior of the X-15 servoactuator under rate 

saturation when coupled with the lightly damped aircraft longitudinal mode at high Mach 

numbers.

F-4. The high-gain nature of the MH-96 AFCS, in which it would operate at or near the 

critical stability limit, decreased robustness to unmodeled nonlinearities and parametric 

uncertainty and accelerated the onset of the divergent limit cycle oscillation.

F-5. By the time of its deployment, the MH-96 had undergone multiple modifications to 

compensate for operational factors not accounted for in its initial concept designs that 

reduced its overall performance and robustness below that of its theoretically ideal 

operating characteristics. 

x These factors included the pilot interface, hysteresis effects, structural flexibility, and 

servoelasticity. There is no evidence to suggest that the effects of these modifications 

were verified analytically against the original design models or that design models 

were updated to reflect observed flight behavior.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

62 of 107

F-6. Loss of control was compounded by pilot actions resulting from some combination of 

mode confusion, attentional tunneling, negative transfer, and possibly hypoxia and SD.

F-7. A major contributor to the loss of control was a poor human interface design of the 

X-15-3 aircraft, consisting of (1) lack of clear and salient mode indication on flightcritical instruments, (2) a complex and counterintuitive interface, and (3) design such that 

the automated flight control system could interrupt access to the pilot’s only control 

effector without notifying the pilot. 

F-8. The successful deployment of an experimental AFCS in an operational mission mode led 

to a dilution of the perceived risks associated with its use and prevented the pilot and 

ground controllers from recognizing and isolating its failure before the destruction of the 

aircraft was inevitable.

F-9. Failure detection features of the MH-96 AFCS that were designed to improve reliability, 

when exercised outside their intended design envelope, malfunctioned and caused 

degraded performance, which contributed to the loss of control.

F-10. Of the five major subsystem failures contributing to the accident, three (i.e., the IFDS 

computer failure, the servo transient anomaly, and the MH-96 limit cycle) had shown 

some evidence of failure on previous flights. 

x The program’s decision to continue flight operations without assessing risk and 

identifying the root cause(s) of these anomalies was a causal factor in the 3-65

accident.

10.2 Observations

O-1. The effectiveness and availability of ground control to assist flight crews in diagnosing 

and troubleshooting subsystem anomalies can be compromised due to operational aspects 

of the flight profile. 

x For example, known flight regimes with poor radio communication can limit ground

control situational awareness; critical maneuvers and dynamic events that occur on 

short timescales (e.g., ballistic atmospheric reentry) lend insufficient time for action.

O-2. Complete or near-complete reliance on a flight crew to troubleshoot and resolve 

subsystem anomalies in a complex experimental system carries excessive risk. 

x This is especially true in single-pilot operation and even more so in flight regimes that 

have extremely demanding, time-critical piloting tasks.

O-3. Ballistic space planes are more susceptible to electrical arcing in high-voltage 

components than aircraft, launch vehicles, or spacecraft due to the extended time spent in 

the critical pd region.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

63 of 107

O-4. The use of COTS components and subsystems in aerospace vehicle designs is 

accompanied by the risk that an unknown design element of the component or subsystem 

may interact negatively with other subsystems.

O-5. Actuator nonlinearity, especially rate limiting, continues to play a role in the introduction 

of latent instabilities in flight control systems that become apparent in high-gain modes of 

operation and with large commands. 

x Such high-gain modes may arise due to high pilot gain (e.g., PIO) or high control 

system gain. Such conditions are generally associated with off-nominal scenarios 

involving large or abrupt maneuvers and may not have been fully exercised in 

simulations.

10.3 NESC Recommendations

The following NESC recommendations are directed to the Human Exploration and Operations 

Mission Directorate:

R-1. Minimize the use of high-voltage electronics, and especially AC potentials, to the greatest 

extent possible. (F-1)

x In particular, systems with peak potentials exceeding 100V should be scrutinized to 

ensure that the design is not at risk of corona discharge or breakdown. Environmental 

qualification of high-voltage components for the target environment is mandatory and 

should include testing at simulated flight conditions when practicable. Departures 

from the assumptions of the ideal breakdown theory and the implications of violating 

these assumptions should be rigorously assessed. These include, but are not limited 

to, frequency, wave shape, gas composition and temperature, external radiation, 

contamination, and electrode composition. Assessed risk should be used to inform 

the scope of detailed analysis, simulation, and test activities. 

R-2. Qualify all experimental equipment for the target environment, even if it is electrically 

and mechanically isolated from safety-critical systems. (F-1)

R-3. Rigorously analyze the reliability and efficacy of electrical isolation and grounding 

schemes to ensure malfunctioning equipment cannot cause cascaded electrical failures.

(F-1)

R-4. Thoroughly understand the implications of using COTS components in a system. (F-1)

x System integrators should assess COTS designs in detail and structure vendor 

requirements such that potentially safety-critical design information is not withheld.

x The risks of accelerated and/or limited flight qualification of COTS components have

been highlighted in other recent assessments by the NESC [refs. 41–44].

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

64 of 107

R-5. Explicitly account for saturation and rate limiting behavior to the greatest extent possible

in flight control system analysis and design. (F-3, F-5)

x Simulations and, when practical, incremental flight testing must exercise regions 

outside the expected flight envelope, to include specific cases that induce nonlinear 

behavior.

x The value of nonlinear simulations can be greatly enhanced by companion 

approximation methods for assessing linear and nonlinear system stability, for 

example, describing function analysis.

R-6. Carefully weigh the benefits and risks of advanced flight control with the cost and 

schedule impacts required to decrease uncertainty in the design models through highfidelity modeling, element testing, or incremental flight testing and post-flight validation.

(F-3, F-4, F-5, F-8)

x Adaptive control is most applicable when system dynamics change in a rapid and 

uncertain way and the environment is potentially uncertain and/or unpredictable. 

Adaptive control should be employed when relevant and warranted by fundamental 

limitations in the predictability or measurability of the system to be controlled.

x In some cases, the use of a conventional flight control algorithm with improved 

design models and/or high-reliability flight instrumentation (e.g., air data systems) 

may provide equivalent performance to an adaptive system and may have behavior 

that is more easily predictable and analytically tractable.

R-7. Conduct training of research pilots for experimental systems using piloted simulations, 

especially with respect to off-nominal scenarios and emergency situations, in a simulated 

cockpit environment that is functionally identical to that of the flight vehicle so as to 

minimize the likelihood of negative transfer. (F-6)

R-8. Ensure priority of pilot and ground control in the event of an anomaly be placed on 

restoring the aircraft to a safe state, which may require the immediate cessation of science 

objectives. (F-2, F-6, F-7)

R-9. Identify possible subsystem malfunctions prior to flight and categorically assign mission 

rules based upon their relative severity to assist controllers and flight crews in 

recognizing and diagnosing failures. (F-2, F-8, F-9, F-10)

R-10. Maintain, to the greatest extent possible, adequate telemetry coverage and voice 

communication with the flight crew. (F-2, F-6)

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

65 of 107

x Risk assessments should dictate requirements for mission planning that minimize the 

duration of exposure to flight regimes in which access to ground assistance is 

impeded.

R-11. Enable ground controllers access to all information on the aircraft systems status needed 

to perform their primary responsibility of maintaining safety of operation. (F-2, F-6,

F-7)

R-12. Ensure that ground controllers inform flight crews on the state of the aircraft and its 

subsystems. (F-2, F-6, F-7, F-8)

x Anomalies that may have any significance to the safe operation of the aircraft should 

be immediately reported to the flight crew.

R-13. Preclude an automated system, the failure of which would compromise the safety and/or 

the operability of the aircraft, from relying on a single source of aircraft or environmental 

data for computation of its automated actions. (F-2, F-9)

R-14. Immediately notify the pilot of a flight control system failure. (F-2, F-6, F-7, F-9)

x If manual control is possible, then any failure must not interfere with the pilot’s

manual and direct aircraft control.

R-15. Reconcile modifications with the baseline design methodology if the control system is 

altered to improve the behavior of a fielded design. (F-3, F-5, F-8)

x If the design process is found to be deficient or poorly correlated with flight, then 

these deficiencies should be resolved and properly documented.

R-16. Design automation to provide for effective dynamic cooperation between the human and 

the nonhuman agents responsible for operating any complex system. (F-2, F-6, F-7, F-8,

F-9)

R-17. Ensure the active mode is clearly and saliently indicated, preferably on the relevant 

display itself, to minimize mode confusion if a critical display is used in two different 

configurations. (F-6, F-7)

R-18. Suspend flight operations to assess risk in the event that unexplained anomalies or 

uncharacterized failure modes occur during flight-testing of safety-critical systems.

(F-10)

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

66 of 107

11.0 Alternate Viewpoint

There were no alternate viewpoints identified during the course of this assessment by the NESC 

team or the NRB quorum.

12.0 Other Deliverables

No unique hardware, software, or data packages, outside those contained in this report, were 

disseminated to other parties outside this assessment.

13.0 Lessons Learned

No applicable lessons learned were identified for entry into the NASA Lessons Learned 

Information System (LLIS) as a result of this assessment.

14.0 Recommendations for NASA Standards and Specifications

No recommendations for NASA standards and specifications were identified as a result of this 

assessment.

15.0 Definition of Terms 

Corrective Actions Changes to design processes, work instructions, workmanship practices, 

training, inspections, tests, procedures, specifications, drawings, tools, 

equipment, facilities, resources, or material that result in preventing, 

minimizing, or limiting the potential for recurrence of a problem. 

Finding A relevant factual conclusion and/or issue that is within the assessment 

scope and that the team has rigorously based on data from their 

independent analyses, tests, inspections, and/or reviews of technical 

documentation.

Lessons Learned Knowledge, understanding, or conclusive insight gained by experience 

that may benefit other current or future NASA programs and projects.

The experience may be positive, as in a successful test or mission, or 

negative, as in a mishap or failure.

Observation A noteworthy fact, issue, and/or risk, which may not be directly within the 

assessment scope, but could generate a separate issue or concern if not 

addressed. Alternatively, an observation can be a positive 

acknowledgement of a Center/Program/Project/Organization’s operational 

structure, tools, and/or support provided.

Problem The subject of the independent technical assessment.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

67 of 107

Proximate Cause The event(s) that occurred, including any condition(s) that existed 

immediately before the undesired outcome, directly resulted in its 

occurrence and, if eliminated or modified, would have prevented the 

undesired outcome.

Recommendation A proposed measurable stakeholder action directly supported by specific 

Finding(s) and/or Observation(s) that will correct or mitigate an identified 

issue or risk.

Root Cause One of multiple factors (events, conditions, or organizational factors) that 

contributed to or created the proximate cause and subsequent undesired 

outcome and, if eliminated or modified, would have prevented the 

undesired outcome. Typically, multiple root causes contribute to an 

undesired outcome.

Supporting Narrative A paragraph, or section, in an NESC final report that provides the detailed 

explanation of a succinctly worded finding or observation. For example, 

the logical deduction that led to a finding or observation; descriptions of 

assumptions, exceptions, clarifications, and boundary conditions. Avoid 

squeezing all of this information into a finding or observation

16.0 Acronym List

Į Angle of Attack

ȕ Sideslip Angle

AC Alternating Current

ADI Attitude Director Indicator

AFCS Adaptive Flight Control System

AFRC Armstrong Flight Research Center

AIB Accident Investigation Board

APU Auxiliary Power Unit

BCS Ballistic Control System

COTS Commercial off the Shelf

DC Direct Current

DFRC Dryden Flight Research Center

FRC Flight Research Center

GN&C Guidance, Navigation, and Control

HWIL Hardware in the Loop

Hz Hertz

IFDS Inertial Flight Data System

IMU Inertial Measurement Unit

LCO Limit Cycle Oscillation

MET Mission Elapsed Time

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

68 of 107

MSFC Marshall Space Flight Center

NESC NASA Engineering and Safety Center

PAI Precision Attitude Indicator

pd Pressure and Gap Distance

PIO Pilot-induced Oscillation

PST Pacific Standard Time

RAS Reaction Augmentation System

RCS Reaction Control System

RRA Range Reference Atmosphere

SAS Stability Augmentation System

SD Spatial Disorientation

SLS Space Launch System

USAF United States Air Force

USN United States Navy

TDT Technical Discipline Team

V Volts

17.0 References

1. Lindahl, J., McGuire, W., and Reed, M.: “Advanced Flight Vehicle Self-Adaptive Flight 

Control System, Part V: Acceptance Flight Tests,” WADD-TR-60-651, Part V, Flight 

Control Laboratory, Aeronautical Systems Division, USAF Systems Command, May 1963.

2. Mellen, D.: “The Development and Flight Test of an Adaptive Flight Control System for the 

X-15 Vehicle,” Technical Report, Minneapolis-Honeywell, February 1963.

3. Bellman, D. et al.: “Investigation of the Crash of the X-15-3 Aircraft on November 15, 

1967,” NASA Flight Research Center, January 1968.

4. Jenkins, D.: “X-15: Extending the Frontiers of Flight,” NASA SP-2007-9-001-HQ, 2007.

5. Holleman, E.: “Control Experiences of the X-15 Pertinent to Lifting Entry,” NASA TN 

D-3262, NASA Flight Research Center, February 1966.

6. Thompson, M. and Welsh, J.: “Flight Test Experience with Adaptive Control Systems,” 

Advanced Control Systems Concepts, AGARD Conference Proceedings, No. 58, pp. 141-147,

January 1970.

7. Dydek, Z.: “Guaranteed Margins and Performance for an Adaptive Flight Control System 

and Application on the X-15 Research Airplane,” Master’s Thesis, Massachusetts Institute of 

Technology, 2007.

8. Dydek, Z., Annaswamy, A., and Lavretsky, E.: “Adaptive Control and the NASA X-15

Program: A Concise History, Lessons Learned, and a Provably Correct Design,” in 

Proceedings of the American Control Conference, Seattle, Washington, 2008.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

69 of 107

9. Jenkins, D.: “Hypersonics before the Shuttle: A Concise History of the X-15 Research 

Airplane,” NASA SP-2000-4518, 2000.

10. Stillwell, W.: “X-15 Research Results,” NASA SP-60, 1965.

11. Burke, M.: “X-15 Analog and Digital Inertial Systems Flight Experience,” NASA TN 

D-4642, July 1968.

12. Maher, J., Ottinger, C., and Capasso, V.: “YLR99-RM-1 Rocket Engine Operating 

Experience in the X-15 Aircraft,” NASA TN D-2391, NASA Flight Research Center, July 

1964.

13. Wiswell, R.: “X-15 Propulsion System,” in Proceedings of the 33rd Joint Propulsion 

Conference and Exhibit, AIAA, July 1997.

14. Proceedings of the X-15 First Flight 30th Anniversary Celebration, NASA CP-3105, 1989.

15. Sanderson, K.: “The X-15 Flight Test Instrumentation,” NASA TM X-56000, NASA Flight 

Research Center, April 1964.

16. Mellen, D., Cole, G., and Lindahl, J.: “Advanced Flight Vehicle Self-Adaptive Flight Control 

System, Part II: Design of MH-96 System,” WADD-TR-60-651, Part II, Flight Control 

Laboratory, Wright Air Development Division, USAF Air Research and Development 

Command, February 1961.

17. Fischel, J. and Webb, L.: “Flight-Informational Sensors, Display, and Space Control of the 

X-15 Airplane for Atmospheric and Near-Space Flight Missions,” NASA TN D-2407, 

NASA Flight Research Center, 1964.

18. Holleman, E.: “Piloting Performance during the Boost of the X-15 Airplane to High 

Altitude,” NASA TN D-2289, NASA Flight Research Center, April 1964.

19. Holleman, E.: “Summary of High-Altitude and Entry Flight Control Experience with the X15 Airplane,” NASA TN D-3386, NASA Flight Research Center, April 1966.

20. Schultz, P., Soufl, C., and Grubin, C.: “A Boost Guidance Scheme for the Dyna-Soar 

Mission,” SSD-TDR-63-336, Systems Research and Planning Division, The Aerospace 

Corporation, December 1963.

21. Cockayne, W.: “Description of an Energy Management System for the X-15,” NASA CR96006, NASA Flight Research Center, June 1968.

22. Cary, J. and Keener, E.: “Flight Evaluation of the X-15 Ball-Nose Flow-Direction Sensor as 

an Air-Data System,” NASA TN D-2923, NASA Flight Research Center, July 1965.

23. Wolowicz, C. and Gossett, T.: “Operational and Performance Characteristics of the X-15

Spherical, Hypersonic Flow-Direction Sensor,” NASA TN D-3070, NASA Flight Research 

Center, November 1965.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

70 of 107

24. Tremant, R.: “Operational Experiences and Characteristics of the X-15 Flight Control 

System,” NASA TN D-1402, December 1962.

25. Jarvis, C. and Adkins, E.: “Operational Experience with X-15 Reaction Controls,” NASA

TM X-56002, NASA Flight Research Center, April 1964.

26. Day, R.: “Coupling Dynamics in Aircraft: A Historical Perspective,” NASA SP-532, NASA 

Dryden Flight Research Center, 1997.

27. Jarvis, C. and Lock, W.: “Operational Experience with the X-15 Reaction Control and 

Reaction Augmentation Systems,” NASA TN D-2864, NASA Flight Research Center, June 

1965.

28. Boskovich, B., Cole, G., and Mellen, D.: “Advanced Flight Vehicle Self-Adaptive Flight 

Control System, Part I: Study,” WADD-TR-60-651, Part I, Flight Control Laboratory, 

Wright Air Development Division, Air Research and Development Command, USAF, 

September 1960.

29. Lindahl, J., McGuire, W., and Reed, M.: “Advanced Flight Vehicle Self-Adaptive Flight 

Control System, Part VII: Final Report on Study, Development, and Test of the MH-96

System for the X-15,” WADD-TR-60-651, Part VII, Air Force Flight Dynamics Laboratory, 

Research and Technology Division, USAF Systems Command, December 1963.

30. Meek, J. and Craggs, J.: Electrical Breakdown of Gases, Oxford, 1953.

31. Sutton, J. and Stern, J.: “Spacecraft High-Voltage Power Supply Construction,” NASA TN 

D-7948, NASA Goddard Space Flight Center, April 1975.

32. Dunbar, W. and Seabrook, J.: “High Voltage Design Guide for Airborne Equipment,” 

AFAPL- TR-75-41, Air Force Aero-Propulsion Laboratory, June 1976.

33. “Experience with the X-15 Adaptive Flight Control System,” NASA TN D-6208, NASA 

Flight Research Center, 1971.

34. Taylor, L. and Smith, J.: “An Analysis of the Limit-Cycle and Structural-Resonance 

Characteristics of the X-15 Stability Augmentation System,” NASA TN D-4287, NASA 

Flight Research Center, December 1967.

35. Reed, M., Wolfe, J., and Mellen, D.: “Advanced Flight Vehicle Self-Adaptive Flight Control 

System, Part IV: Notch Filter Development,” WADD-TR-60-651, Part IV, Flight Control 

Laboratory, Aeronautical Systems Division, USAF Systems Command, June 1962.

36. Klyde, D. and Mitchell, D.: “Investigating the Role of Rate Limiting in Pilot-Induced

Oscillations,” J. Guidance, Control, and Dynamics, Vol. 27, No. 5, 2004, pp. 804–813.

37. Yancey, R.: “Flight Measurements of Stability and Control Derivatives of The X-15 

Research Airplane to a Mach Number of 6.02 and an Angle of Attack of 25 Degrees,” NASA

TN D-2532, NASA Flight Research Center, November 1964.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

71 of 107

38. Taylor, L.: “Recent X-15 Flight Test Experience with the MH-96 Adaptive Control System,” 

in Intercenter Technical Conference on Control, Guidance, and Navigation Research for 

Manned Lunar Missions, NASA TM X-14568, July 1962.

39. Dydek, Z., Annaswamy, A., and Lavretsky, E.: “Adaptive Control and the NASA X-15-3

Flight Revisited,” IEEE Control Syst. Mag., Vol. 30, No. 3, June 2010, pp. 32–48.

40. Bratt, H. R.: “Biomedical Aspects of the X-15 Program 1959–1964,” Technical Report No. 

55-24, Air Force Flight Test Center, Edwards AFB, CA, August 1965.

41. “SpaceX Dragon Power and Avionics Review,” NESC Assessment TI-14-00949, final report 

in progress.

42. “Implementation Case Study of Electronic Components in Safety-critical Avionics Systems,” 

NESC-RP-13-00850, June 26, 2014.

43. “Use of Commercial Electrical, Electronic, and Electromechanical (EEE) Parts in NASA’s 

Commercial Crew Program,” NESC-RP-12-00762, March 15, 2012. Also published as 

NASA/TM-2012-217558, April 2012.

44. “The Use of Commercial-off-the-Shelf (COTS) Electronic Components in Safety-critical 

Human-rated (Commercial Crew) Space Avionics Systems,” NESC-RP-12-00759, February 

27, 2014. Also published as NASA/TM-2014-218261, May 2014.

18.0 Appendices

Appendix A. Analysis of the MH-96 Adaptive Flight Control System

Appendix B. Reconstructed Flight Data

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

72 of 107

Appendix A. Analysis of the MH-96 Adaptive Flight Control 

System

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

73 of 107

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

74 of 107

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

75 of 107

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

76 of 107

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

77 of 107

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

78 of 107

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

79 of 107

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

80 of 107

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

81 of 107

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

82 of 107

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

83 of 107

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

84 of 107

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

85 of 107

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

86 of 107

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

87 of 107

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

88 of 107

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

89 of 107

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

90 of 107

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

91 of 107

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

92 of 107

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

93 of 107

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

94 of 107

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

95 of 107

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

96 of 107

Appendix B. Reconstructed Flight Data

Flight data from X-15 Flight 3-65 appearing in this appendix were reconstructed from a 

photocopy of the original strip chart recordings (see Figure B-1) appearing in the 1968 AIB 

report [ref. 3]. As can be expected with data of poor quality, it is subject to some uncertainty and 

contains a number of filtering artifacts. It is, however, the best available representation of the 

aircraft states known to the authors.

Where data are lacking or incomplete in the original report, the data were reconstructed based on 

assumed atmospheric properties. Unfortunately, the trajectory parameters appearing in the report 

do not indicate which range reference atmosphere (RRA) was used for the reconstruction or the 

sources for the vehicle’s Earth-relative velocity magnitude (composite range radar estimates are 

assumed). As a result, Mach number and dynamic pressure (ݍത) are estimated from other vehicle 

states assuming a quiescent 1976 Standard Atmosphere model.

Figure B-1. Example of Original Strip Chart Recording

Data were time correlated by cross reference to key events appearing in Appendix K of 

reference 3 combined with a re-timing analysis of the digitized cockpit film. To generate plots 

(Figures B-2 through B-6), data were extracted from the original graphics via image processing,

then interpolated and uniformly sampled at 10 Hz. The data were noise filtered with a zerophase (forward-backward) second-order low pass filter (fc = 1 Hz, ȗ = 0.707). MET is referenced 

to ignition occurring at 10:30:08 PST on November 15, 1967.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

97 of 107

Figure B-2. Flight 3-65 Aerodynamic Angles

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

98 of 107

Figure B-3. Flight 3-65 Altitude and Mach Number

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

99 of 107

Figure B-4. Flight 3-65 Axial and Normal Acceleration

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

100 of 107

Figure B-5. Flight 3-65 Attitude Angles (Earth relative, ȥ = 0 true North; 

magnetic variation 16° E)

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

101 of 107

Figure B-6. Flight 3-65 Earth-relative Velocity Magnitude and Dynamic Pressure

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

102 of 107

The X-15-3 aircraft carried three 16-mm film cameras, one of which was attached to the inside 

of the pilot canopy (Figure B-7) and took photographs of the right side of the pilot panel at a rate 

of 2.5 frames per second [ref. 3].

Figure B-7. Location of Film Camera on Canopy (DFRC)

Extracted frames from the cockpit film are shown in Figures B-8 through B-17. Critical events 

and pilot actions are identified in these events based on the re-timing analysis. A digitized 

version of the original film was found as a 29.97-fps digital video disc in the public domain. The 

frame timing from the 2.5-fps film to the 29.97-fps digital was not uniform, so the timing 

synchronization was based on observable events in the video assuming a uniform frame 

rate. This appears to yield a synchronization that is accurate to approximately +/–0.25 sec.

The first synchronization event is the rise in chamber pressure at engine ignition (approximately 

1 second post release), which can be seen in the pilot's chamber pressure gauge at the top left of 

the engine instrumentation panel below the IFDS vertical tapes. According to the AIB report, 

this event occurs at 10:30:08.5 PST. The last event is the last film camera frame prior to sun 

exposure, which occurs at 10:34:54.4 PST. Based on this information, a total time span between 

these events of 4:45.9 is expected, and the frame timing was adjusted to achieve this.

Timecode information was added indicating the frame count (not correlated with the original 

film frame count, which is unknown), and the mission elapsed time referenced to ignition time. 

The recovered video starts about 12 seconds prior to ignition.

The synchronization is relatively accurate. The pilot can be seen to activate the PAI switch at 

MET + 84.7 seconds, corresponding to 10:31:33.2 PST. The AIB reports this event at 

10:31:33.0.

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

103 of 107

Figure B-8. Cockpit Film – Ignition Indicated by Increasing Chamber Pressure (MET = 0 seconds,

10:30:08 PST) 

Figure B-9. Cockpit Film – Boost Phase (MET = 41 seconds, 10:30:49 PST)

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

104 of 107

Figure B-10. Cockpit Film – Begin IFDS Malfunction (MET = 79 seconds, 10:31:27 PST)

Figure B-11. Cockpit Film – Pilot Engages PAI (MET = 84 seconds, 10:31:32 PST)

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

105 of 107

Figure B-12. Cockpit Film – Pilot Attempts IFDS Reset (MET = 87 seconds, 10:31:35 PST)

Figure B-13. Cockpit Film – Pilot Selects Computed IFDS Aerodynamic Angles <50 psf 

(MET = 126 seconds, 10:32:14 PST)

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

106 of 107

Figure B-14. Cockpit Film – One of At Least Two MH-96 Disengages (MET = 139 seconds,

10:32:27 PST)

Figure B-15. Cockpit Film – Near Peak Altitude (MET = 171 seconds, 10:32:59 PST)

NESC Request No.: TI-14-00957
NASA Engineering and Safety Center

Technical Assessment Report

Document #:

NESC-RP14-00957

Version:

1.0

Title:

A Comprehensive Analysis of the X-15 

Flight 3-65 Accident

Page #:

107 of 107

Figure B-16. Cockpit Film – Spin Entry (MET = 202 seconds, 10:33:30 PST)

Figure B-17. Cockpit Film – Last Camera Frame (MET = 286 seconds, 10:34:54 PST)

NESC Request No.: TI-14-00957
REPORT DOCUMENTATION PAGE Form Approved

OMB No. 0704-0188

2. REPORT TYPE 

Technical Memorandum

 4. TITLE AND SUBTITLE

A Comprehensive Analysis of the X-15 Flight 3-65 Accident

5a. CONTRACT NUMBER

 6. AUTHOR(S)

Dennehy, Cornelius J.; Orr, Jeb S.; Barshi, Immanuel; Statler, Irving C.

 7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES)

NASA Langley Research Center

Hampton, VA 23681-2199

 9. SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES)

National Aeronautics and Space Administration

Washington, DC 20546-0001

 8. PERFORMING ORGANIZATION

 REPORT NUMBER

L-20481 NESC-RP-14-00957

10. SPONSOR/MONITOR'S ACRONYM(S)

NASA

13. SUPPLEMENTARY NOTES

12. DISTRIBUTION/AVAILABILITY STATEMENT

Unclassified - Unlimited

Subject Category 16 Space Transportation and Safety

Availability: NASA CASI (443) 757-5802

19a. NAME OF RESPONSIBLE PERSON

STI Help Desk (email: help@sti.nasa.gov)

14. ABSTRACT

The November 15, 1967, loss of X-15 Flight 3-65-97 (hereafter referred to as Flight 3-65) was a unique incident in that it was 

the first and only aerospace flight accident involving loss of crew on a vehicle with an adaptive flight control system (AFCS).

In addition, Flight 3-65 remains the only incidence of a single-pilot departure from controlled flight of a manned entry vehicle

in a hypersonic flight regime. To mitigate risk to emerging aerospace systems, the NASA Engineering and Safety Center 

(NESC) proposed a comprehensive review of this accident. The goal of the assessment was to resolve lingering questions 

regarding the failure modes of the aircraft systems (including the AFCS) and thoroughly analyze the interactions among the 

human agents and autonomous systems that contributed to the loss of the pilot and aircraft. This document contains the 

outcome of the accident review.

15. SUBJECT TERMS

Adaptive Flight Control System; NASA Engineering and Safety Center; X-15; Commercial off the Shelf; Attitude Director 

Indicator; Inertial Flight Data System

18. NUMBER

 OF 

 PAGES

112

19b. TELEPHONE NUMBER (Include area code)

(443) 757-5802

a. REPORT

U

c. THIS PAGE

U

b. ABSTRACT

U

17. LIMITATION OF 

 ABSTRACT

UU

Prescribed by ANSI Std. Z39.18

Standard Form 298 (Rev. 8-98)

3. DATES COVERED (From - To)

June 2014 - September 2014

5b. GRANT NUMBER

5c. PROGRAM ELEMENT NUMBER

5d. PROJECT NUMBER

5e. TASK NUMBER

5f. WORK UNIT NUMBER

869021.03.07.01.03

11. SPONSOR/MONITOR'S REPORT

 NUMBER(S)

NASA/TM-2014-218538

16. SECURITY CLASSIFICATION OF:

The public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, 

gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this 

collection of information, including suggestions for reducing this burden, to Department of Defense, Washington Headquarters Services, Directorate for Information Operations and 

Reports (0704-0188), 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302. Respondents should be aware that notwithstanding any other provision of law, no person 

shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

PLEASE DO NOT RETURN YOUR FORM TO THE ABOVE ADDRESS.

1. REPORT DATE (DD-MM-YYYY)

01- 10 - 2014