U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

53–689PDF 2010

ENSURING THE SAFETY OF HUMAN SPACEFLIGHT

HEARING

BEFORE THE

SUBCOMMITTEE ON SPACE AND AERONAUTICS 

COMMITTEE ON SCIENCE AND 

TECHNOLOGY 

HOUSE OF REPRESENTATIVES

ONE HUNDRED ELEVENTH CONGRESS

FIRST SESSION

DECEMBER 2, 2009

Serial No. 111–66

Printed for the use of the Committee on Science and Technology

(

Available via the World Wide Web: http://www.science.house.gov 
(II)

COMMITTEE ON SCIENCE AND TECHNOLOGY 

HON. BART GORDON, Tennessee, Chair 

JERRY F. COSTELLO, Illinois 

EDDIE BERNICE JOHNSON, Texas 

LYNN C. WOOLSEY, California 

DAVID WU, Oregon 

BRIAN BAIRD, Washington 

BRAD MILLER, North Carolina 

DANIEL LIPINSKI, Illinois 

GABRIELLE GIFFORDS, Arizona 

DONNA F. EDWARDS, Maryland 

MARCIA L. FUDGE, Ohio 

BEN R. LUJA ́ N, New Mexico 

PAUL D. TONKO, New York 

PARKER GRIFFITH, Alabama 

JOHN GARAMENDI, California 

STEVEN R. ROTHMAN, New Jersey 

JIM MATHESON, Utah 

LINCOLN DAVIS, Tennessee 

BEN CHANDLER, Kentucky 

RUSS CARNAHAN, Missouri 

BARON P. HILL, Indiana 

HARRY E. MITCHELL, Arizona 

CHARLES A. WILSON, Ohio 

KATHLEEN DAHLKEMPER, Pennsylvania 

ALAN GRAYSON, Florida 

SUZANNE M. KOSMAS, Florida 

GARY C. PETERS, Michigan 

VACANCY 

RALPH M. HALL, Texas 

F. JAMES SENSENBRENNER JR., 

Wisconsin 

LAMAR S. SMITH, Texas 

DANA ROHRABACHER, California 

ROSCOE G. BARTLETT, Maryland 

VERNON J. EHLERS, Michigan 

FRANK D. LUCAS, Oklahoma 

JUDY BIGGERT, Illinois 

W. TODD AKIN, Missouri 

RANDY NEUGEBAUER, Texas 

BOB INGLIS, South Carolina 

MICHAEL T. MCCAUL, Texas 

MARIO DIAZ-BALART, Florida 

BRIAN P. BILBRAY, California 

ADRIAN SMITH, Nebraska 

PAUL C. BROUN, Georgia 

PETE OLSON, Texas 

SUBCOMMITTEE ON SPACE AND AERONAUTICS

HON. GABRIELLE GIFFORDS, Arizona, Chair 

DAVID WU, Oregon 

DONNA F. EDWARDS, Maryland 

MARCIA L. FUDGE, Ohio 

PARKER GRIFFITH, Alabama 

STEVEN R. ROTHMAN, New Jersey 

BARON P. HILL, Indiana 

CHARLES A. WILSON, Ohio 

ALAN GRAYSON, Florida 

SUZANNE M. KOSMAS, Florida 

BART GORDON, Tennessee 

PETE OLSON, Texas 

F. JAMES SENSENBRENNER JR., 

Wisconsin 

DANA ROHRABACHER, California 

FRANK D. LUCAS, Oklahoma 

MICHAEL T. MCCAUL, Texas 

RALPH M. HALL, Texas 

RICHARD OBERMANN Subcommittee Staff Director 

PAM WHITNEY Democratic Professional Staff Member 

ALLEN LI Democratic Professional Staff Member 

KEN MONROE Republican Professional Staff Member 

ED FEDDEMAN Republican Professional Staff Member 

DEVIN BRYANT Research Assistant 
(III)

C O N T E N T S 

December 2, 2009

Page 

Hearing Charter ...................................................................................................... 2

Opening Statements

Statement by Representative Gabrielle Giffords, Chairwoman, Subcommittee 

on Space and Aeronautics, Committee on Science and Technology, U.S. 

House of Representatives .................................................................................... 19

Written Statement ............................................................................................ 20

Statement by Representative Ralph M. Hall, Ranking Minority Member, 

Committee on Science and Technology, U.S. House of Representatives ......... 22

Written Statement ............................................................................................ 36

Statement by Representative Pete Olson, Ranking Minority Member, Subcommittee on Space and Aeronautics, Committee on Science and Technology, U.S. House of Representatives ............................................................... 36

Written Statement ............................................................................................ 38

Witnesses:

Mr. Bryan O’Connor, Chief of Safety and Mission Assurance, National Aeronautics and Space Administration 

Oral Statement ................................................................................................. 39

Written Statement ............................................................................................ 41

Mr. Jeff Hanley, Program Manager, Constellation Program, Exploration Systems Mission Directorate, National Aeronautics and Space Administration 

Oral Statement ................................................................................................. 45

Written Statement ............................................................................................ 47

Mr. John C. Marshall, Council Member, Aerospace Safety Advisory Panel, 

National Aeronautics and Space Administration 

Oral Statement ................................................................................................. 52

Written Statement ............................................................................................ 54

Mr. Bretton Alexander, President, Commercial Spaceflight Federation 

Oral Statement ................................................................................................. 57

Written Statement ............................................................................................ 58

Dr. Joseph Fragola, Vice President, Valador, Inc. 

Oral Statement ................................................................................................. 66

Written Statement ............................................................................................ 68

Lt. Gen. (Ret.) Thomas Stafford, United States Air Force 

Oral Statement ................................................................................................. 73

Written Statement ............................................................................................ 76

Discussion 

Safety of Launch Systems ................................................................................... 80

NASA—Commercial Industry: Sharing of Safety Standards ........................... 82

Potential Impact of Constellation Program on Commercial Sector ................. 83

Human Rating for Commercial Sector ............................................................... 84

Program Management and Scheduling Issues Between Congress, Administration, and NASA Over Time ......................................................................... 85

Implementation and Application of Safety Standards ...................................... 87

Constellation Program: Human and Certification Options Concerns .............. 89

ESAS Recommendations for Human Space Flight ............................................ 91

Availability and Economic Viability of Commercial Crew Transport .............. 92

Orbital Sciences and SpaceX ............................................................................... 94
Page

IV

Timetable: Commercial Crew Transport ............................................................ 94

Ares Program: Safety and Future Impact .......................................................... 95

COTS vs. Constellation Program ........................................................................ 96

Risk Assessment: Commercial Vehicle ............................................................... 97

Ares, Delta, Atlas: Comparison ........................................................................... 97

Orion Space Craft ................................................................................................ 98

Commercial Crew Development Program .......................................................... 99

Training for Commercial Space Operatives ....................................................... 99

Soyuz Space Craft: Concerns Moving Forward ................................................. 101

Addressing the Gap in Human Spaceflight ....................................................... 103

Ares ....................................................................................................................... 103

Delta IV and Atlas ............................................................................................... 103

Appendix: Answers to Post-Hearing Questions

Mr. Bryan O’Connor, Chief of Safety and Mission Assurance, National Aeronautics and Space Administration ...................................................................... 108

Mr. Jeff Hanley, Program Manager, Constellation Program, Exploration Systems Mission Directorate, National Aeronautics and Space Administration .. 116

Mr. John C. Marshall, Council Member, Aerospace Safety Advisory Panel, 

National Aeronautics and Space Administration .............................................. 122

Mr. Bretton Alexander, President, Commercial Spaceflight Federation ............ 126

Dr. Joseph Fragola, Vice President, Valador, Inc. ................................................ 130

Lt. Gen. (Ret.) Thomas Stafford, United States Air Force ................................... 136
(1)

ENSURING THE SAFETY OF HUMAN 

SPACEFLIGHT 

WEDNESDAY, DECEMBER 2, 2009

HOUSE OF REPRESENTATIVES, 

SUBCOMMITTEE ON SPACE AND AERONAUTICS, 

COMMITTEE ON SCIENCE AND TECHNOLOGY, 

Washington, DC.

The Subcommittee met, pursuant to call, at 10:00 a.m., in Room 

2318 of the Rayburn House Office Building, Hon. Gabrielle Giffords 

[Chairwoman of the Subcommittee] presiding.
2

HEARING CHARTER

COMMITTEE ON SCIENCE AND TECHNOLOGY

SUBCOMMITTEE ON SPACE AND AERONAUTICS

U.S. HOUSE OF REPRESENTATIVES 

Ensuring the Safety of

Human Space Flight 

DECEMBER 2, 2009

10 A.M.–NOON

2318 RAYBURN HOUSE OFFICE BUILDING

I. Purpose 

On December 2, 2009 the Subcommittee on Space and Aeronautics will hold a 

hearing focused on issues related to ensuring the safety of future human space 

flight in government and non-government space transportation systems. The hearing will examine (1) the steps needed to establish confidence in a space transportation system’s ability to transport U.S. and partner astronauts to low Earth orbit 

and return them to Earth in a safe manner, (2) the issues associated with implementing safety standards and establishing processes for certifying that a space 

transportation vehicle is safe for human transport, and (3) the roles that training 

and experience play in enhancing the safety of human space missions.

II. Scheduled Witnesses:

Mr. Bryan D. O’Connor 

Chief of Safety and Mission Assurance 

National Aeronautics and Space Administration

Mr. Jeff Hanley 

Program Manager 

Constellation Program 

Exploration Systems Mission Directorate 

National Aeronautics and Space Administration

Mr. John C. Marshall 

Council Member 

Aerospace Safety Advisory Panel 

National Aeronautics and Space Administration

Mr. Bretton Alexander 

President 

Commercial Spaceflight Federation

Dr. Joseph R. Fragola 

Vice President 

Valador, Inc.

Lt. Gen. Thomas P. Stafford, USAF (ret.)

III. Overview 

The Review of U.S. Human Space Flight Plans Committee, also known as the Augustine committee, recently issued its final report. The committee was tasked to 

‘‘conduct an independent review of ongoing U.S. human space flight plans and programs, as well as alternatives, to ensure the Nation is pursuing the best trajectory 

for the future of human space flight—one that is safe, innovative, affordable, and 

sustainable. The review committee should aim to identify and characterize a range 

of options that spans the reasonable possibilities for continuation of U.S. human 

space flight activities beyond retirement of the Space Shuttle.’’

As directed, the committee’s final report offered a number of options to the president for the conduct of future space exploration, ranging from continuing with the 

Constellation Program of Record (with slight modifications) to pursuing a ‘‘flexible 

path’’ with alternative launch vehicles, including modified Evolved Expendable 

Launch Vehicles (EELV) currently used primarily by the Department of Defense to 
3

transport military payloads. Several of the committee’s options included the use of 

as-yet-to-be-developed commercial services to provide future crew transportation to 

and from the International Space Station (ISS) following retirement of the Space 

Shuttle. While the committee stated that it recognized both the risks and opportunities presented by commercial crew services, it believed such services could be available by 2016. Specifically, the report stated:

‘‘The United States needs a way to launch astronauts to low-Earth orbit, but it 

does not necessarily have to be provided by the government. As we move from 

the complex, reusable Shuttle back to a simpler, smaller capsule, it is an appropriate time to consider turning this transport service over to the commercial sector. This approach is not without technical and programmatic risks, but it creates the possibility of lower operating costs for the system and potentially accelerates the availability of U.S. access to low-Earth orbit by about a year, to 2016. 

The Committee suggests establishing a new competition for this service, in which 

both large and small companies could participate.’’

Using commercial providers for space transportation is not a new idea. Congress 

has encouraged NASA to use commercial transportation services when appropriate 

as part of its space exploration strategy. Support for the commercial space industry 

was affirmed in P.L. 110–422, the National Aeronautics and Space Administration 

Authorization Act of 2008. Along with that support however was a requirement for 

commercial services’ prior conformance with NASA’s safety requirements. Specifically, regarding crew transportation, the Act stated in Sec. 902 that the National 

Aeronautics and Space Administration (NASA) shall:

‘‘make use of United States commercially provided International Space Station 

crew transfer and crew rescue services to the maximum extent practicable, if 

those commercial services have demonstrated the capability to meet NASA-specified ascent, entry, and International Space Station proximity operations safety 

requirements.’’

Those NASA safety requirements are primarily embodied in NASA Procedural Requirements (NPR) document NPR 8705.2B, ‘‘Human-Rating Requirements for Space 

Systems’’ as well as in the ISS Visiting Vehicle requirements that govern proximity 

operations around the ISS. While the NPR requirements apply to the development 

and operation of crewed space systems developed by NASA and used to conduct 

NASA human spaceflight missions, the NPR also states that it ‘‘may apply to other 

crewed space systems when documented in separate requirements or agreements’’. 

Progress has been made in the past few years by commercial entities in designing 

and developing cargo launch capabilities which have the potential to access the ISS. 

However, they are not scheduled to demonstrate the capability to transport cargo 

to the ISS as part of NASA’s Commercial Orbital Transportation Services (COTS) 

Demonstration project until the second quarter of Fiscal Year 2010, at the earliest. 

The transporting of NASA astronauts to low Earth orbit and ensuring their safe reentry to Earth is considered to be significantly more challenging than transporting 

cargo to the ISS. 

That is the crux of the issue. Establishing and enforcing safety standards for the 

transport of crew on commercially provided orbital crew transportation services is 

in many ways uncharted territory. Furthermore, a process has yet to be advanced 

by the government on how the ‘‘airworthiness’’ of commercial space flight vehicles 

used to transport government passengers will be ‘‘certified’’. While the Augustine 

committee’s report projected that commercial crew transportation services could be 

available in 2016, it does not appear that the committee’s projection accounts for 

all of the milestones that must be met prior to the point at which NASA would be 

able to use such services to fly its astronauts to the ISS. Notionally, these include: 

prior Congressional authorization and appropriation of funds for such an activity, 

which could not occur before enactment of the FY 2011 appropriation for NASA at 

the earliest; agreement on human-rating and other safety standards and means for 

verifying compliance, development and implementation of new safety processes, testing and verification procedures to ensure safety, and potentially a new regulatory 

regime for certification; development of a COTS-like demonstration program open to 

multiple participants and competition/award of Space Act Agreements for the demonstration program; completion of the development/demonstration program, which 

would need to include a TBD number of demonstration flights, including tests of 

launch escape systems, etc.; subsequent preparation of an RFP for commercial crew 

transportation/ISS crew rescue services; contract competition, negotiation and award 

of contract(s), and potential protest(s) by losing bidder(s) [which unfortunately has 

become a more frequent occurrence in recent Department of Defense (DoD)/NASA 

contract competitions]; manufacturing of the operational flight vehicle systems 

[some of which could potentially be initiated during the development/demonstration 
4

phase, assuming the companies would be able to fund those tasks with private capital]; TBD number of ‘‘certification’’ flights of the production vehicle system prior to 

NASA agreement to put its astronauts on board; and finally, commencement of initial operations to and from the ISS. 

Any mismatch between the timetable asserted in the Augustine committee’s report and the actual time required to bring commercially provided crew transportation services to operational status is relevant because it highlights a potential inability to meet even a fraction of NASA’s crew transfer needs for the ISS prior to 

the end of even an extended ISS operations period [i.e., an ISS extension to 2020], 

which in turn calls into question the ability of would-be commercial providers to 

identify a credible government market when seeking private capital commitments. 

In the absence of a government commitment to pay for services whether or not they 

are available when needed, would-be commercial providers could face pressures to 

cut costs [or cease to compete], and the government would thus have to be vigilant 

to ensure that safety-related processes and practices were not compromised as a result. 

Regardless of the approach to NASA’s human space flight and exploration program that is recommended to Congress by the president, commercial space providers 

may well play an expanding role in transporting cargo to low Earth orbit (LEO) and 

eventually beyond LEO, and potentially transporting crew to and from LEO in the 

future. Consequently, it is prudent to initiate a detailed examination of the steps 

needed to establish confidence in commercial space transportation systems’ capabilities to transport U.S. and partner astronauts to low Earth orbit and return them 

to Earth safely. 

At the hearing, witnesses will provide a historical perspective on the establishment of safety requirements in NASA human space flight systems; NASA’s efforts 

to develop human safety standards and requirements; the incorporation of crew 

safety requirements in the design of NASA’s Constellation Program; and the commercial space transportation companies’ expectations of how NASA’s safety standards and requirements would be applied to commercial spacecraft as well as the 

level of governmental insight and oversight over their development activities and 

operations that they would consider appropriate.

IV. Issues 

The hearing will focus on the following questions and issues:

• What are the most important safety-related issues that need to be addressed 

in either a government or non-government space transportation system?

• What would be the safety implications of terminating the government crew 

transportation system currently under development in favor of relying on asyet-to-be-developed commercially provided crew transportation services? What 

would the government be able to do, if anything, to ensure that no reduction 

in planned safety levels occurred as a result?

• What expectations should Congress have regarding the safety standards commercial providers should meet if their proposed crew transportation and ISS 

crew rescue services were to be chosen by NASA to carry its astronauts to low 

Earth orbit? What would be required to verify compliance with those standards?

• If a policy decision were made to require NASA to rely solely on commercial 

crew transfer services, which would have to meet NASA’s safety requirements 

to be considered for use by NASA astronauts, what impact would that have 

on the ability of emerging space companies to pursue innovation and design 

improvements made possible [as the industry has argued] by the accumulation 

of flight experience gained from commencing revenue operations unconstrained 

by a prior safety certification regime? Would it be in the interest of the emerging commercial orbital crew transportation industry to have to be reliant on 

the government as its primary/sole customer at this stage in its development?

• What lessons learned from the evolution of NASA’s human space flight systems 

should be reflected in the design and operation of future crewed space transportation systems, whether government or non-government?

• What role does NASA’s Office of Safety and Mission Assurance play in ensuring the safety of human space flight at NASA? What initiatives does the office 

have underway to enhance the safety of human space flight at NASA?

• What is being done to communicate NASA’s safety and human-rating requirements to potential commercial crew space transportation and ISS crew rescue 

services providers?
5

• How and to what extent did safety considerations, especially with respect to 

launch, inform the choices made in NASA’s Exploration Systems Architecture 

Study (ESAS)?

• How has the Constellation Program incorporated safety and applicable 

human-rating requirements, as well as Astronaut Office input on launch/entry 

systems safety, into the program’s design, development, and testing activities?

• What has NASA learned so far in executing the Constellation Program that 

can assist in developing a better understanding of the impact of design features, development and testing and manufacturing processes, and operations 

procedures on the safety of crewed space transportation system alternatives?

• What are the expectations of potential commercial crew transportation services 

providers as to how safety standards and processes will be determined if the 

government decided to use commercial services for the transport of NASA astronauts to and from low Earth orbit and the ISS?

• What do potential commercial crew transportation services providers consider 

to be an acceptable safety standard to which potential commercial providers 

must conform if their space transportation systems were to be chosen by NASA 

to carry its astronauts to low Earth orbit and the ISS? Would the same safety 

standard be used for non-NASA commercial human transportation missions?

• What do potential commercial crew transportation services providers consider 

to be an acceptable level of insight and oversight over their development, test, 

and manufacturing process, their vehicles, and operations if their services are 

used to transport NASA astronauts to and from low Earth orbit and provide 

ISS crew rescue services?

• What do potential commercial crew transportation services providers consider 

to be an acceptable certification regime that potential commercial services providers must comply with to address the government’s regulatory responsibilities over the safety and ‘‘air worthiness’’ of commercial crew transportation vehicles prior to their approval for use in revenue-generating flight operations, 

whether for government or non-government customers?

• What training and familiarization with non-NASA crewed spacecraft and 

launch vehicles would astronauts flying on such non-NASA spacecraft and 

launch vehicles need in order to deal with off-nominal conditions, contingency 

operations and emergencies?

V. Background

Relevant Legislation and Hearing on Safety Issues Associated with Commercial 

Space Launches

NASA Authorization Act of 2005

P.L. 109–155, the National Aeronautics and Space Administration Authorization 

Act of 2005, directed that an independent presidential commission be established to 

investigate incidents resulting in the loss of a U.S. space vehicle used pursuant to 

a contract with the Federal government or loss of a crew member or passenger in 

such a vehicle. The Act made clear that Congress believed that an accident involving astronauts riding on a commercial vehicle would be treated as at least as serious 

a matter as one involving a government vehicle. Specifically, the Act specified:

‘‘(a) ESTABLISHMENT.—The President shall establish an independent, nonpartisan Commission within the executive branch to investigate any incident that 

results in the loss of—

(1) a Space Shuttle; 

(2) the International Space Station or its operational viability; 

(3) any other United States space vehicle carrying humans that is owned by 

the Federal Government or that is being used pursuant to a contract with 

the Federal Government; or 

(4) a crew member or passenger of any space vehicle described in this subsection. 

(b) DEADLINE FOR ESTABLISHMENT.—The President shall establish a Commission within 7 days after an incident specified in subsection (a).’’

The independent commission would be tasked, to the extent possible, to investigate the incident; determine the cause of the incident; identify all contributing factors to the cause of the incident; make recommendations for corrective actions; providing any additional findings or recommendations deemed by the Commission to 

be important; and prepare a report to Congress, the president, and the public.
6

NASA Authorization Act of 2008

The Congress affirmed its support for the commercial space industry in P.L. 110–

422, the National Aeronautics and Space Administration Authorization Act of 2008. 

The Act states in its findings that

‘‘Commercial activities have substantially contributed to the strength of both the 

United States space program and the national economy, and the development of 

a healthy and robust United States commercial space sector should continue to 

be encouraged.’’

With regards to the potential use of commercially-provided ISS crew transfer and 

crew rescue services, the Act states that NASA may make use of commercial services if those commercial services have demonstrated the capability to meet NASA’s 

safety requirements. Specifically, the Act states:

‘‘(a) IN GENERAL.—In order to stimulate commercial use of space, help maximize the utility and productivity of the International Space Station, and enable 

a commercial means of providing crew transfer and crew rescue services for the 

International Space Station, NASA shall—

(1) make use of United States commercially provided International Space 

Station crew transfer and crew rescue services to the maximum extent practicable, if those commercial services have demonstrated the capability to 

meet NASA-specified ascent, entry, and International Space Station proximity operations safety requirements; 

(2) limit, to the maximum extent practicable, the use of the Crew Exploration 

Vehicle to missions carrying astronauts beyond low Earth orbit once commercial crew transfer and crew rescue services that meet safety requirements 

become operational; 

(3) facilitate, to the maximum extent practicable, the transfer of NASA-developed technologies to potential United States commercial crew transfer and 

rescue service providers, consistent with United States law; and 

(4) issue a notice of intent, not later than 180 days after the date of enactment of this Act, to enter into a funded, competitively awarded Space Act 

Agreement with 2 or more commercial entities for a Phase 1 Commercial Orbital Transportation Services crewed vehicle demonstration program.’’

However, with respect to subsection (4) above, the 2008 Act also made clear in 

Sec. 902(b) that:

‘‘(b) CONGRESSIONAL INTENT.—It is the intent of Congress that funding for 

the program described in subsection (a)(4) shall not come at the expense of full 

funding of the amounts authorized under section 101(3)(A), and for future fiscal 

years, for Orion Crew Exploration Vehicle development, Ares I Crew Launch Vehicle development, or International Space Station cargo delivery.’’

Government Indemnification for Commercial Space Launch Operations 

In 1988, Congress amended the Commercial Space Launch Act of 1984 to indemnify the commercial space launch industry against successful claims by third parties. Specifically, the United States agreed, subject to appropriation of funds, to pay 

third party claims against licensees in amounts up to $1.5 billion [in 1989 dollars] 

above the amount of insurance that a licensee carries. The Act’s definition of ‘‘third 

party’’ excludes all government employees, private employees, and contractors involved directly with the launch of a vehicle. 

The Act requires that private launch companies purchase sufficient liability insurance. This amount is determined by the Federal Aviation Administration (FAA) on 

a case-by-case basis depending on its calculation of the ‘‘maximum probable loss’’ 

from claims by a third party. This amount is capped at $500 million for coverage 

against suits by private entities. 

Since the majority of commercial launch activity occurs at federal launch ranges, 

the Act also requires any insurance policy a company obtains to also protect the federal government, its agencies, personnel, contractors, and subcontractors. The liability insurance section of the Act requires reciprocal waivers of claims between the 

licensee and its contractors, subcontractors, and customers. In effect, the licensee 

and any other organization assisting in the actual launch are prevented from seeking damages from one another. The indemnification and liability regime was first 

established by Congress as part of the Commercial Space Launch Act Amendments 

of 1988 and has been extended four times since its original enactment. On October 

20, 2009, the U.S. House of Representatives passed H.R. 3819, a bill to extend the 

commercial space transportation indemnification and liability regime, by a voice 

vote. The liability risk-sharing regime extension is set to expire at the end of the 
7

year; H.R. 3819 would extend it for three more years. Congress has not yet explicitly 

addressed the issues of indemnification and liability for future commercially provided orbital human space flight services.

Commercial Space Launch Amendments Act of 2004

The Commercial Space Launch Amendments Act of 2004 put an initial regulatory 

framework in place for commercial human space flight. The intent of the law was 

to support the development of this private sector effort while also protecting the 

safety of uninvolved public on the ground. The law established an ‘‘informed consent’’ regime for carrying space flight crew and participants (passengers). The Act 

also created a new experimental launch permit for test and development of reusable 

suborbital launch vehicles. The 2004 law called for FAA to ‘‘encourage, facilitate, 

and promote the continuous improvement of the safety of launch vehicles designed 

to carry humans.’’ To allow the industry to grow and innovate, the Act stated that 

‘‘Beginning 8 years after the date of enactment of the Commercial Space Launch 

Amendments Act of 2004, the Secretary may propose regulations’’ pertaining to crew 

and passengers, further adding that ‘‘Any such regulations shall take into consideration the evolving standards of safety in the commercial space flight industry.’’ The 

eight year period [which ends in 2012] reflected the view that by then, the commercial human space flight industry would be ‘‘less experimental.’’

As part of the ‘‘informed consent’’ regime, FAA regulations require an operator to 

inform in writing any individual serving as crew that the United States Government 

has not certified the launch vehicle and any reentry vehicle as safe for carrying 

flight crew or space flight participants. Similarly, the operator must inform each 

space flight participant in writing about the risks of the launch and reentry, including the safety record of the launch or reentry vehicle type. The ‘‘informed consent’’ 

rules became effective in December 2006. 

FAA’s subsequent rules call for launch vehicle operators to provide certain safetyrelated information and identify what an operator must do to conduct a licensed 

launch with a human on board. The protocols also include training and general security requirements for space flight participants. As part of the new measures, 

launch providers must also establish requirements for crew notification, medical 

qualifications, and training, as well as requirements governing environmental control and life-support systems. An operator must also verify the integrated performance of a vehicle’s hardware and any software in an operational flight environment 

before carrying a space flight passenger. However, in issuing operator licenses, FAA 

does not certify the launch vehicle as safe as the agency customarily does with aircraft. In the latter case, the agency’s Office of Aviation Safety provides initial certification of aircraft and periodically inspects an aircraft and certifies it as safe to fly. 

With regards to spacecraft, FAA can also issue experimental permits for launches 

of reusable vehicles conducted for research and development activities related to 

suborbital flight, for demonstrations of compliance with licensing requirements, or 

for crew training before obtaining a license.

2003 Joint Hearing on Commercial Human Space Flight 

The Subcommittee and the Senate’s Subcommittee on Science, Technology, and 

Space of the Committee on Commerce, Science and Transportation held a hearing 

entitled Commercial Human Space Flight in July 2003. Among the issues discussed 

at the joint hearing were when revenue launches would begin to happen, ‘‘what is 

safe enough’’, and whether the government should certify the safety of commercial 

vehicles prior to the commencement of passenger-carrying operations. 

At the 2003 hearing, Senator Sam Brownback asked the witnesses when they 

could take their first commercial paying human customer into space. Mr. Jeff 

Greason, President of XCOR Aerospace said:

‘‘That depends, in part, on factors that are not entirely in my control, like how 

fast we lock up some of the remaining investment. But if the investment is in 

hand, not sooner than about three years, because we have an extensive test program we have to go through.’’

In response to Senator Brownback’s question, Mr. Elon Musk, the CEO of Space 

Exploration Technologies, said:

‘‘Well, the task that SpaceX has set for itself is probably an order of magnitude 

greater than sub-orbital flight. We’ve really aimed at orbital flight, really essentially the job that the Space Shuttle does. That’s a longer road. But I think it’s 

conceivable we could get something done in the 2006 time frame, as well.’’
8

With regards to safety, then-Subcommittee Ranking Member Bart Gordon asked 

Mr. Greason ‘‘What is safe enough, and who should verify that?’’ Mr. Greason replied:

‘‘I mean, it’s safe enough when the customers start to show up, and you go 

through a process of demonstrating the vehicle over and over and over again. 

Now, we have our own internal business targets about how safe we have to know 

it is before we can base a business on it. But it’s important to realize that long 

before we get to the point where we know it’s safe enough that our expensive asset 

won’t crash and be lost to revenue service, something we have to do for our own 

business, long before that point, we will have demonstrated safety far superior 

to what people think of as space flight safety as being right now. I mean, the 

test program, alone is probably going to be 50 flights.’’

In a response to a question for the record posed by then-Subcommittee Chairman 

Dana Rohrabacher to Mr. Dennis A. Tito, CEO of Wilshire Associates, Inc, on what 

features of current aircraft standards and space launch safety standards should be 

applied to commercial human space flight, Mr. Tito provided the following response:

‘‘As I stated in my testimony, commercial aviation is a mature and well-established industry. Aircraft safety standards reflect 100 years of powered flight experience, and are part of a 75+ year history of federal regulation increasingly 

focused on protecting the safety of airline passengers as well as uninvolved third 

parties. The commercial space launch industry is a somewhat less mature industry, with just over two decades of commercial experience. This industry’s heritage, however, is based on over a half-century of military and civilian development and testing of ballistic missiles and their descendant launch vehicles. Missiles and most current launch vehicles have significant destructive potential and, 

because they are expendable, cannot be flight tested, fixed, and re-tested in the 

way aircraft or other reusable systems can. Launch safety standards have therefore focused on detailed oversight, complex system redundancy and flight termination (self-destruct) capabilities. Neither of these two operational safety paradigms is appropriate for commercial human space flight. There may be some 

similarities between aircraft and sub-orbital reusable launch vehicles, and others 

between RLVs [Reusable Launch Vehicles] and expendable rockets. However, I 

predict that these new space planes will in fact merit their own operational safety approaches. At this point, we need to develop and fly some vehicles so we can 

learn what to do and what not to do. That, after all, is the beauty of the competitive marketplace: better ideas are rewarded while less-good approaches suffer 

until they are improved or die off.’’

Responding to a similar question for the record by Mr. Gordon on whether the 

government should certify the safety of his vehicles prior to commencement of passenger-carrying operations, Mr. Greason replied:

‘‘The government should absolutely not certify the safety of our vehicles prior to 

the commencement of commercial, passenger-carrying operations. Today, we have 

a gap of one-million-to-one between the safety of space flight (roughly 40 fatalities per thousand emplanements for U.S. space missions) and aircraft (roughly 

25 fatalities per billion emplanements for U.S. scheduled air carriers). When 

aviation started, its accident rate was as bad or worse than today’s space transportation technology. In the early days, carrying passengers for ‘‘barnstorming’’ 

was one of the few sources of revenue in the aircraft industry. Today, risk tolerance is lower than in the 1920s. We believe we can and must do better. But if 

commercial RLV operators are ten times safer than government space flight efforts (which may be achievable), that is still 100,000 times less safe than aircraft. We are clearly too early for any kind of certification regime as that practiced in commercial aviation.

Early generation RLVs should be allowed to fly as long as the uninvolved general public are kept reasonably safe. The key is a system which investigates failures and shares the methods used successfully. The best and fastest path to safety is establishing a regulatory culture of continuous improvement based on experience; and the more flights we get, the faster we will gain that experience. Attempts to shortcut this process by establishing standards based on guesses or 

predictions about future technologies will stifle innovation, fix in place present 

practices, and slow the pace of safety improvement. This might not be so bad if 

the current safety record of space transportation were something to preserve. But 

it is not; it is something to change for the better.’’

‘‘The current safety situation will change when operational track records are established. It is very likely that there will be dramatic differences in safety between vehicle types. When that happens, AST, industry, and the NTSB need to 
9

collaborate on raising the bar, perhaps by establishing minimum safety records, 

perhaps by design standards, or a mix of both. As this evolves, it will be important to avoid applying these new regulations to vehicle test flights. Research and 

development test flights should continue with the sole burden of protecting the 

safety of the general uninvolved public. In this way we can hope that people will 

look back on the first century of private space flight and see the same dramatic 

improvement in safety which has been demonstrated by aircraft.’’

In addition to illuminating the discrepancy between the schedule predictions of 

the emerging commercial providers and their actual performance to date, the testimony cited above raises the policy issue of the potential impact of a decision to require NASA to rely on commercially provided crew transportation services, which 

would have to meet NASA’s safety requirements prior to NASA having its astronauts utilize those services. Given that the emerging commercial providers appear 

to believe strongly in an evolutionary approach to design and safety innovation to 

be achieved through flight experience gained from revenue flights undertaken without any prior safety certification regime, premature reliance on the government as 

the dominant/only customer would call into question the ability of the emerging 

commercial providers to sustain the approach to innovation that they appear to believe is essential to their long-term success.

NASA’s Incorporation of Safety Measures into Its Human Space Flight Programs 

Several key safety initiatives were undertaken by NASA following the experience 

gained from flight missions:

• In January 1986, the Space Shuttle Challenger and its crew were lost 73 seconds after launch because of the failure of a seal (an O-ring) between two segments of a Solid Rocket Booster. In response to the findings of the Rogers 

Commission that investigated the Challenger accident, NASA established 

what is now known as the Office of Safety and Mission Assurance (OSMA) 

at Headquarters to independently monitor safety and ensure communication 

and accountability agency-wide. The Office monitors ‘‘out of family’’ anomalies 

and establishes agency-wide Safety and Mission Assurance policy and guidance such as human-rating requirements to which NASA program managers 

must adhere. OSMA also reviews the Space Shuttle Program’s Flight Readiness Process and signs the Certificate of Flight Readiness.

• In February 2003, Shuttle Columbia disintegrated as it returned to Earth. In 

the ensuing investigation by the Columbia Accident Investigation Board 

(CAIB), the CAIB found that Columbia broke apart from aerodynamic forces 

after the left wing was deformed from the heat of gases that entered the wing 

through a hole caused during launch by a piece of foam insulation that detached from the External Tank. The CAIB found that the tragedy was caused 

by technical and organizational failures and provided 29 recommendations. 

Then-NASA Administrator Sean O’Keefe requested that Lt. Gen. Thomas 

Stafford, U.S. Air Force (Ret.) assign his Task Force on International Space 

Station Operational Readiness to undertake an assessment of NASA’s plans 

to return the Space Shuttle to flight. At that time, the Stafford Task Force 

was a standing body chartered by the NASA Advisory Council, an independent advisory group to the NASA Administrator. Lt. Gen. Stafford activated a sub-organization with Col. Richard O. Covey, U.S. Air Force (Ret.) 

leading the day-to-day effort of conducting an independent assessment of the 

15 CAIB ‘‘return-to-flight’’ recommendations. As a result, the Return to Flight 

Task Group was chartered in July 2003. Over the next two years, using expertise from academia, aerospace industry, the federal government, and the 

military, the task group, with Lt. Gen. Stafford and Col. Covey as co-chairs, 

assessed the actions taken by NASA to implement the 15 CAIB return-toflight recommendations plus one additional item the Space Shuttle Program 

assigned to itself as a ‘‘raising the bar’’ action. The task group conducted factfinding activities, reviewed documentation, held public meetings, reported the 

status of its assessments to NASA’s Space Flight Leadership Council, and released three interim reports. The task group issued its final report (dated 

July 2005) on August 17, 2005. 

Lt. Gen. Stafford will be a witness at the hearing and can provide insights 

into safety challenges associated with human space flight.

• Among the CAIB’s recommendations was one for NASA to establish an independent Technical Engineering Authority responsible for technical requirements and all waivers to them. In response, NASA created the NASA Engineering and Safety Center’s (NESC) whose mission is to perform value-added 
10

independent testing, analysis, and assessments of NASA’s high-risk projects 

to ensure safety and mission success. 

According to NASA, rather than relieving NASA program managers of their 

responsibility for safety, the NESC complements the programs by providing 

an independent technical review. Additionally, NASA states that the NESC 

provides a centralized location for the management of independent engineering assessment by expert personnel and state of the art tools and methods 

for the purpose of assuring safety. The NESC Management Office is located 

at NASA Langley Research Center in Hampton Virginia, but the NESC has 

technical resources at all 10 NASA Centers and Headquarters, as well as 

partnerships with academia, industry and other Government organizations. 

These technical resources are pooled to perform NESC activities and services. 

Operationally, the NESC falls under the responsibility of NASA’s Office of 

Safety and Mission Assurance.

• NASA said that it recognized the importance of capturing the lessons learned 

from the loss of Columbia and her crew to benefit future human exploration, 

particularly future crewed vehicle system design. Consequently, the Space 

Shuttle Program commissioned the Spacecraft Crew Survival Integrated Investigation Team (SCSIIT) to perform a comprehensive analysis of the accident, focusing on factors and events affecting crew survival; and to develop 

recommendations for improving crew survival for all future human space 

flight vehicles. The Team’s final report was released in December 2008, although findings were shared within NASA during the 3-year effort. Some illustrative recommendations with regards to future space craft design were as 

follows:

• ‘‘Future spacecraft seats and suits should be integrated to ensure proper 

restraint of the crew in offnominal situations while not affecting operational performance. Future crewed spacecraft vehicle design should account for vehicle loss of control to maximize the probability of crew survival.’’

• ‘‘Future vehicle design should incorporate an analysis for loss of control/

breakup to optimize for the most graceful degradation of vehicle systems 

and structure to enhance chances for crew survival. Operational procedures can then integrate the most likely scenarios into survival strategies.’’

• ‘‘Future spacecraft crew survival systems should not rely on manual activation to protect the crew.’’

The Constellation Program’s design is in conformance with the Team’s findings. 

For example, with regards to the recommendation listed above on crew restraint, 

the program has (a) outfitted the Orion seats with the latest innovations in seat and 

restraint systems for enhanced occupant protection; (b) implemented limb flail requirements and additional protections to ensure proper arm positioning to maintain 

control of the vehicle under high acceleration events; and (c) is designing suit and 

seat in an integrated fashion with the entire spacecraft. 

Mr. Jeff Hanley, Program Manager of the Constellation Program, will be a witness at the hearing and can provide additional details on how that Program is incorporating safety and applicable human-rating requirements, as well as Astronaut Office input on launch/entry systems safety, into the Constellation program’s design, 

development, and testing activities.

NASA’s Human Rating and Safety Requirements 

According to NASA’s Inspector General, NASA assembled a diversified group in 

2007 composed of astronauts, engineers, safety engineers, flight surgeons, and mission operations specialists to rewrite the agency’s human-rating requirements, 

which had been embodied in NPR 8705.2A, ‘‘Human-Rating Requirements for Space 

Systems.’’ As stated in the NASA Inspector General’s report IG–09–016 dated May 

21, 2009:

‘‘This group reviewed human-rating documents from the last 45 years that were 

used in the development of Mercury, Gemini, Apollo, Skylab, the Space Shuttle, 

and the International Space Station. The lessons learned from these programs, 

and information from numerous books and studies, resulted in NPR 8705.2B, 

issued May 6, 2008.’’

The stated purpose of NPR 8705.2B is ‘‘to define and implement the additional 

processes, procedures, and requirements necessary to produce human-rated space systems that protect the safety of crew members and passengers on NASA space missions.’’
11

The NPR states that ‘‘a human-rated system accommodates human needs, effectively utilizes human capabilities, controls hazards and manages safety risk associated with human spaceflight, and provides, to the maximum extent practical, the capability to safely recover the crew from hazardous situations. Human-rating is not 

and should not be construed as certification for any activities other than carefully 

managed missions where safety risks are evaluated and determined to be acceptable 

for human spaceflight.’’

The NPR further states that ‘‘Human-rating must be an integral part of all program activities throughout the life cycle of the system, including design and development; test and verification; program management and control; flight readiness certification; mission operations; sustaining engineering; maintenance, upgrades, and 

disposal.’’

As to applicability, the NPR states that ‘‘The human-rating requirements in this 

NPR apply to the development and operation of crewed space systems developed by 

NASA used to conduct NASA human spaceflight missions. This NPR may apply to 

other crewed space systems when documented in separate requirements or agreements.’’ The NPR notes that ‘‘The Space Shuttle, the International Space Station 

(ISS), and Soyuz spacecraft are not required to obtain a Human-Rating Certification 

in accordance with this NPR. These programs utilize existing policies, procedures, 

and requirements to certify their systems for NASA missions.’’ The NPR is applicable 

to the Constellation Program. 

The NPR views human-rating as consisting of three fundamental tenets:

1. Human-rating is the process of designing, evaluating, and assuring that the 

total system can safely conduct the required human missions.

2. Human-rating includes the incorporation of design features and capabilities 

that accommodate human interaction with the system to enhance overall 

safety and mission success.

3. Human-rating includes the incorporation of design features and capabilities 

to enable safe recovery of the crew from hazardous situations.

According to NASA’s guidance, human-rating is an integral part of all program 

activities throughout the life cycle of the system, including design and development; 

test and verification; program management and control; flight readiness certification; mission operations; sustaining engineering; maintenance/upgrades; and disposal. 

The NPR technical requirements for human-rating address system safety, crew/

human control of the system, and crew survival/aborts. The requirements associated 

with crew survival and abort capability were established following the two previously cited Shuttle accidents. For example, the NPR states that for Earth Ascent 

Systems:

• ‘‘The space system shall provide the capability for unassisted crew emergency 

egress to a safe haven during Earth prelaunch activities.’’

• ‘‘The space system shall provide abort capability from the launch pad until 

Earth-orbit insertion to protect for the following ascent failure scenarios (minimum list):

a. Complete loss of ascent thrust/propulsion

b. Loss of attitude or flight path.’’

• ‘‘The crewed space system shall monitor the Earth ascent launch vehicle performance and automatically initiate an abort when an impending catastrophic 

failure is detected.’’

Regarding Earth ascent abort, the NPR states that:

• ‘‘The space system shall provide the capability for the crew to initiate the 

Earth ascent abort sequence.’’

• ‘‘The space system shall provide the capability for the ground control to initiate 

the Earth ascent abort sequence.’’

• ‘‘If a range safety destruct system is incorporated into the design, the space system shall automatically initiate the Earth ascent abort sequence when range 

safety destruct commands are received onboard, with an adequate time delay 

prior to destruction of the launch vehicle to allow a successful abort.’’

Once in orbit, the NPR requires the crewed space system to ‘‘provide the capability to autonomously abort the mission from Earth orbit by targeting and performing a deorbit to a safe landing on Earth.’’

In addition, NPR 8715.3C which establishes NASA’s General Safety Program Requirements, has a section entitled ‘‘Hazardous Work Activities That Are Outside 
12

NASA Operational Control.’’ The NPR states that it is NASA policy to ‘‘document 

and verify that risks are adequately controlled and any residual risk is acceptable’’. 

Applicability to commercial human space flight is cited. Specifically, Section 1.14.1 

states:

‘‘It is NASA policy to formally review and approve NASA participation in hazardous work activities that are outside NASA operational control as needed to 

ensure that NASA safety and health responsibilities are satisfied. This policy applies unconditionally to NASA participation in commercial human spaceflight 

where current federal regulations do not necessarily provide for the safety of 

spaceflight vehicle occupants. This policy is non-retroactive and applies to hazardous ground or flight activities that involve research, development, test and 

evaluation, operations, or training, where all five of the following conditions 

exist:

a. NASA civil service personnel, Government detailees, specified contractors, 

or specified grantees are performing work for NASA.

b. The activity is outside NASA’s direct operational control/oversight.

c. An assessment by the responsible NASA manager indicates there are insufficient safeguards and/or oversight in place.

d. The activity is not covered by a basic contract, grant, or agreement where 

Federal, State, and/or local requirements address personnel safety.

e. The nature of the activity is such that, if NASA were controlling it, a formal safety and/or health review would be required as part of the NASA 

approval process.’’

In terms of responsibilities, the NASA Associate Administrator, as chair of the 

Agency Program Management Council, is the authority for human-rating and is responsible for certifying systems as human-rated. In this capacity, the NASA Associate Administrator makes the determination to certify a system as human-rated. 

Appeals for exceptions and waivers to the NPR are made to the NASA Associate 

Administrator. The Chief, Safety and Mission Assurance, is the Technical Authority 

for Safety and Mission Assurance and is responsible for assuring the implementation of safety-related aspects of human-rating. 

In its 2008 Annual Report, the Aerospace Safety Advisory Board (ASAP), the congressionally established body which evaluates and provides advice on NASA’s safety 

performance, noted changes in NPR 8705.2B from the prior guidance:

‘‘The ASAP is concerned about HRR [human rating requirements] substance, application, and standardization NASA-wide.

• After several briefings, the Panel is just beginning to fully understand the 

changes (e.g., in failure tolerance, inadvertent actions, redundancy, and integrated design analysis) and the implications for future system development—

an index of the challenge facing NASA.

• The new HRR standards move from validating compliance with mandatory 

failure tolerance requirements to an approach of designing to acceptable risk, 

but without any apparent clear and visible criteria for estimating ‘‘how safe 

is safe enough’’ for various mission categories.

• A direct linkage between current standards and engineering directives is missing.

• NASA training materials on the new HRR standards are still in development 

and should be accelerated to distribute information before new Constellation 

systems are developed.’’

Mr. Bryan O’Connor, Chief of Safety and Mission Assurance and former astronaut, will be a witness at the hearing and can provide additional details on OSMA’s 

latest activities associated with implementing safety-related aspects of human-rating, including addressing the ASAP’s concerns. Mr. John Marshall, a member of the 

ASAP, will also be testifying at the hearing.

Enhancing Safety through Crew Training 

As evidenced by the performance of the crew of Apollo 13 after the incident that 

created a serious emergency situation en route to the Moon, astronauts play a major 

role in ensuring human safety in space. In that situation, the crew detected, reacted, 

and with the help of engineers and technicians on the ground, overcame problems 

that mechanical systems could not. Integral to that crew’s ability to improvise under 

difficult conditions was the training they received. 
13

Today’s astronaut training program builds on years of flight experience. Once selected as candidates, astronauts undergo a rigorous training program that ranges 

from basic training in generic vehicle systems to being trained to operate spacecraft 

systems using simulators. Survival training includes emergency egress from the 

Shuttle and surviving in a water or wilderness environment. As a final step, crews 

conduct integrated operational training with flight controllers in NASA’s Mission 

Control Center at the Johnson Space Center. 

Training for off-nominal operations is an important facet of crew training. Astronauts are acquainted with non-safety-critical failure modes and the ways to respond 

to them. Training for off-nominal conditions is primarily accomplished by inserting 

failures during simulations at which time astronauts are trained to recognize the 

off-nominal conditions and identify corrective measures. The level of difficulty arises 

when several failures are injected during simulations and crew members must perform failure analyses in an integrated manner and apply corrective procedures in 

sequence. Emergency training is needed for those situations where all measures 

identified through other forms of training cannot be used. The most critical emergencies primarily involve fire, depressurization, and toxic contamination. The goal 

of NASA’s training is to have a trained astronaut who is able to respond and assist 

in any contingency situation that may arise.

Safety Considerations in NASA’s Selection of Space Exploration Vehicles 

In January 2004, President Bush announced his Vision for Space Exploration, 

which called for NASA to safely return the Space Shuttle to flight; complete the 

International Space Station (ISS); return to the Moon to gain experience and knowledge for human missions beyond the Moon, including Mars; and increase the use 

of robotic exploration to maximize our understanding of the solar system and pave 

the way for more ambitious human missions. Congressional support for a new direction in the Nation’s human spaceflight program was clearly articulated in the 2005 

NASA Authorization Act. Specifically, the Act directed the NASA Administrator ‘‘to 

establish a program to develop a sustained human presence on the Moon, including 

a robust precursor program, to promote exploration, science, commerce, and United 

States preeminence in space, and as a stepping-stone to future exploration of Mars 

and other destinations. The Administrator was further authorized to develop and 

conduct appropriate international collaborations in pursuit of these goals.’’

Shortly after Dr. Michael Griffin was named the new NASA Administrator in 

April 2005, he set out to restructure the Exploration Program by giving priority to 

accelerating the development of the Crew Exploration Vehicle (CEV) to reduce or 

eliminate the anticipated gap in U.S. human access to space following the retirement of the Space Shuttle. Specifically, he established a goal for the CEV to begin 

operation as early as 2011and to be capable of ferrying crew and cargo to and from 

the ISS. He also decided to focus on existing technology and proven approaches for 

exploration systems development. In order to reduce the number of required 

launches for exploration missions and to ease the transition after Space Shuttle retirement in 2010, the Administrator, consistent with the congressional guidance contained in the NASA Authorization Act of 2005, directed the Agency to examine the 

cost and benefits of developing a Shuttle-derived Heavy-Lift Launch Vehicle to be 

used in lunar and Mars exploration. As a result, the Exploration Systems Architecture Study (ESAS) team was established to determine the best exploration architecture and strategy to implement these changes. 

In November 2005, NASA released the results of the ESAS, an initial framework 

for implementing the VSE and a blueprint for the next generation of spacecraft to 

take humans back to the Moon and on to Mars and other destinations. ESAS made 

specific design recommendations for a vehicle to carry crews into space, a family of 

launch vehicles to take crews to the Moon and beyond, and a lunar mission ‘‘architecture’’ for human lunar exploration. ESAS presented a time-phased, evolutionary 

architectural approach to returning humans to the Moon, servicing the ISS after the 

Space Shuttle’s retirement, and eventually transporting humans to Mars. Under the 

2005 ESAS plan, a Crew Exploration Vehicle (CEV and now called Orion) and Crew 

Launch Vehicle (CLV and now called Ares I) development activities would begin immediately, leading to the goal of a first crewed flight to the ISS in 2011. Options 

for transporting cargo to and from the ISS would be pursued in cooperation with 

industry, with a goal of purchasing transportation services commercially. In 2011, 

the development of the major elements required to return humans to the Moon 

would begin—the lunar lander (now called Altair), heavy lift cargo launcher (now 

called Ares V), and an Earth Departure Stage vehicle. These elements would be developed and tested in an integrated fashion, with the internal goal of a human lunar 

landing in 2018. When resources needed to achieve the 2011 goal for CEV oper-
14

ations were not forthcoming, the Constellation Program established a formal target 

of 2015 for initial CEV flights to the ISS. 

According to the ESAS report, the team’s major trade study was a detailed examination of the relative costs, schedule, reliability, safety, and risk of using DoD’s 

Evolved Expendable Launch Vehicle (EELV) and Shuttle derived launchers for crew 

and cargo missions. Among its operational ground rules and assumptions was the 

CAIB finding on the desirability of an architecture that will ‘‘separate crew and 

large cargo to the maximum extent practical’’. 

The EELV options examined for suitability for crew transport by the ESAS team 

were derived from the Delta IV and Atlas V families. The team found that:

• None of the medium versions of either vehicle had the capability to accommodate CEV lift requirements. Augmentation of the medium-lift class systems 

with solid strap-on boosters was thought by the team to pose an issue for 

crew safety because of small strap-on Solid Rocket Motor reliability.

• Both vehicles required modification for human-rating, particularly in the 

areas of avionics, telemetry, structures, and propulsion systems.

• Both Atlas- and Delta-derived systems required new upper stages to meet the 

lift and human rating requirements.

• Both Atlas and Delta single-engine upper stages fly highly lofted trajectories, 

which can produce high deceleration loads on the crew during an abort an, 

in some cases, can exceed crew load limits as defined by NASA standards.

CLV options derived from Shuttle elements focused on the configurations that 

used a Reusable Solid Rocket Booster (RSRB), either as a four-segment version 

nearly identical to the RSRB flown today or a higher-performance five-segment 

version of the RSRB. The team sought to develop options that could meet the lift 

requirement using a four-segment RSRB. To achieve this, a 500,000-lbf vacuum 

thrust class propulsion system would be needed. Two types of upper stage engines 

were assessed. According to ESAS, the option chosen, including using the Space 

Shuttle Main Engine (SSME) for the upper stage, was selected due to projected 

lower cost, higher safety/reliability, its ability to utilize existing human-rated systems and infrastructure and the fact that it gave the most straightforward path to 

a heavy lift launch vehicle for cargo. Subsequently, to achieve lower recurring costs, 

the rocket motor powering the upper stage was changed to a variant of the J–2S 

Saturn-era motor and now called J–2X. 

The following chart from the ESAS report summarizes the team’s findings with 

regards to CLV options and compares these options on the basis of Loss of Mission 

(LOM) and Loss of Crew (LOC) probabilities:
15

Source: NASA (ESAS)

With regards to crew safety, as shown in the table above, analysis by the ESAS 

team showed that the initially recommended concept had a mean LOC of 1 in 2,021 

and the current design had a mean LOC of 1 in 1,918. As such, initially both concepts met the recommendations from the CAIB and the Astronaut’s Office that a 

Shuttle replacement have at least a LOC of 1 in 1,000 missions. In comparison, the 

other options ranged from 1 in 614 to 1 in 1,100. The selected CLV design, which 

later became known as Ares I, was also projected to offer significant improvement 

in Loss of Mission over other launch options. 

In his presentation to the Augustine Committee on July 29, 2009, Dr. Joseph 

Fragola, a member of the ESAS team and Vice President of Valador, Inc., told the 

Committee that this meant that ‘‘Ares I is at least a factor of 2 safer from a loss 

of crew perspective and in some cases closer to a factor of 3.’’ In a recent conversation 

between Subcommittee staff and Dr. Fragola, he indicated that the ESAS team was 

more interested in establishing the relative risk among the options and not in their 

absolute risk values. According to NASA, the recommended concept’s lower LOC estimate is a direct reflection of the use of a simpler design and fewer moving parts 

characteristic of a single solid propellant first stage. The recommended concept was 

accepted and formed the basis of the Ares I crew launch vehicle. 

Dr. Fragola will be a witness at the hearing and can provide additional details 

on the ESAS Team’s analysis of how alternative configurations compared with regards to loss of crew and loss of mission projections.

Safety Oversight by the Aerospace Safety Advisory Panel 

Since it was established in 1968 by Congress, the Aerospace Safety Advisory 

Panel (ASAP) has been evaluating NASA’s safety performance and advising the 

agency on ways to improve that performance. The Panel consists of members appointed by the NASA Administrator and is comprised of recognized safety, management, and engineering experts from industry, academia, and other government 

agencies. 

The ASAP reports to the NASA Administrator and Congress. The Panel was established by Congress in the aftermath of the January 1967 Apollo 204 spacecraft 

fire. The Panel’s statutory duties, as prescribed in Section 6 of the NASA Authorization Act of 1968, Public Law 90–67, 42 U.S.C. 2477 are as follows:

‘‘The Panel shall review safety studies and operations plans that are referred to 

it and shall make reports thereon, shall advise the Administrator with respect 
16

to the hazards of proposed operations and with respect to the adequacy of proposed or existing safety standards, and shall perform such other duties as the 

Administrator may request.’’

The Panel was authorized in Section 106, Safety Management, of the National 

Aeronautics and Space Administration Authorization Act of 2005, [P.L. 109–155]. 

The ASAP bases its advice on direct observation of NASA operations and decisionmaking. The Panel provides an annual report. In addition to examining NASA’s 

management and culture related to safety, the report also examines NASA’s compliance with the recommendations of the CAIB. Advice from the ASAP on technical 

authority, workforce and risk management practices has been provided to the NASA 

Administrator. 

Critical human space flight safety issues the Panel identified in its 2008 Annual 

Report included the proposed extension of the Space Shuttle Program; the use of 

commercial transportation sources; the safety and reliability of the Russian Soyuz 

spacecraft; an opportunity to hardwire safety into the fabric of the Constellation 

Program; the suitability of agency management approaches; and technical Standards Program focused on safety and risks. 

In his testimony at the Subcommittee’s June 2009 hearing on ‘‘External Perspectives on the FY 2010 NASA Budget Request and Related Issues’’, the ASAP witness 

stated that while the Panel endorses and supports investing in a Commercial Orbital Transportation Services (COTS) program, it believes ‘‘at this juncture that 

NASA needs to take a more aggressive role articulating human rating requirements 

for the COTS Program since most programs are well underway. To do otherwise 

may, at a later time, pressure NASA into accepting a system for expediency that is 

below its normal standard for safety’’. In its 2008 report, the ASAP stated:

‘‘COTS vehicles currently are not subject to the Human-Rating Requirements 

(HRR) standards and are not proven to be appropriate to transport NASA personnel.’’

and

‘‘The capability of COTS vehicles to safely dock with the ISS still must be demonstrated.’’

In addition to its annual report, the Panel submits Minutes with recommendations to the NASA Administrator resulting from its quarterly meetings. The Panel 

held its Third Quarterly Meeting in July 2009 [the Panel’s most recent Quarterly 

Meeting was held on October 22, 2009 at the Kennedy Space Flight Center]. At that 

meeting, the Panel’s official minutes referenced the panel’s continuing concerns regarding the application of human rating criteria to commercial crew transportation 

services:

‘‘As far as the safety issues, they basically boil down to expanding the cargo capability to include crew. If that is done, the traditional method would be to apply 

full human rating criteria initially at the beginning of the program’s development. However, thus far NASA has consciously chosen to not use a traditional 

approach, and there yet have been any performance requirements identified to 

put crews on board a COTS vehicle. The Panel previously had made a recommendation regarding this issue and continues to be perplexed as to why 

NASA has delayed this important action.’’

‘‘The Panel has addressed its concern in its previous quarterly and annual reports. The issue is becoming more focused and more urgent. The prospect of a 

COTS delivery of cargo to space is organizationally and politically simpler than 

crew transport. The issue of human rating with COTS and the delivery of NASA 

astronauts into space is the primary concern. Admiral Dyer [Chairman of the 

ASAP] noted that the Panel remains concerned that in the probing of this question, NASA looks to the FAA, which doesn’t have the institutional history and 

people to speak clearly to the topic. This issue represents an opportunity for improved interagency performance.’’

Admiral Dyer also noted at the July meeting that ‘‘If the [commercial] vehicle is 

being designed to be a cargo hauler, that is a different mission and a different set 

of designs than a crew transporter.’’ Mr. John Frost, a Panel member, added that 

‘‘the human rating requirements for the Agency are built around the design process 

and those processes are ongoing now at the COTS contractors. It would be problematic to come back later to put these requirements into a process that is already complete.’’

As mentioned above, Mr. John Marshall, a member of the ASAP, will be a witness 

at the hearing and can provide additional details on the Panel’s work and safetyrelated concerns.
17

Commercially Provided Crew and Cargo Space Transportation Services 

At present there are no commercially owned and operated human space transportation systems in service. Only one company, Scaled Composites, has successfully 

launched and returned humans safely to space and back on suborbital flights in an 

experimental spacecraft [SpaceShipOne] and launch system. Virgin Galactic intends 

to purchase operational vehicles from Scaled Composites and enter into commercial 

operations. Originally slated to enter into commercial operations in 2007, they are 

currently projecting a 2011 debut for SpaceShipTwo’s suborbital flight operations. 

Several other companies/ventures also have plans to take paying passengers on suborbital ’tourism’ trips, but have not yet flown any craft to space with humans 

aboard. 

Along with space tourism, the ‘NewSpace’ community has stated that suborbital 

services will be able to provide opportunities for suborbital science experiments, suborbital travel and package delivery. According to members of this ‘Newspace’ community, after carrying out suborbital business operation, a number of them have 

hopes of being able to undertake orbital operations in the future. However, there 

are a number of regulatory concerns and technical issues that would have to be addressed, as well as significant investments made, before such a future could be realized. Orbital flight operations are considered significantly more challenging than 

suborbital flight operations.

Commercial Orbital Transportation Services Demonstrations 

Under the Commercial Orbital Transportation Services (COTS) Demonstration 

project, NASA is helping industry develop and demonstrate cargo space transportation capabilities. According to NASA, the COTS project provides a vehicle for industry to lead and direct its own efforts with NASA providing technical and financial assistance. NASA will invest approximately $500 million toward cargo space 

transportation flight demonstrations. There are currently two funded participants in 

the COTS demonstration project, namely Space Exploration Technologies (SpaceX) 

and Orbital Sciences Corporation (Orbital). 

According to NASA, as of September 16, 2009, SpaceX had completed 15 of 22 

milestones and has received a total of $243 million in payments, with $35 million 

available for the remaining milestones. Milestone tasks range from Project Plan Review to Flight Demonstration. SpaceX has begun manufacturing the flight Dragon 

capsule and Falcon 9 launcher to be used for the COTS demonstration flight 1. 

Under the terms of the current Space Act Agreement, SpaceX was scheduled to complete its first demonstration flight in June 2009 (The initial Space Act Agreement 

between NASA and SpaceX was signed in August 2006 and called for a scheduled 

first demonstration flight by September 2008). 

To allow additional time for Dragon and Falcon 9 manufacturing and testing programs, SpaceX indicated in June 2009 that it expected to complete its first demonstration flight in January 2010, with the second and third flights then planned 

for June 2010 and August 2010, respectively. However, making the first COTS demonstration flight in January 2010 will be challenging. According to an October 29th, 

2009 Space News article, development of the Falcon 9 rocket—along with that of its 

smaller sibling, the Falcon 1—has taken longer than SpaceX expected. The same 

Space News article reports that SpaceX’s range request for the inaugural Falcon 9 

flight made for February 2010 conflicts with another already approved launch. This 

is significant because of the relationship between the Falcon 9 inaugural flight and 

the first COTS demonstration flight. The first COTS flight must receive an FAA license before it is launched. In its June 2009 briefing to the Augustine Committee, 

SpaceX projected that the first COTS demonstration flight would occur 2 months 

after the inaugural Falcon 9 flight. The smaller Falcon 1, which is designed for 

transport of satellites to low Earth orbit and is not part of the COTS project, has 

encountered its share of developmental challenges. In July 2009, Falcon 1 successfully delivered the Malaysian RazakSAT satellite to orbit. Prior to a successful test 

flight in September 2008 at which time a dummy payload reached orbit, there had 

been three unsuccessful Falcon 1 flights, the first of which occurred in March 2006. 

As of September 16, 2009, NASA says that Orbital has completed 10 of its 

planned 19 milestones and has received a total of $120 million to date with an additional $50 million available for future milestones. The Orbital demonstration flight 

is currently planned for March 2011 due to the company’s decision to change its 

cargo transportation architecture from an unpressurized (external) cargo system to 

a pressurized (internal) cargo system. The initial Space Act Agreement signed in 

February 2008 had a scheduled first demonstration flight date of December 2010. 

According to NASA, the agency will not pay for any milestone until the milestone 

is successfully completed per the Space Act Agreement and approved by the agency. 
18

Should a milestone be missed, NASA says that it will evaluate partner progress 

made and recommend future actions that are in the best interest of the government.

Commercial Resupply Services 

In December 2008, NASA awarded contracts to two companies for the delivery of 

cargo to the ISS after the retirement of the Space Shuttle. The successful bidders 

for Commercial Resupply Services (CRS) contracts were Orbital and SpaceX, the two 

COTS demonstration program funded participants. NASA says that it awarded two 

contracts to mitigate the risk of being dependent on a single contractor. A protest 

lodged to the Government Accountability Office (GAO) in January 2009 by 

PlanetSpace, Inc, an unsuccessful bidder, was subsequently denied by GAO in April 

2009. 

The scope of the CRS effort includes the delivery of pressurized and/or unpressurized cargo to the ISS and the disposal or return of cargo from the ISS. In addition, there are non-standard services and special task assignments and studies that 

can be ordered to support the primary standard resupply service. NASA ordered 8 

flights valued at $1.88 billion from OSC and 12 flights valued at $1.59 billion from 

SpaceX. According to NASA’s press release announcing the contracts, the maximum 

potential value of each contract is $3.1 billion. Based on known requirements, the 

combined value of the two awards is projected at $3.5 billion. 

Each award under the contracts calls for the delivery of a minimum of 20 metric 

tons of cargo to the ISS, as well as the return or disposal of 3 metric tons of cargo 

from the orbiting complex. The CRS contracts are firm-fixed price, Indefinite Delivery Indefinite Quantity procurements with a period of performance from January 

1, 2009, through December 30, 2015.

Commercial Crew Transportation Services 

Although NASA currently has no contracts for the transportation of crew by commercially provided space transportation services [which do not at present exist], it 

has recently applied funds from the American Recovery and Reinvestment Act of 

2009 to work on the Commercial Crew and Cargo Program:

• A modification to the Bioastronautics contract with Wyle Integrated Science 

& Engineering Group was made to develop a set of human system integration 

requirements for application to commercial spacecraft in support of NASA’s 

Commercial Crew and Cargo Program. According to NASA, the human system integration requirements developed under this task order will be based 

on a review of existing Human Rating requirements, Spaceflight Human Systems Standards, Constellation Program requirements, Commercial Crew and 

Cargo Program Office operational concepts and requirements, and the Johnson Space Center Space Life Sciences Directorate Human Interface Design 

Handbook.

• NASA’s Commercial Crew and Cargo Program is applying Recovery Act funds 

to solicit proposals from all interested U.S. industry participants to mature 

the design and development of commercial crew spaceflight concepts and associated enabling technologies and capabilities. NASA plans to use its Space Act 

authority to invest up to $50 million dollars in multiple competitively awarded, funded agreements. This activity is referred to as Commercial Crew Development, or CCDev.

Commercial Spaceflight Federation 

According to the Commercial Spaceflight Federation (CSF), its mission is to ‘‘promote the development of commercial human spaceflight, pursue ever higher levels of 

safety, and share best practices and expertise throughout the industry. CSF member 

organizations include commercial spaceflight developers, operators, and spaceports’’. 

The Commercial Spaceflight Federation is governed by a board of directors, composed of the member companies’ CEO-level officers and entrepreneurs. 

The Federation recently voiced strong support for the report by the Review of U.S. 

Human Space Flight Plans Committee which included in its options the creation of 

a Commercial Crew program to develop commercial capabilities to transport crew 

to the International Space Station. 

Mr. Bretton Alexander, President of the Commercial Spaceflight Federation, will 

be a witness at the hearing and can provide details related to commercial provider 

plans to human rate commercial space transportation systems as well as the commercial space industry expectations of how NASA’s safety standards and requirements would be applied to commercially crewed spacecraft.
19

Chairwoman GIFFORDS. Good morning. This hearing has now 

come to order. 

This hearing this morning is the latest in a series of hearings 

that this Subcommittee is holding on a critical issue, an issue that 

we will have to take into consideration as Members of Congress 

and also the White House in considering the future direction and 

funding for NASA. In many ways, the topic of today’s hearing is 

one of the most important issues confronting us, namely, how to 

ensure the safety of those brave men and women whom the Nation 

sends into space to explore and push back the boundaries of the 

space frontier. Of course, I am not under any illusion that human 

spaceflight can ever be risk-free. Nothing in life, of course, is. 

The Apollo 1 fire, the Challenger, Columbia, these fatal accidents, as well as other spaceflight incidents that could have led to 

loss of life, have driven that point home in stark and tragic terms. 

Indeed, this Subcommittee is holding today’s hearing because we 

need to be sure that any decision being contemplated by the White 

House or by the Congress are informed by our best understanding 

of the fundamental crew safety issues facing our human spaceflight 

program. And in making those decisions, we should not let either 

advocacy or unexamined optimism replace probing questions and 

thoughtful analysis. 

That is why the Subcommittee has invited this distinguished 

panel of witnesses to appear before us today. We need the benefit 

from your perspective and experience as we examine critically important questions that Congress will need to have answered if we 

are to assess the various proposals that are being put forth. 

Much has been said about the potential future plans for exploration in recent months, but there has been precious little discussion about safety. Today’s hearing is the first step in rectifying that 

situation. 

Let me list just a few questions that we hope our witnesses will 

answer today. As several of the witnesses have put in their prepared testimony, the Constellation program strove to respond to 

the recommendations of the Columbia Accident Investigation Board 

that the design of the system that replaces the shuttle should give 

overriding priority to crew safety. The result is a system that is 

calculated to be significantly safer than the space shuttle, and two 

to three times safer than the alternative approaches considered by 

NASA. Given that, we hope that our witnesses as to whether—we 

will hear from them whether or not they believe that the burden 

of proof should be put on those who would propose alternatives to 

Constellation to demonstrate that their systems will be at least as 

safe as Ares and Orion. Alternatively, we would like to hear whether or not it would be acceptable to reduce the required level of crew 

safety on commercially provided crew transport services used to 

transport U.S. astronauts much below what looks likely to be 

achievable in the Constellation program. 

In addition, we need to hear our witnesses’ views on whether the 

timetable suggested for the availability of commercial crew transport services is realistic or not. That is, when one takes into account all of the steps, not just those that are explicitly safety related, that will need to be taken before the first NASA astronaut 

can ride to the International Space Station on an operational com-
20

mercial crew vehicle, do our witnesses believe that such vehicles 

will be available in time to meet a significant fraction of NASA’s 

ISS crew transfer and crew rescue needs prior to 2020 or not. Similarly, given those required steps, do our witnesses believe that 

would-be commercial crew transport service providers will be able 

to garner sufficient revenues from non-NASA passenger transport 

services to remain viable over that same time period or not. 

I ask these questions, and we will hear other questions of course 

from our members, because it is going to be difficult to make reasoned judgments about the wisdom of investing significant taxpayer dollars in would-be commercial providers or of altering 

Congress’s commitment to the existing Constellation program in 

the absence of clear answers. 

Finally, what do our witnesses consider to be the most important 

safety-related issues that will need to be addressed if we are to 

make our decisions on the future of NASA’s human spaceflight and 

exploration program, and, at the end of the day, what will Congress need to do to have the assurance that we have done all we 

can to ensure the safety of our Nation’s future human spaceflight 

activities? This is not a hypothetical question. It is fundamental for 

fulfilling our responsibilities as Members of Congress. With so 

much for our Subcommittee to consider, I am comforted that we 

have a very distinguished panel who can speak with conviction and 

knowledge about safety issues and everything that needs to be considered. 

So I welcome all of you to today’s hearing. All of us here of 

course are passionate about space, whether in the private sector or 

the public sector. We want the best possible future for our Nation 

in its space endeavors. I hope that this morning’s hearing will help 

us chart a productive and a responsible path forward. 

And finally, I would be remiss if we did not acknowledge the 

unique contributions of one of our witnesses to the advancement of 

safety in human spaceflight, and I want to welcome each of you to 

our hearing but particularly Gen. Tom Stafford, a veteran of Gemini, Apollo, Apollo-Soyuz, Shuttle Return to Flight, and countless 

other space flight efforts. He can speak as a true national hero and 

an authority. 

So in closing, I know that my colleagues join me in saying that 

we all owe General Stafford a great amount of debt for everything 

you have done for our country and we are honored, sir, that you 

are here with us today. Thank you. 

[The prepared statement of Chairwoman Giffords follows:]

PREPARED STATEMENT OF CHAIRWOMAN GABRIELLE GIFFORDS

Good morning. This morning’s hearing is the latest in a series of hearings that 

this subcommittee is holding on critical issues that the White House and Congress 

need to consider as decisions are made on the future direction and funding for 

NASA. In many ways, the topic of today’s hearing is one of the most important 

issues confronting us—namely, how to ensure the safety of those brave men and 

women whom the nation sends into space to explore and push back the boundaries 

of the space frontier. Of course, I am under no illusions that human spaceflight can 

ever be made risk-free. Nothing in life is. 

The Apollo 1 fire, the Challenger and Columbia fatal accidents, as well as other 

space flight incidents that could have led to loss of life, have driven that point home 

in stark and tragic terms. Indeed, this subcommittee is holding today’s hearing because we need to be sure that any decisions being contemplated by the White House 

and Congress are informed by our best understanding of the fundamental crew safe-
21

ty issues facing our human space flight program. And in making those decisions, 

we should not let either advocacy or unexamined optimism replace probing questions and thoughtful analysis. 

That is why the subcommittee has invited this distinguished set of witnesses to 

appear before us today. We need the benefit of your perspectives and experience as 

we examine critically important questions that Congress will need to have answered 

if we are to assess the various proposals that have been put forth. 

Much has been said about potential future plans for exploration in recent months, 

but there has been precious little discussion of crew safety Today’s hearing is a first 

step in rectifying that situation. 

Let me list just a few of the questions that we would like our witnesses to address 

today. As several of the witnesses at today’s hearing will testify, the Constellation 

program strove to respond to the recommendation of the Columbia Accident Investigation Board that ‘‘The design of the system [that replaces the Shuttle] should give 

overriding priority to crew safety . . .’’ The result is a system that is calculated to 

be significantly safer than the Space Shuttle, and two to three times safer than the 

alternative approaches considered by NASA. Given that, we hope to hear from our 

witnesses as to whether they believe that the burden of proof should be put on those 

who would propose alternatives to the Constellation program to demonstrate that 

their systems will be at least as safe as Ares/Orion. Alternatively, do they think it 

would it be acceptable to reduce the required level of crew safety on commercially 

provided crew transport services used to transport U.S. astronauts much below 

what looks to be achievable in the Constellation program? 

In addition, we need to hear our witnesses’ views on whether the timetable suggested for the availability of commercial crew transport services is realistic or not. 

That is, when one takes into account all of the steps—not just those that are explicitly safety-related—that will need to be taken before the first NASA astronaut 

can take a ride to the ISS on an operational commercial crew vehicle, do our witnesses believe that such vehicles will be available in time to meet a significant fraction of NASA’s ISS crew transfer and crew rescue needs prior to 2020 or not? Similarly, given those required steps, do our witnesses believe that would-be commercial 

crew transport services providers will be able to garner sufficient revenues from 

non-NASA passenger transport services to remain viable over that same time period 

or not? 

It will be difficult to make reasoned judgments about the wisdom of investing significant taxpayer dollars in would-be commercial providers or of altering Congress’s 

commitment to the existing Constellation program in the absence of clear answers 

to those questions. 

Finally, what do our witnesses consider to be the most important safety-related 

issues that will need to be addressed as we make our decisions on the future of 

NASA’s human space flight and exploration program. 

And, at the end of the day, what will Congress need to do to have the assurance 

that we have done all we could to ensure the safety of the nation’s future human 

space flight activities? That is not a hypothetical question. It is fundamental to fulfilling our responsibilities as Members of Congress. With so much for this subcommittee to consider, I am comforted by the realization that we have a very distinguished panel who can speak with conviction and knowledge about the safety issues 

that will need to be considered. 

I want to welcome each of you to today’s hearing. All of us who are passionate 

about space, whether in the private sector or the public sector, want the best possible future for our nation in its space endeavors. I hope that this morning’s hearing 

will help us chart a productive and responsible path forward. 

Finally, I would be remiss if I did not acknowledge the unique contributions of 

one of our witnesses to the advancement of safety in human space flight. I want 

to welcome each of you to today’s hearing. Lt. Gen. Thomas P. Stafford, a veteran 

of the Gemini, Apollo, Apollo-Soyuz, Shuttle Return-to-Flight, and countless other 

space flight efforts, can speak with authority on safety issues—he has lived them. 

He is a true national hero. 

So in closing, I know that my colleagues join me in saying that we owe Gen. Stafford and the other pioneers of human space flight a debt of gratitude. Without their 

efforts—and bravery—NASA would not have made the safety advances that it has.

Chairwoman GIFFORDS. The Chair now recognizes Mr. Olson for 

his opening statement. 

Mr. OLSON. Madam Chairwoman, I would like to yield to the 

ranking member of our full Committee if he is ready to make his 

statement at this time. 
22

Mr. HALL. I don’t know how ready I am but I will take a shot 

at it. 

I really enjoyed, Madam Chairman, your speech and I agree with 

everything you have said. You are in an unusual position to know 

what you are talking about and have more than just a passing interest and more than a committee chairman’s interest in the safety 

that we are going to talk about today, and I want to thank you for 

allowing me to make the statement and for holding this hearing. 

It is one of the topics that I think I am most passionate about and 

that is the safety of our crews. It simply has to be at the heart of 

everything NASA does in space. 

Also, I want to sincerely thank all of today’s witnesses for taking 

the time and effort. I know it takes time. You prepared yourself 

back during your lifetime for this presentation to us and you are 

the very type of citizen that comes here that gives us information 

from which we glean the ingredients that go into the bills, and we 

know it takes your time. Your time is valuable and you didn’t suffer to get here but you paid the price to get here. We are very honored to have each one of you. I want to sincerely thank all of you 

for taking the time and effort. 

I especially want to welcome a friend of mine here and have the 

liberty of saying a word or so about Gen. Tom Stafford. He is a 

good friend. He is a national hero. I have relied on his advice for 

many years. He is the kind of guy that I call and get him out of 

the garden or wherever he is, the library, wherever he may be, but 

I have called on him for a lot of information on many occasions and 

we have exchanged personal letters through the years, most recently when he chaired the Stafford-Covey Return to Flight Task 

Force established to ensure that the Columbia Accident Investigation Board’s recommendations were carried out. 

And we have a lot of important issues to cover today. The Columbia Accident Board gave NASA many safety recommendations and 

principles to follow in the design of future launch vehicles. In May 

of 2004, after carefully reviewing the findings, the Astronaut Office 

published their position on the safety of future launch systems. 

One recommendation was to include a crew escape system module 

as part of any new launch vehicle. In the NASA authorization bill 

of 2005, many of us worked together to ensure that such a system 

was part of NASA’s plans for the next human exploration vehicle, 

and I know we all will continue to insist that this remains the case. 

Much of what I say today is in a piece in Monday’s edition of 

Space News. Madam Chair, I would like to ask unanimous consent 

to include a copy of the May 4, 2004, Astronaut Office position on 

future launch system safety and throw in a copy of my November 

30th Space News editorial into the record. 

[The information follows:]
23
24
25
26
27
28
29
30
31
32
33
34
35

Chairwoman GIFFORDS. Without objection. 

Mr. HALL. And with that, I want to just say another word or so 

about Tom Stafford. He graduated from the U.S. Naval Academy 

ten years after Sam Rayburn came to my breakfast table to talk 

to my mother to tell her why he couldn’t appoint me to the Naval 

Academy. They were in school together at Mayo College there. It 

is now Texas A&M at Commerce, but they were friends forever. 

She was part of the first team to ever get Sam Rayburn to run for 

office. She wanted him to appoint me to the Naval Academy. He 

said there are just four reasons and all four reasons are his grades. 

Later, Madam Chairman, that came home to me because they ran 

an article in the paper when I was running for reelection for judge 

one time that I had made four F’s and a D one time and my dad 

had punished me for spending too much time on one subject. That 

wasn’t very good. But Tom has also flown two Gemini missions. He 

is the first Gemini mission, and he piloted the first rendezvous in 

space. He is cited by the Guinness Book of World Records for the 

highest speed ever obtained by a man, or a woman, I am sure, 

24,791 miles per hour during the reentry of Apollo 10. He was instrumental in our early space missions with the Russians. He 
36

logged over 507 hours in space and flew four different types of 

spacecrafts. He obtained the rank of three-star general and he 

served as a defense advisor to one of the great Presidents of the 

century, President Ronald Reagan. Tom and you other five gentlemen, we thank all of you for what you are doing and your presence 

here today. 

I yield back. Thank you, Madam Chairman. 

[The prepared statement of Mr. Hall follows:]

PREPARED STATEMENT OF REPRESENTATIVE RALPH M. HALL

Madame Chair I want to thank you for recognizing me to make a statement, and 

for holding today’s hearing on ensuring the safety of human space flight in future 

space transportation systems. It is one of the topics I am most passionate about. 

Safety of our crews simply must be at the heart of everything NASA does in space. 

I also want to sincerely thank all of today’s witnesses for taking the time and effort to share their unique and valuable wisdom and expertise with us. I especially 

want to welcome General Tom Stafford. Tom is a good friend and a real national 

hero. I have relied on Tom’s advice for many years, most recently when he chaired 

the Stafford-Covey Return to Flight Task Group that was established to ensure the 

Columbia Accident Investigation Board’s recommendations were carried out. 

We have a lot of very important issues to cover today so I will be brief. 

The Columbia accident board gave NASA many safety recommendations and principles to follow in the design of future launch vehicles. In May 2004, after carefully 

reviewing the findings, the Astronaut office published their position on the safety 

of future launch systems. One recommendation was to include a crew escape system 

as part of any new launch vehicles. In the NASA Authorization Bill of 2005, I ensured that such a system was part of NASA’s plans for the next human exploration 

vehicle, and I will continue to insist that this remains the case. 

Much of what I would say today is in my editorial piece in Monday’s edition of 

Space News. Madame Chair I’d like to ask unanimous consent to include a copy of 

the May 4, 2004 Astronaut Office Position on Future Launch System Safety; and 

a copy of my November 30, 2009 Space News editorial into the record. 

With that, I look forward to a very productive hearing and yield back my time.

Chairwoman GIFFORDS. Thank you, Mr. Hall. 

If there are other members who wish to submit additional opening statements, your statements will be added to the record at this 

point. 

Mr. OLSON. Madam Chairwoman? 

Chairwoman GIFFORDS. Yes. 

Mr. OLSON. May I make an opening statement? 

Chairwoman GIFFORDS. Sure. 

Mr. OLSON. Thank you very much. I appreciate that, and I know 

part of this is my fault for getting the ranking member in here. 

Madam Chairwoman, thank you for calling this morning’s hearing on a topic of paramount importance to the future of our human 

spaceflight program. The issue of safety is really the starting point 

from which all discussions about the course and purpose of our Nation’s human spaceflight program should begin. I am certain we 

would have a line of people out the door to test-drive the new rocket. That pioneering spirit is in the fabric of our Nation, but we 

must not take it for granted, not cheapen it by failing to provide 

the direction or performance, performing the diligence necessary to 

ensure the astronauts’ safety. 

I would like to thank our witnesses for their appearance before 

the Subcommittee today. I recognize that each of you has spent 

considerable time and effort preparing for this hearing and in some 

cases traveling long, long distances to be here, and we are not 

going to calculate General Stafford’s distance that he has traveled 
37

because he has got a big advantage over the rest of us. But please 

know that the Subcommittee appreciates your efforts as well as the 

wisdom and experience you bring and that we will refer to your 

guidance in the coming months and years ahead as the Committee 

goes forward. 

NASA is facing a transition away from the space shuttle to the 

Constellation program, a program that is in the midst of testing 

and design, desperately needs more funds, and thank you, Mr. 

Hanley, for all you have done for the Constellation program. But 

there is a theme across our entire spaceflight program, human 

spaceflight program. An increase in resources would enhance the 

abilities and capabilities of the commercial sector to allow their increased participation as well. I fully support all of the current endeavors including commercial cargo, but sadly, from my position, 

fully supporting and fully funding are not synonymous. I truly wish 

they were. 

Safety is and must be on the minds of the men and women of 

NASA all the time. We have astronauts orbiting in the ISS right 

now and each shuttle flight carries with it the extra increment of 

risk that an accident could end NASA as we know it. 

I would like in my brief time to focus on an area of concern to 

me that is just as critical as design standards, human ratings requirements, airworthiness, to name a few, and that is the issue of 

culture. Culture is difficult to define. I know that. But it is something that the Columbia Accident Investigation Board spent a great 

deal of time on. It found that, and this is a quote, ‘‘The NASA organizational culture had as much to do with this accident as the 

foam.’’ The Augustine report cites that, another quote, ‘‘Significant 

space achievements require continuity of support over many years. 

One way to assure that no successes are achieved is to continually 

introduce change.’’

It must not be lost on this committee that the increased participation of commercial providers will necessitate a change in business as usual at NASA. We cannot take that lightly. Changing the 

way a bureaucracy operates is not easy. In many cases, it is not 

advisable, and frustratingly, in most cases, not achievable, but 

make no mistake, I am not for letting the status quo dictate the 

way our government runs. I am just stating that in this case, a 

change like this brings challenges and risk that we must not overlook. 

The agency faces limited budgets, massive contractor layoffs and 

retirement of the signature program and perhaps a new way of 

doing things. Again, a new way of doing things is not inherently 

bad. I am not saying that. I am just saying it would bring forth 

challenges to a workforce and systems and processes that are every 

bit as difficult as designing rockets. 

I do not believe the CAIB report is a historical artifact but a 

guiding document. The Constellation program was designed with 

the CAIB freshly in mind, and we must keep that report fresh in 

ours as time goes on. 

The challenge of a lack of funding permeates every discussion we 

have about NASA but not a distant second is a lack of commitment 

to a defined program. We have a program before us. It is time we 

committed to it with our actions and the funding necessary to see 
38

it through. In my mind, the cost of not doing so far exceeds the 

amount needed to complete the task. We are a Nation founded by 

great explorers who were willing to take great risks. Great success 

is achieved out of the willingness to make great sacrifice. However, 

as a Nation, especially at taxpayer expense, we must be diligent in 

making sure that the promised success is worth the promised sacrifice. 

Thank you, Madam Chairwoman. I yield back my time. 

[The prepared statement of Mr. Olson follows:]

PREPARED STATEMENT OF REPRESENTATIVE PETE OLSON

Madam Chairwoman, thank you for calling this morning’s hearing on a topic of 

paramount importance to the future of our human space flight program. The issue 

of safety really is the starting point from which all discussions about the course and 

purpose of our nation’s human space flight program should begin. 

I am certain we would have a line of people out the door (and behind me, by the 

way) to test ride a new rocket. That pioneering spirit is in the fabric of our nation, 

but we must not take it for granted, nor cheapen it by failing to provide the direction or performing the diligence necessary to ensure their safety. 

I’d like to thank our witnesses for their appearance today before this subcommittee. I recognize that each of you has spent considerable time and effort preparing for this hearing, and in some cases traveling considerable distance (although 

we won’t calculate all of Gen. Stafford’s career miles) to be here. Please know that 

this subcommittee appreciates your efforts, as well as the wisdom and experience 

that you bring, and that we will refer to your guidance in the months and years 

ahead. 

NASA is facing the transition away from the space shuttle and to the Constellation program, a program that although is in the midst of testing and design, desperately needs more funds. But that is a theme across our entire human space flight 

program. An increase in resources would enhance the abilities and capabilities of 

the commercial sector to allow their increased participation in space as well. I fully 

support all of the current endeavors, including commercial cargo, but sadly from my 

position, fully supporting and fully funding are not synonymous. I truly wish they 

were. 

Safety is and must be on the minds of the men and women at NASA all the time. 

We have astronauts orbiting in the ISS right now, and each shuttle flight carries 

with it the extra increment of risk that an accident could end NASA as we know 

it. 

I would like in my brief time to focus on an area of concern that to me is just 

as critical as design standards, human-ratings requirements, and airworthiness, to 

name a few (and not making light of any of them) and that is the issue of culture. 

Culture is difficult to define I know, but it is something that the Columbia Accident Investigation Board spent a great deal of time on. It found that ‘‘the NASA 

organizational culture had as much to do with this accident as the foam.’’

The Augustine report cites that ‘‘significant space achievements require continuity 

of support over many years. One way to assure that no successes are achieved is 

to continually introduce change.’’ It must not be lost on this committee that the increased participation of commercial providers will necessitate a change in business 

as usual at NASA. We cannot take that lightly. Changing the way a bureaucracy 

operates is not easy, in many cases not advisable, and frustratingly, in most cases, 

not achievable. Make no mistake, I am not for letting the status quo dictate the way 

our government runs, I am just stating that in this case a change like this brings 

challenges, and risks, that we must not overlook. 

The agency faces limited budgets, massive contractor layoffs, the retirement of a 

signature program, and perhaps a new way of doing things. Again, a new way of 

doing things is not inherently bad, I am not saying that, I’m just saying that it will 

bring forth challenges to a workforce and to systems and processes that are every 

bit as difficult as designing rockets. 

I do not believe the CAIB report is a historical artifact, but a guiding document. 

The Constellation program was designed with CAIB freshly in mind, and we must 

keep that report fresh in ours as time goes on. 

The challenge of a lack of funding permeates every discussion we have about 

NASA. But a not distant second is the lack of a commitment to a defined program. 

We have a program before us; it is time we committed to it with our actions and 
39

the funding necessary to see it through. In my mind, the cost of not doing so far 

exceeds the amount needed to complete the task. 

We are a nation founded by explorers who were willing to take risks. Great success is achieved out of the willingness to make great sacrifice. However, as a nation, 

especially at taxpayer expense, we must be diligent in making sure that the promised success is worth the possible sacrifice. 

Thank you, Madam Chairwoman. I yield back by time.

Mr. HALL. Will the gentleman yield to me just one minute before 

he yields back his time? 

Mr. OLSON. Yes, sir. Yield back to the ranking member. 

Mr. HALL. Madam Chairperson, we have in the audience a longtime staffer and part of the bedrock of the NASA program and the 

bedrock of this Committee, Tom Tate. Tom, we are always glad to 

have you back here and thanks for the many years you have spent 

back on this side of the desk. 

Thank you, Madam Chairman. I yield back. 

Chairwoman GIFFORDS. Thank you. 

Because we anticipate votes probably occurring in about 45 minutes, I am going to ask if other members have additional opening 

statements that we submit them for the record at this point. 

We do have a distinguished set of panelists today. I would like 

to introduce them briefly. Mr. Bryan O’Connor is here. He is a veteran of two space shuttle missions and is currently the Chief of 

Safety and Mission Assurance at NASA. He will be discussing 

NASA’s processes and plans for resolving safety and human rating 

issues. Next we will hear from Mr. Jeff Hanley, who is Program 

Manager for the Constellation program at NASA. He will be discussing the steps taken by the Constellation program to maximize 

crew safety in its Ares-Orion System. We will also hear from Mr. 

John C. Marshall, who is a Council Member on NASA’s Aerospace 

Safety Advisory Panel. He will provide the perspectives of the 

agency’s outside safety advisory board. Welcome. Also, we will hear 

from Mr. Bretton Alexander, who is currently the President of the 

Commercial Spaceflight Federation. He will provide the commercial 

industry’s perspectives and plans for addressing crew safety issues. 

Welcome. Dr. Joseph Fragola is Vice President of Valador Incorporated. He has more than 40 years experience in risk analysis in 

the aerospace and nuclear industries and will provide his perspectives on the issues involved in ensuring the safety of both government and non-government crew space transportation systems, a 

true expert. Welcome, Dr. Fragola. And of course, Lt. Gen. Tom 

Stafford, who has been introduced a couple times already. We are 

just very, very delighted that you are here. 

As our witnesses should know, you will each have five minutes 

for your spoken testimony. Your written testimony will be included 

in the record for the hearing, and when you have completed your 

spoken testimony, we will begin with questions, and each member 

will have five minutes to question the panel, and we would like to 

begin this morning with Mr. O’Connor. 

STATEMENT OF BRYAN O’CONNOR, CHIEF OF SAFETY AND 

MISSION ASSURANCE, NATIONAL AERONAUTICS AND SPACE 

ADMINISTRATION 

Mr. O’CONNOR. Thank you, Chairwoman Giffords, members of 

the Subcommittee. I appreciate the opportunity to appear here 
40

today to discuss how NASA works to ensure the safety of human 

spaceflight. In your letter inviting me to testify at today’s hearing, 

you asked that I address a number of questions related to the Office of Safety and Mission Assurance at NASA and how we work 

with safety of human spaceflight. My statement will address those 

questions and provide additional context. 

The Office of Safety and Mission Assurance provides policy direction, functional oversight and assessment for all agency safety reliability and quality engineering activities. We are responsible for 

the agency’s safety and mission assurance requirements and standards and we serve as principal advisor to the Administrator on 

matters pertaining to human spaceflight safety and mission success. 

In the past several years, my organization has sponsored several 

initiatives to take advantage of our lessons learned from the past 

50 years of human spaceflight. Included are increased emphasis on 

the qualifications and credibility of our professional workforce, formal technical authority for associated safety and mission assurance 

requirements as well as the authority to determine safety risk acceptability for designs and for operations including human 

spaceflight launch, increased emphasis on safety culture throughout the human spaceflight programs. This includes more open communications including encouragement for dissenting opinions, clear 

appeal paths all the way to the Administrator as necessary for 

safety dissenting opinion, and something we started recently called 

the ‘‘Yes If’’ initiative. It is an incentive that promotes the ideal 

that credible and capable safety and mission assurance professionals don’t simply just know the rules but they understand the 

rationale behind those rules to the point that they can help the designer and the operator with alternative approaches consistent 

with safety and mission success, improvements in critical software, 

independent validation and verification and improvements in our 

knowledge management systems. A significant portion of these activities as well as improved audits, assessment and mishap investigation procedures and capabilities in the agency are primarily 

managed at the new NASA Safety Center, which we established 

two years ago in Cleveland near the Glenn Research Center. 

As I mentioned, much of our current thinking comes from hard 

lessons learned from the past. The Columbia Accident Investigation 

Board documented for us once again the inherent risk of human 

spaceflight, noting that ‘‘the laws of physics make it extraordinarily 

difficult to reach earth orbit and return safely.’’ To justify that risk 

the CAIB called for ‘‘a national mandate providing NASA a compelling mission requiring human presence in space.’’ It also recommended that design of the shuttle replacement should give overriding priority to crew safety rather than to trade safety against 

other performance criteria such as low cost and reusability or 

against advanced space operations capabilities other than crew 

transfer. The X–15 incidents, the Apollo fire, the Challenger, the 

Columbia accidents have caused us to insist on clear lines of accountability in what we do with strong checks and balances, capable systems integration and a strong safety culture with open communications in all directions. We treat every crewed spaceflight 

like an engineering test flight, retaining adequate program re-
41

sources to thoroughly prepare for each flight and to analyze and resolve ground and flight anomalies. Finally, we emphasize crew escape and emergency systems to improve crew survivability during 

anticipated or unanticipated flight contingencies. 

We have also learned an awful lot working with our Russian 

counterparts beginning in Apollo-Soyuz and continuing with Shuttle-Mir and the International Space Station about the challenges of 

spaceflight and safety of human spaceflight. For example, we note 

in the Soyuz design the robust reliability and failure tolerance features. The systems for unknown contingencies are treated with capable, highly capable abort, escape and emergency systems. 

On the matter of crew egress and escape and abort, the Columbia 

Crew Survival Investigation Report prepared by NASA Spacecraft 

Crew Survival Integrated Investigation Team released last December is a comprehensive study of crew safety equipment and procedures used during the Space Shuttle Columbia accident. We have 

made this report available to the Constellation program as well as 

to industry for use and guidance in their design for survivability. 

Finally, as we review the options presented by the Augustine 

panel, we are considering how best to address their suggested commercial crew transportation options. We are using fiscal year 2009 

Recovery Act funds to supplement or to support activities related 

to technologies that enable commercial human spaceflight capabilities. We are also investing Recovery Act funds to begin development of a more concise set of human rating technical requirements 

that might apply to non-NASA developers and we are looking at 

appropriate oversight and insight approaches to be used for such 

a venture. 

In closing, the Office of Safety and Mission Assurance plays a 

significant role in assuring safety of human spaceflight. Chairwoman Giffords, I would be happy to respond to any questions you 

or other members have on this matter. 

[The prepared statement of Mr. O’Connor follows:]

PREPARED STATEMENT OF BRYAN O’CONNOR

Chairwoman Giffords and other Members of the Subcommittee, thank you for the 

opportunity to appear today to discuss how NASA works to ensure the safety of 

human spaceflight. In your letter inviting me to testify at today’s hearing, you asked 

that I address a number of questions related to the Office of Safety and Mission 

Assurance and the safety of human spaceflight at NASA. My statement will address 

those questions, and provide additional context.

The Role of OSMA in Ensuring Human Spaceflight Safety 

The NASA Office of Safety and Mission Assurance provides policy direction, functional oversight, and assessment for all Agency safety, reliability, maintainability, 

and quality engineering and assurance activities and serves as a principal advisory 

resource for the Administrator and other senior officials on matters pertaining to 

human spaceflight safety and mission success. As Chief of the Office of Safety and 

Mission Assurance, I report directly to the Administrator. OSMA supports the activities of—but is organizationally separate from—the human spaceflight Mission 

Directorates and the Office of the Chief Engineer, thus providing the Administrator 

an independent view of the safety and effectiveness of human spaceflight designs, 

flight test and mission operations in addition to all other mission roles of the Agency. 

Specifically, the Office of Safety and Mission Assurance:

• Develops strategies, policies, technical requirements, standards, and guidelines for system safety, reliability, maintainability, and quality engineering 

and assurance;
42

• Establishes the applicable set of Safety and Mission Assurance (SMA) requirements for all human spaceflight programs, and, through delegated technical authority, formally approves or disapproves waivers, deviations and/or 

exceptions to same;

• Verifies the effectiveness of safety and mission assurance requirements, activities, and processes, and updates, cancels or changes them as time, technology and/or circumstances dictate;

• Advises NASA leadership on significant safety and mission assurance issues, 

including investigation of human spaceflight-related mishaps and close calls, 

and provides guidance for corrective actions stemming from those investigations as well as corrective actions related to ground and flight test anomalies;

• Performs broad-reaching independent assessments of human spaceflight-related activities, including formal Independent Validation and Verification 

(IV&V) of flight and ground software critical to flight crew safety;

• Oversees and assesses the technical excellence of safety and mission assurance tools, techniques, and practices throughout the human spaceflight program life cycle;

• Provides knowledge management and training in safety and mission assurance disciplines to the assigned workforce; and,

• Assures that adequate levels of both programmatic and Center institutional 

resources are applied to safety and mission assurance functions.

NASA Human Spaceflight Safety Initiatives 

In the past several years, OSMA has sponsored several initiatives with the intent 

of enhancing the safety of human spaceflight. OSMA has increased its emphasis on 

the qualification and credibility of safety and mission assurance professionals by 

working with the Center Directors to assign some of their best and brightest employees to safety and mission assurance positions. We have also established a new 

Technical Excellence Program with a four-tier training and qualification system for 

all safety and mission assurance professionals across the Agency. Additionally, safety and mission assurance professionals assigned to human spaceflight programs now 

have formal technical authority for associated safety and mission assurance requirements as well as the authority to determine safety risk acceptability for designs 

and/or operations, including human spaceflight launch. 

Another initiative is an increased emphasis on safety culture throughout the 

human spaceflight programs. This includes more open communications, including 

encouragement for dissenting opinions; clear appeal paths to the Administrator for 

safety dissenting opinions; and the ‘‘Yes if’’ initiative, an incentive that promotes the 

ideal that credible and capable safety and mission assurance professionals not simply know the rules, but understand their rationale to the point that they can help 

the design or operations team with alternative approaches consistent with safety 

and mission success. 

OSMA has also made improvements in critical software IV&V by increasing the 

emphasis on validation of critical software requirements early in design. The IV&V 

team is also increasing the use of modeling and other systems engineering techniques to enhance their effectiveness in assessing the safety and utility of the critical software. 

Improved knowledge management and requirements management tools and processes have also been put into place. This includes dedicated knowledge capture, 

archiving and dissemination activities, as well as better tools for tracking, updating, 

and rationalizing the more than 3,000 NASA technical and operational SMA requirements (many of which apply to human spaceflight). These activities, as well 

as improved audit, assessment and mishap investigation procedures and capabilities, are all primarily managed at the NASA Safety Center located near the Glenn 

Research Center. 

Finally, OSMA has increased the amount of mentoring, training and technical assistance provided by our Headquarters SMA experts to the human spaceflight programs and their host Center SMA and engineering organizations.

Incorporating Lessons Learned into Agency Standards and Procedures 

The Columbia Accident Investigation Board (CAIB) documented for us once again 

the inherent risk of human spaceflight, noting that ‘‘the laws of physics make it extraordinarily difficult to reach earth orbit and return safely.’’ To justify the risk, the 

CAIB called for ‘‘a national mandate providing NASA a compelling mission requiring human presence in space.’’ The Board also recommended that ‘‘ the design of 

the Shuttle replacement] should give overriding priority to crew safety, rather than 
43

trade safety against other performance criteria, such as low cost and reusability, or 

against advanced space operation capabilities other than crew transfer.’’

The many CAIB recommendations dealing with root causal factors, as well as 

NASA’s own Return to Flight assessments, pointed to several important lessons including, but not limited to, those outlined below. These recommendations and lessons indicate that NASA should:

• Maintain clear lines of accountability including strong checks and balances 

between program/project managers and their assigned independent technical 

authorities.

• Organize for a strong program-level systems integration function for complex, 

multi-element human spaceflight programs.

• Infuse the organization with a strong safety culture with open communications in all directions, encouragement of alternate opinions, and formal appeal 

paths for dissent.

• Treat every crewed space flight like an engineering test flight, and retain adequate program resources to thoroughly prepare for each flight and analyze 

and resolve ground and flight anomalies.

• Emphasize crew escape, abort and emergency systems and procedures to improve crew survivability during anticipated or unanticipated flight contingencies.

In the early 1990s NASA engaged in a joint U.S.-Russian project called ShuttleMir, picking up where the Apollo-Soyuz Test Project had left off in 1975. In preparation for the joint activity, NASA technical experts, including senior safety engineers, 

spent a significant amount of time over a three-year period talking with ApolloSoyuz veterans, visiting with current Russian counterparts, and reviewing the long 

history of Soyuz, Salyut, and Mir operations in an effort to understand the Russian 

approach to human spaceflight safety. The two governments also established a highlevel, joint technical oversight body (the Stafford-Utkin, now Stafford-Anfimov, Commission) in January 1995 to independently review Soyuz readiness for flight and to 

report its findings directly to the heads of agencies. In March 1995, Norm Thagard 

became the first U.S. astronaut to launch on the Soyuz. He and the other five astronauts who spent time on Mir used the Shuttle for subsequent transportation, but 

they all received training in Soyuz as their primary escape system. 

Following on the success of the Shuttle-Mir program, NASA and the Russian Federal Space Agency (Roscosmos) agreed to create a joint space station in 1993. The 

International Space Station (ISS) Intergovernmental Agreement and Memorandum 

of Understanding (the final version of which was signed in 1998) recognized the 

Russian government’s responsibility for crewmember safety for their elements, including Soyuz. The next American to launch on Soyuz was Bill Shepherd, the Commander of the first ISS increment in October 2000. Like Thagard, Shepherd returned to Earth on Shuttle, and like the Mir astronauts, he was trained on the 

Soyuz spacecraft. Since then, 14 different NASA astronauts have flown on Soyuz, 

bringing the total NASA astronaut trips to 14 up, and 13 down, several of which 

were made during the post-Columbia Return-to-Flight timeframe. Canadian and European partner astronauts have flown to and from ISS on Soyuz, and the next Soyuz 

will carry a Japanese partner astronaut. As we speak, Soyuz is the primary mode 

of transportation to and from the ISS for all ISS crewmembers. 

NASA’s Russian partner engineers and managers have been open with their designs, operations, system anomalies, and close calls; however, there have been occasions when, for various reasons, they have restricted technical information transfer 

to our engineers. On these occasions, perseverance by our technical staff on the 

ground and dependence on the Russians’ proven engineering and operational savvy 

that spans more than 40 years of human spaceflight, have resulted in sufficient confidence in their systems and operations (approximately 96 percent mission success 

rate, and 98 percent crew safety record for all versions since 1967), and mutual 

trust initiated during the ApolloSoyuz program, and reinforced most recently with 

over 15 years of joint space station operations. Some of the many human spaceflight 

safety lessons from NASA’s joint work with the Russians on Soyuz, Mir, and ISS 

include:

• The Russian design philosophy depends heavily upon reliability in addition 

to adherence to a strong design heritage (robust systems and failure tolerance, often using dissimilar redundancy), but they are big believers in abort, 

escape, and emergency systems for known or unknown contingencies that are 

not covered by reliability alone.
44

• The Russian design philosophy also rests heavily on testing. During the 

Soyuz update from the TM (modified transport) to TMA (TM anthropometric) 

version (enlarged in the 1990’s to accommodate larger astronauts), they performed multiple tests, including drop tests, to ensure that the design was 

equivalent, or superior, to previous versions. This testing is often carried to 

conditions beyond the nominal expected environments. As Roscosmos prepares to upgrade the control computer system on the Soyuz, they are first installing and testing this upgrade in the Progress cargo vehicles. In this way, 

they can flight test the system with less critical cargo before it is required 

to transport crew. This provides an additional rigorous test and helps to insure overall crew safety.

• The Russian development philosophy is based on evolutionary upgrades, 

keeping what works, and modifying or replacing what does not.

• The Russian design and operational organizations include reliability and 

quality engineering staffs, but they do not have an independent safety engineering staff like NASA does. That said, they include many of the same safety 

functions as NASA does as part of the other engineering disciplines, and they 

do provide one of their most experienced engineers as NASA’s SMA counterpart.

• The Russian technical staff is very skilled and displays outstanding knowledge of the flight systems. With relatively low turnover, they also have excellent corporate memory, which helps them deal with any repeat problems.

• The Russians, unlike NASA, rely on automation and ground control for certain critical dynamic events like abort initiation, landing, proximity operations and docking.

Although NASA and Roscosmos have occasionally disagreed about relative risk 

levels for such things as orbital debris, battery hazards, etc., our experience to date 

shows us that they have no intention of putting crewmembers in known unsafe situations for the sake of expediency. 

The Columbia Crew Survival Investigation Report, prepared by the NASA Spacecraft Crew Survival Integrated Investigation Team (SCSIIT) and released in December 2008, is a comprehensive study of crew safety, equipment and procedures used 

during the Space Shuttle Columbia accident. The report contains 29 specific findings, half of which apply to Space Shuttle and to NASA investigation procedures, 

and half to future designs. The Constellation Program has assessed the report’s 

findings, incorporating several of them into the Orion design, and the Program 

plans to incorporate others as the design matures. The fundamental theme of the 

findings is that human spaceflight programs should include crew survivability in the 

system design, and that operational plans should provide for safe egress, abort and/

or escape from contingency situations. This is a top level requirement in NASA’s 

most recent human rating requirements policy contained in NASA Procedural Requirement (NPR) 8705.2B (May 6, 2008). The rationale comes from our three fatal 

human spaceflight accidents. It is not enough to design a human spaceflight system 

to be reliable. The Earth-to-orbit mission is about managing incredibly high-energy 

systems and environments, with very little room for error. When measured by number of flights, human spaceflight transportation is still relatively immature, and the 

designers and operators are continuously learning about the real risks involved with 

spaceflight activities. Thus, as the report highlights, and the human rating requirements mandate, there is a need to provide the crew with a fighting chance for survival if and when something goes wrong, anticipated or not. 

The Constellation Program is using the SCSIIT report as a design guideline; and 

as the Program tailors its suggestions into Program requirements, we in OSMA are 

drafting a follow-on technical standard for use by future human spaceflight system 

developers. The design standard will provide cues for designers and will also make 

it clear that the addition of any systems to increase the survivability of the crew 

needs to consider both the system design and concept of operations. In the meantime, NASA has made the SCSIIT report available to the public, sending copies directly to all known commercial space companies. The SCS1IT has also given presentations about the associated lessons-learned to NASA Centers, as well as to the National Transportation Safety Board, Federal Aviation Administration, the Department of Defense, the Defense Contract Management Agency, and others totaling 

over 4000 people to date.

Safety and Commercial Spaceflight 

NASA will require that any Earth-to-orbit and/or orbit-to-Earth system that carries NASA astronauts be human rated, thus ensuring that all of our stringent crew 
45

and launch safety requirements would be met before any NASA crew would be allowed to travel on a spaceflight vehicle. As part of that process, the Agency’s Technical Authorities (Engineering, SMA and Health and Medical) will determine which 

of NASA’s mandatory standards apply in designing, manufacturing and operating 

their system. OSMA and the Johnson Space Center SMA organization worked closely with the Constellation program for over six months in 2008 to establish and tailor 

the applicable SMA requirements for the Constellation Program. This was a very 

detailed and involved activity that reminded us that the job of validating the right 

set of requirements for a new crewed flight system is not a simple cookie-cutter or 

checklist task. Nor is it expected to be a one-time task. The requirements refining 

and tailoring process will continue as we learn more about the design, the environment and the operational concepts. NASA’s Commercial Crew and Cargo Program 

Office has initiated an effort to determine and establish the requirements (both 

process and design) as well as any other standards that should apply to commercial 

partners when engaging in services for transporting astronauts. 

Currently, NASA is working with two companies, Space Explorations Technologies 

Corporation (Space X) and Orbital Sciences Corporation (Orbital), as part of individual Commercial Orbital Transportation Services (COTS) projects designed to develop and demonstrate commercial cargo capabilities to and from low-Earth orbit. 

In doing so, NASA has agreed to pay both companies prenegotiated amounts when 

each company achieves pre-negotiated milestones outlined in Space Act Agreements, 

and OSMA is part of the review team assessing each company’s progress toward 

meeting required milestones. Last year, NASA also issued contracts to both Space 

X and Orbital, for cargo delivery to the ISS under the Commercial Resupply Services (CRS) Program. 

NASA is utilizing FY 2009 Recovery Act funds to support activities to stimulate 

efforts to develop and demonstrate technologies that enable commercial human 

spaceflight capabilities. NASA is also investing Recovery Act funds to begin development of a more concise set of NASA human rating technical requirements. These 

requirements would be applicable to NASA developed crew transportation systems 

as well as commercially-developed crew transportation systems for use by NASA. 

This task is being performed by a team comprised of representatives from NASA’s 

human spaceflight programs, the Astronaut Office, and Agency technical authorities, including OSMA. We are also consulting with other Government partners such 

as the Federal Aviation Administration and with commercial stakeholders.

Conclusion 

In closing, the Office of Safety and Mission Assurance plays a significant role in 

ensuring the safety of human spaceflight. By continually improving its workforce, 

communications, and processes, the Office of Safety and Mission Assurance is an organization of technical excellence that is well-equipped to support the Agency’s 

human spaceflight safety efforts. By disseminating and incorporating into its standards and policies the many lessons learned throughout the history of human 

spaceflight, NASA is able to improve safety in its own future designs, and to facilitate safety in those that may be developed commercially. 

Chairwoman Giffords, I would be happy to respond to any questions you or the 

other Members of the Subcommittee may have.

Chairwoman GIFFORDS. Thank you, Mr. O’Connor. 

Mr. Hanley. 

STATEMENT OF JEFF HANLEY, PROGRAM MANAGER, CONSTELLATION PROGRAM, EXPLORATION SYSTEMS MISSION 

DIRECTORATE, NATIONAL AERONAUTICS AND SPACE ADMINISTRATION 

Mr. HANLEY. Good morning. Chairwoman Giffords and members 

of the Subcommittee, thank you for the opportunity to appear here 

today to discuss NASA’s emphasis on the continuing effort to improve safety factors for our most valuable commodity, NASA’s astronauts. Simply put, safety is a top priority of NASA’s Constellation program. 

My testimony today will outline how the Constellation program 

has sought to improve crew safety above that achieved in previous 

crewed spacecraft. This has been accomplished by incorporating 
46

safety into the Constellation design process from the very beginning, and in doing so, we are ensuring that the Constellation vehicles are being designed to account for future missions beyond low 

earth orbit as well as the less challenging requirements of our current Space Station missions. 

However, before we delve too far into the Constellation program’s 

risk-informed design process, I think it is first important that we 

take a look back where we came from. Many of you have touched 

on some of that foundation here this morning already. Following 

the loss of the Space Shuttle Columbia, NASA chartered the Columbia Accident Investigation Board to provide the agency with the 

guidelines for moving forward with our return to flight activities. 

Mr. O’Connor cited the finding in their report, and I won’t repeat 

it here again, that informed our design efforts going forward from 

there. The crew office also put out a memo then in 2004 weighing 

in on the discussion about how the next generation human 

spaceflight system should be designed, stating that an order of 

magnitude reduction ‘‘in the risk of loss of human life during ascent compared to the space shuttle is both achievable with current 

technology and consistent with NASA’s focus on steadily improving 

rocket reliability and should therefore represent a minimum safety 

benchmark for future systems.’’ NASA’s Exploration Systems Architecture Study of 2005 used this guidance in recommending that 

NASA select a single, solid first-stage concept that would later become known as the Ares I Crew Launch Vehicle. 

Today, the Constellation program has a design goal of increasing 

astronaut safety 10-fold relative to shuttle missions and we believe 

that this goal is achievable for four key reasons. First, Constellation is utilizing a multifaceted design approach that remains unchanged since Apollo: design the system to be inherently as safe as 

we can make it, eliminate known risks and hazards where we find 

them and then add backup such as an abort system to mitigate the 

residual risk. In addition to leveraging systems with human-rated 

heritage such as the space shuttle solid rocket motor, NASA is utilizing improved computer modeling to help identify, reduce and 

eliminate hazards and risks where we find them. 

Second, unlike the space shuttle, the Orion capsule will have a 

launch abort system. During Apollo, NASA had comparatively little 

experience and computational capability and the abort effectiveness 

of such a system was only estimated. Today we can use advanced 

simulation tools and computers to test within the computer so that 

NASA can conduct a more thorough analysis in addition to utilizing test flights. 

Third, Constellation has chosen to tightly interweave design and 

safety team members into the design process. The team has actively worked with design engineers to provide expertise and feedback via various assessments and analyses throughout the design 

maturation process and that process is ongoing and continues. 

And finally, Constellation has used the agency’s active risk management approach that identifies technical challenges early in the 

design process and aggressively works solutions. Technical risks 

are identified by likelihood of occurrence and consequence, allowing 

designers to modify the emerging design to reduce or eliminate 

hazards. 
47

Currently, the Constellation program is progressing through an 

active phase of hardware and software tests, and as tests are completed and data analyzed, our models will be updated, allowing us 

to improve safety and improve system performance. At the same 

time, we are investing heavily in risk-reduction hardware and activities that will help better calibrate and refine our models and 

simulations data that is essential to incorporate as early as possible into the Ares I and Orion designs. 

NASA is also developing an integrated test and verification plan 

as part of its program preliminary design review in the next calendar year that includes a series of developmental tests to further 

refine and validate our designs. For example, on October 28, NASA 

completed the Ares I–X test flight at the Kennedy Space Center in 

Florida, and although the data is still being collected and processed 

from more than 700 onboard sensors, the data is already providing 

tremendous insight into the aerodynamic, acoustic, structural, vibrational and thermal forces that Ares I is expected to experience, 

knowledge that will contribute substantially to the reliability and 

safety of the Ares I design. 

In closing, I would like to reiterate that safety is and always will 

be our number one priority in everything we do and that everyone 

at NASA is dedicated to ensuring that our astronauts are equipped 

to safely conduct the missions asked of them and that they are able 

to return safely home. 

Chairwoman Giffords, I would be pleased to respond to any questions the member might have. 

[The prepared statement of Mr. Hanley follows:]

PREPARED STATEMENT OF JEFFREY HANLEY

Chairwoman Giffords and Members of the Subcommittee, thank you for the opportunity to appear today to discuss NASA’s next-generation human spaceflight program and the Agency’s emphasis on continuing to improve safety factors for our 

most valuable assets—the men and women who dare to explore the mysteries of our 

universe. Everyone at NASA is dedicated to ensuring that these brave pioneers are 

equipped to safely conduct the missions asked of them, and that they are then able 

to safely return home to their loved ones. Simply put, safety is the first of our core 

values at NASA, and it is also the top priority of the Agency’s Constellation Program. 

As requested in your invitation to me to testify at today’s hearing, my testimony 

will outline NASA’s ongoing focus on safety matters with regard to human 

spaceflight, focusing primarily on how the Agency sought to improve crew safety for 

the Constellation Program above that achieved on previous crewed spacecraft. This 

has been accomplished by incorporating safety in all aspects of Constellation from 

the beginning of the design process. My testimony will also outline how the Constellation Program has progressed into the early developmental testing stages, and 

how data from those tests is being used to improve our models and to validate the 

rigorous safety requirements developed for the Constellation vehicles.

Columbia Accident Investigation Board and the Exploration Systems Architecture Study 

In 2003, the Columbia Accident Investigation Board (CAIB) report provided NASA 

with guidelines for moving forward with our return to flight efforts. In addition to 

determining the causes of the Columbia accident, the CAIB also provided the Agency with a set of comprehensive recommendations to improve the safety of the Space 

Shuttle Program and to change the corporate culture of the Agency—changes that 

have positively impacted the Constellation Program. NASA has also established 

processes that enhance our ability to assess risk and to improve communication 

across all levels and organizations within the Constellation team. 

More specifically, with regard to the design of the next-generation crew launch vehicle, the CAIB recommended that:
48

‘‘The design of the system [that replaces the Shuttle] should give overriding priority to crew safety, rather than trade safety against other performance criteria, 

such as low cost and reusability, or against advanced space operation capabilities other than crew transfer.’’

In other words, the CAIB gave NASA clear guidance that the next-generation 

crew launch vehicle should be simpler and safer, and that crew safety should be the 

driving design principle. Now the question became, how did we meet this challenge? 

More specifically, how did we make a vehicle ‘‘inherently safe’’ while also protecting 

against residual risk, in a mass-constrained, highly-energetic system such as a 

launch vehicle? We started by going back to the basics, first identifying the known 

risks and hazards and then working to eliminate, or at least to minimize, each one 

of them. From there, the designers turned their attention to developing acceptable 

mitigation approaches for the residual risks. From the beginning, this complicated 

and lengthy process, known as risk-informed design, has been at the heart of 

NASA’s Constellation Program. 

However, before there was even a program known as Constellation, NASA used 

the CAIB guidance and other policy directives to initiate the Exploration Systems 

Architecture Study (ESAS) in 2005 with the purpose of assessing and defining the 

top-level requirements and configurations for crew and cargo launch systems, not 

only to support future lunar and Mars exploration programs, but also to support the 

International Space Station. 

In conducting its review, the ESAS team focused on guidance issued by the Chief 

of the Astronaut Office in May 2004—particularly on one key statement, which 

states:

The Astronaut Office believes that an order-of-magnitude reduction in the risk 

of loss of human life during ascent, compared to the Space Shuttle, is both 

achievable with current technology and consistent with NASA ’s focus on steadily 

improving rocket reliability, and should therefore represent a minimum safety 

benchmark for future systems. This corresponds to a predicted ascent reliability 

of at least 0.999.

Keeping in mind the CAIB recommendation of focusing on crew safety first, ESAS 

placed a premium on crew safety. All candidate crew launch vehicle concepts considered during ESAS included an escape capability referenced as a launch abort system 

or LAS. During the study, NASA eliminated any launch vehicle concept that did not 

approach at least a predicted probability for loss of crew (LOC) of 1 in 1,000 missions. In addition, concepts that would place the crew module in close proximity to 

the boosters and/or other potential sources of accident initiation were eliminated to 

improve the reliability of a LAS and to improve the likelihood of crew survival in 

the event of an accident during ascent. This process resulted in the selection of the 

single solid First Stage concept, which would later become known as the Ares I 

Crew Launch Vehicle. In the end, the potential for increased safety provided by Ares 

I (compared to other alternatives considered during ESAS) was based primarily on 

the simplicity of the First Stage. 

As compared to the Space Shuttle, the Ares I will be a simpler vehicle to process 

prior to launch because NASA has designed the Ares Ito have fewer moving parts, 

thus requiring less hands-on labor prior to launch, and also reducing the potential 

for human error. In addition to the inherent safety associated with the rocket’s simplified design, the Ares I integrated rocket will have a LAS for crew, as will be outlined in greater detail during the next section of this testimony.

The Constellation Program and Risk-Informed Design 

In the Apollo era, crewed launchers were designed with the best level of expertise 

available, tested to exhaustion, and then robustness or redundancy was added to 

mitigate the residual risk. The goal was to make the design as reliable as possible, 

so that backup systems would never have to be used, and to make the backup systems as robust as possible to maximize the likelihood of crew survival and return, 

should a failure (anticipated or not) of the primary system or element take place. 

This approach worked, producing dramatic advances in reliability and crew safety, 

as proven, for example, when the Lunar Module did not experience a single anomaly 

on the final lunar mission, and the crew survived despite the explosion aboard the 

Command/Service Module during the Apollo 13 mission. However, as my colleague, 

Bryan O’Connor, will outline in his testimony, safety at NASA is also about more 

than design. NASA’s focus on safety also includes ensuring that our crews and operators know how to deal with contingencies, and that, when someone has a concern 

about a safety issue, whether it be a crew member, a design team member etc. that 

there are clear paths for those who have dissenting opinions to raise their concerns 

to senior management. 
49

Today, NASA’s Constellation Program has a goal of increasing astronaut safety 

tenfold relative to Shuttle missions. While a seemingly daunting challenge, NASA 

believes that this goal is achievable for many reasons. 

First, NASA is utilizing a multi-faceted design objective for safety that remains 

the same as during the Apollo era—design the system to be as inherently safe as 

we can make it, and then add backup to mitigate the predicted as well as unknown 

residual risk. This, along with aforementioned guidance issued by the Chief of the 

Astronaut Office in May 2004, was the starting point of the Constellation design 

team. As has been stated, inherent safety implies the elimination of hazards that 

have historically been associated with the operation of the type of system being designed. This, in turn, implies the systematic identification of the hazards associated 

with operation of the system alternatives being considered. 

The key to a risk-informed design is integrating risk analysis into the design alternative evaluation and selection process in a fundamental way by using newly capable, logical, and phenomenological (or physics-based) computer models. These 

models help focus the design effort toward identifying and reducing or eliminating 

design hazards, which, in turn, helps NASA identify and develop mitigation approaches to address the residual risks. In addition, NASA recognizes that safety of 

an overall system can be improved by addressing human factors issues, which is 

why the Ares I Upper Stage and Orion designs have been developed to simplify and 

automate processing and operations as much as possible, thus reducing the potential for human error. 

Second, unlike the Space Shuttle, the Orion crew capsule will have a LAS that 

will offer a safer and more reliable method of moving the entire crew out of danger 

in the event of an emergency on the launch pad or during the climb to Earth orbit. 

Mounted at the top of the Orion and Ares I launch vehicle stack, LAS will be capable of automatically separating the Orion from the launch vehicles and positioning 

the Orion and its crew for landing. In comparison, during Apollo, NASA had comparatively little experience and computational capability, and the abort effectiveness 

was estimated by comparison to escapes from high-performance military aircraft 

combined with the results of a few escape system tests. Today, with the flight tests 

combined with advanced simulation tools and advanced computers available, NASA 

can conduct a more thorough analysis. Specifically, the integrated abort system’s effectiveness can now be calculated using computer models of the blast environment 

by employing more realistic, physics-based, simulations of abort conditions. While 

computer models and computational capability were much less capable during the 

Apollo era, today this calculation can be carried out with remarkable speed and accuracy given NASA’s evolved engineering expertise and the computational power of 

our computers. 

Third, Constellation has chosen to tightly interweave the design and safety team 

members into the decision making process. As a result, the Constellation team represents skills from safety and reliability engineering disciplines traditionally found 

under the Safety and Mission Assurance organizations, as well as engineers with 

backgrounds such as computational fluid dynamics, aerospace, and physics disciplines. The team has been given the clear direction to work daily with the design 

engineers to provide expertise and feedback via various assessments and analysis 

techniques throughout the design maturation process. This investment demonstrates a sincere commitment to the CAIB findings. 

Finally, as a key element of our risk-informed design process, the Agency has an 

active risk-management process that identifies technical challenges early in the 

process and aggressively works solutions. The Program identified key risks during 

the risk management process and associated mitigation steps to inform the designs. 

Technical risks are identified by likelihood of occurrence and consequence. For example, NASA is currently working a thrust oscillation risk for the Ares I First 

Stage. This phenomenon is a characteristic of all solid rocket motors. NASA has 

made significant progress in identifying both primary and backup approaches to 

mitigate the oscillation effect, and we now believe that we have now baselined a 

passive mitigation technique. However, additional testing will continue to ensure we 

have the best mitigation prior to making the final decision at the Constellation Program’s Preliminary Design Review (PDR) early next year. With regard to the Upper 

Stage, the J–2X engine remains a priority, with the focus being on achieving needed 

performance requirements while also incorporating modem approaches (e.g., materials, manufacturing, electronics, etc) into this Apollo-era heritage hardware. 

In choosing a Shuttle-derived architecture, NASA recognized from the outset that 

some of the heritage hardware would need to be modified or replaced so as to 

achieve improved safety, reliability, as well as to meet needed performance and 

lower lifecycle costs. At the same time, the Agency recognized that leveraging systems with human-rated heritage would reduce the uncertainties and risks associ-
50

ated with developing a new human-rated crew launch vehicle. For example, the Ares 

I First Stage consists of a five-segment reusable solid rocket motor (RSRM), an aft 

skirt, a forward skirt, and a frustum. The five-segment RSRM is an evolutionary 

development from the four-segment solid RSRM strap-ons currently utilized to 

power the Space Shuttle. As a result, the Constellation Program is building on the 

proven track record of this heritage hardware. There have been 252 solids flown in 

the Shuttle Program with one failure (Challenger STS–51L). The Ares I also benefits from the improvements in the RSRMs that have resulted from recovery and 

post-flight inspections along with modifications that have been made to the Shuttle 

boosters. The Ares I booster also will continue the protocol of recovery and postflight inspection that began in the Shuttle Program. 

The J–2X engine would be used for both the Ares I and Ares V vehicles, thus creating a common link between the two vehicles that is based on evolved heritage 

hardware, specifically the powerful J–2 engine that propelled the Apollo-era Upper 

Stage on the Saturn I–B and Saturn V rockets, and the J–2S that was developed 

and tested in the early 1970s. In addition, the J–2X will leverage knowledge from 

the Delta IV’s RS–68 by incorporating manufacturing techniques from the RS–68 

into the J–2X engine. However, NASA recognizes that there are also challenges involved with utilizing and integrating heritage systems into new vehicles, so for the 

J–2X, NASA has taken steps to increase the amount of component-level testing, to 

procure additional development hardware, and to work to make a third test stand 

available to the contractor earlier than originally planned. 

Already, the Ares I risk assessment and failure analysis teams have provided 

input and/or impacted the outcome of Ares I design issues, trades, or risks on numerous challenges, including:

• Abort triggers study: Provided LOC and Abort Effectiveness assessments, including engineering models and timing, to determine what potentially catastrophic scenarios warrant abort sensors and software algorithms;

• Separation study (booster deceleration motors ): Hazard analysis combined 

with probabilistic design analysis led to the design decision to increase the 

number of booster deceleration motors from eight to 10; and,

• The Hazards Team identified that the First Stage and Upper Stage designs 

failed to meet properly at the interface flange (due to differing number of 

bolts) and a re-design was instituted. The team provided an assessment to 

Upper Stage that resulted in clocking of the hydrogen and oxygen vents to 

improve separation distance.

While NASA awaits further direction from the President and Congress with regard to the future of human spaceflight, the Agency is continuing to pursue our current programs, per direction from the Office of Science and Technology Policy. Currently, the Constellation Program is progressing through an active phase of hardware and software tests and, as tests are completed and data analyzed, our models 

will be updated, allowing us to improve safety and improve systems performance. 

At the same time, we are investing heavily in risk-reduction hardware and activities 

that will help calibrate and refine our models and simulations related to the Ares 

I and Orion—data that is essential to incorporate as early as possible into vehicle 

designs, based on the Program’s risk-based design approach. NASA is developing an 

Integrated Test and Verification plan that includes a series of developmental tests 

to further refine and validate our designs. Test flights, for example, are being designed to include several hundred measurement points that will characterize the actual operating environment and system performance in the most stressing of cases. 

NASA is in the process of continuing to refine this test and verification strategy 

prior to the Program’s PDR early next year, when the Integrated Test and 

Verification plan will be baselined. 

Following are just a few examples of recent and upcoming developmental tests 

which have yielded, or are expected to yield, significant amounts of data that will 

be incorporated into our risk-based design effort:

• In September 2009, NASA and ATK conducted the first test of the Ares I’s 

five-segment development motor in Promontory, Utah. This test provided 

NASA with valuable thrust, roll-control, acoustics and vibration data as engineers continue to design the Ares I. In all, seven ground tests are scheduled 

for the five-segment booster.

• In October 2009, the Ares I–X test flight took place at Kennedy Space Center 

in Florida. Although data is still being collected and processed from more 

than 700 on-board sensors, preliminary results show that the vehicle performed precisely as it was meant to perform. Early data shows that the vehicle was effectively controlled and stable in flight. Thrust oscillation fre-
51

quencies and magnitude data from the Ares I–X flight are consistent with 

measurements from recent Shuttle flights that were instrumented, leading us 

to conclude that the oscillation vibration on the Ares I would be within the 

bounds that the Ares I is currently being designed to. When assessment of 

this data is finalized, we believe it will provide tremendous insight into the 

aerodynamic, acoustic, structural, vibration, and thermal forces that Ares I is 

expected to experience—knowledge that will contribute substantially to the 

reliability and safety of the Ares I design, as well as to enhancing NASA’s 

modeling capabilities for future vehicles.

• In March 2010, NASA plans to perform its first developmental test of the 

Orion LAS at the White Sands Missile Range, New Mexico. This test will validate the LAS design approach and will contribute substantially to the Orion’s 

final designs for reliability and safety. NASA plans a series of tests to characterize the LAS. The Pad Abort I test is the first of these tests, and it will 

address what happens if an emergency occurs while the Orion and the launch 

vehicle are still on the launch pad. Other tests will determine how the LAS 

performs in critical parts of the flight regime.

Human Rating and the Constellation Vehicles 

The launch of any spacecraft is a very dynamic event that requires a tremendous 

amount of energy to accelerate to orbital velocities in a matter of minutes. There 

also is significant inherent risk that exposes a flight crew to potential hazards that 

could be catastrophic, if not controlled. Therefore, through a very stringent process 

of human rating, NASA attempts to eliminate hazards that could harm the crew, 

control the hazards that do remain, train the crews and operators to react appropriately, control the manufacturing and test of all components to minimize errors, 

and provide for crew survival even in the presence of system failures. Spaceflight 

vehicles are cleared by NASA to carry crew for missions that are associated with 

specific mission and performance requirements in an engineering flight test environment. It is also important to note that certification is made for an entire spaceflight 

system (i.e. Ares I, Orion, and associated ground support infrastructure count as one 

entire system), and not for specific elements of a system. NASA is currently in the 

process of developing those specific mission requirements for Ares I and Orion. 

To guide the evolution of human rating requirements for any mission, NASA is 

developing Agency-level requirements documents. However, human rating a 

spaceflight system is not as easy as following one document. Instead, it is an intricate, continuing process, involving the translation of requirements into designs that 

can be built, tested, and certified for flight, and an understanding of risks with mitigation approaches in place. However, the challenge to projects such as Ares I and 

Orion is that there is no single document that spells out what they should do to 

receive a human rating certification from the Agency. 

NASA is investing FY 2009 Recovery Act funds to begin development of a more 

concise set of NASA human rating technical requirements. These requirements 

would be applicable to NASA developed crew transportation systems as well as commercially-developed crew transportation systems for use by NASA. This task is 

being performed by a team comprised of representatives from NASA’s human 

spaceflight programs, the Astronaut Office, Agency technical authorities, including 

the Office of Safety and Mission Assurance. We are also consulting with other Government partners such as the Federal Aviation Administration and with commercial 

stakeholders.

Conclusion 

In closing, I would like to quote from the October 2009 Review of U.S. Human 

Spaceflight Plans report: ‘‘Human space travel has many benefits, but it is an inherently dangerous behavior.’’ NASA wholeheartedly endorses this statement because 

it is a challenge we live with day in and day out. Safety is and will always be our 

number one priority in everything we do. That is why the Constellation Program 

has employed a continuous risk-informed design process, and that is why our designs are being developed with an overriding priority given to crew safety at every 

stage of the design and operational process. 

Chairwoman Giffords, I would be pleased to respond to any questions that you 

or the other Members of the Subcommittee may have.

Chairwoman GIFFORDS. Thank you, Mr. Hanley, for your testimony. 

Next we will hear from Mr. Marshall. 
52

STATEMENT OF JOHN C. MARSHALL, COUNCIL MEMBER, 

AEROSPACE SAFETY ADVISORY PANEL, NATIONAL AERONAUTICS AND SPACE ADMINISTRATION 

Mr. MARSHALL. Chairwoman Giffords and other distinguished 

members of the committee, good morning. Thank you again for inviting the ASAP to testify before your Subcommittee today. 

As you may know, today’s topic has been area of interest that the 

ASAP has focused on for a sustained period. Most recently we visited SpaceX and Orbital Sciences, both currently commercial providers to NASA for logistics re-supply to the Space Station, to discuss firsthand their approach to integrating safety into their vehicles. 

Of course, interest in using the commercial space industry to fulfill NASA’s crew delivery services to low earth orbit, LEO, has 

spiked because of the recent Augustine report recommendations 

that appropriate consideration be given to turning the service over 

to the commercial sector. In making this recommendation, they 

also noted that while safety never can be absolutely assured, safety 

was assumed to be a given. The ASAP believes this assumption 

was premature and an oversimplification of a complex and challenging problem in that there is no cookie cutter approach to safety 

in space nor is it a ‘‘given.’’

NASA’s Procedural Requirements, NPR 8705.2b, identifies the 

human rating process for NASA space systems. It specifies a riskbased approach to evaluate a system against pre-established requirements. It does not, however, establish what those requirements are. NASA emphatically intends this document to be a starting point with detailed requirements to be tailored specifically for 

each NASA human spaceflight program including a possible NASAcrewed COTS mission. 

Because it is illogical to rely on commercial providers to develop 

their own requirements for contractual services on human 

spaceflight to NASA, the ASAP strongly believes that specific criteria should be developed to establish how safe is safe enough for 

these services. In addition, it is imperative that the COTS enterprises understand in detail how verification of compliance shall be 

demonstrated. This just now is being developed by NASA. 

With the above background, I will now briefly address the four 

questions that you asked us to talk to. First was, what do you consider to be the most safety-related issues that will have to be addressed if NASA were to consider using commercial providers for 

crew transportation and station crew rescue services. The ASAP 

believes that ensuring the safety of NASA’s astronauts that we 

send into space may be the hardest part of commercialization of the 

LEO crew transportation mission. Significant challenges to be 

solved include first establishing detailed safety requirements that 

NASA deems essential to safe flight. There must be clear and enforceable form that can be placed into a contract and tested for 

compliance. Second, because no launch vehicle can be considered 

truly safe in the conventional sense of the word, establishing minimum acceptable safety levels to guide systems safety design and 

a baseline for both NASA and their contractors as to what is safe 

enough is critical. Third, much of the inherent safety of spacecraft 

design depends upon choices and decisions where risks are weighed 
53

against performance costs and schedule. A process to ensure that 

all the potential hazards are properly vetted by both the government and contractors is important. This will require more than the 

hands-off approach that some envision. And finally, establishing a 

disciplined process-related checks and balances so that NASA can 

verify that the contractor has demonstrated compliance with the 

launch vehicle designs requirements is necessary. 

The next question was, what safety standards should commercial 

entities have to meet if they are chosen by NASA to carry U.S. government astronauts to low earth orbit and what will be required 

for verification? As noted previously, NASA’s NPR procedures prescribe a human rating process for NASA’s space system. This document, changed in 2008, represents a significant and substantive 

shift from the prescriptive approach to one that applies good engineering standards and judgments. Prescriptive standards describe 

how things get done and are applied rigidly. A good-judgment approach offers less specific direction and guidance. The ASAP sees 

advantages in both but with a clear need for written guidance of 

record of change and direct connectivity to establish time-tested engineering standards. 

In this regard, it is the ASAP position that any new standards 

for commercial entities should begin with NASA’s NPR and that 

the human rating for each system must appropriately be tailored 

to combine robust design, solid engineering, and testing along with 

a system safety approach for examining options to minimize the 

probability and impact of failure. Doing so will in the end provide 

both higher reliability and safety for human life. With respect to 

demonstration, verification and certification, the ASAP agrees that 

each of these actions must be performed for both government and 

commercial programs prior to NASA’s use. It also is the ASAP’s position that NASA is the best qualified to be the oversight body for 

each of these actions. 

Three: What would be required to certify the airworthiness of 

any commercially provided crew transportation system or station 

rescue service prior to its use by U.S. government astronauts? How 

long do you anticipate such certification would take? As you know, 

airworthiness certification is a process that is carried out by a regulatory body. Typically, it is an agency such as the FAA or government organization. Certification gives assurance that necessary 

practices, policies and criteria have been satisfied to protect the 

safety of the crew, passengers and the public from harm due to a 

design or operational flaw in the functioning of the vehicle. For certification of any commercial or government space transportation 

system, it is clear that the human rating standard would have to 

be understood by all of the participating parties once those standards are known and it is incumbent upon any party presenting a 

vehicle for use to present compelling evidence that the standards 

have been met. That evidence can take several forms, most of 

which are covered by standard industry practices. In the case of 

crew delivery, cargo delivery, rescue from the station, it is well to 

remember that it must not only be certified for its own safe operations in itself but must also be able to approach, dock and interface with the station without presenting a hazard to that vehicle 

as well. 
54

In response to the question of how long such a process would 

take, our experience indicates that this is a function of two things. 

First, there must be clarity and mutual understanding the requirements and a process for verifying the requirements have been met. 

Second, there must be an openness and degree of sharing of cooperation of the design process to the reviewing authority. Of 

course, the completion of the review remains directly proportional 

to the complexity and uniqueness of the proposed system. 

Finally, in the annual report that ASAP published for 2008, the 

ASAP is concerned about human rating requirements substance, 

applications and standards NASA-wide. What is the basis for this 

concern? The basis for our concern is that in more than two years 

into the COTS program, efforts to develop human rating standards 

for a COTS–D-like program have only just begun and no guidance 

thus far has been promulgated. Therefore, it is premature to consider any potential COTS–D vehicle as being human rated. If 

COTS entities are to ever provide the level of safety expected for 

NASA crews, it is imperative that NASA’s criteria for safety design 

of such systems quickly be agreed upon and provided to current or 

future providers. 

I would be happy to respond to any other questions you or any 

other members may have. 

[The prepared statement of Mr. Marshall follows:]

PREPARED STATEMENT OF JOHN MARSHALL

Chairwoman Giffords and other distinguished members of the Subcommittee, good 

morning. Thank you for inviting the Aerospace Safety Advisory Panel (ASAP) to testify again before your Subcommittee on the topic of ensuring human space flight 

safety in future government and potential future non-government space transportation systems. 

As you may know, this topic has been an area of interest that the ASAP has focused on over a sustained period. Most recently we have visited the Space Exploration Technologies Corporation (Space X) and Orbital Sciences Corporation, both 

currently commercial providers to NASA for logistical re-supply to the International 

Space Station (ISS)—and possible Commercial Orbital Transportation Services 

(COTS–D) providers in the future, to discuss firsthand their approach towards integrating safety into their vehicles. 

Of course interest in using the commercial space industry to fulfill NASA crewdelivery services to Low Earth Orbit (LOE) has spiked because of the recent Augustine report recommendation that appropriate consideration be given to turning this 

service over to the commercial sector. 

Unfortunately, in making this recommendation they also note that while human 

safety never can be absolutely assured, safety was assumed to be ‘‘sine qua non,’’ 

or ‘‘a given’’ in their recommendation. The ASAP believes this assumption is premature and over simplifies a complex and challenging problem, in that there is no 

‘‘cookie-cutter approach’’ to safety in space. Nor is it ‘‘a given.’’

We further believe that since NASA has given serious consideration only recently 

to what their approach will be in establishing human rating requirements for a vehicle that is occupied by NASA personnel, the commercial sector may be substantially behind in addressing human rating requirements for the future. 

NASA’s Procedural Requirements (NPR) 8705.2b identifies the human rating requirements for NASA’s space systems. It contains recently updated requirements 

and captured lessons learned that are applicable to the development and operation 

of crewed space systems. NASA emphatically intends this document to be a starting 

point with detailed requirements to be tailored specifically for each NASA human 

spaceflight program, including a possible NASAcrewed COTS mission. Additionally, 

NASA specifically caveats that the results of any tailored effort for a NASA-crewed 

COTS mission could be different from that developed for a NASA program. 

Because it is illogical to rely on commercial providers to develop their own requirements for contractual services on human spaceflight to NASA, the ASAP 

strongly believes that specific criteria should be developed to establish how safe is 
55

‘‘safe enough’’ for these services, including the need to stipulate directly the acceptable risk levels for various categories of activity. In addition, it is imperative that 

the COTS enterprises understand in detail how verification of compliance shall be 

demonstrated. This too is just now beginning development by NASA. 

With the above background, I will now briefly address the four specific questions 

that you posed to the panel:

1. What do you consider to be the most significant safety-related issues that 

will have to be addressed if NASA were to consider using commercially provided crew transportation and International Space Station (ISS) crew rescue 

services?

Response: Ensuring the safety of the NASA astronauts that we send into space 

may be the hardest part of commercializing LEO crew transportation. The significant challenges to be solved include:

• Establishing detailed safety requirements that NASA deems essential to safe 

flight. These must be in a clear and enforceable form that can be placed on 

contract(s) and tested for compliance.

• Because of their energy, speed, and complexity, no launch vehicle can be considered truly ‘‘safe’’ in the conventional sense of the word. Therefore, establishing minimum acceptable safety levels to guide system designs and set the 

baseline for both NASA and their contractors as to what is ‘‘safe enough’’ is 

critical.

• Even with clear safety requirements and levels, much of the inherent safety 

of complex systems like spacecraft depends upon the design choices and decisions where risks are weighed against performance, costs, and of course, 

schedules. An open and effective system has been developed within NASA to 

accomplish this. A similar process needs to be institutionalized by any commercial provider as well, whereby all potential hazards are properly vetted by 

both government and contractors. This will not be easy and may require more 

than the ‘‘hands off’ approach envisioned by some.

• Establishing disciplined program and process-related checks and balances so 

that NASA can verify that the contractor has evidence of compliance with the 

launch vehicle design requirements in the as-built vehicle and successful completion of the activities necessary to demonstrate mission readiness.

2. What safety standard should commercial entities have to meet if they are 

chosen by NASA to carry U.S. government astronauts to LEO, and what will 

be required to verify compliance?

Response: As noted previously, NASA’s NPR 8705.2b prescribes human rating 

requirements for NASA’s space systems. This document, changed in 2008, represents a significant and substantive shift from a prescriptive approach to one that 

applies good engineering judgment. Prescriptive standards describe how to do things 

and are applied rigidly. Good judgment offers less specific direction and guidance. 

The ASAP sees advantages in both, but with a need for clear written record-ofchange and direct connectivity to establish and time-tested engineering standards. 

In this regard, it is the ASAP’s position that any new standards for commercial 

entities should begin with NASA’s NPR—the ‘‘gold standard’’ if you will—and that 

the human rating for each system must appropriately be tailored to combine testing, 

solid engineering, and robust design along with a system safety approach for examining options to prevent and minimize the impact of failures. Doing so will, in the 

end, provide both high reliability and safety of human life. 

With respect to demonstration, verification, and certification, the ASAP agrees 

that each of these actions must be performed for both government and commercial 

programs prior to NASA’s use. Further, it also is the ASAP position that NASA is 

best qualified to be the oversight body for each of these actions as today only NASA 

has the competence in hand to effectively audit the complex technical work required.

3. What would be required to certify the ‘‘airworthiness’’ of any commercially 

provided crew transportation and ISS rescue service prior to its use by U.S. 

government astronauts? How long do you anticipate such certification would 

take?

Response: Similar to other certifications, ‘‘airworthiness certification’’ is a process 

that is carried out by a regulatory body. Typically that is an agency such as the 

Federal Aviation Administration or other governmental body that acts in the interest of the party having the most critical concern in the outcome. Certification is an 

oversight process, which serves to give assurance that necessary practices, policies, 

and criteria have been satisfied to protect the safety of the crew, passengers, and 
56

the public from harm due to a design or operational flaw in the functioning of the 

vehicle. 

Building on this basic principal, for certification of any commercial or government 

space transportation system, it is clear that human rating standards that have been 

discussed in prior answers would have to be developed, published, and understood 

by all participating parties. 

Once those standards are known, it then is incumbent on any party presenting 

a vehicle for utilization covered under the certification process to present compelling 

evidence that the standards have been met. That evidence can take several forms, 

most of which are covered by standard industry practice. 

Testing typically is used to verify that the design meets the standard. The simplest of these would be the proof testing of pressure vessels that has been common 

for most of the last century. When testing is not possible because it is either too 

dangerous or involves conditions that cannot be set up in the laboratory, then analysis or sub-scale experiment is accomplished. Finally, well-validated analysis (finite 

element structural analysis, computational fluid dynamics, physics based simulations) can form an acceptable mechanism to show compliance. 

In the case of crew delivery, cargo delivery, and rescue from the ISS it is well 

to remember that not only must the certified vehicle be safe in and of itself, but 

it must be able to approach, dock, and interface with the ISS without presenting 

a hazard to that vehicle as well. This means that besides the certification standards 

for the vehicle in question it will also have to meet additional requirements for operation in the vicinity of and docking to/departing from the ISS. These standards have 

already been developed and thus any new vehicle certification would also have to 

meet these requirements. 

In response to the question of how long such a process would take, our experience 

indicates that this is most certainly a function of two things. First, there must be 

clarity and mutual understanding of the requirements and a process for verifying 

that the requirements have been met. Second, there must be openness and a degree 

of sharing/cooperation/transparency of the design process to the reviewing authority. 

Waiting until the design is complete and all parts and pieces are in place, sealed, 

and potentially inaccessible before inviting review of the design would be a recipe 

for failure. Conversely, providing periodic design reviews, openness for witnessing 

testing, clarity of analytical methods as the work progresses can assure a process 

with minimum to no delay. If the data is delivered as requested, testing is witnessed 

as it takes place, and the analysis uses known and validated methods, the finalization of the review remains directly proportional to the complexity and uniqueness 

of the proposed system. Missing or absent data, analysis that is incorrect or faulty, 

and tests that have been done but not confirmed can extend the process indefinitely.

4. In its annual report for 2008, the ASAP stated ‘‘the ASAP is concerned about 

human rating requirements substance, application, and standardization 

NASA-wide.’’ What is the basis of ASAP’s concern?

Response: The basis for our concern is that more than two years into the COTS 

program, efforts to develop human rating standards for a COTS–D like program 

have only just begun and no guidance thus far has been promulgated. If COTS entities are ever to provide the level of safety expected for NASA crews, it is imperative 

that NASA’s criteria for safety design of such systems immediately be agreed upon 

and provided to current or future COTS providers. 

As a minimum, the ASAP believes that NASA should begin a dialogue with the 

funded COTS partners to address requirements for human rating. Additionally, 

NASA needs to clarify how much or how little they will be involved in the design, 

approval and operation of the NASA-crewed vehicles in order to verify that the 

funded COTS partners are compliant with the human rating requirements. The 

ASAP recommends the agency be ‘‘hands-on.’’

NASA has indicated that they are considering a tiered or stair-step approach in 

addressing the technical review and approval processes to confirm safe flight and 

operational readiness, starting first with some level of technical insight for the unmanned services for routine supplies, then with greater insight for unmanned services involving high-valued cargo, and finally building up to the technical insight and 

process to be used for a NASA-crewed COTS mission. In modeling the COTS tiered 

technical insight processes, NASA will use its experience gained in the ISS program 

for transfer of routine supplies, and in the launch services program for commercial 

Expendable Launch Vehicle launches of high valued payloads. The ASAP concurs 

with this methodology. 

Finally, as part of the launch certification requirements, NASA should immediately identify the number of launch successes that COTS partners will need to 

achieve with the unmanned vehicle in order to demonstrate the required vehicle re-
57

liability for a NASA-crewed launch. In developing the criteria for manned launch 

vehicle certification, NASA may also need to address whether and how the successful flights and results from the COTS ISS cargo reservicing and NASA launch services programs, can provide evidence for consideration in assessing launch reliability 

for NASA-crewed vehicle. 

Chairwoman Giffords, I would be happy to respond to any questions you or the 

other members of the Subcommittee may have.

Chairwoman GIFFORDS. Thank you, Mr. Marshall. It is good to 

have you back. 

Mr. Alexander. 

STATEMENT OF BRETTON ALEXANDER, PRESIDENT, 

COMMERCIAL SPACEFLIGHT FEDERATION 

Mr. ALEXANDER. Chairwoman Giffords, Ranking Member Olson, 

distinguished members of the Subcommittee, thank you for the opportunity to testify this morning on behalf of the 20 member organizations of the Commercial Spaceflight Federation. We appreciate 

the Committee’s longstanding support of commercial space. 

Commercial crew transportation is complementary, not competitive, with NASA’s mission and it is crucial to the future of our Nation’s human spaceflight program for several reasons. First, after 

shuttle retirement, the United States will not have the capability 

to launch humans into space for likely six to seven years. Entering 

this gap, we will send billions of dollars overseas as we purchase 

seats on Russian vehicles at $51 million a seat and rising. A commercial crew can help prevent future Russian price increases, preserve redundant access to the space station and potentially shorten 

the gap. Second, enhanced commercial spaceflight will allow us to 

more fully utilize the space station, which is just now being completed. Third, commercial missions to low earth orbit will allow 

NASA to focus its resources and expertise on exploration beyond 

low earth orbit. 

Commercial crew has been endorsed by a long line of Presidents 

and Congresses from the 2004 Vision for Space Exploration to the 

2005 and 2008 NASA Authorization Acts. As such, it should come 

as no surprise that the Augustine committee stated, ‘‘There is little 

doubt that the U.S. aerospace industry has the technical capability 

to build and operate a crew taxi to low earth orbit.’’

Just as important, the committee stated their unequivocal belief 

that commercial spaceflight could be done safely. Indeed, safety is 

paramount to everyone in this industry. A group of 13 former 

NASA astronauts recently wrote in the Wall Street Journal that 

‘‘We believe that the commercial sector is fully capable of safely 

handling the critical task of low earth orbit human transportation.’’

A taxi service to low earth orbit is a less difficult, more narrowly 

focused mission than the Orion Crew Exploration Vehicle and can 

therefore have more robust margins. For these reasons, commercial 

vehicles can be more cost-effective for Space Station operations 

without sacrificing safety. 

In order to meet stringent safety goals, NASA and industry must 

agree upon a detailed, thoughtful plan. The commercial spaceflight 

industry believes the following four principles are key. First, demonstrated reliability through a robust test program is crucial. Robust testing throughout development and production is necessary 

to demonstrate confidence in the overall system. Commercial crew 
58

systems will only begin crewed flights once reliability has been 

demonstrated through multiple successful test flights without crew. 

Demonstrated launch reliability is essential for overall safety. The 

Atlas family, for example, has had over 90 consecutive successes. 

The Atlas V has a perfect record of 19 successful launches. And the 

Falcon 9 will have launched more than a dozen times for cargo and 

satellite missions before crew missions begin. 

Second, robust safety will require additional human rating of the 

launch vehicle and a reliable crew escape system to protect the 

crew in the event of a launch vehicle anomaly. 

Third, clear safety standards and requirements are crucial. It is 

vitally important that NASA and industry agree on the safety requirements up front and this dialog must begin in earnest now. 

NASA’s human rating requirements document will serve as a starting point for this dialog but must be tailored for commercial systems just as it is for NASA-developed vehicles. NASA is currently 

reviewing their applicability to commercial systems and the commercial spaceflight industry is also conducting a similar review. 

Finally, let me address government oversight. Any commercial 

crew program must be conducted under the current regulatory regime established by law, namely FAA licensing. FAA licensing is 

important to ensuring a consistent regulatory regime for both government and commercial missions, which is key to attracting private investment and non-NASA customers. While the FAA would 

retain the overall licensing authority, NASA would maintain oversight as the customer. In particular, NASA would establish astronaut safety requirements in consultation with industry, establish 

mission-unique requirements such as crew capacity and requirements for space station docking, and most importantly, have final 

approval authority over the launch of NASA astronauts, which 

would be granted only after NASA is satisfied that the vehicle is 

safe, just as NASA does for today’s shuttle missions. 

In conclusion, we firmly believe that NASA and commercial industry can and must work together to develop safer human 

spaceflight capabilities. We must begin that dialog now. 

Thank you for the opportunity to be here today and I look forward to your questions. 

[The prepared statement of Mr. Alexander follows:]

PREPARED STATEMENT OF BRETTON ALEXANDER

Introduction 

Chairwoman Giffords and distinguished members of the Space and Aeronautics 

Subcommittee, thank you for the opportunity to testify. I am pleased to be here. 

The Commercial Spaceflight Federation is an association of 20 leading businesses 

and organizations working to make commercial human spaceflight a reality. Our 

members include developers and operators of orbital spacecraft, suborbital spacecraft, and the spaceports from which they fly. Our membership also includes product 

and service providers for human spaceflight training, medical, and life support 

needs. Our mission is to promote the development of commercial human spaceflight, 

pursue ever higher levels of safety, and share best practices and expertise throughout the industry. One goal of all of our member organizations is to greatly increase 

the number of people that fly into space, generating new economic activity here on 

Earth. 

Significant investment has already been committed to the development of commercial human spaceflight. According to a recent survey done by The Tauri Group, 

$1.46 billion in investment has been committed to commercial human spaceflight activities to date. Coupled with the more than $500 million in development funding 
59

provided by NASA under the Commercial Orbital Transportation Services, or COTS, 

program, more than $2 billion has been pledged for the development of commercial 

spaceflight capabilities. I want to take this opportunity to thank the Congress and 

NASA for your support of the COTS program. 

In my testimony today, I will address the safety and oversight questions relating 

to commercially procured crew services. In order to understand these issues, it is 

important to first discuss the context of commercial spaceflight. My testimony covers 

the following key topics:

Summary of Key Points

1. Commercial crew transportation to Low Earth Orbit (LEO) is a goal endorsed by the Vision for Space Exploration (2004), the Aldridge Commission 

(2004), the 2005 NASA Authorization Act, the 2008 NASA Authorization Act, 

and the Augustine Committee.

Æ Commercial crew is complementary, not competitive, with NASA activities, as commercial crew transportation to LEO will allow NASA to focus 

its unique resources on the more difficult task of beyond LEO exploration.

Æ After shuttle retirement, the United States will send billions of dollars 

overseas to purchase seats on Russian vehicles during the gap in U.S. 

government launch capability. Only commercial crew allows us to reduce 

the gap, prevent future Russian price increases, and preserve redundant 

access to the Space Station.

2. Safety is paramount for the commercial spaceflight providers. Indeed, commercial vehicles such as Atlas V and Delta IV, developed with substantial 

private funding and engineering expertise, are already trusted to launch key 

government national security assets upon which the lives of our troops overseas depend.

3. Since computer calculations of vehicle safety cannot account for most of the 

root causes of accidents historically, such as human error or design flaws, 

and since even reliable vehicles have historically suffered a period of ‘‘infant 

mortality,’’ the commercial spaceflight industry believes that safety must include the following:

Æ Demonstrated reliability from orbital flight tests of the full system

Æ Not placing crews on initial flights, since early flights are historically 

most risky

Æ A highly reliable crew escape system

Æ Standards-driven design and operations

4. Industry believes that the safety of commercial spaceflight must be greater 

than that of any vehicle currently in operation today. In addition to the 

FAA’s existing regulatory authority, as codified in U.S. law, industry will 

satisfy customer-specific requirements levied by NASA in partnership with 

industry. This process has already begun with the cooperation of the stakeholders involved.

5. NASA and FAA will be there every step of the way, and will have oversight 

during design, testing, manufacturing, and operations. As codified in existing 

U.S. law, a licensing, rather than certification, regime is appropriate for 

these vehicles.

Government Beyond LEO, Commercial to LEO 

Support and encouragement for the commercial development of space, including 

commercial space transportation services, has been a cornerstone of civil space policy for decades. It has been endorsed by numerous Presidential Administrations and 

Congresses, and by both parties. A quarter-century ago, the law that created NASA, 

known as the Space Act, was amended to specify that NASA is to ‘‘seek and encourage, to the maximum extent possible, the fullest commercial use of space’’ and ‘‘to 

encourage and provide for Federal Government use of commercially provided space 

services and hardware.’’ Additionally, the Commercial Space Act of 1998 directed all 

agencies including NASA to ‘‘acquire space transportation services from United 

States commercial providers whenever such services are required in the course of 

its activities.’’

In 2004, following the Space Shuttle Columbia accident, the Vision for Space Exploration (U.S. Space Exploration Policy, National Security Policy Directive-31), announced by President George W. Bush on January 14, 2004, directed NASA to:
60

Æ ‘‘Develop a new crew exploration vehicle [now called Orion] to provide 

crew transportation for missions beyond low Earth orbit.’’

Æ ‘‘Acquire’’—and it’s important to note here the intentional use of the word 

‘‘acquire,’’ not ‘‘develop’’—‘‘cargo transportation as soon as practical and 

affordable to support missions to and from the International Space Station.’’

Æ And again ‘‘Acquire crew transportation to and from the International 

Space Station, as required, after the Space Shuttle is retired from service.’’

Æ To put further emphasis on this point, the policy directed NASA to ‘‘Pursue commercial opportunities for providing transportation and other services supporting the International Space Station . . . .’’

This was reinforced by the Aldridge Commission on implementation of the Vision 

which recommended in June 2004 that ‘‘NASA recognize and implement a far larger 

presence of private industry in space operations . . . most immediately in accessing 

low-Earth orbit.’’

This fall, the Review of U.S. Human Space Flight Plans Committee endorsed the 

development of commercial crew capabilities as the primary means to transport astronauts to and from the International Space Station. Astronaut Sally Ride, a member of the Committee, stated, ‘‘We would like to be able to get NASA out of the business of getting people to low Earth orbit.’’

Given the above history, the Augustine Committee’s endorsement of the development of commercial crew capabilities should come as no surprise. Commercial crew 

and cargo to the Station has always been part of the Vision for Space Exploration, 

which had at its most fundamental core the philosophy that government should explore beyond low Earth orbit and the commercial sector should provide transportation to low Earth orbit. As such, commercial is complementary to government activities, not competitive. 

Congress has noted the importance of commercial spaceflight as well, as the 2005 

and 2008 NASA Authorization bills endorsed commercial cargo and crew. The 2005 

NASA Authorization Act directed NASA to ‘‘work closely with the private sector, including by . . . contracting with the private sector for crew and cargo services, including to the International Space Station, to the extent practicable.’’ The 2008 

NASA Authorization Act directed NASA to initiate a commercial crew program and 

to fund ‘‘two or more commercial entities . . . for a crewed vehicle demonstration 

program.’’

To its credit, NASA has already been acquiring cargo delivery to the Station. 

First, NASA invested $500 million in the development of two commercial systems, 

with additional investment contributed by the companies themselves, through the 

Commercial Orbital Transportation Services (COTS) program. After several years of 

development, NASA demonstrated its confidence in the commercial cargo sector by 

declining to purchase additional Russian cargo flights after 2011 and instead awarding over $3 billion in domestic Commercial Resupply Services (CRS) contracts for 

Space Station cargo. In just four years, commercial cargo has transitioned from a 

small initiative to a program that is crucial to the continued existence of the Space 

Station. The bottom line is that commercial space services are on the critical path 

for cargo to the Station and NASA has a vested interest in its success. 

With commercial cargo now on the critical path for the Space Station, it is time 

to consider the value of commercial crew services for Space Station as well.

Commercial Crew is Essential to Mitigate the Gap 

Despite having an option for crew transportation in the COTS program—the socalled Capability D option—NASA has not yet invested in the development of full 

commercial crew capabilities, opting to prove out cargo services first with the possibility of crew later. The case for beginning a commercial crew program has grown 

stronger in the years since the COTS cargo program began:

Æ Flights of the Atlas, Delta, Falcon, and other vehicles have helped mature the capabilities that will be needed during a future commercial crew 

program;

Æ Commercial companies have invested their own internal R&D and study 

money to explore commercial crew;

Æ NASA’s $50m CCDev program is revealing the strength of interest in 

commercial crew by both large and medium-sized companies in the aerospace industry;
61

Æ And the Augustine Committee notes that ‘‘the use of commercial vehicles 

to transport crews to low-Earth orbit is much more of an option today 

than it might have been in 2005.’’

Today, three years after the award of the COTS Space Act Agreements (SAAs), 

we no longer have the luxury of time. The Space Shuttle will be retired next year, 

or shortly thereafter, while the first flight of Ares I and Orion has slipped to at least 

2017, according to the Augustine Committee. In fact, the Committee added that if 

the Space Station is extended to 2020 as seems likely, the first human launch of 

Ares I would slip further, even if NASA receives the extra money the Committee 

recommended. As a result, we will be dependent on the Russians for crew transportation to the International Space Station for at least five years, if not longer. 

Given that Ares I/Orion is not likely to be ready until at least 2017 and that system is optimized for the unique requirements of exploration beyond Low Earth 

Orbit, we believe a vibrant U.S. commercial crew program is essential for avoiding 

a sole-source reliance on the Russian Soyuz vehicles in the interim. In fact, we have 

already purchased rides on Russian Soyuz spacecraft at the price of $51 million per 

seat, having taken extraordinary measures and changing U.S. nonproliferation laws 

to allow these payments. Buying crew services from U.S. industry should not be 

viewed as nearly so extraordinary. 

Moreover, Russia’s prices are rising and are certain to increase once we become 

totally reliant on them. A robust U.S. commercial crew program, however, will apply 

competitive pressure on Russia to keep costs down. Also, NASA’s ability to purchase 

Soyuz vehicles from Russia expires in 2016. Ares/Orion is not likely to be ready by 

then. It is impossible to know with certainty whether another extension of INKSNA 

(Iran, North Korea, and Syria Nonproliferation Act) will be granted by Congress at 

that time. Pursuing a commercial option to meet near-term needs for Station could 

help alleviate the risks inherent in Russian reliance. By not pursuing commercial, 

it is almost certain Congress will have to re-address the INKSNA issue.

Complementary, Not Competitive 

Commercial crew is complementary, not competitive with NASA’s exploration program. NASA should once again be focused on exploration beyond low Earth orbit, 

and turn over to the private sector the repetitive tasks of resupplying the Station—

and that includes transporting people there too. Not just a few people, but a multitude of researchers, engineers, and technical specialists. We need more activity in 

low Earth orbit, not less. 

Exploration beyond low Earth orbit will not be sustainable—if it happens at all—

without a vibrant commercial sector providing transportation services to and from 

low Earth orbit. The Center for Strategic and International Studies recently released a report on the U.S. space program which stated: ‘‘Without commercial engagement, exploration will . . . continually expand the scale of government obligations, rather than keeping civil space programs focused on the frontiers of exploration.’’ None of us believes that the government can continuously expand the obligations and expectations of our civil space program without reaching a breaking 

point, regardless of where one thinks that breaking point is. The additional resources and capabilities of the private sector are essential.

Commercial to LEO is Less Difficult than Exploration Beyond LEO 

The Augustine Committee, like the Aldridge Commission before it, found that the 

commercial sector is ready and capable to handle the task of transportation to Low 

Earth Orbit. Low Earth Orbit is less difficult, and therefore more achievable by the 

private sector, compared to the more capable tasks that NASA’s current exploration 

vehicles are optimized for. 

Thus, it is not an apples-to-apples comparison to compare a commercial crew capability to the Orion crew exploration vehicle. Rather, it is apples and oranges, because transporting crew to and from the International Space Station requires a far 

less complex spacecraft than exploring beyond low Earth orbit. It is akin to developing a Gemini spacecraft for low Earth orbit, rather than an Apollo spacecraft for 

reaching the Moon. The Orion spacecraft, for example, must reenter the atmosphere 

at one-and-a-half times orbital velocity, encountering heat loads nearly double those 

when returning from low Earth orbit, and Orion must do so with far more precision. 

Orion must also operate autonomously in lunar orbit untended while astronauts explore the surface, acting more like a space station than a crew taxi, and requiring 

more complex onboard vehicle systems. 

As a result, the Orion spacecraft is a 25 metric ton (mT) vehicle, whereas spacecraft designed solely for low Earth orbit transportation are expected to be in the 8–

12 mT range, or less than half the size for the same number of crew. Quite simply, 
62

you don’t take an 18-wheeler to the corner grocery store. Nor do you drive a Formula One racecar. The Orion crew exploration vehicle is, in fact, far more capability 

than is needed to go to and from the Space Station. 

Because it serves a simpler mission, any vehicle that is designed simply to service 

the Space Station—and not go beyond—should be faster and more cost effective to 

develop without sacrificing safety, regardless of whether it is a government or commercial capability. The Gemini spacecraft, for example, was developed in just under 

2 1/2 years, and had a perfect crew safety track record. 

Regardless of the extent to which ‘‘the gap’’ can be reduced, a spacecraft designed 

solely for low Earth orbit transportation will be more cost effective to operate and 

require smaller launch vehicles. The result will be more frequent missions to the 

Station, increased research and other utilization of the Station, and more resources 

available for exploration beyond low Earth orbit.

Implementing a Commercial Crew Program 

In light of all the considerations above, the Augustine Committee outlined a $2.5–

3.0 billion fixed-price Commercial Crew program, in which NASA would invest in 

multiple private companies, each of which would also be required to invest their 

own funds, thereby putting their own ‘‘skin in the game.’’ The committee also suggested that NASA fund human rating of a proven U.S. launch vehicle to mitigate 

the dependence on the development of new launch systems in addition to the spacecraft themselves. 

A Commercial Crew program of $2.5–3.0 billion over 5 years should be sufficient 

funding. For example, one major aerospace company conducted a study that concluded they could develop a commercial capsule to transport crew to low Earth orbit 

and human rate an existing U.S. launch vehicle for around $1 billion. As another 

example, SpaceX has an unfunded option in its COTS Agreement for $308 million 

to upgrade its Dragon spacecraft to carry crew to and from the Station. Demonstrating the diversity of interest and capability, the Augustine Committee received price estimates from, according to the report, ‘‘five different companies interested in the provision of commercial crew transportation services to low-Earth orbit. 

These included large and small companies, some of which have previously developed 

crew systems for NASA.’’

Additional evidence that a Commercial Crew program is viable at $2.5–3.0 billion 

is again provided by the Gemini program. Despite only having access to 1960s technology, and with only a few years of total experience with spaceflight, NASA and 

industry human-rated the Titan II launch vehicle (which required 39 months), and 

designed and tested a crew capsule, for about $2.5 billion in today’s dollars. The 

Gemini program completed all missions safely. 

Since NASA’s budget for the next five years is almost $95 billion, a $2.5 billion 

Commercial Crew program represents less than 3% of total NASA expenditures. 

Clearly, it is not an either/or proposition between commercial crew and NASA exploration. Commercial vehicles will not have the capability to go beyond low Earth 

orbit, while NASA must develop the capability to conduct exploration beyond low 

Earth orbit. 

To promote competition and innovation, NASA’s investment in a Commercial 

Crew program should be structured using milestone-based, fixed-price agreements 

as it is in the COTS program, unlike traditional cost-plus contracts. The COTS 

Cargo program has shown the wisdom in this approach. NASA initially selected two 

winners, SpaceX and Rocketplane-Kistler, rather than putting all of its eggs into 

one basket. When Rocketplane-Kistler failed to raise the capital to meet its milestones under its Space Act Agreement with NASA, NASA terminated its funding, 

held a new competition, and had 85 percent of the funding left over to give to the 

new winner, Orbital Sciences. This ‘‘portfolio approach’’ diversified the risk to 

NASA, greatly enhancing the likelihood that NASA will get the expected level of capability that it needs.

Safety of Commercial Human Spaceflight 

Let me now address the safety of commercial human spaceflight systems. Safety 

is paramount. Private companies understand that they will not be in business if the 

systems they develop are not safe. In fact, private industry recognizes that it must 

increase safety from that demonstrated in the past in order to fulfill its vision of 

greatly increasing human activity in space. I believe industry has a healthy respect 

for the limits of their knowledge when it comes to safety. They do not presume to 

know it all and they maintain a strict discipline of safety. At the same time, they 

bring fresh eyes and insights from other cultures and I believe this will ultimately 

enhance safety. 
63

1The astronaut signatories were Buzz Aldrin, Ken Bowersox, Jake Garn, Robert Gibson, Hank 

Hartsfield, John Herrington, Byron Lichtenberg, John Lounge, Rick Searfoss, Norman Thagard, 

Kathryn Thornton, Jim Voss and Charles Walker.

Human spaceflight is an inherently risky endeavor. This has been true for government human spaceflight and will also be true for commercial. Working in partnership with NASA, U.S. industry firmly believes it can develop the capability to transport crew to low Earth orbit safely. Last month, 13 former NASA astronauts 1 endorsed commercial human spaceflight in a statement in the Wall Street Journal. 

This group of astronauts are highly experienced with spaceflight—collectively, they 

have flown a total 42 space missions and logged a total of 2 years and 48 days in 

space flying six different spacecraft including Gemini, Apollo, Space Shuttle, Soyuz, 

Mir, and the International Space Station. They stated: 

‘‘As astronauts, we know that safety is important. We are fully confident that the 

commercial spaceflight sector can provide a level of safety equal to that offered 

by the venerable Russian Soyuz system, which has flown safely for the last 38 

years, and exceeding that of the Space Shuttle. Commercial transportation systems using boosters such as the Atlas V, Taurus II, or Falcon 9 will have the 

advantage of multiple unmanned flights to build a track record of safe operations prior to carrying humans. These vehicles are already set to fly over 40 

flights to orbit in the next four years.’’

Working together, NASA and the commercial industry can develop the capabilities 

to safely conduct human spaceflight. NASA and industry must begin the dialogue 

now on the requirements, standards, and processes necessary to make this successful for all involved. Agreement on the requirements is essential to the success of any 

partnership between NASA and the commercial sector. 

There are several important factors to keep in mind when discussing the safety 

of commercial crew vehicles:

Commercial Spaceflight Has a Demonstrated Track Record 

First, when we discuss commercial spaceflight, some tend to think of an activity 

in the future. In fact, commercial spaceflight occurs right now and has for years. 

Currently, the Atlas V and Delta IV launch vehicles—both commercially developed 

with substantial private funding—are used to launch multi-billion dollar national 

security payloads upon which the lives of our troops overseas depend. These vehicles 

are also entrusted by NASA to handle some of the most safety-critical applications 

in the civil space sector. For example, the Atlas V is Category 3 certified by NASA 

for launch of NASA’s most critical payloads, and is also certified for launch of nuclear payloads, such as NASA’s New Horizons spacecraft to Pluto, launched with radioactive plutonium onboard. 

Not only is the commercial spaceflight sector real, but it has an extensive history 

of successful flights to orbit: the Atlas and Delta families of rockets, many of which 

were developed with substantial private investment and serve multiple customers, 

have a combined record of 114 consecutive successful flights since 2000. The Atlas 

V, for instance, has had 19 consecutive successful flights since its inception. 

We must now turn our efforts to extending this demonstrated track record and 

depth of operational experience to human spaceflight. Fortunately, commercial 

human spaceflight to LEO will not require the development of new launch vehicles. 

Instead, it can be accomplished using existing launch vehicles and those currently 

under commercial development, such as the Atlas V, Falcon 9, and Taurus II launch 

vehicles. This will allow us to leverage our existing track record. 

I will now examine some of the key requirements for ensuring the safety of commercial spaceflight, and explain how the commercial spaceflight sector can meet 

these high standards.

Key Requirements for Commercial Spaceflight Safety 

Since computer calculations of vehicle safety cannot account for most of the root 

causes of accidents historically, such as human error or design flaws, and since even 

reliable vehicles have historically suffered a period of ‘‘infant mortality,’’ the commercial spaceflight industry believes that safety must include the following:

Æ Demonstrated reliability from orbital flight tests of the full system

Æ Not placing crews on initial flights, since early flights are historically 

most risky

Æ A highly reliable crew escape system

Æ Standards-driven design and operations
64

I will now consider each of these topics in turn. 

I. Demonstrated Reliability from Orbital Flight Tests: By the time any astronaut climbs onboard a commercial vehicle, including the Atlas V, Falcon 9, and Taurus 2, each will have had multiple demonstrated successful flights to orbit. For example, SpaceX’s Falcon 9 would likely have more than 15 missions prior to its first 

crewed launch, due to customers such as the COTS Cargo program and satellite 

launches. As the Wall Street Journal astronauts pointed out, the Atlas, Falcon, 

Delta, and Taurus systems combined have over 40 more missions on the manifest 

before 2014, in addition to numerous flights of commercial systems that have taken 

place before this year. 

Human-rating of existing launch systems will cost money, and care must be 

taken, but as a recent study by The Aerospace Corporation concluded, there are no 

show-stoppers to human rating the existing proven fleet of launch vehicles. Norm 

Augustine pointed out that we did it safely for Mercury and Gemini, when our expertise in human spaceflight was much lower than it is today, and we can do it now. 

Demonstrated reliability is so important because computer models and Probabilistic Risk Assessments (PRAs) are not sufficient to capture the majority of failure modes that affect real, flying vehicles—especially vehicles that are flying their 

first few missions. The Augustine Committee, which included two experienced astronauts, pointed out the following on PRAs:

‘‘Studies of risk associated with different launch vehicles (both human-rated and 

non-human-rated) reveal that many accidents are a result of poor processes, 

process lapses, human error, or design flaws. Very few result from so-called random component failures. The often-used Probabilistic Risk Assessment (PRA) is 

a measure of a launch vehicle’s susceptibility to these component or system failures. It provides a useful way to compare the relative risks of mature launch vehicles (in which the design is well understood and processes are in place); it is 

not as useful a guide as to whether a new launch vehicle will fail during operations, especially during its early flights.’’

Probabilistic Risk Assessments and computer models are useful tools, but they 

have limitations. While the commercial spaceflight industry will make use of every 

tool that is available to improve safety, computer models are just one tool among 

many. Demonstrated reliability and a robust flight test program are crucial. Reasonable minds can differ on how many successful launches is sufficient before putting 

people on top, but there is no debate that more is better. 

At this point, let me briefly address two myths surrounding the safety of commercially procured crew transportation systems. First, some have claimed that commercial crew systems will only be able to produce cost savings for NASA by cutting corners and being less safe. In fact, commercial crew systems are cheaper for a different reason—because they have a less ambitious mission than systems designed 

for exploration. Since commercial LEO systems are simply tackling a less difficult 

challenge, commercial crew will be able to achieve cost savings for Space Station 

missions without cutting any safety corners. By focusing on a less ambitious mission 

that requires less capable vehicle performance, the commercial spaceflight industry 

is following a statement of the Columbia Accident Investigation Board that ‘‘the design of the system should give overriding priority to crew safety, rather than trade 

safety against other performance criteria.’’

Second, some have claimed that NASA’s Exploration Systems Architecture Study 

(ESAS) shows that the current exploration vehicles are safer than commercial crew 

vehicles. In actuality, commercial crew vehicles were never even analyzed in the 

ESAS report—the ESAS report only looked at vehicles large enough to carry Orion, 

such as Ares I and variants of the triple-core Delta IV Heavy, and did not examine 

the smaller, simple, single-core vehicles, such as Atlas V Medium and Falcon 9 Medium that are sufficiently sized for commercial crew missions. Moreover, even if 

ESAS had compared exploration vehicles to commercial crew-sized vehicles, the 

comparisons would be ‘‘apples vs. oranges,’’ because of the dramatically different 

tasks of these two types of vehicles. 

II. Not Risking Crew During Initial Flight Tests: Historical records show that 

even reliable vehicles, such as the Soyuz, initially go through a period of lower reliability (‘‘infant mortality’’) as design flaws are caught and corrected. The use of 

proven launch vehicles enhances safety by using a mature system with a demonstrated track record that has gone through the infant mortality stage experienced 

by most new launch systems. 

By leveraging the cargo and satellite flights, such as the COTS Cargo flights, that 

precede the first crewed flights, the commercial sector can help ensure that the infant mortality phase does not risk human lives. Commercial providers are free to 

pursue multiple customers, such as NASA science missions, national security mis-
65

sions, or commercial satellite missions, to help extend and strengthen the crucial 

test flight phase before humans are launched. Again, reasonable minds can differ 

on how many test flights are needed in light of infant mortality, but all can agree 

that it is good that the commercial sector can leverage non-crewed flights, such as 

cargo and satellite launches, to help alleviate crew risks associated with flying during the infant mortality phase. 

III. A Robust Crew Escape System: In addition to demonstrated reliability of 

the launch vehicle, ascent safety will be based on an emergency detection system to 

detect any anomalies during launch and a crew escape system to separate the spacecraft from the launch vehicle in the event of an anomaly. 

The commercial spaceflight industry understands that safety requires not just a 

reliable launch vehicle, but an integrated system with robust crew escape capabilities. As the Augustine Committee notes, ‘‘It is unquestionable that crews need access to low-Earth orbit at significantly lower risk than the Shuttle provides. The 

best architecture to assure such safe access would be the combination of a high reliability rocket and . . . a launch escape system.’’ The commercial spaceflight industry is committed to meeting this combination. 

IV. Effective Government Oversight: Human spaceflight is now almost 50 years 

old with the first flights of Alan Shepard and John Glenn occurring before I was 

born. It is time to transition access to low Earth orbit to the private sector so NASA 

can once again lead exploration beyond. Nevertheless, NASA and the FAA will be 

involved in every step of a Commercial Crew Program. In fact, every human spacecraft to date has been developed in partnership between NASA and U.S. industry, 

and this will also be true for a Commercial Crew Program. I will now address this 

crucial topic in more detail. 

First, any NASA Commercial Crew Program must be conducted under the current 

regulatory regime established by law, namely, licensing by the Federal Aviation Administration (FAA) Office of Commercial Space Transportation. FAA licensing of 

commercial spaceflight activities is established by law, requires a high degree of system safety, and provides a stable and predictable regulatory environment necessary 

for the success of commercial human spaceflight businesses. As codified in existing 

U.S. law, a licensing regime, rather than a certification regime, is appropriate for 

these vehicles. 

While the FAA would retain overall licensing approval authority, NASA would 

maintain strong oversight as the mission customer. As with today’s commercial expendable launches, the customer has go/no-go authority over the readiness of the 

mission and, therefore, NASA would maintain its role as safety approval authority 

for its crew onboard any commercial vehicle. NASA-unique requirements would be 

imposed as customer requirements, rather than as the overall regulator of the commercial spaceflight activity. (This is discussed in more detail in the next section.) 

While it is appropriate for NASA to establish customer-specific requirements, an 

entirely new licensing or regulatory regime, separate from the current FAA regime, 

should not be established for NASA or any other entity that would require compliance with different rules and regulations for commercial human spaceflight services 

provided for U.S. Government and commercial customers. The creation of a NASAspecific regulatory regime would impose parallel regulatory and operating environments for commercial operations for private customers and ‘‘commercial’’ operations 

for NASA. A two-track regulatory environment could hurt industry’s ability to obtain non-NASA customers, impacting business viability by lowering the total number of flights. Such a situation would be the opposite of the more robust flight history and greater operational experience that is crucial to enhance safety.

NASA Will Be There Every Step of the Way 

In any Commercial Crew program, NASA will play a pivotal role in the design, 

development, and operation of the commercial vehicles. NASA will be there every 

step of the way. In particular:

Æ NASA, in consultation with industry, will establish baseline human 

spaceflight safety requirements. That dialogue must begin now.

Æ NASA will also establish its mission-unique requirements, such as crew 

capacity; ability to dock with the International Space Station, including 

meeting visiting vehicle requirements; and functionality as a crew rescue 

vehicle, among others.

Æ And NASA will have final approval authority over the launch of NASA 

astronauts on commercial vehicles, which would be granted only after 

being satisfied that the vehicle is safe for launch, just as it does for today’s Space Shuttle missions.
66

Whether or not these safety requirements are the same as those found in NASA’s 

current human-rating requirements document (NPR 8705.2B) is currently under 

consideration. NASA is reviewing its human-rating requirements as they would be 

applied to commercial human spaceflight capabilities. This is the right thing for 

NASA to do and I applaud them for doing so. 

In fact, there is already a precedent for reviewing human-rating requirements. 

During the Constellation Program, NASA revised its human-rating requirements 

document in May 2008, going from the original version A to the current version B. 

Based on the judgment of NASA engineers, version B revised some requirements related to structural safety margins and dual-fault tolerance. In fact, no existing U.S. 

spacecraft—or Russian, for that matter—has ever met all of NASA’s human-rating 

requirements, but rather have obtained waivers to certain requirements. These examples demonstrate the importance of early dialogue between NASA and the commercial spaceflight sector on the nature of human-rating requirements for commercial systems, with demonstrated reliability, robust test flights, and a reliable crew 

escape system being key. 

While NASA is conducting its review, U.S. industry is also conducting a similar 

review. We have established a Commercial Orbital Human Spaceflight Safety Working Group. While the Commercial Spaceflight Federation has taken the lead in organizing the effort, the working group includes representatives from a broader spectrum of companies, including several of the major aerospace primes and more traditional government space contractors. The goal of the effort is to develop industry 

consensus on principles for safety of commercial orbital human spaceflight. So far, 

we have met among industry and have begun to engage NASA and the FAA. There 

is much more work to be done. However, consensus has been reached among a number of companies on principles with other companies currently reviewing the document. Regardless, it has already been useful in illuminating the issues and differing 

perspectives of those involved and is an important step in the right direction. 

Finally, I note that industry and NASA standards will include more than just the 

launch vehicle. For example, once in orbit, spacecraft must rendezvous with the 

Space Station, dock or berth with it, and then undock and de-orbit, reentering the 

atmosphere and landing safely back on Earth. The technologies to rendezvous and 

dock with the Station have been demonstrated by the United States, Russia, Europe 

and Japan. Working in partnership with NASA, Europe and Japan demonstrated 

these capabilities this year, and NASA is working with SpaceX and Orbital Sciences 

here at home to demonstrate the same capabilities under the COTS Cargo program. 

Examples such as these illustrate the importance of cooperation between the private 

sector and NASA to ensure safe operations.

Conclusion: A Partnership Between NASA and U.S. Industry 

The discussion of standards brings me to one of the most important prerequisites 

for success of any Commercial Crew Program—how NASA engages with the private 

sector is ultimately as important, if not more important, than the amount of funding 

provided. NASA’s COTS Cargo program is an excellent example. While some were 

initially resistant to commercial resupply of the Station, once it became a necessity 

NASA engaged the private sector in true partnership in order to ensure that the 

capability is available as soon as possible. 

I have every confidence that we are at such a turning point with Commercial 

Crew as well. It is now a necessity, and I believe that NASA and industry will both 

step up to make it happen. 

Thank you for the opportunity to be here today and I look forward to your questions.

Chairwoman GIFFORDS. Thank you, Mr. Alexander. 

Dr. Fragola. 

STATEMENT OF JOSEPH FRAGOLA, VICE PRESIDENT, 

VALADOR, INC. 

Mr. FRAGOLA. Madam Chairwoman and distinguished members, 

it is an honor to be able to be before you today, and I would like 

to share with you some of the experience that I have had in the 

form of four simple laws for a safe space launcher design. 

The first law has been referred to before, and that is to make the 

design as inherently safe as possible. That involves two important 

aspects: first, to make the launcher reliable, and second, and this 
67

is four times not mentioned in discussion, to make sure that the 

failure modes of the launch vehicle present a benign environment 

to the abort system. This is so important I would like to repeat it: 

to assess the vehicle to make sure that the abort modes given a 

failure represent a benign environment for the system for escape. 

Second, separate the crew from the source of failure as far as possible in the design, or as I like to say, put them on top where God 

meant them to be. Third, establish a credible abort trigger set, and 

in doing so, balancing the warning time available with the threat 

of false positives against the G load on the crew. Fourth, include 

an abort system that is tested and verified for robustness to allow 

for a safe crew escape and recovery. 

I would mention that from my experience, the Ares I vehicle is 

the singular vehicle that has been designed from the very moment 

of its conception with safety in mind. What I mean by that is that 

other launches, for example, have emphasized launch reliability 

but investigation of subsequent two accident conditions allowing for 

abort is something they usually don’t address, and the reason for 

it is very simple. They are interested primarily in payload to orbit. 

When a payload fails, the subsequent conditions are no matter to 

the person who pays for the payload. When a crew launcher fails, 

the conditions subsequent to that launch failure are important to 

the payload, which is the crew. 

We hope that the alternatives to the Ares I will follow the remainder of the rules that we mentioned, but in most of the literature discussing it, the importance of an abort system and the 

testing of an abort system independent of the number of experiences of the launcher has not really been addressed. Many times, 

for example, we speak of successes in terms of maybe 19 successes 

of the Atlas V, which is a credible, wonderful, reliable record but 

I will remind the Subcommittee that the space shuttle had 25 successes prior to the Challenger accident. 

One of the things to remember in the design of a new launch vehicle or the application of an existing launch vehicle to crew is to 

understand that invariably in modifications of designs or the development of new designs we have an issue of reliability growth. Immature designs need time to become mature, and that is why the 

abort system testing and integration into the design and the benign 

nature of the failure initiators is extremely important for a crewed 

launcher. 

Now, as was mentioned, we did an independent assessment of 

the Ares on an apples-to-apples comparative basis to all the other 

alternatives we were provided, and I showed this on a slide that 

is presented there. On a comparative basis, you can see that from 

the standpoint of loss of crew, the Ares vehicle is somewhere between two to three times safer than all the alternatives, in some 

cases more than three times safer than the alternative vehicles. If 

we look at this, people often mention yes, but there is a certain 

amount of uncertainty, there certainly is uncertainty but even with 

the uncertainty taken into consideration, the loss of crew benefits 

from the Ares I vehicle are significant above the alternatives. The 

reason for it is not only its inherent reliability in the first stage 

proven in 255 successful shuttle launches but also the nature of a 

solid rocket booster. The predominant failure mode by far is case 
68

breach, nozzle burn-through or joint burn-through. All of those alternatives, although they are very significant when combined with 

a single core liquid or a tandem booster in a singular solid rocket 

booster present a rather benign abort environment to launch abort 

system. It is the combination of this inherent reliability and its inherent benign abort conditions that make the Ares I such a safe 

launcher and that is the reason why it was designed from the beginning in that way. Thank you. 

[The prepared statement of Mr. Fragola follows:]

PREPARED STATEMENT OF JOSEPH R. FRAGOLA

Madam Chairwoman, distinguished members of the Subcommittee: I want to 

thank you for the opportunity to address you today. My testimony will detail my 

personal perspective on the ongoing focus on safety matters with regard to human 

space flight, focusing primarily on how NASA sought to better safety ratios for the 

Constellation Program via a risk-informed design process whose overriding priority 

has always been and will always be crew safety.

Introduction

Risk-based Design for Inherently Safe Crewed Launchers: The design of 

the system [that replaces the shuttle] should give overriding priority to crew safety, than trade safety against other performance criteria, such as low cost and 

reusability, or against advanced space operation capabilities other than crew 

transfer. (Columbia Accident Investigation Board (CAIB) Report Section 9.3)

This quote from the CAIB gives NASA clear direction to the design of the next 

generation crew launch system: make it simple, make it safe, and let the driving 

design principle be crew safety. That is simple enough to say, but how do we design 

for safety from the start? In other words, how do we make it ‘‘inherently safe’’ while 

also protecting against residual risk, in a mass-constrained, highly-energetic system 

such as a launch vehicle? To paraphrase the definition of inherently safe design is 

to say that the principle objective of the design process should be to eliminate, or 

at least reduce to a minimum, the hazards associated with the process so that the 

elimination or reduction is both permanent and inseparable from the design. Once 

a design concept has eliminated or reduced the hazards to a minimum, the designers can focus on developing acceptable mitigation approaches for the residual risks. 

This process is referred to as a risk-based or risk-informed design. 

NASA has utilized the May 2004 memo from the Chief of the Astronaut Office 

on future system launch safety as guidance in designing for ascent safety. A key 

statement from this memo is,

The Astronaut Office believes that an order-of-magnitude reduction in the risk 

of loss of human life during ascent, compared to the Space Shuttle, is both 

achievable with current technology and consistent with NASA’s focus on steadily 

improving rocket reliability, and should therefore represent a minimum safety 

benchmark for future systems. This corresponds to a predicted ascent reliability 

of at least 0.999. To ensure that a new system will achieve or surpass its safety 

requirement, it should be designed and tested to do so with a statistical confidence level of 95%. (Astronaut Office Memo)

The paragraphs that follow explain how this is being accomplished in the development of what has come to be the Ares I crew launcher and Orion spacecraft, and 

why the current design is believed to be inherently safer and operationally safer 

than alternative design concepts that might be equal in operational capability, or 

in some cases even more capable. The Constellation system is the only launch system that has been specifically engineered to meet the Crew Office memorandum 

guidance of 1 in 1,000 missions loss of crew (LOC).

The Two Elements of Risk-Informed Design 

In the Apollo era, crewed launchers were fundamentally designed with the best 

level of expertise available, tested to exhaustion, and then robustness or redundancy 

was added to mitigate the residual risk. This redundancy was applied across the design and included engine-out capability during at least portions of ascent, launch 

escape capability, a ‘‘life boat’’ vehicle on the way to the Moon, an abort stage possibility during descent to the lunar surface, and component robustness or redundancy 
69

where element redundancy was no longer possible. Reliability and risk-informing 

analyses were primarily qualitative, such as Failure Modes and Effects Analyses 

(FMEAs), which were applied as a check of the design rather than being integral 

to the design development. 

Design development for Constellation, therefore, has consisted of two key tenets 

related to safety. These are to make the design as reliable as possible (inherent safety), so that backup systems would never have to be used, and to make the backup 

systems as robust as possible to maximize the likelihood of crew survival and return 

given a failure of the primary system or element. Notice that, in the Apollo era, redundancy or robustness was not added for mission continuance as it was in the 

shuttle era in some cases at least, but was applied to ensure safe return of the crew.

Tenet Number 1—Make the Design Inherently Safe 

As codified in Constellation Program safety policy, inherent safety implies the 

elimination of hazards that have historically been associated with the operation of 

the type of system being designed. This in turn implies the systematic identification 

of the hazards associated with operation of the system alternatives being considered. The process of hazard identification is implemented in a global sense by a hazard analysis, which essentially establishes the potential spectrum of generic hazards 

that might be applicable to a particular design. The hazard analysis also establishes 

a local evaluation of the credibility of these hazards being applicable to the design 

in terms of their likelihood of being activated, as well as the local conditions that 

would determine their consequences if unmitigated. Both the likelihood of activation

and the associated consequences once activated are established and developed from 

historical data on heritage systems and the combined judgment of design and safety 

experts on how this heritage data applies to each specific design alternative. 

If mission reliability, i.e., inherent safety, were equivalent to crew safety as it is 

for payload ‘‘safety,’’ then the task that would be left to the analysts would be to 

inform the decision makers of the forecasted mission reliability of each design. Even 

in this case, an alternative that employed a first stage that made use of a solid, 

which could subsume the reliability of the shuttle solid, would be a strong contender 

because the shuttle solid has demonstrated a mission reliability of just a single failure in approximately 250+ booster firings. This implied demonstrated reliability of 

0.996, or 99.6%, rivals the best of the best of the boosters worldwide. However, in 

the case of crew safety, mission reliability is not the entire story.

Tenet Number 2—Adequacy of ‘‘Abort Effectiveness’’

The shuttle designers, unlike the Apollo designers before them, concentrated fully 

and completely on the inherent safety of the vehicle—that is, they relied on the forecasted mission reliability of the design alone to guarantee crew safety. Clearly, the 

primary focus of a launcher design should be on mission reliability, regardless of 

whether or not it is crewed. The primary objective of the design should always be 

to avoid failure. 

A mitigating system, given a failure, should never be used as a crutch to enhance 

crew safety, but rather only be used as a way to abort the mission and recover the 

crew. However, unless the reliability of the primary design can be assured to a significantly high degree, a mitigating system (such as the Orion Launch Abort System) is essential to ensuring crew safety. The crew safety enhancing power of an 

abort system is generated by the fact that it provides an additional or conditional 

crew survival probability given the occurrence of a crew threatening event. This conditional probability of a successful abort and return given a crew-threatening event 

is referred to as the ‘‘Abort Effectiveness.’’

The abort effectiveness value is a function of several things: the probability that 

the abort can be initiated in time to allow for a safe distance to be established for 

crew survival with employing an acceleration that also allows for survival, the reliability of the abort system, and the conditions that the crew vehicle will be obligated 

to negotiate subsequent to the abort initiation. In the days of Apollo, when NASA 

had comparatively little experience and computational capability, the abort effectiveness was estimated by comparison to escapes from high-performance military 

aircraft combined with the results of a few escape system tests, Little Joe I and II. 

Today, Constellation is systematically applying throughout the design process the 

software simulation tools and advanced computers that allow us to do a much better 

analytic design assessment than Apollo. Specifically, the integrated abort effectiveness can now be calculated by employing more realistic simulations of abort conditions. The integrated abort effectiveness is the effectiveness of each abort against 

each initiated abort scenario weighted by the occurrence probability of the scenario. 
70

While simulation tools and computational capability were unavailable in the Apollo 

era, today this calculation can be carried out with reasonable accuracy. 

The value of the abort effectiveness for each acceptable, payload-capable alternative is possible but complicated to determine. However, what is known is that the 

primary determinate of the effectiveness of an abort is the time available to affect 

the abort along with the severity and extent of the environment in the abort locale.

Top Level Risk-Informed Design Selection During ESAS 

The above paragraphs have indicated the importance of incorporating risk evaluation from the very beginning of the crewed launcher design selection process to 

achieve an overriding priority for crew safety. Without this focus on safety risk evaluation, the crew launcher focus can slip into one emphasizing performance over 

safety. Even with safety as the overriding priority, the launcher must have acceptable payload capability and be affordable. Safety risk alone cannot be the criteria 

for the selection of a crew launcher design. Decisions must be made with safety risk 

as a priority, but within the context of a risk, performance, and cost picture. This 

implies that from a top-down perspective, potential crewed launchers should be each 

evaluated on the basis of cost, performance, and risk simultaneously, and this is just 

how the ESAS study efforts for the selection of a crewed launcher design proceeded. 

During ESAS, any launch vehicle concept that did not approach at least 1 in 1,000 

forecasted launch Loss of Crew (LOC) risk was eliminated. In addition, concepts 

that would place the crew module in close proximity to the boosters and/or other 

potential sources of accident initiation were eliminated because it as anticipated 

they would interfere in NASA’s ability to incorporate a launch abort system into the 

next-generation launch vehicles. Lastly, as part of its findings, the ESAS team recommended that this risk-informed design process be extended to the development 

of the design of the selected single solid First Stage concept, which would later be 

known as the Ares 1 Crew Launch Vehicle.

Constellation Safety Story 

The Constellation program baseline was derived directly from the ESAS recommendations, and a clear discriminator among crew launch vehicle alternatives 

was the relative complexity of the launcher’s first stage and the effectiveness of the 

crew escape system. 

The Ares I first stage (FS) consists of a 5-segment reusable solid rocket motor 

(RSRM), an aft skirt, a forward skirt, and a frustum. The 5-segment solid is an evolutionary growth from the 4-segment solid RSRM tandem boosters utilized to power 

the space shuttle. The Ares I booster will continue the protocol of recovery and postflight inspection that began in the Shuttle Program. To summarize, the 5-segment 

solid for the Ares I has many advantages over other designs, including:

• Drawing extensively from the heritage and knowledge derived from the Shuttle RSRM Program. There have been 252 solids flown in the Shuttle Program 

with one failure (Challenger STS–51L).

• Applying the knowledge gained from that experience-base to actively improve 

design features.

• Utilizing extensive qualification and flight test programs.

• Incorporating a failure-tolerant design against the primary failure modes of 

joint leakage and case burn-through.

• Incorporating an extensive system of process controls in manufacturing and 

assembly.

• Benefiting from the basic Ares ‘‘single-stick’’ architecture, which eliminates 

the possibility of engaging elements that are radially or tandem mounted.

The Orion crew capsule will have a Launch Abort System (LAS) that will offer 

a safe, reliable method of moving the entire crew out of danger in the event of an 

emergency on the launch pad or during entire first stage and the most risk intense 

portion of the second stage climb to Earth orbit. Mounted at the top of the Orion 

and Ares I launch vehicle stack, the abort system will be capable of automatically 

separating the Orion from the launch vehicle and positioning the Orion and its crew 

for a safe landing. NASA plans a series of tests to characterize the LAS. Pad Abort 

(PA)-1, which is planned for March 2010, is the first of these tests and will address 

what happens if an emergency occurs while the Orion and the launch vehicle are 

still on the launch pad. Other such tests will determine how the LAS behaves during critical parts of the flight regime. These tests will take place at White Sands 

Missile Range, New Mexico. 
71

NASA is making substantial progress in maturing its approach and design methodology for designing a robust crew-launch system. From the very onset of the Constellation Program, the NASA design team insisted on the application of a risk-informed design approach. That is, safety risk members are included as integral parts 

of the Constellation design team. They are chartered to develop risk-informed approaches for the Ares I and Orion design concept refinement, and are included in 

all trade studies that involved safety risk. 

The skill mix of the NASA team includes not only the Failure Modes and Effects 

Analyses, Integrated Hazard, and Probabilistic Risk Assessment (PRA) disciplines 

traditionally found under the Safety and Mission Assurance (S&MA) organizations, 

but also engineers with such backgrounds as computational fluid dynamics (CFD), 

Aerospace, and Physics disciplines. The team functions as a single group entitled 

Crew Safety and Reliability (CSR) and has been given the clear direction to work 

daily with the design engineers to provide expertise and feedback via various assessments and analysis techniques throughout the design maturation process. This investment continuously emphasizes a sincere commitment to the CAIB findings. 

Additionally, the primary modus operandi of past programs has been to provide 

intermittent reviews of design ‘‘drops’’ at the prescribed reviews. This limited meaningful insight into the systems development, which was occurring in the everyday 

work environment where design risks, nuances, trade studies, etc., are introduced. 

The Constellation approach, by contrast, has fostered the development of a truly 

risk-informed culture on a continuing and synergistic basis. 

In parallel and in concert with the Ares I design development; NASA’s Constellation team is providing the resources for the development of the supporting logical 

and phenomenological (or physics-based) computer models and associated historical 

data sets. This allows for the identification of all credible potential events that 

might initiate an accident, the extant local external environmental conditions as determined by aero-physics computer models, and internal conditions, as determined 

initially by judgment and then later by motor and engine physics computer models, 

at the postulated time in the ascent trajectory that initiator was to occur. Then the 

global environment is imposed upon the integrated ascending Ares I stack and on 

the Orion crew module as determined by sophisticated computer models replicating 

those environments seen as potentially assaulting the vulnerabilities of Orion. Specifically, fragmentation fields, propagated impulse and pressure fields, and thermal 

radiation fields generated by the accident scenarios are initiated, forming the basis 

of the ‘blast environment’ that the Orion must escape from. 

Currently the Ares I has an estimated AE of about 84%, which when combined 

with its high heritage based inherent reliability makes it two to three times safer 

than alternative launchers as shown in Table 1 and in graphical form in Figure 1. 

This corresponds to a LOM of 1 in 200 in ascent, which leads to LOC of about 1 

in 1300 according to our independent calculations.
72

Meanwhile, examples of cases where the risk assessment and failure analysis 

teams have provided input and/or impacted the outcome of Constellation design 

issues, trades, or risks include the following.

• Abort triggers study: Provided LOC and Abort Effectiveness assessments, including engineering models and timing, to determine what potentially catastrophic scenarios warrant abort sensors and software algorithms.

• Separation study (booster deceleration motors (BDMs)): Hazard analysis combined with probabilistic design analysis (PDA) led to the design decision to 

increase the number of BDMs from 8 to 10.

• The Hazards Team identified that the first stage and upper stage designs 

failed to meet properly at the interface flange (different number of bolts) and 

a re-design was instituted. Hazards team provided assessment to Upper Stage 

that resulted in clocking of the hydrogen and oxygen vents to improve separation distance.

• Orion and Ares systems architecture trades: risk assessment and failure analysis teams have informed the active mitigation of systems design 

vulnerabilities for both the rocket and spacecraft.

• Failure Modes and Effects Analysis teams:

Æ J–2X FMEA was used to support redline sensor selection in order to detect failure modes prior to their propagation to a catastrophic condition.

Æ Upper Stage Main Propulsion System (MPS) FMEA identified need for 

modifications related to solenoid valves to increase reliability and failure 

mitigation.

Æ US Reaction Control System FMEA identified need for additional temperature sensors to detect freezing of hydrazine to support launch commit criteria.

Æ US Flight Safety System (FSS) FMEA identified need to relocate cryogenic helium line that was adjacent to Flight Termination System (FTS) 

linear shaped charge.

Æ FS Roll Control System was changed from bipropellant to monopropellant 

due to significant reduction in critical failure modes.

Summary 

The Constellation design development process has, and continues to employ, a 

continuous risk-informed design process adopted from the outset of the program. 

This process has included both logical and physical simulation models as appropriate in a way that has had a synergistically beneficial impact on Orion and Ares 

I designs by allowing them to be developed with an ‘‘overriding priority’’ given to 

crew safety at every stage of the design and operational processes. I believe that 
73

the Constellation development represents a successful, pioneering application of a 

new approach to engineering design, a type of engineering risk design, which will 

have multiple applications and refinements in aerospace system designs in the future.

Closing 

In closing, I would be remiss if 1 did not bring your attention to a statement from 

the Augustine report that I believe to be problematic. Specifically, on page 9 of their 

report the Committee states:

Can we explore with reasonable assurances of human safety? Human space travel has many benefits, but it is an inherently dangerous endeavor. Human safety 

can never be absolutely assured, but throughout this report, safety is treated as 

a sine qua non. It is not discussed in extensive detail because any concepts falling short in human safety have simply been eliminated from consideration. (Augustine 9)

I believe this statement to be problematic because I believe it to be indicative of 

what I like to call a ‘‘goal post’’ mentality rather than the proper safety mentality 

which should be ‘‘As low as reasonably achievable’’, or ALARA. In the former case 

items are considered safe if they meet the criterion, in this case ‘‘human safety’’, 

or not if they don’t. If they meet the criterion and are considered safe they are retained, and if they don’t they are considered unsafe and are eliminated from consideration. It matters not if some alternatives just miss the criterion, or they miss it 

by a mile, they are eliminated nonetheless. And if they just make the criterion or 

they are much better, they are all considered ‘‘safe’’. While it is certainly true that 

safety cannot be assured in spaceflight and it is also true that the safety level of 

concepts are uncertain this approach has led in the past in other industries, such 

as the commercial nuclear power industry, to a safety perspective that focused only 

on which concepts or designs should be considered safe and which not. In this way 

the safety bar is set to include the lowest acceptable rather than focusing on which 

designs were as safe as achievable. There are always uncertainties in every analysis, and risk analysis is no exception. Still when solid, heritage-based analysis 

shows significant differences in safety risk amongst alternatives it is questionable 

how an investigation that claims safety as a sine qua non can fail to highlight these 

discriminations. 

Now it is true that the goal post approach will eliminate design concepts that are 

clearly unacceptable, but it also fails to discriminate designs that are clearly desirable among those that are acceptably safe. It is my belief that the Ares I vehicle, 

because of its inherent focus on being as safe as achievable from the very start, has 

the best chance to be an outstandingly safe crew launcher. There is no way to insure 

safety, and spaceflight will always be a risky endeavor, but a launcher that is designed to be safe from the start, at least to me, is a good way to begin. 

Madam Chairwoman, I would like to thank you and the members of this Subcommittee for the opportunity to express my ideas. I would be pleased to respond 

to any questions that you or the other Members may have.

Chairwoman GIFFORDS. Thank you, Dr. Fragola. 

General Stafford. 

STATEMENT OF LT. GEN. (RET.) THOMAS STAFFORD, UNITED 

STATES AIR FORCE 

Lt. Gen. STAFFORD. Chairwoman Giffords, Ranking Member 

Olson, distinguished members of the Committee, many old friends, 

I am honored to be invited here to appear before you today to testify on the matter of crew safety in human spaceflight. 

As a result of the Augustine Committee report, it is imperative 

that the information and their observations that resulted in recommendations be considered carefully before the Congress directs 

or allows changes to be made to the program that NASA has pursued and the Congress has approved over the past years. Mr. Augustine invited me to be the first presenter to the committee due 

to the fact that I presently chair the ISS Independent Advisory 

Taskforce and previously had chaired the Shuttle-Mir Taskforce. I 

had also chaired a yearlong study at the direction of the Vice Presi-
74

dent on how NASA should return to the moon and go on to Mars 

in a safer, better and a more rapid timeframe at a minimum cost. 

The study was titled ‘‘America at the Threshold’’ and Mr. Augustine provided a copy to all members of the committee prior to that 

first meeting they had. 

After the Columbia accident in 2003, I was asked by the NASA 

Administrator to chair the Return to Flight Task Group to review 

the Columbia Accident Investigation Board recommendations to ensure that these recommendations are carried out by NASA before 

the space shuttle return to light, and today I want to acknowledge 

the work performed by the Augustine Commission that covered 

these broad-based subjects in a relatively short period of time. 

After my own extensive examination of the committee’s reports, I 

strongly agree with the majority of their findings. However, on a 

few I disagree. 

I would strongly agree that the NASA Administrator who is assigned responsibility for the management of NASA needs to be 

given authority to manage the agency. This includes restructuring 

resources, the workforce and facilities to meet the needs. The Augustine committee has pointed out to some of the underlying concerns and all the deliberations on the future of U.S. human 

spaceflight program are that NASA has been inadequately funded 

for many years, and on this point I strongly agree. I certainly hope 

that this year a satisfactory appropriations bill for NASA will be 

passed. 

I agree with the committee’s recommendation that the remaining 

space shuttle flights should be launched on a schedule that is compatible with the normal procedures that are used for safe checkout 

and test for launch operations and which may extend to flights into 

2011. We presently have a shuttle at KSC standby on notice for 

rescue if required. If funding were available, this shuttle should 

launch large cargo that could enhance the viability of the ISS sixperson crew capability. 

The committee wisely recommended the continuation of U.S. participation in the ISS to be extended to 2020. We must remember 

that the United States cannot make a unilateral decision to end 

and deorbit the International Space Station. However, the ISS will 

never be fully and effectively utilized unless researchers and all the 

ISS international partners have confidence that the facility will be 

supported and sustained as long as it is operationally viable and 

technically useful. To effectively use this great international laboratory, the ISS requires a guaranteed cargo and crew delivery to 

be available as soon as possible after the space shuttle retirement. 

Yet the committee suggested that the responsibility be removed 

from NASA and offered to commercial contractors. It is feasible for 

the U.S. industry to develop a commercial cargo crew delivery system to the ISS. However, the cargo dimensions are somewhat limited. 

The commercial transport of government crews to the ISS has 

major implications of which I have a very different view. I would 

like to differentiate the two subjects: potential commercial crew 

cargo delivery to the ISS and commercial crew delivery to the ISS. 

NASA has incentivized and selected two contractors to provide 

commercial cargo delivery to the ISS, and for commercial cargo de-
75

livery, the first issue is development of a reliable booster to low 

earth orbit. The second issue is to develop an autonomous transfer 

vehicle to transfer the cargo from the booster to the ISS in a safe 

manner that would meet the ISS visiting spacecraft requirements, 

which were recently complied with by the European Space Agency’s 

ATV and the Japanese HTV. 

The development of a transfer vehicle is in itself a significant 

challenge. The European Space Agency recently delivered their 

first ATV payload approximately four years later than their initial 

target delivery date. The Japanese delivered their HTV some two 

years later than their initial target date. Both government entities 

used considerable resources to develop these individual transfer vehicles. I certainly wish the two U.S. entities success in meeting 

their NASA milestones for cargo delivery since the ISS is dependent upon continued supply of cargo delivery by the partners. 

With respect to commercial government crew launch delivery to 

the ISS, I would like to recall my own experience. I flew on two 

Gemini missions with a specially modified Titan II ICBM booster 

and two Apollo missions, one on the small Saturn IB and one on 

a giant Saturn V, and over the period of 13 years I experienced and 

participated in development of high reliability, human-rated boosters, human-rated spacecraft and launch abort systems. I was the 

backup pilot for the first manned Gemini flight and spent many 

months in the factory and countless hours in the spacecraft as it 

was being built and tested. I was then pilot of Gemini VI, the 

world’s first rendezvous mission, and on that the Titan II stage ignited and then shut down at T0. Wally Schira and I had the liftoff 

signals in the spacecraft and a fire broke out down below the base 

of the booster. The special emergency detection system that had 

been installed on that Titan II helped us resolve a couple of critical 

failures and our own decisions prevented a fatality. Had that not 

been modified and the decisions right, I would not be here today, 

Madam Chairman, and you would have been reading about me in 

the obituary column. 

I was also backup commander for the second Block I Apollo flight 

and had my crew performing a similar test in the sister spacecraft 

at the same time the Apollo I accident occurred and the Apollo I 

crew died in the fire at the Cape. I was a backup commander on 

the first Apollo Block II spacecraft, Apollo VII, and again spent 

considerable time in the factory as it was undergoing tests and fabrication. At that time there were numerous NASA engineers, inspectors, support technicians to facilitate this effort. 

I was then commander of Apollo X, the first flight of the lunar 

module to the Moon and again I spent an inordinate amount of 

time in performing the tests to check out the command and the 

lunar module. 

My fourth mission was commander of the Apollo-Soyuz Test Program. Again, I spent considerable time in that spacecraft and also 

a brief time in the Soyuz spacecraft for the first flew we ever flew. 

These flights both as prime and backup crew members were accompanied by thousands of hours of training in different types of spacecraft simulators and mockups in which numerous emergency situations were simulated and resolved. Therefore, safe delivery of a 

government crew to the ISS involves the human rating of a launch 
76

vehicle, the spacecraft, the launch abort system, successful integration of all three elements. The process of requirements, design and 

construction, all these parts start with the NASA safety and mission assurance requirements. There also has to be a process where 

there is not excessive creep in these requirements which could result in cost increases and launch schedule delay. 

Unfortunately, the Augustine report gave just a very brief mention of crew safety for launch, orbit and recovery operations. The 

report had no in-depth discussion of these vital issues of safe 

launch to orbit and return to Earth of government crews. If NASA 

can provide incentive seed money, can industry raise or finance the 

funds? What are the safety requirements for commercial government crew vehicle? That must be commensurate with other government operating crew transport systems. 

The commercial entities that propose to provide safe government 

crew transport will require a guarantee of a certain number of 

flights for a certain period of time and a price in order to minimize 

or to recover the reoccurring investment and have a satisfactory return. 

A major issue is, who assumes liability for the safe government 

crew delivery. If it is commercial, would insurance be available and 

at what cost? If safe commercial flight transportation for government crew does evolve, other questions will arise. On page 72 of 

the committee report it states, ‘‘It is critical to the success of the 

program that multiple providers be carried through to operational 

service,’’ and that statement in itself has a huge financial implication for both the government and the commercial providers. If 

NASA is buying a government crew ride rather than a spacecraft, 

then how, by whom and to what standards will the government’s 

equipment and operations be certified? What entity other than 

NASA can establish and verify appropriate standards for human 

spaceflight? That question becomes very crucial. 

Madam Chairman, thank you and the members of the Subcommittee for the opportunity to express my opinions. I will be glad 

to respond to any questions you or the other distinguished members have. Thank you. 

[The prepared statement of Lt. General Stafford follows:]

PREPARED STATEMENT OF LT. GENERAL THOMAS P. STAFFORD

Chairwoman Giffords, Ranking Member Olson, and Members of the Subcommittee, I am honored to be invited to appear before you today to testify on the 

matter of crew safety in human spaceflight. In the wake of the Augustine Committee report, it is imperative that the implications of that Committee’s recommendations be considered carefully before this Congress directs, or allows, 

changes to be made to the program NASA has pursued and the Congress has approved for more than four years. 

Before proceeding to answer your questions, I would like to make a few observations concerning the Augustine Committee report. 

The most important observation of that Committee, and the underlying concern 

in all deliberations on the future of U.S. Human Spaceflight, is that it has been inadequately funded for many years now. The budget projected for NASA in the next 

decade and beyond is inadequate to accomplish the core objectives with which NASA 

has been charged. The funding is inadequate to build a timely replacement for the 

Space Shuttle, to return our astronauts and other international partner nations 

from the Space Station to the Earth and then to visit the moon, near-Earth asteroids, and to develop the technology and systems required for the first human voyages to Mars. 
77

This plan for NASA has been approved by the Congress. It is a program offering 

the strategic vision for human spaceflight that was demanded by Adm. Gehman and 

the Columbia Accident Investigation Board. It is a program worthy of our nation. 

The Augustine Committee notes that at least three billion dollars per year must be 

added to NASA’s appropriation to accomplish the mission. Even more importantly, 

the Committee notes that there is no other worthwhile program of human 

spaceflight which could be accomplished for the amount of money presently planned 

for NASA. 

The choice is now plain: either we will provide the funding necessary to accomplish worthy objectives in space, or this nation will cede its leadership on the space 

frontier to others. I wish to add my voice to those who say that this leadership, the 

result of five decades of effort purchased at the cost of nearly a trillion of today’s 

dollars and many lives, some of them given by close friends of mine, must not be 

allowed simply to drift away. As a nation, as a people, we must be better than that. 

Today, I want to acknowledge the intense work performed by the Augustine Committee to cover these broad based subjects in such a relatively short period of time. 

After extensive examination of the Committee’s report, I strongly agree with the 

majority of their findings and recommendations. I also strongly agree that the 

NASA Administrator, who has been assigned the responsibility for the management 

of NASA, needs to be given authority to manage NASA. This includes restructuring 

resources, the workforce, and facilities to meet mission needs. However, on some of 

the Committee’s findings, I have a different opinion. 

I agree with the Committee’s recommendation that the remaining Space Shuttle 

flights should be launched on a schedule that is compatible with the normal procedures used for safe check out test and launch operations, which may extend the 

flights into 2011. We presently have a Shuttle at KSC on standby to launch on short 

notice, if required. If funding were available this Shuttle could carry cargo delivery 

that would enhance the viability of the ISS six-person crew capability. 

The Committee wisely recommends the extension of the International Space Station past 2015 to at least the year 2020. However, the ISS will never be fully and 

effectively utilized unless researchers in all of the ISS partner nation have confidence that it will be supported and sustained as long as it is operationally viable 

and technically useful. 

To have and to use this great international laboratory requires a guaranteed 

space transportation capability to be available as soon as possible after Space Shuttle retirement. The Committee recommends that this responsibility be removed from 

NASA and offered to commercial providers. 

I would like to differentiate the two subjects, Potential Commercial Cargo delivery 

to the ISS and Potential Commercial Government Crew delivery to the ISS. NASA 

has incentivized and selected two contractors to provide commercial cargo delivery 

to the ISS. For commercial cargo delivery, the first issue is the development of a 

reliable booster to low earth orbit. The second issue is to develop an autonomous 

transfer vehicle to transport cargo from the booster to the ISS in a safe manner that 

would meet the stated ISS visiting spacecraft requirements that were complied with 

by the European Union Space Agency ATV and Japan’s HTV. The development of 

this type of a transfer vehicle is a major challenge. The European Space Agency recently delivered their first ATV payload approximately four years later than their 

initial target delivery date. Japan delivered their HTV some two years later than 

their initial target date. Both government entities used considerable resources to develop their individual transfer vehicles. I certainly wish the two U.S. entities success in meeting their NASA milestones for cargo delivery since the ISS is dependent 

upon a continued supply of cargo deliveries by the partners. 

With respect to commercial crew launch delivery to the ISS, I would like to recall 

my own experience. I have flown two Gemini missions on a modified TITAN II, 

ICBM, booster and two Apollo missions, one on the Saturn IB and one on the giant 

Saturn V. Over a period of thirteen years, I have experienced and participated in 

the development of high reliability boosters, spacecraft, and launch abort systems. 

I was a back-up pilot for the first manned Gemini spacecraft and spent many 

months in the factory and countless hours of testing in the spacecraft as it was 

being built and tested. I was then pilot of Gemini VI, the world’s first rendezvous 

mission. On that mission, the TITAN II first stage engines ignited and then shutdown at T=0. Wally Schira and I had the lift off signals and a fire broke out below 

the base of the booster. The emergency detection system that had been installed on 

the TITAN II helped us to resolve the two critical failures that we experienced in 

that extremely short period of time. 

I was the back-up commander for the second Block I Apollo flight and had my 

crew performing a similar test, in the sister spacecraft, at the same time that the 

Apollo I accident occurred and the crew died in the spacecraft fire on the launch 
78

pad. I was then back-up commander of the first Block II Apollo spacecraft, Apollo 

VII, and spent considerable time in the command module which was being built and 

tested. There were also numerous NASA engineers, inspectors and support technicians at the factory to facilitate this effort. This support effort was similar to the 

Gemini program, where numerous NASA engineers, inspectors and support technicians participated in the manufacturing and test at the factory. I was then the Commander of Apollo X, the first flight of the Lunar module to the moon. Again, I spent 

an inordinate amount of time in performing test and check-out in the command 

module and the lunar module. 

My fourth mission, I was commander of Apollo for the Apollo-Soyuz Test Program. 

Again, I spent considerable time for the test and check out of the Apollo spacecraft 

and a brief time in the Soyuz spacecraft. These flights, both as a prime and as a 

backup crew member were accompanied with hundreds of hours of training in different types of spacecraft simulators and mockups where numerous emergency situations were simulated and resolved. 

Therefore, safe delivery of a government crew to the ISS involves the human rating of the launch vehicle, the spacecraft, and the launch abort system, and the successful integration of all three elements. The process of requirements, design, and 

construction all begin with the NASA safety and mission assurance requirements. 

There also has to be a process where there is not an excessive creep in requirements 

that would result in cost increases and launch schedule delays of the vehicles. The 

Augustine Committee report gave just brief mention of crew safety for launch, orbital, and recovery operations. Unfortunately, there were no in-depth discussions of 

the vital issue of safe launch to orbit and return to earth of government crews. 

It may be that the complexity of developing a new government crew space transportation capability, and the difficulty of conducting spaceflight operations safely 

and reliably, it is not fully appreciated by those who are recommending the cancellation of the present system being developed by NASA, and the early adaptation of 

the presently non-existent commercial government crew delivery alternatives. There 

seems to be some belief that if NASA would ‘‘step aside’’, private alternatives would 

rapidly emerge to offer inexpensive, safe, reliable, dependable government crew delivery space transportation at an earlier date. 

Human spaceflight is the most technically challenging enterprise of our time. No 

other activity is so rigorously demanding across such a wide range of disciplines, 

while at the same time holding out such harsh consequences for minor performance 

shortfalls. Aerodynamics, aerospace medicine, combustion, cryogenics, guidance, and 

navigation, human factors, manufacturing technology, materials science, structural 

design and analysis—these disciplines and many more are pushed to their current 

limits to make it possible and just barely possible at that, to fly in space. Space is 

very, very hard. 

We’ve learned a lot about human spaceflight in the last five decades, but not yet 

nearly enough to make it ‘‘routine’’ in any meaningful sense of the word. As Adm. 

Gehman and the CAIB outlined, these flights in the past have been developmental 

flights and the relatively small number in the future will be the same. Thus far, 

it has been a government enterprise with only three nations yet to have accomplished it. Development of new systems is very costly, operational risks are extremely high, and profitable activities are elusive. It may not always be this way, 

but it is that way at present. 

Apart from questions of technical and operational complexity and risk, there are 

business issues to be considered if the U.S. is to rely upon commercial providers for 

government crew access to space. It is not that industry is incapable of building 

space systems. Far from it. It is American industry which actually constructs our 

nation’s space systems today, and carries out most of the day-to-day tasks to implement flight operations, subject to the government supervision and control which is 

required in managing the expenditure of public funds. 

So the question is not whether industry can eventually develop government crew 

delivery systems and procedures to fly in low Earth orbit. It can. The relevant questions in connection with doing so commercially are much broader than that of the 

relatively simple matter of whether it is possible. Let us consider a few of those 

questions. 

Absent significant government backing, will industry provide the sustained investment necessary to carry out the multi-year development of new commercial government crew delivery systems to LEO? Will industry undertake to develop such products with only one presently known customer, the U.S. Government? What happens 

if, midway through the effort, stockholders or boards of directors conclude that such 

activities are ultimately not in the best interests of the corporation? 

What happens if, during development or flight operations, an accident occurs with 

collateral damages exceeding the net worth of the company which is the responsible 
79

party? A key lesson from the development of human spaceflight is that safety is expensive, and the failure to attain it is even more expensive. Apollo 1, Challenger, 

and Columbia have shown that spaceflight accidents generate billions of dollars in 

direct and collateral liabilities. Who will bear this risk in ‘‘commercial’’ space operations? If the company, how much insurance will be required, where will it be obtained, and at what cost? If government indemnification is expected, upon what 

legal basis will it be granted, and if the government is bearing the risk, in what 

sense will the operation then be ‘‘commercial’’? 

When commercial government crew delivery space transportation does come 

about, other questions will arise. Will there be competition in this new sector, or 

will there be a monopoly supplier? If NASA is to contract with the first, or only, 

commercial government crew space transportation supplier, and if there is no price 

ceiling established by a government alternative, how do we ensure a fair price for 

the taxpayer in a market environment in which the government is the only customer for the products of a single provider? And how is a space operation ‘‘commercial’’ if the government is both regulatory agency and sole customer? 

Leaving aside technical, operation, and business concerns, there is the matter of 

the schedule by which these new commercial systems are expected to come into 

being. The Augustine Committee has been particularly pointed in its clams that, 

with suitable government backing, such systems can be made before the comparable 

Constellation systems, Ares 1 and Orion, could be ready. Page 71 of their report offers such a claim. 

Are such claims optimistic? Any launch system and crew vehicle that can transport a half-dozen people to and from the ISS, and loiter on-orbit for a six-month 

crew rotation period while serving as an emergency crew return vehicle, is necessarily on the same order of complexity as that of the old Saturn 1 and the Apollo 

systems. The Saturn 1 conducted its first test flight, with a dummy upper stage, 

in October 1961, and carried a crew for the first time in October 1968. The Apollo 

VII spacecraft which carried that crew, of which I served as back-up Commander, 

began its own development in 1962. Thus, the Earth-orbital segment of the Apollo 

system architecture required a half-dozen years and more to complete. These developments were carried out by highly experienced teams with virtually unlimited development funds in the cause of a great national priority. 

If, in the fashion of airline travel, NASA is buying a ride rather than a spacecraft, 

then how, by whom, and to what standards will the company’s equipment and operation be certified? How is NASA to determine that the system is truly ready to fly? 

Does the government merely accept the claims of a self-interested provider, on the 

basis of possibly very limited flight experience by company pilots? We certainly do 

not do that for military aircraft, and even less so is this the case for civilian transport aircraft. Extensive development and hundreds or even thousands of hours of 

flight testing followed by operational test and evaluation by the government is required before a new military aircraft is released into operational service; I’ve done 

that kind of testing. Similarly, new civilian aircraft are subject to extensive testing 

involving certification of systems and hundreds of flights to exact certification standards before they are allowed to be put in passenger service. Will we accept less for 

new, ‘‘commercial’’ space systems which carry government astronauts, or those of 

our international partners? In my opinion, the Congress should certainly not accept 

less. 

Yet, today, we do not even know what standards should exist for the certification 

of commercial spacecraft to carry government crew members into orbit. What entity 

other than NASA can establish and verify appropriate standards for human 

spaceflight? I will tell you that from my perspective and from the history that I have 

lived, these standards, like airworthiness standards, are written in other people’s 

blood. Some of that blood was shed by friends of mine. We don’t know enough, yet, 

about human spaceflight to relax the hard-learned standards by which we do it. And 

we certainly do not yet know enough to make the assumption that new and untried 

teams can accomplish it on a schedule that is better than was achieved during Apollo. 

This takes me to another point. Some of you may recall that, a few years back, 

I chaired a Task Force on International Space Station Operational Readiness. This 

task force was charged with making an independent assessment of our readiness to 

put crew on the ISS, and to sustain it with the transportation systems, Russian and 

American, which were necessary for cargo delivery and crew rotation. We did not 

take this matter lightly. The ISS was new, and much smaller. We did not then have 

the years of experience we have since accumulated in building the ISS and flying 

on it. Our then-recent long-duration spaceflight experience had mostly been accumulated during the Shuttle-Mir program, and Russian experience in resupplying the 

Mir and the earlier Salyut space stations was not unblemished. Numerous docking 
80

failures had occurred over the lifetimes of these programs, resulting not only in 

cargo which went undelivered but also, in one case, the collision of an unmanned 

Progress resupply vehicle with the Mir. An in another instance there had been a 

fire on Mir itself and the first crew to visit their first very small space station Salyut died after performing the orbit maneuver to reenter the atmosphere. 

These indicants and accidents gave us pause. Not because we doubted the capability of the team; the Shuttle had been flying for over fifteen years by that time, 

and the Russians had accumulated decades of experience in long-duration 

spaceflight. I’ve flown with them; I know how capable they are. No, our concerns 

were heightened by our awareness of just how careful one has to be in this most 

demanding of enterprises. We cannot afford to relax that vigilance today as we go 

forward into a new era of ISS utilization, and as we prepare once again to voyage 

outward from Earth, first to the moon or the asteroids and then beyond. There is 

a place in these plans for the contributions of commercial government crew space 

transport entrepreneurs, but not yet demonstrated, and not to the exclusion of 

NASA’s own systems. 

I have asked many questions in this testimony, questions which I believe must 

be answered if commercial government crew human spaceflight is to become viable. 

I believe that these questions and others yet to come can and will be answered at 

some date. However, America’s continued leadership in space should not depend 

upon the nature and timing of those answers. When commercial entities can provide 

dependable transportation reliable, U.S. government crews as well as partner nation 

crews, the government should buy it. But until that time, there should be an assured government capability to accomplish the task. 

Thank you.

Chairwoman GIFFORDS. Thank you, General. 

I want to thank all of our witnesses today, and we are really 

blessed to have such a star-studded group of individuals with lifetimes worth of knowledge and expertise. 

We are going to begin our round of questions now. I am going 

to start with 5 minutes, and because we have so many members, 

I will try to really make sure that we all speak for five minutes 

including cutting myself off. 

SAFETY OF LAUNCH SYSTEMS

Let me begin with something that Dr. Fragola had put in his testimony and touched on it with his slides. You had stated that it 

was your belief that the Ares I launch vehicle because of its inherent focus on being as safe as achievable from the very beginning 

has the best chance to be outstandingly safer in terms of it being 

a crew launcher. You talked about that as a good way to begin 

from just the very start. Given the fact that we are under enormous budget constraints here in the Congress and that funds available for NASA’s human spaceflight and exploration program are always going to be more constrained than we would like, we need to 

think about how we prioritize, and I would like to hear from I 

think General Stafford and Mr. Marshall on how important a factor 

should the inherent safety of the Ares I vehicle be for Congress to 

consider as we make a decision on which launch system or systems 

to pursue in meeting NASA’s International Space Station and exploration needs. I would also like to hear whether or not this 

should be the inherent safety of the Ares I, should this be a significant discriminator when choosing among alternatives and also who 

should carry the burden of proof? General, let me start with you. 

Lt. Gen. STAFFORD. Madam Chairwoman, again it starts with the 

requirements stated there by the NASA Safety and Mission Assurance, and I noticed that the astronaut group had stated their own 

requirements, that the reliability of the crew from launch into orbit 
81

is three nines. In other words, you have had a failure no more than 

one out of 10,000. I did my own review and my best memory back 

from Apollo, and we were striving for four nines at that time, 

Madam Chairman, 40 years ago, and just to be sure that I had this 

right I checked with Dr. Chris Kraft, who was there with the space 

task group and director of mission operations and then was later 

center director, and he said that they were striving for four nines, 

and in fact, Dr. Kraft said he would like to give a few of his 

thoughts on his how to distinguish reliability of boosters. 

‘‘Since the first time a pencil was put to paper, the engineers and 

technicians are all responsible that the vehicle be used to carry astronauts and others into space. They know that the life of the individual depends on it. This is true of the first-level engineer, the 

lead designer, the chief engineer, the program manager and company executives. This is also true of the machinists, the contract 

buyer, the piece part selector and the safety, reliability and quality 

control experts and the test engineers and eventually by the person 

who has to stand up on launch day and say ‘go’ when that launch 

director asks. 

‘‘In my opinion, that is the case for the Ares I and Orion. It is 

not the case for the COTS-crewed government vehicles. To think 

that it is the large and dedicated oversight, you know, group could 

provide the same amount of credibility and reliability and safety 

and quality for a machine is to say that the first paragraph was 

misunderstood and has probably not been experienced.’’ 

So it starts right from the very start. And I know from my own 

experience that the Titan II had several dead zones in it. That program in Titan Gemini was a high-risk demonstration program only. 

Chairwoman GIFFORDS. Thank you, General. 

Mr. Marshall? 

Mr. MARSHALL. Well, first of all, as you have heard today from 

this panel, I think everybody agrees that safety has got to be an 

integral process of selection and enforcement of any vehicle that is 

used in the future for human flight to provide astronaut travel to 

any place in low earth orbit or beyond. So I think that that is an 

absolute given that it has to be fundamentally thought through 

from the very beginning. That said, the ASAP has had the opportunity to look and observe the evolution of the Ares process. We 

have challenged Jeff and his team on numerous occasions and we 

have been very, very impressed by the product and the processes 

that they have employed. The commercial side is just now beginning, and as I noted in my opening statement, we, the ASAP, believe actually that NASA is behind because they haven’t articulated 

what the requirements are from a human ratings requirement. We 

find good receptivity from the commercial providers thus far but 

the truth is, if they are building vehicles today and we would rather have had those rating requirements articulated so that they 

could be integrated into the design processes at that moment rather than let them transpire and move forward for integration at 

some other time. So we are very concerned about where the COTS–

D program or the like or similar name is in this process case, so 

the basic bottom line is, safety has to be a primary consideration 

in any selection of any vehicle. 

Chairwoman GIFFORDS. Thank you, Mr. Marshall. 
82

Next we will hear from Mr. Olson. 

NASA—COMMERCIAL INDUSTRY: SHARING OF SAFETY

STANDARDS

Mr. OLSON. Thank you very much, Madam Chairwoman, and I 

would like to follow up on Mr. Marshall’s comments but with you, 

Mr. O’Connor. I mean, that is one of the criticisms we have heard 

about the COTS–D program, NASA’s commercial space, is that 

NASA is behind in getting the information to the industry as to 

what they need to do to become human rated. And so could you 

briefly explain how NASA uses its human rating requirements to 

tailor the design of a particular crewed system such as the Ares 

and the Orion, and again, following up on the line of questioning 

of Mr. Marshall’s comments, if the human rating requirements are 

the top-level requirements, how would a potential commercial provider gain the insight to design a system that meets NASA’s requirements? And one more question, how did NASA get comfortable enough to finally certify the Soyuz for human spaceflight? 

Mr. O’CONNOR. Yes, sir, glad to answer those. The first part of 

this is the commercial crew transport. Currently, there is no formal 

start of that program. We have been talking about it. We have 

asked for people to—commercial companies to give us information 

on how they think that might go. We have made our regulations, 

our policies, our requirements known. All that have asked for 

them, we have made them available. As I mentioned, even those 

things that are not yet transformed into requirements and standards, the results of the survivability study that we did in 2008, 

that has not yet been flowed into a set of standards but we tried 

to make that available as well. The human rating requirements 

document at the top level is 31 technical requirements, or what I 

call ‘‘shall’’ statements. It is very limited. It is very top level. It is 

the kind of thing that says that shall have an abort escape system, 

you shall have failure tolerance in your design. But in the beginning of that document it says that there are three pieces to this. 

The first piece is that you are expected with your design to do all 

the things in a NASA development that are required throughout 

the whole set of standards and requirements, not just those 31 but 

all the mandatory standards and requirements are given before you 

get into this human rating requirements document. 

This is where tailoring comes in. We spent six to eight months 

with the Constellation team and my team going over the flow-down 

of all the safety and mission assurance requirements. These requirements come in the form of documents that are called mandatory standards or mandatory requirements. But in order to know 

which of the ‘‘shall’’ statements that are embedded in those things 

really apply, you have to go through a pretty thorough flow-down 

activity and we did that with Constellation. It took about 6 to 8 

months to go through that tailoring process to figure out for this 

particular concept, for this particular mission, for this particular 

design which of our ‘‘shall’’ statements would apply. We also invited the team to come in with alternatives. There is a NASA 

standard but there is also alternatives. Industry has some standards, for example, on how to do soldering and so on. We start with 

the NASA standard but we invite our contractors and our projects 
83

to come in with alternatives if they think they can do it just as 

well. This is part of that ‘‘Yes If’’ thing I was telling you about earlier. 

Now, as far as something that we don’t design because our NASA 

human rating requirements document is for a NASA development. 

Now, in the past we said we would like to fly with the Russians. 

We would like to fly one of our astronauts. Norm Thagard back in 

1995 flew on the Soyuz. The Soyuz was not built to any given 

NASA standards of the day. It was built to Russian standards back 

in the 1960s. The process for building and assembling and launching the Soyuz was not to NASA standards. It was to longstanding 

Russian procedures. To get to the comfort level we needed to fly 

our person on their mission, we spent about three years with some 

of our best engineers working with the Russians to understand the 

equivalence of their system. We know they don’t do things exactly 

the way we do but can we get confident about it, and we took some 

time and a lot of good people to develop that confidence, and in the 

end we got to the point where we believed that even though they 

may not do things exactly the way we do, we are confident to the 

same level that we would if we were flying them on one of our systems. This business of acceptability of risk is part meeting requirements. It is also part building the confidence where the requirements don’t exist or where they are someone else’s requirements. 

We need to do a risk-informed confidence-type activity to get to 

where we feel comfortable doing it. 

Mr. OLSON. Well, thank you for that very thorough answer to my 

question. I see my time is over. I yield back. 

Mr. MARSHALL. Sir, may I make an addition if I may? 

Chairwoman GIFFORDS. Yes, Mr. Marshall, just briefly, though. 

Mr. MARSHALL. I just wanted to report that we have followed up 

with NASA as to where they are. We received a detailed briefing 

in November and are satisfied that the approach that they are 

moving forward is now appropriate and timely. 

Mr. OLSON. Thank you, Mr. Marshall. 

Chairwoman GIFFORDS. Thank you, Mr. Olson. 

Dr. Griffith, please. 

POTENTIAL IMPACT OF CONSTELLATION PROGRAM ON

COMMERCIAL SECTOR

Mr. GRIFFITH. Thank you, Madam Chair, and thank the panel for 

being here. We have been in numerous, numerous hearings prior 

to the Augustine report and after the Augustine report. Each time 

the Ares I comes to the top as a respected and well-thought-out 

plan some four, five years in the making. The successful test of 

Ares I–X was an achievement that we truly, truly appreciated and 

with the 700 sensors that were mentioned and the data that is 

going to be collected, it seems to me that the commercial aspect of 

this was an introduction into the Augustine report that was fascinating and it is greatly discussed but it is not hard science as we 

have now today with documentable evidence of safety. It is probably three, maybe four or five years out and it seems that we could 

achieve our commercial aspirations in space by developing the Ares 

I to the point where it is reliable, consistent. Our solid fuel engine 

is reliable. Our liquid fuel motor is reliable. Our Orion capsule is 
84

going to be reliable. We have every reason to believe that it is and 

it seems like our steppingstone into the commercial venture is successful development of Ares where it can be insured, where we can 

be confident that our human spaceflight, our astronauts can be insured and it can be successful. 

My question is, why wouldn’t we take the approach of asking our 

government to fund the Constellation project with the idea in 36 

months or 48 months we could transfer much of that information 

into the commercial sector with a great deal of confidence and not 

delay the challenge that we are facing with China, India and 

Japan? Mr. Alexander, would you address that, please? 

Mr. ALEXANDER. First of all, I think it is important to remember 

that Ares, Orion, particular Orion, is designed for exploration beyond LEO. It is a spacecraft whose prime purpose is to take—originally designed to take people to the Moon and back and the space 

station if necessary if there were not alternatives. As such, it is a 

more complex spacecraft and more expensive spacecraft than I 

think what you would want to do commercially. As for the Ares I 

rocket in terms of commercial use, I think you also have an infrastructure, a per-flight cost that would be prohibitive from a commercial perspective. That being said, the Commercial Spaceflight 

Federation, you know, takes no position over whether the Ares I 

program should continue as is or should be changed or Orion for 

that matter. I personally believe that, you know, this country needs 

an exploration program and it needs a crew exploration vehicle like 

Orion to go beyond low earth orbit. That is very important for the 

Nation’s human spaceflight program. But at the same time, we 

don’t need to be serving all missions with the same vehicle because 

then you are not optimized for any one mission, and I believe and 

I think the Augustine Committee found that the capability or the 

technology, the knowledge is resident in U.S. industry to do crew 

transfer and cargo transfer to low earth orbit and that if NASA 

wants to get on with the business of exploring beyond low earth 

orbit, it needs to transition operational tasks like that to commercial sector so that it is not continually taking on more obligations 

than it can afford to take on. 

Mr. GRIFFITH. Thank you. 

HUMAN RATING FOR COMMERCIAL SECTOR

Mr. Hanley, the timeframe for human rating on Atlas or Delta 

for the astronauts would be what? What would we look at if we 

said today that we are going to develop commercial sector with taxpayer-funded money and a commercially or human-rated launch vehicle? 

Mr. HANLEY. Well, the work that we have done over this last 

year, we had a study that was performed by the Aerospace Corporation for NASA. They projected, and I am going on memory 

now—we can get an answer for the record if I misstate this but I 

believe it is on the order of six years from start to develop a system 

that would have been derived off the Delta IV heavy launch vehicle. That booster as Aerospace studied it would have used the existing core stage and a new upper stage. Not included in that study, 

of course, were the implications to the Orion if Orion had to change 
85

at all, and that would be something that would have to be further 

studied. 

Mr. GRIFFITH. Thank you. 

Thank you, Madam Chairman. 

Mr. ALEXANDER. Could I follow up on that, please? 

Chairwoman GIFFORDS. Sure, Mr. Alexander. 

Mr. ALEXANDER. That study as described by Mr. Hanley was 

talking about a Delta IV heavy vehicle that is for the Orion spacecraft to low earth orbit, a 25-metric-ton spacecraft. It did not address or at least in the comments did not address the Atlas V 

version vehicle which has flown 19 times successfully, which would 

be used to put commercial crew capsules that are on the order of 

8 to 12 metric tons up into low earth orbit. So it is not an applesto-apples comparison to talk about a six- or seven-year human rating process for one vehicle when in the commercial world we are 

talking about a different vehicle that has already, you know, 

achieved a certain demonstrated reliability, would go through a 

human rating process but is certainly not at the six- to seven-year 

timeframe. 

Mr. GRIFFITH. But what would be your estimate other than the 

six to seven years. Would you say three? 

Mr. ALEXANDER. I would say that. I think the capsule is what is 

going to drive the timeline, not the human rating and the launch 

vehicle. 

Mr. GRIFFITH. Lieutenant General? 

Lt. Gen. STAFFORD. The experience we had with the Gemini 

Titan, and that was an all-out push, was 39 months. It was over 

three years. And we had some dead zones in that, and I don’t see 

how this could be any sooner. It will probably be longer. One thing 

I might add about this gap, and I would rather not transfer money 

to Russia just like anybody on this Committee would, but I think 

one thing to look at that has occurred is that the OMB to me in 

de facto has set space policy when they came in and cut money 

back and said you will finish—first originally came in just a person 

over there a second-level tier said the Administrator will finish it, 

15 flights 2008, they said, but the President said we are going to 

complete the space station, phase out the shuttle and said maybe 

so but this is what it is. So to me, there needs to be an institution, 

someone like the National Space Council used to have that would 

oversee that so that second-level tier and groups like that would 

not cut back. If the proper money, it is my understanding, sir, had 

been applied, we would have had the Ares Orion flying in 2012 or 

2013 so there would not have been too much of a gap. And I don’t 

know that the President ever really got the word back because he 

had other major issues on his desk at that time like Iraq and Afghanistan. 

Mr. GRIFFITH. Thank you, Madam Chair. 

Chairwoman GIFFORDS. Thank you, General Stafford. Thank you, 

Dr. Griffith. 

Next we will hear from Mr. Hall, please. 
86

PROGRAM MANAGEMENT AND SCHEDULING ISSUES BETWEEN CONGRESS, ADMINISTRATION, AND NASA OVER

TIME

Mr. HALL. Thank you, Madam Chairman. 

General Stafford, you worked in the space program for many, 

many, many years and you spanned a lot of days from Apollo to 

the current shuttle program, and I think you are about as knowledgeable as anyone I know, and you know we are looking for a way 

to save the program that I guess the last four or five or six Congresses have agreed on to pursue, and that involves having to address that four-year gap in there, and if I may be wrong, I probably 

am, but it seems like to me that we need about $2 billion a year 

additional for about four years to make that happen. And what 

that would do would preserve our leadership in space, would preserve our space station, would preserve our friendship with some 

partners that have been good partners in space. What was your experience during the Apollo program in working with Congress and 

the Administration on program management and scheduling 

issues, and could you highlight the major distinctions between then 

and now? It was a lot easier then than it is now, and I think we 

just have to keep insisting that the President either in the next address to the Nation comes on in and recommends what we have all 

asked for and what I think everybody on this Committee here 

wants, to save our space station, save our position in space and not 

have to rely on Russia for anything. You might just in a minute 

or so if you can just kind of compare those times with today. 

Lt. Gen. STAFFORD. Thank you, Mr. Hall. The President’s policy 

was carried out completely with the help and approval of the Congress. The National Space Council that was chaired by the Vice 

President helped oversee that and the OMB followed in line, and 

as I mentioned just previously, it appears that in certain cases the 

OMB in de facto is setting space policy, and this is one of the real 

issues. Also, we have today Continuing Resolutions that we didn’t 

have in those days. But if the President sets a policy, it should be 

carried out and the funding you said would certainly do it, so we 

could have had the Ares Orion flying in 2012 or 2013 so there 

wouldn’t have been much of a gap in this. Thank you, sir. 

Mr. HALL. Any others want to make any comment on that? You 

are all experienced and you have been around all a while. You 

know, not too many years ago we almost lost the space program 

by one vote in Congress, and that alerted everybody from schoolchildren and everybody else that is interested in the space program. It even caused a fine old man like Dr. DeBakey to come and 

walk out all four of the floors here in the Rayburn Building to talk 

to everybody, and a lot of them couldn’t find time to talk to him 

because they didn’t want to tell him no. But that following year I 

think we passed the program by something over 100 votes, 120 or 

something, but then we all got together on it. I am just wondering 

what kind of pressure we can put on the President of the United 

States to come out with a recommendation. Of course, back in 

those days, that is before Katrina and before the vicissitudes of nature had set us back in several of our states and 9/11 and 8, nine 

years of war. We are in a little different situation. But you know, 
87

if you can throw away $350 billion on AIG and not even know 

where it is going or not ever receive an accounting for it, they can 

find $2 billion a year for the next four years for us to save a program like the space program. It is a lot harder to do now but you 

six men are leaders and more knowledgeable than anyone I know—

this is the best panel I have seen up here in a long, long time—

to put your shoulder to the wheel and every chance you get talk 

to the President, talk to the czar, talk to whoever you have to talk 

to to get into it. But we need to save this program. We need to go 

forward with this program and we don’t need to fall back behind 

or have to battle with China or any other nation. We just have to 

assert ourselves some way and find that money. If we are going to 

have all these bailouts, this is an awfully good place for one right 

now. Save the program. I have even thought about trying to alert 

all the schoolchildren of America for write-ins to get them to write 

in what they think about it because they are the real loser or beneficiary of what you do and what this Congress is going to do this 

year and next year with regard to the space program. 

But you see a lot of difference in then and now, don’t you, Tom? 

Lt. Gen. STAFFORD. Mr. Hall, I certainly do. It is a different era. 

In the cooperation between the President, the Congress, the OMB, 

it is completely different, sir. I wish it could be like that. In fact, 

it could be possibly a recommendation from me to this Committee 

to say that the OMB should follow the policy of the President. 

Mr. HALL. And then we want to talk to the President. I yield 

back. I think I have used my time. Thank you, Madam Chairman. 

Chairwoman GIFFORDS. Thank you, Mr. Hall. 

One of the reasons why we have held so many hearings, two 

hearings ago we had a fascinating panel of experts to talk about 

tech transfer from NASA because in so many ways the accomplishments of NASA go beyond just exploration or go beyond what we 

can physically see up in space right now, but from the airline industry to the medical industry, computers, it has been extraordinary the gifts that NASA has given to our country and to the 

world and so part of our job on the Subcommittee is to make sure 

that the American people, the President, other Members of Congress understand that as well. 

Next we are going to hear from Ms. Edwards. 

IMPLEMENTATION AND APPLICATION OF SAFETY STANDARDS

Ms. EDWARDS. Thank you, Madam Chairwoman, and thank you 

to the panel. Every time we have these hearings, I learn something 

new. In my mid-20s I recall sitting in front of a monitor at Goddard 

Space Flight Center, the elation of a launch in January 1986, the 

confusion thinking that there was something that we had done 

wrong in our communications on that day, and then the absolute 

silence of silence, unlike any I have ever heard over our colleagues 

as we realized the disaster that had happened with the Challenger. 

And I think at that time I think all of us, no matter what we did 

believe, that we paid great attention to safety and obviously the investigations that followed demonstrated that there were huge gaps 

in safety, pockets where there was a lot of attention to safety and 

other pockets where there wasn’t, and we even to this day and 

after the Columbia disaster continue to point to some of those same 
88

gaps, and I think, you know, safety has to be north, south, east and 

west in NASA whether the services and work is being performed 

by a contractor or internally at NASA and so I appreciate the testimony today. 

In looking at the Augustine report, there is really actually very 

scant mention of safety in the report I think as General Stafford 

pointed out and so one of the questions that I have really is, and 

especially with the principles that I think Dr. Fragola, you outline, 

how you would take those principles today and actually even apply 

them to Challenger and to Columbia to see whether, you know, 

these design systems, for example, that had been, you know, 

launched—I don’t know—25 times, I think when the Challenger

disaster happened and we would have described those as, you 

know, pretty reliable, but whether those principles applied today 

would allow Challenger and Columbia to meet the mark as you 

have indicated that perhaps in the design and the concept of Ares 

you think that that would meet the mark. 

Mr. FRAGOLA. The principal problem with the space shuttle is a 

lack of abort system, the lack of being able to address the recovery 

of the crew given an incident. The shuttle as a launch vehicle is 

among the best, if not the best in the world as a reliable vehicle 

but the shuttle points out very dramatically the difference between 

reliability and safety. I would also like to point out, having been 

involved in the original shuttle competition, the reason—one of the 

reasons we sought the shuttle was, we were concerned at the time 

about recovery of the Apollo capsule. We had had one failure where 

we lost one parachute and we were concerned about that system 

and we were therefore interested in designing a system that would 

address the failings of the past, and so we felt that a landed system, a system with wings, would improve on the recovery, and it 

certainly has improved on the recovery but it has increased the 

vulnerability in ascent and increased the vulnerability in other 

areas. So one of the things that I think we should learn from this 

is that we can’t anticipate all the unknown unknowns in a system, 

and that is one of the reasons why it is essential to have a robust 

and well-tested system that is able to survive and abort safely. We 

didn’t do that on the shuttle. 

Ms. EDWARDS. So Mr. Marshall, I wonder if you would describe 

for me how it is that we could apply a set of safety standards and 

principles both within NASA and also in a commercial environment 

given our experiences? 

Mr. MARSHALL. Well, you heard earlier that the FAA ought to be 

the licensing authority for commercial venue. We certainly agree 

with that and we think that there is a need to really aggressively 

develop that process. I am not an expert on that and haven’t participated but my understanding is that the process is just beginning. Conversely, NASA establishes the crew safety requirements, 

and this is what I was talking to from a commercial venue. We, the 

ASAP, believe that NASA does a great job for its own governmentcontrolled programs but that this process really needs to be accelerated from a commercial perspective if there is going to be movement and direction in that particular arena. So we think that it is 

a combination of both the licensing authority and the user of that, 
89

which is the NASA authorities, to aggressively develop the human 

rating standards that are necessary to provide for the crew safety. 

Ms. EDWARDS. Thank you. 

Madam Chairwoman, I know my time is expired. I obviously 

have tons more questions. 

Chairwoman GIFFORDS. Thank you, Ms. Edwards. 

Next we will hear from Mr. Rohrabacher. 

Mr. ROHRABACHER. Thank you very much, Madam Chairman, 

and again, thank you for your leadership in this Subcommittee. 

CONSTELLATION PROGRAM: HUMAN AND CERTIFICATION

OPTIONS CONCERNS

First of all, let me just state, I am not opposed to the Constellation concept. I think that from what I have seen, the Orion and 

Ares system has a role to play. I am a bit worried that what we 

have here, however, is a mindset that I have seen before and a 

mindset that has failed before, and that is, trying to have one system that will serve all needs and thus actually bring down the 

chance of success of that mission or the ability of that mission to 

actually do a very great job in a specific area. I remember the 

Edsel car was supposed to be something for everybody and it 

turned out to be nobody in particular really wanted it because it 

was designed for everybody. I remember the F–111, which was an 

aircraft that was designed supposedly—I remember that during the 

early 1960s and it was supposed to be something that could fulfill 

every mission but then once they built it, none of the military people really wanted it because it really didn’t fulfill any of the missions as well as they had hoped or what they wanted. I would hope 

that with Ares Orion, we are not making that same mistake trying 

to say that we have to have the same rocket and transportation 

system for low earth orbit that we have to have for other missions, 

later on the Moon, and I support the moon mission. That is why 

I think maybe the Ares Orion system is important in the long run 

but why in the short run do we have to have it fulfilling the same 

needs that we could perhaps serve—might be better served by 

making the Delta system, which is a very good system, been very 

reliable, or the Atlas V system, and just making them with the 

ability to carry people then and they can, I guess, man certified I 

guess is the words we are looking for. So why is it that we have 

to have—Mr. O’Connor, why is it that we have to have Ares doing 

everything rather than going with trying to do manned certification 

for Delta and Atlas? 

Mr. O’CONNOR. Well, sir, this is a decision that was made some 

time back when we were looking at the vision and what we wanted 

to do with human spaceflight, and in the context of the mission, 

which was to have something that would take our astronauts to the 

moon as a steppingstone to further out, the concept included two 

different launch vehicles, one heavy and one light, and the light 

one was carrying crew. And by definition, the light system that carried the crew had to be able to take the crew to low earth orbit. 

Now, the Orion was designed——

Mr. ROHRABACHER. Having to do that doesn’t necessarily mean 

it is the most cost-effective and the most efficient way of doing it. 
90

Mr. O’CONNOR. Right, and I agree. It had to do that as part of 

the lunar mission, and if you simply said let us not worry about 

the lunar mission, let us do something just to low earth orbit, then 

you would start from scratch and say let us do something that is 

just for low earth orbit, and you may not have the Ares Orion system. 

Mr. ROHRABACHER. We spent a lot of money on the Delta and 

Atlas systems over the years and they have proven themselves in 

terms of actually launch systems. I don’t know, we haven’t put people on them but they have proven very reliable in that. Again, I 

don’t—and by the way, I support the moon mission. I think the 

moon mission is a good mission and that is why I support the Ares 

Orion system but suggesting that we then have to because that is 

going to be used for a later mission, we have to use that rather 

than Delta or Atlas, I don’t think it makes sense. There is something that doesn’t—I am going to have to study this a little more. 

It just doesn’t seem to come together for me that that is a requirement. 

Mr. O’CONNOR. Yes, sir. You know, when we looked at this—and 

I am going to defer to the program manager on this because he has 

looked at it harder than I have but just from my view as the safety 

guy, it seemed to me that either one of those two options was an 

F–111 equivalent. The Atlas and Delta are not designed to carry 

people in space. They don’t have the structure for it. They were designed for cargo, and they are very reliable but they would have 

to be significantly modified in order to do——

Mr. ROHRABACHER. Well, you know, reliability of cargo, what we 

are talking about is human cargo, and I don’t see that as being in 

a totally different category. You just want to make things a little 

bit adjusted for human beings. 

Well, my time is up. Thank you very much, Madam Chairman, 

and maybe we can have a second round if we have time. 

Chairwoman GIFFORDS. Indeed. 

Mr. Hanley, would you like to comment? 

Mr. HANLEY. Just to address your concern with respect to the exploration mission and Ares I, the underpinnings of the Constellation’s exploration architecture to go to the moon was integral to the 

decision to choose Ares I or something quite like it when those decisions were made. We began from the process of the design of the 

Constellation system with the moon in mind. The key driving requirements of Constellation, the preponderance are for the lunar 

mission. So we selected it because where we want to be taking our 

risk is on the lunar surface, not in the first 100 miles. And we leveraged off of the decision that we made on heavy lift, and because 

Ares I is derived from the infrastructure we need for the big rocket, 

the Ares V, you get it at sort of a marginal additional cost. The design of the first stage solid and the design of the upper stage engine on Ares I are the same assets that are used for the Ares V, 

so the production capacity is common for those. 

Chairwoman GIFFORDS. Thank you, Mr. Hanley, Mr. Rohrabacher. 

Ms. Kosmas, please. 

Ms. KOSMAS. Thank you, Madam Chairman. Thank you, gentlemen, for being here today. This is obviously an issue of great im-
91

portance to us here on the panel and also I think to the American 

public as we move forward and make every effort to maintain our 

leadership in space exploration for all the reasons that are obvious 

to us and that we attempt on a regular basis to make obvious to 

others, so we thank you for being here. 

ESAS RECOMMENDATIONS FOR HUMAN SPACE FLIGHT

No question about the fact that safety is a very important concern. I want to chat with you a little bit about an article that was 

in today’s Orlando Sentinel. I am from central Florida where the 

Kennedy Space Center is and so it is a big issue for us in our district with regard to what the next phase of space exploration will 

be, and also a great concern of course for the gap, but nevertheless, 

safety of course is very important. The story in today’s Orlando 

Sentinel discusses the 2005 architecture study, ESAS, recommendation that after two test flights, the first five flights of the 

new rocket and capsule deliver only cargo to the International 

Space Station to establish a record of reliability before putting humans on board. The ESAS states it takes five flights in addition 

to the two test flights to surpass the shuttle safety level of one in 

100. If there were no cargo flights beforehand, the risk of the first 

crewed flight after the two test flights would be approximately one 

in 40, or approximately two and a half times the shuttle. Adding 

cargo flights to ensure safety would only seem to increase the gap 

in U.S. human spaceflight capability. 

So the question I wanted to ask was beginning with Mr. Hanley, 

I understand that the current plans propose putting astronauts 

aboard Ares I and Orion after only a single unmanned flight of the 

final rocket. Can you discuss this decision in light of the ESAS 

original recommendation and what steps are you taking to address 

this concern? 

Mr. HANLEY. Certainly. As part of the program’s preparation for 

its program preliminary design review that will be next year, next 

calendar year, we are putting together our integrated test and 

verification plan. The flight in which the crew will launch will be 

informed by that plan and it requires an understanding of the test 

program, and Joe talked about this earlier, the test program that 

goes into verifying that these systems will in fact perform the way 

that the designers believe they will. There is a lot of variability in 

the methods one might apply to try to use a crystal ball to predict 

how reliable a particular system will be. Coming up with an absolute number is very sensitive to the method or the approach, the 

thought process that you use, and that is what we see. So predominantly we use these risk numbers to compare alternatives, not necessarily to inform some absolute number of what the risk level 

really is. So with respect to the assertions made in the ESAS study 

versus what we are doing today, I would invite Joe to maybe comment because he was integral to the ESAS study. 

Mr. FRAGOLA. And since I wrote that section that you referred 

to, that is a great confusion. If they had only gone to the page before, they would have seen that that statement referred to an advanced engine on the Orion spacecraft using LOX/methane. What 

we were trying to do was to enhance the reliability, the mission reliability of the lunar missions with a given performance. We were 
92

looking at LOX/methane because LOX/methane was able to be carried through as a launch propellant for Mars. What we wanted to 

show from a safety standpoint was that there was a penalty in immaturity to the system if we chose that LOX/methane option. So 

what you were seeing there was that penalty. If we look at the 

Ares system, Orion system today with the propulsion system that 

is now on Orion, which is essentially the same that is on the space 

shuttle OMS systems and has performed absolutely perfectly on 

the OMS and was also on the lunar module descent engine and on 

the command module serving as propulsion system, the immaturity 

of the system drops to almost zero and now the immaturity of the 

system is based on primarily the second stage of the Ares system. 

And if you look at what it takes for that to get to the equivalent 

of the shuttle, it is between one or two test flights necessary to get 

the equivalent of the shuttle. It is certainly not going to get to one 

in 1,000 at that point but we are looking at trading off versus when 

does it get to the point that the shuttle, which is what we are flying crew on today. So the statement in the Sentinel is correct but 

it applied to an option in the ESAS study, not the one that we are 

flying today. 

Ms. KOSMAS. Thank you. Unfortunately, I am afraid that ended 

up using all my time, but thank you for the answer and I will see 

to it that that information is passed along. Thanks. 

Chairwoman GIFFORDS. Thank you, Ms. Kosmas. 

For the remaining member for our first round is Mr. Hill. Mr. 

Hill. 

Mr. HILL. Well, thank you, Madam Chairman. I got here rather 

late so I need to get caught up on some of the conversations you 

have been having for the last hour or so, so I will pass on asking 

questions. 

Chairwoman GIFFORDS. Thank you, Mr. Hill. We are glad you 

are here. 

AVAILABILITY AND ECONOMIC VIABILITY OF COMMERCIAL

CREW TRANSPORT

We are going to begin a second round. We have not had votes yet 

so it is our good fortune today, and while we have all of you here 

we are going to take advantage of it, so I would like to begin. I am 

going to ask everyone on the panel starting with General Stafford 

if you could answer two questions. Taking everything that we have 

learned today about safety and the complexities of what it takes to 

build these vehicles, is the timetable for availability of commercial 

crew transport truly realistic? That is my first question. And the 

second is, given the required steps of everything that factors into 

building these vehicles, do our witnesses believe that would-be 

commercial crew transport service providers be able to garner sufficient revenues from non-NASA passenger transport services to remain viable over this time period as well? So those are the two 

questions that I have. I know that you gentlemen come from different aspects and different angles of this industry. You know, the 

backdrop of course is in light of the fact that we have a diminished 

budget. I mean, if we had sufficient budget to do everything, I am 

sure that all of us on this Committee would agree that this is 

where we want to invest our money, I mean, because the benefits 
93

that come from both the private and public space sector is outstanding and much underappreciated. But given the fact that we 

have finite resources, I think that these are two important questions. I would like to begin with you, General Stafford. 

Lt. Gen. STAFFORD. Thank you, Madam Chairman. First, on the 

safety for the commercial crew delivery for government crews, the 

observations in the Augustine report said 2016. If they would go 

to meet the requirements starting with safety and mission assurance, I think that would be a very tough goal to make it. They 

could possibly make it. But on the other hand, when they said 2017 

for the Ares Orion, I do not understand that. It should be far sooner than that. 

As far as other customers that the commercial crew delivery corporation would deliver to, right now, other than the space station, 

I know of no other ones that would be there at this time. 

Chairwoman GIFFORDS. Thank you, General. 

Dr. Fragola? 

Mr. FRAGOLA. Well, certainly the challenge is a potential challenge that could be met by the commercial crew. It is a question 

of what the uncertainty involved is, and from my perspective based 

upon history, it would be very uncertain that we could meet that 

kind of a date. Certainly the type of work that has gone on in Ares 

since the time of ESAS to today to ensure safety in that vehicle is 

equivalent to what you would have to do on any vehicle, whether 

it would be a Titan or a Delta or an independent commercial 

launcher. 

I would like to go back to that one thing that I said before to answer Mr. Rohrabacher. There is a big difference between a crew 

payload and a payload that is not crew because after the accident, 

the payload that is not crew doesn’t care a whit about what happened but the payload that is crew cares a lot, so what we have 

to do is to design the abort system integral to the failure mechanisms that are on that system and that requires a much greater 

knowledge of your launcher than they have today with commercial 

payloads or for Air Force payloads. 

Chairwoman GIFFORDS. Thank you, Doctor. 

Mr. Alexander. 

Mr. ALEXANDER. Thank you. I believe that the timetable as laid 

out by the Augustine Committee is realistic. That is seven years 

from now. Certainly I don’t believe that the human rating of the 

launch vehicle is the long pole in the tent. I believe it is the development of a capsule to take people to the station and back. There 

are companies that say they can do it in significantly faster time 

than that and there are others that say it will take at least that 

long, and I wouldn’t, you know, pretend to be the expert that is 

going to predict exactly what it will take. However, I do know that 

it will take longer if we do not start now. As I said before, I don’t 

believe that, you know, Ares Orion and commercial crew are competitive. I think that you need to do both, so it is not about which 

one gets there first necessarily but I do believe that because servicing the station is a simpler mission, less complex, and you can 

use demonstrated reliable launch vehicles that will need modifications but not extensive modifications because they have a track 
94

record of 19 successful launches or heritage of 19 launches, that 

that is a realistic timetable. 

Second, as to whether there are viable revenues from non-commercial or non-government sources, there is already a market for 

private spaceflight participants that have been paying between $25 

million and $35 million to fly on the Soyuz. Those people spent 6 

months of their lives learning Russian, training on Russian systems separated from their revenue-generating jobs that they have. 

I believe that if the United States industry were able to offer that 

capability, you would have a far greater number of people willing 

to take that on and pay that kind of money. Also, you know, with 

the hope that with commercial, the price comes down, that market 

becomes bigger, but there is also a market for other U.S. industries 

and other activities, microgravity research, et cetera, in space that 

is not efficiently served by NASA and the NASA process and I 

think that commercial will be able to find additional revenues 

there. They certainly will not be the bulk of revenues in the beginning but there is a place for—or there is a demonstrated market 

there now that will only grow. 

Chairwoman GIFFORDS. Thank you, Mr. Alexander. 

Mr. Marshall. 

Mr. MARSHALL. Regarding the two questions, is the timetable realistic, in the ASAP’s 2008 annual report, we made a statement 

that said that there is no evidence to suggest that the use of a commercial space industry vehicle can significantly close the gap. We 

stand by that statement. We have no evidence that would say otherwise. I think the term that is of importance is ‘‘significant.’’

ORBITAL SCIENCES AND SPACEX 

The second is, given the steps, is there sufficient revenue to provide survivability. I mentioned to you in my opening statement 

that we have gone to both SpaceX and to Orbital Sciences. We were 

at Orbital Science this week, and during the presentation we asked 

their senior management if they had done a market analysis to 

find other revenue sources that would address this specific issue. 

The answer was no, we have not done the market analysis because 

we see no viable commercial requirement at this time. Now, I am 

not trying to put words in their mouths. That is just the way I interpreted it. I would think that that is a fairly accurate statement. 

Chairwoman GIFFORDS. Thank you, Mr. Marshall. 

Mr. Hanley? 

TIMETABLE: COMMERCIAL CREW TRANSPORT

Mr. HANLEY. With respect to timetable, I can really only speak 

to what I would see as the challenges, and Joe has touched on 

them. I think it is—and I would agree with Mr. Alexander, I think 

it is about the spacecraft, it is about the launch abort system as 

well as the rocket. Joe, I think, spoke quite eloquently about how 

it is an integrated system. It needs to be designed altogether as an 

integrated system to be able to maximize crew safety, and I think 

that is where the real challenges lie for other developers. That is 

certainly where our focus has been for these four years, and so 

what kind of—what that does to the timetable or not I really 
95

couldn’t comment, not having detailed knowledge of the plans and 

the alternatives. So with respect to revenue, I hope to maybe live 

to see the day when I can buy a ride, but as far as revenue, I really 

don’t have a comment. 

Chairwoman GIFFORDS. Thank you, Mr. Hanley. 

Mr. O’Connor. 

Mr. O’CONNOR. I haven’t done an independent assessment of 

these schedules but I can just tell you as a safety guy watching 

program and project managers and contractors predict schedules 

for years, as I watch that happen, I have seen that sometimes they 

miss and some of the things that cause them to miss schedules is 

the down time after failure. Another thing is the lack of integration 

up front. If you don’t do good integration up front, then you pay 

for it later and it takes time. I remember after Challenger we tried 

to retrofit an escape system on the Challenger and we flat couldn’t 

do it. So it wasn’t even a matter of schedule. It was just too hard. 

So getting early, getting things done quickly in the front part of a 

program that you are going to need later on can help with schedule 

because it takes much longer to fix things than to do it right in the 

first place, so that is all I can add to that, and I really haven’t 

looked at commercial revenue at all so I wouldn’t comment on that. 

Chairwoman GIFFORDS. Thank you. 

Mr. Olson. 

ARES PROGRAM: SAFETY AND FUTURE IMPACT

Mr. OLSON. Thank you, Madam Chairwoman, and this is a question for all of you or anybody who wants to comment, but I want 

to get back to some of the issues, some of the concerns we were 

talking about about the Ares program, and as you all know, a couple of weeks ago we had a very successful test of Ares I–X, a vehicle that had over 700 sensors on board to measure many of the factors that that spacecraft was feeling as it went through its ascent, 

and I just want to get some comments from all of you. How does 

that level of technology that we have now, how does that increase 

our ability to develop a vehicle safely and not have necessarily the 

flight test that we had to have in the past, and one sort of side 

question to that is, how does development of Ares I help speed up 

the development of Ares V, you know, basically the same system 

in many, many ways. Does that allow us to accelerate the development of the Ares V? Mr. Hanley, you first. 

Mr. HANLEY. Well, the way I think of it is that by developing 

Ares I we are in fact developing parts of Ares V today so we 

aligned our strategy purposefully back four years ago. If you will 

recall, coming out of the Explorations System Architecture Study, 

the Crew Launch Vehicle, as it was called at that time, the Ares 

I was called, was a four-segment solid plus an upper stage that utilized the space shuttle main engine and we purposefully at the 

agency level made a decision to change to the five-segment and J2-

based upper stage because we wanted to leverage the early investment of dollars we were making toward building the heavy lift 

launch vehicle. So that is the synergy between Ares I and Ares V 

that a lot of folks miss. So we are building part of the Ares V rocket today with the five-segment booster with the J2X engine. We 

even purposefully will be looking to play forward the investment 
96

we are making in the avionics that guide the rocket as well. The 

hurdles that we face with building a larger rocket really focus on 

the core stage, the massive core stage in that system, and those are 

investments we have yet ahead of us. 

Mr. OLSON. Thank you for the answer, Mr. Hanley. 

Any other panel member care to comment? Okay. Well, that was 

my last question, Madam Chairwoman. I yield back the balance of 

my time. 

Chairwoman GIFFORDS. Thank you, Mr. Olson. 

Dr. Griffith, please. 

COTS VS. CONSTELLATION PROGRAM

Mr. GRIFFITH. Thank you, Madam Chair. 

Some in NASA have suggested that by taking on the risk of procuring maybe a commercial service to deliver astronauts to the 

space station that we will lower our costs and provide greater 

launch capability, yet the COTS program was to be a proving 

ground for commercial sector to deliver cargo to the station but to 

my knowledge, that has yet to happen. I don’t know that any of the 

commercial orbital transportation service providers or the funding 

of that has been able to deliver what we had hoped that it would. 

It seems that we should require our commercial providers to prove 

their ability to deliver on these contracts or on these ventures that 

taxpayer funds have funded. And so my question is, and anyone 

can answer this, the commercial orbital transportation services, 

what evidence do we have, what hard evidence do we have that we 

can rely on them to deliver manned spaceflight in a more timely 

way than we have with our Ares I or Constellation project? Is there 

any evidence? 

Lt. Gen. STAFFORD. Mr. Griffith, as I said, I did extensive examination of the Augustine report and I knew many of the members 

and have talked to them, I told them I would be giving testimony 

here today. In fact, this morning I talked to Dr. Crowley twice on 

my cell phone on his idea of multiple providers and his assumed 

cost on those commercial government crew delivery vehicles, and 

then I checked with Mr. Hanley here and so it was a wide variance 

between their assumptions and what we have, and also I found 

that there was also, on the Augustine Committee there was somewhat of a wide variance of opinions among the committee members, 

sir. 

Mr. GRIFFITH. Thank you. 

Mr. Alexander? 

Mr. ALEXANDER. Thank you. The question of whether to prove 

cargo first, if you will, before putting people on top, I certainly 

agree with that in terms of demonstrated reliability. Those cargo 

systems that are being developed are being developed right now 

and those will fly many times before people are put on those rockets or any new system goes on an Atlas V which already has a 

demonstrated reliable launch record. The question of whether cargo 

has delivered, you know, the programs has not been completed yet 

to first flight. They have not had their demonstration flights yet. 

As Mr. O’Connor said, every space program seems to have cost 

growth and schedule risk, or schedule drift, if you will. I would put 

the record of those cargo demonstration programs up against the 
97

record of government space program developments in terms of cost 

growth and schedule risk, and I think they would compare very favorably. So whether they have met all their milestones exactly as 

they originally planned four years ago, I am not the expert to 

speak to that but they are certainly progressing well as evidenced 

by the fact that NASA is paying on those milestones and is in 

agreement that things are progressing well. So I do believe that 

those programs are functioning well. I believe that, you know, demonstrated launch vehicles and cargo missions will happen before 

crew missions happen, and again, as I said before, the longer we 

wait to start that process of crew activities or commercial crew activities, the longer it will take us in terms of shortening any gap 

or when we actually would be able to deliver that service. 

Mr. GRIFFITH. Thank you, Mr. Alexander. 

RISK ASSESSMENT: COMMERCIAL VEHICLE

Dr. Fragola, are you involved in the risk assessment whether it 

be the risk assessment of a commercial vehicle for delivery of cargo 

or the development of a commercial vehicle for the delivery of our 

astronauts? 

Mr. FRAGOLA. At this moment, I have no involvement in that. 

However, as part of the review, the independent review, I did look 

at the alternative launch vehicles, particularly Delta IV heavy. As 

part of the ESAS study, we did look at the Atlas V single core. By 

the way, it is important to point out as Mr. Alexander has mentioned, the Atlas with the 19 successes is a single-core vehicle with 

a rather limited payload capability to orbit as compared to the payloads that we are talking about on the Ares I. There is no doubt 

that the single-core vehicle would be more reliable than a triplecore Atlas but a triple-core Atlas doesn’t exist today. We don’t have 

an Atlas heavy. The option would be a Delta IV heavy and that 

was evaluated and seemed to be about a factor of two to a factor 

of three less safe than the Ares. But one of the things I wanted to 

point out, as I mentioned, immaturity is very important. One of the 

arguments against the Ares is, well, the first stage of the Ares is 

not equivalent to the SRB on the shuttles, it is a five-segment 

booster. I would point out that we are recovering the booster first 

stage. That is not going to occur on any of the commercial alternatives and so the learning we can get from inspection post flight 

is incredibly important to advancing the maturity of the vehicle 

and to proving that we have carried over the 255 successful 

launches of the SRB on the shuttle and the Ares I. 

Mr. GRIFFITH. Thank you. 

Thank you, Madam Chair. 

Chairwoman GIFFORDS. Mr. Hall, please. 

Mr. HALL. Madam Chairman, I think you will leave the record 

open for us to write and make inquiries if we need to. With that 

understanding, I will yield my time to Mr. Rohrabacher. 

ARES, DELTA, ATLAS: COMPARISON

Mr. ROHRABACHER. Thank you very much. I just want to get into 

this thing about making some comparisons in terms of the alternatives that we have, and Dr. Fragola, I appreciate your comments. 
98

I think we might disagree but I am really interested in learning 

from you on this because you know much more about it than I do. 

I understand that. But when you are suggesting to us that we have 

to look at the many uses that have been put through and the actual track record of the first stage of the Ares, that really doesn’t 

count, does it? Because the system itself can’t be certified as being 

reliable until the second stage, which has never even been built 

yet, is put into the system. Isn’t that right? So with that type of 

analysis, there is not even a comparison between the Delta and 

Atlas in reliability because the Ares doesn’t even have their second 

stage built yet, which the system will fail if the second stage 

doesn’t work. 

Mr. FRAGOLA. That is correct. The second stage is the risk driver 

and that is the reason why we chose a J2X system which has heritage both in the RS–68 engine and in the J2 engine and the J2–

S engine. It is true that the stage and the engine as an integral 

sum has not been——

Mr. ROHRABACHER. You say risk driver, but that risk has already 

been assessed in terms of Atlas and Delta. We have no way to even 

assess whether that risk—what that risk is because we haven’t 

even built the second stage——

Mr. FRAGOLA. Even——

Mr. ROHRABACHER. —to get the system that you are talking 

about. 

Mr. FRAGOLA. Again, the equivalent payload, even on the Delta 

IV heavy, we would have to modify the second stage of the Delta 

IV heavy. There is no way we can get the payload that we get so 

we would have to have——

Mr. ROHRABACHER. Well, that is if you want a payload that big, 

but if you are having medium-sized payloads, it has already been 

proven. 

Mr. FRAGOLA. If you were to decrease the requirements significantly down to the payload like Mr. Alexander has spoken to, then 

you would have to—you would be able to use the existing second 

stage——

Mr. ROHRABACHER. And you might want to have a few more 

launches rather than having to launch everything on one rocket. 

That doesn’t—it doesn’t make sense to me that you just have to 

have everything in a big payload carrier. 

ORION SPACE CRAFT

Let me get to beside the rocket, and I only have a couple minutes 

left here. I would like to look at the actual spacecraft, the Orion 

spacecraft, as compared to the alternatives there as well, and 

again, I am not opposed to the Ares Orion system because I do believe in the moon project. I just think that if we try to do everything—the moon project has to be the same thing that we rely on 

for a low earth orbit. That may not be the best deal for the taxpayers and it may not be as reliable and it may not be as far so 

that we can bring it into play, but I understand Boeing—Boeing is 

in my district, and I seem to remember that they are developing 

this other spacecraft, and why is it that spacecraft—in terms of 

safety, is it more—is the Orion safer than what Boeing is presenting to us? 
99

Mr. FRAGOLA. I guess I am not familiar with the particular Boeing spacecraft. I know some other spacecraft. Which one are you referring to? 

Mr. ROHRABACHER. Well, it is in development right now. I understand that it hasn’t been flown yet, but I understand that they are 

proposing this. Maybe I——

Mr. FRAGOLA. I can’t comment on a design I haven’t seen. I 

haven’t seen that yet. If someone would present the design, I could 

look at it. 

Mr. ROHRABACHER. And do the NASA people know anything 

about a Boeing proposal on this? So I am wrong then, I have been 

misinformed then that the commercial spacecraft companies are actually proposing a spacecraft that would be similar to Orion. 

Mr. FRAGOLA. Well, we visited—similar to Orion, no, but we did 

visit a few people who had mockups of vehicles, but mockups of vehicles, we had them in ESAS four years ago. I mean, between that 

and a real design is a far way to come. 

Mr. ROHRABACHER. And Mr. Alexander wants to mention something here. 

COMMERCIAL CREW DEVELOPMENT PROGRAM

Mr. ALEXANDER. If I might, I believe that Boeing has teamed 

with Bigelow Aerospace to propose something under NASA’s 

CCDev, or commercial crew development program. So that is at 

this point probably a concept——

Mr. ROHRABACHER. It hasn’t actually been designed out and——

Mr. ALEXANDER. Right. They were one of the, you know, finalists 

for the Orion Crew Exploration Vehicle. Lockheed Martin ended up 

winning that program. I am sure that they have—their current design has a lot of heritage to what they were proposing for Orion 

but they were not the winner. 

Mr. FRAGOLA. By the way, we saw that vehicle and that vehicle’s 

design requirement requires you to rendezvous and dock within the 

first orbit in order to meet the payload, and that means that if you 

don’t have proper rendezvous and you don’t dock the first time, you 

deorbit, and Bigelow was willing to accept that because he was a 

commercial enterprise, but to do that on the station, I don’t know 

that that’s something that is prudent. If he does that, he limits the 

payload, limits the design. He also doesn’t have to carry the things 

to sustain the crew for two or three orbits and that significantly 

reduces the mass of the——

Mr. ROHRABACHER. Thank you very much. 

Thank you, Madam Chairman. 

Chairwoman GIFFORDS. Thank you, Mr. Rohrabacher. 

Ms. Edwards. 

TRAINING FOR COMMERCIAL SPACE OPERATIVES

Ms. EDWARDS. Thank you, Madam Chairwoman. I just have a 

question and it goes to the testimony that you presented, General 

Stafford, with regard to training and your indication of how involved and important it is for the crew to really be involved in 

training that simulates off nominal conditions and also, you know, 

the number of hours that are spent with regard to safety in every 
100

detail. And so I wonder if you could actually speak to what you 

might identify as some of the challenges presented for training 

with commercial space operations. 

Lt. Gen. STAFFORD. Ms. Edwards, to launch, rendezvous and 

then dock with the International Space Station, you would have, 

you know, working with the spacecraft simulator and mockups and 

then you also have integrated simulations with the mission control 

center that, you know, has control of the International Space Station. So you would have to go through the contingencies and so it 

would be a whole series of issues and that would start with a whole 

series of just to start with, using the launch abort system, the recovery, what action the crew would take, egress from it. And so 

also on these vehicles as they are being built, we are talking, I 

think, approximately, Ms. Edwards, two and a half flights per year, 

if I am correct, that the crew would probably be there at the factory when the spacecraft was being built too to understand it. But 

also in the simulations, it would be just repeat simulations and 

there is a profile for this and it requires really hundreds of hours. 

Ms. EDWARDS. And do you think that that profile changes in any 

respect with what are essentially sort of off, you know, outside of 

NASA operations? And I also wonder if Mr. Alexander could speak 

to this question. 

Lt. Gen. STAFFORD. Well, if it is outside of NASA operations, I 

would assume it would not go to the ISS because the requirements, 

you know, you have to go to rendezvous and dock with the ISS, a 

strict number of requirements. In fact, I was involved with some 

of that, having worked with the investigator with the Progress colliding with the Mir there on the Shuttle-Mir program then. So I 

think NASA would be involved there, and then you have, you 

know, particularly the commander and the pilot would have to be 

deeply involved and go through this and maybe people just along 

for the payload specialist or mission specialist for the ride would 

not have to undergo near that many but the one that is the commander and the pilot would definitely have to undergo hundreds of 

hours on that. 

Ms. EDWARDS. Mr. Alexander? 

Mr. ALEXANDER. Certainly a rigorous testing program and training program would be instituted for any commercial crew mission, 

whether it is a commercial mission just to low earth orbit or whether it is carrying NASA astronauts to the space station. So obviously 

everybody on board the vehicle is going to have to go through a rigorous training program, and certainly the pilot and commander 

would be much more rigorously trained than anybody that is just 

simply a participant on the flight. 

I think in a broader context, you know, right now for any U.S. 

human spaceflight mission throughout our history, it has been a 

mix of government through NASA and industry, U.S. industry, 

building things, and the relationship has been one of a seamless, 

integrated relationship between NASA and industry, you know, a 

certain contractual environment. What we are talking about for a 

commercial crewed program that would fly NASA astronauts is still 

going to involve an intimate relationship between NASA and industry. Some of that relationship will change based on historical patterns. But it is certainly not one without the other, and I think it 
101

would be a mistake to assume that from a commercial perspective 

we expect to develop something, throw it over the transom and 

have NASA just accept it. NASA is going to be there every step of 

the way. They are going to be intimately involved and that certainly will be true for training of NASA astronauts but will also be 

true in the design, testing and production processes. 

Ms. EDWARDS. So you don’t envision any significant change to 

training protocols and requirements with a venture towards commercial operations? 

Mr. ALEXANDER. I am not an expert on what those are today but 

there would certainly be rigorous training and there would certainly be agreement between NASA and the private sector about 

how that is going to happen and what is expected such that by the 

time a NASA astronaut is on board that vehicle, they are not only 

capable of flying it and capable of flying it in off nominal conditions 

and abort scenarios but that NASA at the highest levels all the 

way up to the Administrator and through Bryan O’Connor have the 

confidence in that system and the overall system capability including the people involved. 

Ms. EDWARDS. Thank you, Madam Chairwoman. 

Chairwoman GIFFORDS. Thank you, Ms. Edwards. 

Ms. Kosmas, please. 

SOYUZ SPACE CRAFT: CONCERNS MOVING FORWARD

Ms. KOSMAS. Thank you, Madam Chairman. 

I wanted to chat with you all a little bit about the Soyuz that 

is intended to be used during the gap. I know, Mr. O’Connor, you 

spoke earlier about the history and the fact that not that much 

combined testing was done early on and that we made a decision 

as a Nation to send an astronaut anyway. But I think we are a little more enlightened now perhaps. As you know, following retirement of the shuttle, NASA is planning to rely solely on the Soyuz 

for astronaut transportation to and from the International Space 

Station, and this will probably be, from discussions we are having 

right now, for at least five years. So I would like to ask, General 

Stafford, you can answer it or Mr. O’Connor, last year the Soyuz 

experienced a few rough landings due to malfunctions, and can you 

discuss NASA’s assessments following these incidents whether they 

were involved in the assessments following the incidents and the 

decision to continue to use the Soyuz? The other question which I 

will go ahead and ask now is, are we now—is the Soyuz now required to meet our U.S. standards for quality, safety, environment, 

wages of workers, financial accountability and engineering practices? So are they accountable to us in the same way that we would 

expect our commercial operations to be or that we would expect 

NASA itself to meet? I would appreciate if you could address that 

since it does appear that that is our alternative during the five 

years. General? 

Lt. Gen. STAFFORD. Thank you, ma’am. As the chairman of the 

ISS Advisory Committee, we meet with our Russian colleagues at 

least twice a year and they have conference calls once a week concerning issues that would arise, and on that the Soyuz first flew 

in 1967. There have been two fatalities, one in 1967 and one in 

1971. Since 1971 they have had 100 percent reliability. The basic 
102

first stage flew 52 years ago. The second stage in the Soyuz has 

been—is 42 years old. Since 1971 they have had 100 percent success. They did not meet all of our criteria. In fact, I am the only 

one on the committee here who has been in the Soyuz and I did 

that first one on the Apollo-Soyuz and we had them change a couple of their systems before we would fly with them and there has 

been follow-up since then, and I think Mr. O’Connor has outlined 

the fact of what they do with their safety and they are very attuned to it, and we are completely informed about that. As far as 

the two reentries on the delay of the service module, the separate 

and all that, they have taken into account, explained that, and so 

to me, it should be a situation that is solid again. I would rather 

have us fly on our spacecraft, ma’am, as soon as possible and if we 

had the budget we could do that. 

Ms. KOSMAS. Mr. O’Connor? 

Mr. O’CONNOR. Ms. Kosmas, we were quite concerned with these 

landings. In fact, Peggy Whitson was in one of those and it was a 

pretty interesting ride for her, and would be for anybody, and so 

we offered to help the Russians in their investigation. They put together a commission to take a look at it. General Stafford and his 

counterpart in Russia have a committee that oversees the safety of 

the Soyuz flights and they were interested. We were all asking 

questions. We did our own independent assessment of what we 

thought might have happened based on what we know about 

Soyuz’ design and we compared notes with the Russians. In the 

end, they didn’t get to the root cause the way they wanted to but 

they fixed all the possible things that could be the real root cause 

of this thing and they fixed those things to our satisfaction. They 

shared a lot of information with us, way more than they used to 

in the old days. There are some times when we and the Russians 

do not agree on something like, for example, the relative risk of 

some issue that has come up, but by and large they are very open, 

and when we don’t agree with one another, we lean back on their 

demonstrated reliability, the quality of their workforce and the relationship our engineers have with theirs over a period of about 15 

years now. 

As for how we are planning to work with them in the future, we 

don’t retroactively assign all of our human rating or any other kind 

of requirements on the Russians to participate with them as partners. We have an MOU with them. We have signed up to extend 

the MOU to fly our astronauts and those other astronauts from 

Japan, Canada and Europe who depend upon us for transportation. 

It is the Russian transportation that we will be providing for them 

as well. So we take them under our wing. We take our responsibility very seriously. 

Ms. KOSMAS. Thank you. Unfortunately, the time is up. 

Chairwoman GIFFORDS. Thank you, Ms. Kosmas. 

Because we have a situation where we have time yielded to Mr. 

Rohrabacher, we actually now will go back to Mr. Rohrabacher, but 

I would like to introduce Ken Bowersox, an astronaut who has experience in both shuttle and Soyuz. It is good to see you today, sir. 

Welcome to our Committee. 

Mr. Rohrabacher. 
103

ADDRESSING THE GAP IN HUMAN SPACEFLIGHT

Mr. ROHRABACHER. Thank you very much, Madam Chairman, 

and we are in a little time bind here and I will try to be as quick 

as I can. Let me get to some fundamental issues here. 

The basic challenge that we are facing is to close the gap that 

will be created when the shuttle is grounded as soon as possible 

and with as less risk as possible, and that is the challenge that we 

have. The challenge isn’t going to the Moon. Right now the challenge we face is closing that gap. In terms of servicing the space 

station and low earth orbit, will the Delta system and the Atlas 

system, those rockets as they are now configured, will they be able 

to lift the payload necessary to deliver either a payload or crew to 

the space station or we will have to reconfigure those rockets? Anybody? 

Mr. ALEXANDER. Absolutely those vehicles as they are designed 

now have the performance capability to take a capsule for people 

or cargo to the space station. 

ARES

Mr. ROHRABACHER. Okay. When it comes to Ares Orion, they 

need to have something else that is developed and which is actually 

invented or, so to speak, a second stage or that system cannot deliver a capsule to the space station. Is that correct? 

Mr. FRAGOLA. If it were the Orion capsule, it could not do that. 

For a degraded with payload that is much less than Orion and we 

would do it on a single-core Atlas, we would have to use probably 

an Atlas 431, which includes three solid rocket boosters wrapped 

around a central core, and I doubt that that would be able to pass 

snuff on safety because in the OSP days when Bowman did his report, comprehensive report of alternatives, they showed that wrapping solids around a liquid core is——

Mr. ROHRABACHER. Okay, but I am not talking about Atlas here. 

I just want to get the information about the Ares. We are going to 

have——

Mr. FRAGOLA. The Ares payload is significantly better than any 

of those alternatives. 

Mr. ROHRABACHER. Okay, but it depends on developing a second 

stage that doesn’t exist. 

Mr. FRAGOLA. You would need a second stage for the Delta IV 

heavy as well to carry the payload. If you changed the payload or 

you changed the——

DELTA IV AND ATLAS

Mr. ROHRABACHER. Does the Delta IV—you are saying that the 

Delta IV cannot carry a payload to the space station without something new being put onto the Delta IV? I am trying to get at——

Mr. FRAGOLA. Yeah, for the Orion spacecraft on the Delta IV 

heavy, we would need a new upper stage. We would either have to 

four RL–10s or——

Mr. ROHRABACHER. We just heard the testimony from Mr. Alexander——

Mr. FRAGOLA. He is speaking of a much smaller payload. 
104

Mr. ROHRABACHER. Well, listen, I am not talking about—you 

know, maybe we have to fly more missions to get the same level 

of payload. I am just talking about getting an actual payload to the 

space station. You might have to—it might actually be less risky 

to fly three Delta missions there with a rocket that currently we 

have than to rely on a rocket that has a heavier lift but you have 

to build a whole new second stage which may or may be able to 

be built. Until that thing flies, we don’t even know if it is going 

to function. 

Mr. FRAGOLA. I would respectfully suggest that history shows us 

that the first-stage problem is the serious problem, and on the 

Delta 431, which is the only single core that can carry the payload 

that Mr. Alexander is talking about, you would have not only a single core but you would have three solid rocket boosters, and the 

Delta II accidents and the Delta 34D accidents show how important the interaction between the solids and the liquids are in a survivable condition. You would create a condition if you lost the solid, 

that would engage the——

Mr. ROHRABACHER. I have only got a couple more seconds. But 

the Delta—from my understanding, the Delta and Atlas have a 

very good track record, and what we are saying is, we have a track 

record to actually get things to the station, close that gap as compared to an Ares. If our strategy is to depend on that, it is to depend on a second stage that hasn’t been built yet, and I will have 

to say from my experience, any time you don’t have a piece of technology that is built and functioning, you can have the schedule go 

way back and the costs go way up so we wouldn’t be able to close 

that gap. 

Mr. HANLEY. And that is exactly why—you mentioned Boeing 

earlier. 

Mr. ROHRABACHER. Yes. 

Mr. HANLEY. That is exactly why we have Boeing on contract to 

be producing the upper stage for Ares because they have the corporate knowledge and the heritage in producing such systems of 

similar scale and they are bringing—doing a fantastic job bringing 

their expertise——

Mr. ROHRABACHER. It was a good decision to take Boeing——

Chairwoman GIFFORDS. Mr. Rohrabacher, we only five minutes 

left in the vote so I am going to have to cut you off. 

Mr. ROHRABACHER. Thank you very much. 

Chairwoman GIFFORDS. Mr. Hill, my apologies. Okay. We are 

coming down to the minute. We are going to run over. I want to 

thank our witnesses today. It was absolutely brilliant testimony. I 

think we learned a lot. This won’t be the first time that we address 

safety. We will come back to this because it is so critically important. 

You know, I am sorry Mr. Hall can’t be here for the end because 

I really believe what he said initially is so compelling and really 

reflects the sentiment of the Congress. We are strongly committed 

to provide a safe way for our astronauts to go to space and to travel 

back, and I have to say that I find the level of safety that has been 

planned for Ares and for Orion and the steps being taken to build 

safety into this Constellation program from the very beginning to 

be something that we have been proud to support for the last four 
105

years. While I continue to have an open mind, I look to the testimony of Mr. Marshall provided and I believe I quote you here, ‘‘The 

ASAP believes that if Constellation is not the optimum answer, 

than any new other design system has to be substantially superior 

to justify starting over.’’ Based on what we have heard today, and 

there is more in your written testimony, I see no justification for 

a change in the direction on safety-related grounds. Instead, I am 

in fact impressed with the steps that have been to infuse safety 

into Constellation. It is something that of course we are very proud 

as a country we have been able to achieve this. 

That being said, I don’t intend, and I hope that people don’t 

think that is a competition of commercial versus NASA. It is simply not that. We are all really excited and welcome the growth of 

new commercial space capabilities in America. Like Mr. Hanley, I 

too want to go to space and welcome the opportunity to do that 

someday, not for $30 million but maybe if the cost comes down. But 

currently I do not see those capabilities as competition with, as Mr. 

Alexander talked about, but rather complementary to our government systems that are currently under development. Whatever the 

Congress may decide to do with the question of additional incentives to the commercial space industry, of course, in this time of 

constrained budgets is something that really concerns all of us and 

this is why this discussion today has been so important. It is a 

question that needs to be decided on its merits, again, not on passion, not on what ifs but the actual reality of what is achievable 

and what can be documented. This is not a substitute for a continued commitment to the Constellation system that offers incredibly 

the safety benefits that we have heard in the testimony today. 

So thank you, gentlemen, for being here and to the Members of 

Congress, of course, for being here. With that, I will bring this 

hearing to a close by stating that the record will remain open for 

two weeks for additional statements from the members and for answers to any follow-up questions that the Subcommittee may ask 

of the witnesses. The witnesses are now excused and the hearing 

is now adjourned. Thank you. 

[Whereupon, at 12:30 p.m., the Subcommittee was adjourned.] 

(107)

Appendix: 

ANSWERS TO POST-HEARING QUESTIONS
108

ANSWERS TO POST-HEARING QUESTIONS

Responses by Mr. Bryan O’Connor, Chief of Safety and Mission Assurance, National 

Aeronautics and Space Administration

Questions submitted by Chairwoman Gabrielle Giffords

Q1. In your prepared statement, you cite that NASA is beginning development of a 

more concise set of human rating technical requirements applicable to NASA developed crew transportation systems as well as commercially-developed crew 

transportation systems or use by NASA.

• When do you envision these more concise human rating technical requirements 

will be defined so that commercial stakeholders can understand NASA’s 

needs?

• Is solely meeting these technical requirements the litmus test NASA should use 

to determine if a commercial transportation system is safe for its astronauts 

to use?

A1. NASA has formed a team to develop an implementation plan for human rating 

of commercially-developed crew transportation systems. This plan is based on 

NASA’s approach to safety risk management and the existing Agency human rating 

philosophy. This plan will clarify NASA expectations, including technical requirements, and will be derived from: NASA Procedural Requirements 8705.2 (HumanRating Requirements for Space Systems); Space Shuttle Program 50808 (ISS to 

Commercial Orbital Transportation Services Interface Requirements Document); 

and, other existing NASA requirements documents such as NASA Directives, NASA 

Standards, NASA adopted standards, the Exploration Architecture Requirements 

Document, the Constellation Architecture Requirements Document, and the Constellation Human Systems Integration Requirements. 

NASA released the preliminary plan using a NASA Request For Information on 

May 21, 2010. Responses were due on June 18, 2010 and NASA is in the process 

of reviewing and evaluating the responses. NASA plans to finalize the Commercial 

Human-Rating implementation plan in time to support an open-competition when 

NASA pursues the development phase of commercial crew transportation systems. 

Meeting NASA Human-Rating requirements is an important part of the overall 

process but not the sole test NASA will use to determine if a commercial transportation system is safe for NASA astronaut transportation. Any system destined to operate in the proximity of the ISS will be subject to the ISS ‘‘Visiting Vehicle’’ requirements, for example. 

NASA will define, as part of this plan, the appropriate level of ongoing government visibility into the development, testing/engineering analysis, production and 

operation of all launch vehicles and spacecraft that carry NASA astronauts. NASA 

will also define its role in hazard and risk analysis/acceptance, as well as design 

and operational certification and flight readiness.

Q2. The Shuttle’s operational costs have declined in the past few years.

a. Do lower operational costs necessarily mean less safety?

b. What lessons learned from the way NASA is operating the Shuttle may prove 

useful to how your office will oversee the safety of future space transportation 

system, be they government or commercially-provided?

A2. Although the overall annual Shuttle budget has declined over the past few 

years, it should not be interpreted that the decline is in the ‘‘operational costs’’ of 

conducting Shuttle missions. 

After the Columbia accident in 2003, the Shuttle Program budget was significantly increased as NASA pursued parallel paths to address findings and recommendations of the Columbia Accident Investigation Board. The related costs for 

design, development, test and certification peaked in the 2004–2005 timeframe, and 

have gradually declined since. 

As we approach the retirement of the Space Shuttle Program, NASA is gradually 

closing out the Shuttle Program’s production capabilities as the last needed hardware and subsystems are making their way through the production pipeline. This 

has led to a further reduction of cost. 

These cost reductions have not and will not impact the focus on safety by the Program for the remaining flights. 

Once NASA has developed a strategy for acquisition of any new launch, entry, 

and/or emergency deorbit capability or service, the Agency must define its own role 

in ongoing management oversight and technical insight, including certification of 
109

the design and operation, and readiness of the team for flight, as well as ongoing 

role in problem resolution, sustaining engineering, hazard and risk analysis/acceptance. These decisions will be based on a number of factors, most stemming from 

hard lessons learned during Apollo 204, Challenger and Columbia mishap investigations and recovery. Examples include: a respect by all involved for the inherent 

risks in human spaceflight, not only in early development phases, but throughout 

the lifecycle; the need for rigorous checks and balance between the developer and 

the ‘‘owner’’ of the technical requirements (Technical Authority); the need for technical excellence among the development and assurance work force, the need to include flight crew in system development as well as flight test operations safety-critical decision-making; the necessity of continually challenging past assumptions and 

engineering models as part of the ongoing risk management process; and, the importance of clear roles and responsibilities and good communications in all directions 

as part of a healthy safety culture.

Questions submitted by Representative Pete Olson

Q1. Please explain with examples if possible. how NASA uses its human-rating requirements to tailor the design of a crewed space system such as Ares and 

Orion?

A1. NASA’s Human Ratings Requirements document (NPR 8705.2B) applies to the 

integrated flight/ground system, and is based on three key principles:

1) Human-rating is the process of designing, evaluating, and assuring that the 

total system can safely conduct the required human missions.

2) Human-rating includes the incorporation of design features and capabilities 

that accommodate human interaction with the system to enhance overall 

safety and mission success.

3) Human-rating includes the incorporation of design features and capabilities 

to enable safe recovery of the crew from hazardous situations.

For instance, requirements associated with the first principle drive a considerable 

focus on human factors aspects of the design, such as proper layout of cockpit displays and controls, and environmental factors such as adequate crew cabin temperature and humidity. 

Separately, requirements associated with the third principle stipulate that certain 

abort and or escape capabilities be present. To implement this requirement, significant effort has gone into prelaunch and post landing emergency egress capabilities 

and the design of a launch abort system which would be used to pull the crew capsule away from the launch vehicle and allow the crew to return to Earth should a 

catastrophic event occur during launch. In light of the Presidential direction for FY 

2011, it is worth noting that the lessons that NASA has learned from all past and 

present systems pertaining to human rating with be utilized, to the best extent 

practicable, in the development of any future vehicle.

Q2. If the human-rating requirements are the top level requirements, how would potential commercial providers gain the necessary insight to design a system that 

meets NASA’s requirements? Similarly, how did NASA get comfortable enough 

to finally certify the Russian Soyuz for human space flight?

A2. NASA has formed a team to develop an implementation plan for human rating 

of commercially-developed crew transportation systems. This plan is based on 

NASA’s approach to safety risk management and the existing Agency human rating 

philosophy. This plan will clarify NASA expectations including technical requirements, and was derived from NASA Procedural Requirements 8705.2 (Human-Rating Requirements for Space Systems); Space Shuttle Program 50808 (ISS to Commercial Orbital Transportation Services Interface Requirements Document); and, 

other existing NASA requirements documents such as NASA Directives, NASA 

Standards, NASA adopted standards, the Exploration Architecture Requirements 

Document, the Constellation Architecture Requirements Document, and the Constellation Human Systems Integration Requirements. 

NASA released the preliminary plan using a NASA Request For Information on 

May 21, 2010. Responses were due on June 18, 2010 and NASA is in the process 

of reviewing and evaluating the responses. NASA plans to finalize the Commercial 

Human-Rating implementation plan in time to support an open-competition when 

NASA pursues the development phase of commercial crew transportation systems. 

Meeting NASA Human-Rating requirements is an important part of the overall 

process but not the sole test NASA will use to determine if a commercial transportation system is safe for NASA astronaut transportation. Any system destined to op-
110

erate in the proximity of the ISS will be subject to the ISS ‘‘Visiting Vehicle’’ requirements, for example. Other considerations are demonstrated reliability, the extent and quality of the developer’s design, test and evaluation processes as well as 

their production and operations activities. 

NASA will define, as part of this plan, the appropriate level of on-going government visibility into the development, testing/engineering analysis, production and 

operation of all launch vehicles and spacecraft that carry Agency astronauts. NASA 

will also define its role in hazard and risk analysis/acceptance, as well as design 

and operational certification and flight readiness. 

The first step in building confidence in Russia’s human spaceflight in the early 

1990’s was to review lessons from the Apollo Soyuz program. Then NASA worked 

closely with the Russian Space Agency, now ROSCOSMOS to develop technical and 

management relationships and to understand each partner’s roles and responsibilities for safety in the program. Before NASA began flying NASA astronauts on the 

Russian Soyuz, NASA performed several reviews of the Soyuz design, manufacturing, operations and quality and safety process. Based on these reviews, the trust 

stemming from our government to government relationships, as well as the long 

operational history of the Soyuz (rocket, crew capsule and ground systems), NASA 

developed the confidence to declare the Soyuz system acceptable for US astronaut 

participation. In preparation for potential use of the Soyuz design as a U.S. Space 

Station Freedom crew rescue vehicle, and then later in preparation for the joint 

Shuttle-Mir activity, NASA technical experts, including senior safety engineers, 

spent a significant amount of time talking with Apollo-Soyuz veterans, visiting with 

current Russian counterparts, and reviewing the long history of Soyuz, Salyut, and 

Mir operations in an effort to understand the Russian approach to human 

spaceflight safety. From this they were able to determine acceptability by equivalence to, if not compliance with, NASA technical standards. In March 1995, Norm 

Thagard became the first U.S. astronaut to launch on the Soyuz. He and the other 

five astronauts who spent time on Mir used the Shuttle for subsequent transportation, but they all received training in Soyuz as their primary escape system. The 

next American to launch on a Soyuz was Bill Shepherd, the Commander of the first 

Space Station increment in October 2000. Since then, 14 different NASA astronauts 

have flown on Soyuz, bringing the total NASA astronaut trips to 14 up, and 13 

down, several of which were made during the post-Columbia Return-to-Flight timeframe. With over 15 years of joint operations NASA has gained confidence in the 

Russians systems and operations, as well as their design and development philosophy, including not just dependence on system reliability but on crew escape and 

on their extensive system and subsystem testing. 

NASA has not certified, and does not intend to ‘‘certify,’’ the Soyuz for human 

space flight relative to all NASA’s technical requirements. NASA continues to approve or clear its participation in each flight by maintaining knowledge and insight 

into the on-going Soyuz program, formally approving NASA and NASA-sponsored 

crewmember participation in its own Flight Readiness Review process, and by participating in the Russian General Design Review process, which is similar to the 

Agency’s Flight Readiness Review process. Additionally, since 1995 a joint Russian 

and NASA committee, the Space Station Advisory Committee (Stafford-Anfimov) advises both agencies on the operational and safety status for each Soyuz flight.

Q3. Since Crew Escape Systems, including emergency detection and launch abort 

systems, should be developed in conjunction with the launch vehicle, how could 

NASA evaluate the overall safety of an as-yet-to-be developed launch vehicle 

whether provided by a COTS provider, United Launch Alliance, or an international partner?

A3. As suggested by the question, the evaluation of abort system effectiveness, and 

human rating in general, requires an integrated analysis of launch vehicle, crew 

capsule, crew, and the abort system itself. Any launch vehicle has to be designed 

to provide critical vehicle status and abort triggers to notify the crew vehicle and 

launch escape system that an abort is required or to allow the crew to make an 

abort decision. The design needs to take into account the launch vehicle failure 

modes and the timely detection of these failures. Transportation system developers 

would be required to design the integrated vehicle to support the abort trigger requirements. The crew escape system would have to be designed so that it can reliably and safely pull the crew capsule from the launch vehicle given the failures and 

resulting environments during the critical portions of the launch vehicle’s flight profile. An integrated safety analysis to review the specific implementation would be 

conducted to assure that effective crew escape capabilities are available to address 

critical failure scenarios of the integrated system. 
111

NASA has spent considerable effort in doing this kind of analysis for the baseline 

architecture. Similar analyses will have to be performed for other concepts.

Q4. From the Safety and Mission Assurance perspective, would you elaborate on the 

potential to close the gap using EELV’s, including cost information if available?

A4. NASA doesn’t human-rate individual components or elements of a launch system, so in order to use an EELV that EELV would need to be human-rated in combination with all of the flight and ground elements needed to accomplish a specific 

reference mission. The EELVs in combination with these other elements (spacecraft, 

abort/escape/egress system, etc.) would need to be human-rated to ensure that collectively they provide a sufficient level of safety, and particularly allow for survivability of the crew during any potential hazardous situations. 

In 2009, NASA commissioned a study performed by Aerospace Corporation to 

study the feasibility of human rating current EELVs. The study concluded that 

EELVs are ‘‘human-ratable,’’ however the cost to do so is highly dependent on program requirements, specific interpretation of and compliance with NASA’s humanrating requirements document (NASA Procedural Requirements 8705.2) and especially noteworthy the integration of the EELV design with other elements of the system. In addition, the study found that the gap between Shuttle retirement and 

availability of a new crew transportation system to ISS would not be reduced from 

the then-current Constellation target milestone of March 2015 initial operating capability.

Q5. Since a significant portion of launch failures are due to human error it is critical to have a strong safety culture. The Columbia Accident Investigation Board 

reiterated again the importance of a strong safety culture. Would a shift to commercially provided low-Earth orbit launch vehicles disrupt that culture at 

NASA? Could that be cause for concern?

A5. Depending on the acquisition approach, contracting with industry for a new ISS 

crew transportation system could represent some changes in NASA’s traditional 

human spaceflight processes, including its interactions with industry. NASA will 

‘‘own’’ major NASA-related safety requirements (visiting vehicle and human rating), 

and will establish an appropriate forum for verification that the system has met 

them. To the extent that NASA retains accountability for the safety of its employees 

and contractors (crewmembers), it will play a role in technical oversight/insight, as 

well as hazard analysis, and risk assessment and acceptance. These processes and 

relationships, however, are only a part of a strong safety culture, the remaining aspects being all about communications in all directions. Especially important will be 

the establishment and maintenance of a strong effective dissent and appeal system 

on both the commercial and government side of the relationship. NASA is committed to preserving a strong safety culture regardless of the acquisition approach.

Questions submitted by Representative Marcia L. Fudge

Q1. In your prepared statement, you cite that NASA is beginning development of a 

more concise set of human rating technical requirements applicable to NASA developed crew transportation systems as well as commercially-developed crew 

transportation systems or use by NASA.

• When do you envision these more concise human rating technical requirements 

will be defined so that commercial stakeholders can understand NASA’s 

needs?

• Is solely meeting these technical requirements the litmus test NASA should use 

to determine if a commercial transportation system is safe for its astronauts 

to use?

A1. NASA has formed a team to develop an implementation plan for human rating 

of commercially-developed crew transportation systems. This plan is based on 

NASA’s approach to safety risk management and the existing Agency human rating 

philosophy. This plan will clarify NASA expectations including technical requirements, and will be derived from: NASA Procedural Requirements 8705.2 (HumanRating Requirements for Space Systems); Space Shuttle Program 50808 (ISS to 

Commercial Orbital Transportation Services Interface Requirements Document); 

and, other existing NASA requirements documents, such as NASA Directives, NASA 

Standards, NASA-adopted standards, the Exploration Architecture Requirements 

Document, the Constellation Architecture Requirements Document, and the Constellation Human Systems Integration Requirements. 

NASA released the preliminary plan using a NASA Request For Information on 

May 21, 2010. Responses were due on June 18, 2010 and NASA is in the process 
112

of reviewing and evaluating the responses. NASA plans to finalize the Commercial 

Human-Rating implementation plan in time to support an open-competition when 

NASA pursues the development phase of commercial crew transportation systems. 

Meeting NASA Human-Rating requirements is an important part of the overall 

process, but not the sole test NASA will use to determine if a commercial transportation system is safe for NASA astronaut transportation. Any system destined to operate in the proximity of the ISS will also be subject to the ISS ‘‘Visiting Vehicle’’ 

requirements, for example. 

NASA will define, as part of this plan, the appropriate level of ongoing government visibility into the development, testing/engineering analysis, production and 

operation of all launch vehicles and spacecraft that carry NASA astronauts. NASA 

will also define its role in hazard and risk analysis/acceptance, as well as design 

and operational certification and flight readiness.

Q2. The Columbia Accident Investigation Board (CAIB) recommended the establishment of an independent Technical Engineering Authority responsible for technical requirements and all waivers to them. In response, NASA created the 

NASA Engineering and Safety Center’s (NESC) which operationally falls under 

the responsibility of your office. How has that independent center enhanced the 

safety of human space flight?

A2. In response to recommendations from the CAIB, NASA formalized Technical 

Authority (TA) roles for NASA’s Safety and Mission Assurance, Engineering and 

Health and Medical organizations establishing clear authority and responsibilities 

related to the technical requirements established by the TA organizations and waivers to those requirements. 

The TAs are a key part of NASA’s overall system of checks and balances and provide independent oversight of programs and projects in support of safety and mission success. Individuals fulfilling the TA roles are embedded in their respective 

technical cadres and organizations across the Agency, and are continuously engaged 

in programmatic decision-making processes. They ensure that all opinions are heard 

and engage with line management to ensure that the right technical decisions are 

made with respect to requirements, non-compliances, hazards, critical items, as well 

as ensuring work is performed to a high standard. 

The NESC was formed in response to CAIB criticism of the safety organization’s 

lack of technical depth. Its mission is to perform value-added independent testing, 

analysis, and assessments of NASA’s high-risk projects to help ensure safety and 

mission success. The organization has established a strong set of processes, technical leaders and communities of practice across the Agency and access to key technical experts and facilities outside of NASA to allow rapid response with the best 

possible technical capability to the Agency’s most critical problems. In a typical 

year, the NESC performs in excess of 50 independent assessments for a variety of 

customers, including, but not limited to, the Agency’s SMA organizations. 

The Technical Authorities and the NESC operate across all of NASA but are particularly important in addressing problems which arise in connection with human 

space flight. The totality of the contributions is too great to catalog here, but two 

examples are illustrative. 

Between the time of STS–114, the return to flight after Columbia, and the final 

preparations for the launch of STS–120 in the fall of 2007, anomalies with the Reinforced Carbon Carbon panels used on the wing leading edges had come to light. All 

panels show cracking and crazing after exposure to high temperatures with damage 

thresholds established for repair or replacement but there was new test data potentially indicating the need to repair or replace panels not previously suspect. 

The NESC was asked to quickly establish an independent team to assess the 

problem in parallel with the ongoing work being performed by the project team. The 

NESC team performed a great deal of high caliber and ground breaking technical 

work in a short time and recommended both a measurement methodology and quantitative threshold. The processes established in support of the Technical Authority 

model for the flight readiness reviews and leading to the Certification of Flight 

Readiness ensured that the recommendations were fully considered and led to adoption of both the recommended flight worthiness criterion for the RCC and a longer 

term program to better understand the materials and utilize nondestructive inspection techniques in support of improved flight safety. 

Data from the flight of STS–126 in November 2009 and post-flight inspection of 

the hydrogen flow control valves showed that a large piece of a valve poppet had 

liberated. This had never happened before in flight and raised significant safety of 

flight concerns for STS–119 since there were multiple scenarios leading to catastrophic failures during powered flight. The problem was extremely difficult and the 

first round of reviews could not establish a rationale and supporting data to allow 
113

a commitment to launch. In response, the Project team was augmented with engineering and safety and mission assurance personnel from across the Agency to establish and execute a combination of tests and analyses to establish the basis for 

a safety of flight assessment. The NESC brought its cadre to bear, both to directly 

support the technical teams and also to provide independent assessments in critical 

areas. Technical authority line managers were strongly engaged both to ensure that 

all possible resources were brought to bear but also that the many alternate technical opinions were appropriately heard and considered and that a flight rational 

could be established on a sound technical basis. As a result of an extraordinary 

quantity and quality of work done in a very short time, not only was a sound decision basis established for the safe launch of STS–119 but the understanding of the 

flow control valve failure modes and effects and non-destructive examination techniques were greatly improved. This in turn led to greatly improved processes and 

criteria for all subsequent missions and significant reduction in risk.

Q3. The Augustine Committee has done a commendable job of providing options and 

alternatives for the U.S. Human Space Flight program for consideration. However, changes to an ongoing development program carry the real threat of major 

adverse impacts on cost and schedule, increased risk and dislocations for the 

workforce. In this regard, please comment on the safety impacts of two potential 

changes discussed in the Summary Report: 1) Reducing Orion crew size; and, 

2) Relying on commercial crew-delivery service rather than continuing the development of Ares 1.

A3. NASA looks at any significant change in architecture or performance requirements with an eye toward safety impacts. The decision to reduce the crew size from 

six to four had no direct or indirect adverse safety. The primary rationale for the 

Orion crew size requirement change was to simplify design activities and thereby 

reduce cost and schedule challenges while improving mass margins during the Program’s early phases. Since the maximum crew size requirements were originally established at the Constellation Systems Requirements Review in 2006, Orion had 

been pursuing parallel designs for the Space Station six-person and the Lunar fourperson configurations. Therefore, Orion’s work included multiple designs for crew 

seat pallets and Environmental Control and Life Support hardware, and multiple 

analyses for consumables, stowage, and crew operations. By shifting to a common 

crew size configuration for the Space Station and lunar missions, Orion’s team 

would be able to focus activities on a single design and analysis set rather than two 

parallel design efforts. 

The maximum crew size reduction for Orion ISS missions actually had operational 

advantages that improve crew safety:

• The free volume for the crew’s on-orbit activities and tasks could be increased 

by 20–25 cubic feet.

• The nominal and emergency crew egress capability would be improved.

• More stowage volume and mass could be made available for carrying mission 

equipment and bringing payloads and cargo to the ISS.

The President’s budget ‘‘funds NASA to contract with industry to provide astronaut transportation to ISS as soon as possible, reducing the risk of relying solely 

on foreign crew transports.’’ In response, NASA will use an acquisition approach appropriate to the criticality of and risk inherent in the mission. Included will be an 

acceptable mix of NASA technical requirements and industry practices as well as 

NASA technical insight and management oversight. These things, along with the 

design, support and demonstrated reliability of the transportation system, will allow 

NASA to determine when the system will be suitable to carry NASA (and International Partner) crews to the ISS.

Q4. One of the Augustine Committee findings is that investment in a well-designed 

and adequately funded space technology program is critical to enable progress 

in exploration. NASA’s space technology budget has been severely reduced over 

time. Power, propulsion, in-space refueling, communications and a host of other 

technologies will be crucial for exploration. What safety-related considerations 

are associated with investing in such technologies?

A4. Without new technologies, human exploration of the solar system will likely be 

unaffordable and unsustainable. The safety implications of new technologies, however, must be evaluated on a case-by-case basis. While the use of new technologies 

can provide safety benefits, e.g., by eliminating risks in existing systems and 

through increasing safety margins, they also generally introduce risks due to immaturity of and unfamiliarity with such technologies. 
114

These impacts must be assessed as part of design and operational trade studies. 

For example, technology development for in-space refueling must weigh the safety 

impact of designs involving an initial crew transportation system that fully relies 

on in-space refueling against a crew transportation system that can take advantage 

of in-space refueling after the refueling technology has been proven with robotic 

missions. 

However, new technologies are not necessarily used to improve safety, and may 

instead be used to expand mission goals. For example, weight savings in one area 

might be used to increase science/mission payload or to increase propellant reserves 

or shielding. The investment in developing and integrating new technologies is essential to ensuring that our Nation’s space program is engaged in innovations that 

will help NASA find better and safer ways to explore the solar system.

Questions submitted by Representative Dana Rohrabacher

Q1. In the Launch Services Program NASA has generally required that a launcher 

demonstrate multiple successful flights before being considered for use launching 

science payloads and satellites. In some cases, up to 14 successful flights of the 

rocket were required before being used to launch a ‘‘Class A’’ satellite. By contrast, the Constellation Program is currently planning (subject to review) only 

one full-up test flight before placing astronauts aboard the Orion/Ares I. I understand that these two parts of NASA—manned and unmanned—have different 

requirements and operate with different rules, but in both cases the overall mission success is a primary objective. Can you please explain how these two systems of evaluating launch vehicles have evolved so differently, what are the similarities, and in the above example how NASA’s Constellation program can comfortably accept a plan that demands 92 percent fewer test flights than what was 

required for a satellite program?

A1. The most important factor in determining when it is appropriate to fly crewmembers on a new test vehicle is the level of confidence the team has in safely conducting the test. In the case where NASA validates the technical requirements, designs and manufactures the flight and ground systems, writes the launch commit 

criteria and flight rules, performs all number of ground tests and engineering analyses, and conducts the reliability, safety and risk analyses, it has arguably maximized its understanding of and associated confidence in the system. Based on this, 

the team decides when to conduct its first crewed flight test. As the distance between NASA and the design, development, manufacturing, and operations increases, 

so does the Agency’s reliance on demonstrated reliability, and/or other government 

certifications (i.e. Russia’s ROSCOSMOS or the U.S.’s Federal Aviation Administration). NASA has not come to a final determination on the number of test flights that 

would be required prior to sending NASA astronauts into space using the crew 

launch vehicle under the Program of Record. 

Regarding the comparison with the LSP, NASA has a range of options available 

depending on the launch system’s proven reliability, the value of the payload, and 

the certification status of the provider. In some cases, this program has little insight 

into, or oversight of, the commercial launch providers. In those cases, NASA requires a demonstration of 14 successful launches for certification of the launch vehicle for high value payloads. This certification option, which is rarely chosen, is 

predicated on an assumption of no prior knowledge about launch vehicle performance, and limited government oversight into the design and operation. Another option is to fly the NASA payload on a relatively new system with as few as three 

flights (two successes in a row), but with substantial NASA process requirements 

and insight into the contractor’s design, engineering and operations processes. For 

lower value payloads with a higher risk tolerance, another certification category is 

available. It only requires one successful flight of the launch vehicle and a significant technical assessment. 

NASA’s ongoing human spaceflight program has established a host of safety and 

mission assurance activities including (subsystem) tests, verifications, and analyses, 

which would establish a level of confidence in the vehicle’s performance prior to the 

full-system test launches. Decisions regarding the needed number of full-system test 

launches should account for these assurance activities.

Q2. John Marshall from the Aerospace Safety Advisory Panel (ASAP) said in his 

written testimony that, ‘‘more than two years into the COTS program, efforts to 

develop human rating standards for a COTS–D like program have only just 

begun and no guidance thus far has been promulgated. If COTS entities are ever 

to provide the level of safety expected for NASA crews, it is imperative that 

NASA’s criteria for safety design of such systems immediately be agreed upon 
115

and provided to current or future COTS providers.’’ What steps is NASA taking 

to address this concern and develop a process that can be used by potential 

COTS–D competitors?

A2. NASA has determined that human rating requirements will apply to any crew 

transportation systems used by the Agency to provide transportation to low earth 

orbit. Consistent with the President’s plan to ‘‘contract with industry to provide astronaut transportation to the International Space Station as soon as possible, reducing the risk of relying solely on foreign crew transports . . .’’ NASA is using American Recovery Reinvestment Act (P.L. 111–5) funds to develop guidelines for acquisition and oversight/insight approach in FY 2010. NASA’s approach to human-rating 

a transportation architecture for a specific mission starts with the initial design 

phase, and assumes all pertinent NASA standards and requirements are followed 

throughout the project. This task will define a minimum set of human rating requirements and consolidate them into a single product using a development team 

comprised of representatives from NASA’s human space flight programs, NASA 

technical authorities, and the NASA Astronaut Office. In addition, NASA will define 

hazard and risk assessment processes and goals and thresholds to support risk acceptability decisions. NASA will seek the advice of interested industry stakeholders 

to refine the human rating technical requirements. 

More specifically, NASA has formed a team to develop an implementation plan 

for human rating of commercially-developed crew transportation systems. This plan 

is based on NASA’s approach to safety risk management and the existing Agency 

human rating philosophy. This plan will clarify NASA expectations, including technical requirements, and was derived from: NASA Procedural Requirements 8705.2 

(Human-Rating Requirements for Space Systems); Space Shuttle Program 50808 

(ISS to Commercial Orbital Transportation Services Interface Requirements Document); and, other existing NASA requirements documents such as NASA Directives, 

NASA Standards, NASA adopted standards, the Exploration Architecture Requirements Document, the Constellation Architecture Requirements Document, and the 

Constellation Human Systems Integration Requirements. 

NASA released the preliminary plan using a NASA Request For Information on 

May 21, 2010. Responses were due on June 18, 2010 and NASA is in the process 

of reviewing and evaluating the responses. NASA plans to finalize the Commercial 

Human-Rating implementation plan in time to support an open-competition when 

NASA pursues the development phase of commercial crew transportation systems.

Q3. Dr. Fragola indicated during the hearing that a launch vehicle with a liquid 

core and solid strap-ons was likely to present a more dangerous, or a more difficult environment for crew escape in the event of a launch catastrophe. What 

is the reason for this, and does it apply evenly to shuttle derived concepts such 

as shuttle-C, or Jupiter Direct type designs? Further, it has been reported that 

pursuant to the Augustine committee report, NASA is studying the human rating of heavy lift vehicle concepts (or their derivatives) as potential Orion launch 

vehicles. Assuming any new Orion-carrying heavy lift vehicle would use a combination of liquid core with solid strap-ons, how does that affect the crew escape 

and Loss of Crew calculations?

A3. The reason that strap-on boosters in general represent a more difficult environment for crew escape in event of a launch catastrophe includes the following two 

factors. First, such configurations have failure modes that would more readily propagate from one booster to another, with the potential to lead to a more energetic 

post-accident environment. Secondly, there is a much greater potential for thrust 

imbalance, leading to greater aerodynamic stresses. These concerns apply to Shuttle-derived concepts. 

A better understanding of the specifics and absolute values of the relative risks 

of the various configurations would require simulations of the post accident environment and system responses similar to those already performed on the Ares I configuration. If Orion and the launch abort system remain the same, it would be expected that in the heavy lift configuration the factors mentioned above would cause 

a higher risk to the crew than in the Ares I configuration. 

At the same time, compared to side-mount options, this configuration would cause 

the crew to be further removed from the first stage, which would actually reduce 

risk to the crew due to failures of the solid/liquid first stage combination. The increased launch capability of a heavy lift configuration would further allow for modifications to Orion and the launch abort system that enhance crew survival capabilities.
116

ANSWERS TO POST-HEARING QUESTIONS

Responses by Mr. Jeff Hanley, Program Manager, Constellation Program, Exploration Systems Mission Directorate, National Aeronautics and Space Administration

Questions submitted by Chairwoman Gabrielle Giffords

Q1. What is the basis of NASA’s determination that the Ares I/Orion combination 

should be ten times safer than the Shuttle? How confident are you that you can 

achieve that level of safety?

A1. With regard to your questions about the current program of record, NASA’s 

Constellation Program was developed with the goal of increasing astronaut safety 

tenfold relative to Shuttle missions based on two key directives:

• The May 2004 Astronaut Office Position on Future Launch System Safety, 

which stated that office’s belief that an order of magnitude reduction of risk 

during the ascent phase of a crewed space mission was possible. This position 

was written with regard to the Orbital Space Plane booster selection, and in 

response to the Columbia Accident Investigation Report, and it serves as a 

goal for increasing system safety during this critical phase of flight.

• The Exploration Systems Architecture Study (ESAS) of November 2005, 

which suggested that ‘‘. . . crew missions to the ISS may be at least 10 times 

safer than the Shuttle . . .’’ While risk estimates for various phases of flight 

(e.g., ascent, docking, re-entry, landing) and spacecraft components (e.g., service module) are constantly undergoing review the Constellation Program’s 

Loss-of-Crew (LOC) requirements were derived from the ESAS.

Probabilistic Risk Analysis (PRA) is a tool used to analyze system risks and understand a systems probability of problems and the magnitude of impacts due to the 

problems. Program managers use PRAs to assess designs in an effort to judge merits of technical trades. Additionally, NASA communicates risks to project, engineers 

and the outside world using PRAs. PRA numbers fluctuate over time as designs mature and system trades are accepted. 

From the very beginning, Constellation has been committed to building an architecture that effectively balances the use of critical design commodities to achieve the 

optimal safety and mission success capability. Therefore, at the time of my testimony, NASA believed its ultimate goal of increasing safety tenfold via the utilization of the Ares I/Orion combination, while seemingly daunting, would have been 

achievable. However, based on current data, NASA believes the Ares I/Orion combination overall would be about five times safer than the Shuttle. These numbers, 

however, are averaged estimates and not the way that NASA calculates or tracks 

the PRA of specific vehicles. 

In terms of Ares I/Orion, the current PRA for the integrated stack for the Ascent 

Phase shows a 1 in 1,877 probability LOC. It also greatly exceeds the challenging 

1 in 1,000 LOC Ascent Phase requirement. This is due to both the projected reliability of the Ares I launch vehicle and a robust Launch Abort System. For the OnOrbit Phase, the current Constellation Program PRA results in a 1 in 521 for a 210 

day mission. This phase is heavily dominated by the micrometeoroid and orbital debris risk to both vehicles. For the entry phase, as we have seen through history, 

is just as demanding as the ascent phase. Because of this, NASA has the same challenging 1 in 1,000 LOC requirement as for the ascent phase. Unlike ascent where 

there will be abort capabilities; there is no easy way to gain significant improvement 

for the entry phase. The risk is dominated by parachute and thermal protection system contributions. These systems are currently a priority for design improvements 

as well as a comprehensive test program. 

In comparison, the purpose of the Shuttle PRA is to provide a useful risk management tool for the Space Shuttle Program to identify strengths and possible weaknesses in the Shuttle design and operation. Currently, the mean PRA for an entire 

Space Shuttle mission to the ISS (including the ascent, on-orbit and re-entry 

phases) is 1 in 89, with a range of 1:63 to 1:130 (representing the 5th and 95th percentiles). The equivalent PRA figure for Constellation is 1 in 406, representing a 4.6 

factor of improvement over the Shuttle risk assessment for the equivalent 5 day 

docked ISS mission. 

As with any PRA of a large, complex, and engineered system, the Shuttle PRA 

is developed for a defined scope, and reasonable engineering judgment is used to 

make assumptions where necessary. Therefore, limitations exist as to its use, and 

the per-mission ratio should not be seen as a single-point estimate, but merely the 
117

mean number in a range of risk. The PRA can be useful in comparing different systems (assuming they are calculated using similar bases), and not as an absolute risk 

number. For these and other reasons, it is difficult to compare Constellation risk 

estimates to the Shuttle PRA; NASA has a far higher level of knowledge about the 

Shuttle system and the PRA methodologies for operational systems are different 

from the risk estimation methodologies for systems in development.

Q2. You are having to human-rate the Constellation launch vehicle and spacecraft 

system. How involved a process is that? Is it simple compliance with a set of 

itemized requirements, or is it something more involved?

A2. Regarding human-rating, the launch of any spacecraft is a very dynamic event 

that requires a tremendous amount of energy to accelerate to orbital velocities in 

a matter of minutes. There also is significant inherent risk that exposes a flight 

crew to potential hazards. Through a very stringent human rating process, NASA 

attempts to eliminate hazards that could harm the crew, control the hazards that 

do remain, and provide for crew survival even in the presence of system failures. 

Human rating is a process that involves more than a simple set of design requirements. The process intertwines with the acquisition process, starting with initial 

concept design and progressing through all phases of the program. Its progress is 

checked and reported to Agency management at each major acquisition milestone. 

It includes not just requirements compliance, but also consideration of hazards, failure modes, escape system effectiveness and limitations, failure tolerance, and other 

safety risks both in flight and on the ground. The requirements are all applicable 

mandatory standards used in designing and operating our most important unmanned mission systems, with the addition of human crew unique requirements 

dealing with life support, human factors, crew escape/abort and survivability. The 

scope and magnitude of the process is dependent upon the Agency’s risk tolerance 

for the particular mission, as well as the complexities and hazards associated with 

the vehicle design and its assigned mission profile. As written, NASA’s human rating process is structured specifically for NASA developed systems, where the NASA 

program manager is the design decision and risk acceptance authority, and the 

NASA Engineering, Safety and Mission Assurance, and Health and Medical Technical Authorities have cognizance of the associated standards and requirements. 

However, Agency policy allows some or all of its human rating process and requirements to be applied, as it sees fit, to systems developed by other organizations or 

entities as conditions for clearance to fly NASA or NASA sponsored crew/passengers. 

For NASA developed systems, human rating certification includes: validation by 

the technical authorities that the design requirements are properly tailored to the 

program; verification that the design meets those design requirements (by ground 

test, analysis, and flight test as appropriate); and full-up flight demonstration of an 

appropriate level of system reliability prior to manned flight test and prior to full 

mission clearance. Finally, NASA human rates an entire system, including ground 

elements and operational procedures (fundamentally, anything about the flight or 

ground system that impacts flight crew/passenger safety). This means that it looks 

at integrated safety issues and accident scenarios, not just failures at the subsystem 

level. 

Given that safety is NASA’s first core value, the Constellation Program, had incorporated safety into the Constellation design process from the very beginning. In 

doing so, the Constellation program chose to tightly interweave the design and safety team members into the decision process, including Engineering, Safety and Mission Assurance and Health and Medical technical authorities, so that each have a 

role in the Agency’s human rating process. The team has actively worked with the 

design engineers to provide expertise and feedback via various assessments and 

analysis techniques throughout the design maturation process. 

Human rating a spaceflight system is not as easy as following one document. Instead, it is an intricate, continuing process, involving the translation of specific mission requirements into designs that can be built, tested, and certified for flight and 

an understanding of risks with mitigation approaches in place. Additionally, before 

any system can be human rated, it must meet all other Agency standards and requirements applicable to a specific mission and type of system. Therefore, part of 

the challenge to projects such as Ares I and Orion has been that there is currently 

no single document that spells out what they should do to receive a human rating 

certification from the Agency. In turn, this is partly why NASA is investing FY 2009 

Recovery Act funds to develop a more concise set of NASA human rating technical 

requirements. 

Although NASA does not yet have one consolidated document for human rating, 

the Constellation Program has depended heavily on NASA Procedural Requirement 
118

8705.2B, in designing its spaceflight vehicles. This document is based on three key 

tenets:

1) Human-rating is the process of designing, evaluating, and ensuring 

that the total system can safely conduct the required human missions. The mission will have certain mission objectives and system performance requirements that must be met. The mission will also expose the crew 

to potential hazards that must be considered early in the design process. 

During the design process, a careful examination of the potential hazards 

and design features that prevent hazards—known as ‘‘hazard controls’’—is 

undertaken. Hazard controls are features incorporated into the system during the design phase to prevent the occurrence of a hazard. These can take 

many forms such as incorporating redundant or backup systems and components, application of system margins to ensure function of the system even 

under the most extreme conditions, proper selection of technical standards 

for design and construction, and rigorous process controls from early material and component selection through final assembly and checkout operations. Mission objectives and performance requirements may need to be reevaluated to reduce the risk for human spaceflight missions. The balance between system performance and crew safety would be weighed among Engineering, Safety and Mission Assurance, and Crew Health and Medical technical authorities. The outcome of the design will be a balance between maximizing mission objectives while minimizing risk to the flight crew.

2) Human-rating includes the incorporation of design features and capabilities that accommodate human interaction with the system to 

enhance overall safety and mission success. This tenet includes all the 

aspects of flight crew performance necessary for the crew to successfully 

carry out their mission, without imposing undo risk to the flight crew. Crew 

situational awareness, crew commanding, cockpit display design and spacecraft environmental factors all are critical factors that affect a crewmember’s 

performance. For example, proper layout of controls, adequate crew cabin 

temperature and humidity, and proper mission workload planning all factor 

into the crewmember’s ability to safety operate the system and increase the 

likelihood of mission success. The same rigor and balance in design trades 

utilized in tenet one is applied also in tenet two to arrive at the best working 

environment for the crew that maximizes the probability of mission success, 

while minimizing the risk to the flight crew.

3) Human-rating includes the incorporation of design features and capabilities to enable safe recovery of the crew from hazardous situations. Launch of a crew has significant inherent risks, so even with all the 

care that goes into system design and development, the system must be designed to accommodate failure. Sometimes failure can be dealt with by designing redundant systems that would allow mission continuation. In some 

cases, however, mission continuation is no longer possible and steps must be 

taken to safely return the crew—an event that is usually referred to as a 

mission abort. In the case of a launch failure, an abort could involve an 

emergency return of the crew. The Orion vehicle, for example, will have a 

launch abort system which could be used to pull the crew capsule away from 

the Ares I launch vehicle and allow the crew to immediately return to Earth 

should a catastrophic event occur. An abort also can be an operational decision to stop the mission and return the crew if, for example a system has 

degraded to a point that mission continuation exposes the crew to an increased probability of a catastrophic hazard.

The President’s FY 2011 budget request includes significant investments to spur 

the development of commercial crew and further cargo capabilities, building on the 

successful progress in the development of commercial cargo capabilities to-date. A 

key early step to enable commercial crew transport is establishing a concise set of 

NASA human rating technical requirements that would be applicable to NASA developed crew transportation systems for Low Earth Orbit (LEO) as well as commercially-developed crew transportation systems for use by NASA. NASA is investing 

Recovery Act funds to begin development of these requirements. A NASA team has 

completed an initial set of commercial crew human rating requirements documents 

and commercial human systems interface requirements document and the documents are currently in the preliminary review cycle. A Request for Information will 

be issued within the next few months to seek industry feedback on related humanrating documents. In addition to the human rating requirements, NASA is developing an insight/oversight model that will contribute to the safe flight and safe re-
119

turn of NASA crew members on commercial space vehicles. NASA’s years of experience and lessons learned with respect to human rating of space systems will help 

shape future systems to be developed in as safe a manner as possible.

Questions submitted by Representative Pete Olson

Q1. Although the Ares I–X test flight was not an exact replica of the Ares 1, it involved a significant effort by the launch team to modify the facilities and develop 

the launch processing requirements and procedures to perform a successful test 

flight. In addition, Ares I–X was instrumented with over 700 sensors relaying 

information about the flight. To what extent do test flights improve safety and 

reliability by reducing overall risk? If adequate funding were available would 

more test flights allow you to accelerate the development and achieve an earlier 

crewed flight to shorten the gap?

A1. In general, a comprehensive flight test program is essential to understanding 

the integrated vehicle systems in the actual flight environment. Flight test provides 

engineers with the confidence in and understanding of the flight systems. Flight 

tests can and will reveal many of the ‘‘unknown unknowns’’ which remain hidden 

in analysis and subsystem (not integrated) testing, thus allowing engineers to solve 

problems before committing high-value payloads or crews to flight. Flight tests also 

enable engineers to better calibrate models so that they are more accurate in predicting worst case loads on the vehicle, responses of the vehicle’s structure, and 

other parameters that ultimately affect final designs for safety,. Furthermore, flight 

tests enable retirement of risks that cannot be fully mitigated through ground testing only. Demonstrating factors such as vehicle controllability, abort effectiveness, 

and re-entry and landing performance under integrated real-world conditions must 

occur before crewed flight. Flight tests prove these and other critical systems are 

therefore essential to attaining an acceptable risk posture for crewed flight. 

Even flight tests of vehicles that are not identical to the final operational configuration still provide valuable data, though for obvious reasons, the closer the test article can be to final configuration, the more useful the test results. For example, 

NASA’s Ares I–X test flight afforded NASA the opportunity to collect data that 

would be used to refine computational models and subscale test techniques that 

would be used by Ares I, thus allowing reduction of conservatism incorporated into 

initial models. Other test events, such as the recent firing of an Ares first stage development motor, designated ‘‘DM–1’’, and subsequent static test firings, also contribute to analytical model validation and refinement. Such tests provide additional 

real data to anchor analytical models used to predict vehicle physics, such as thrust 

oscillations, specific to Ares I. While additional test flights for the program of record 

could help achieve additional risk reduction, NASA will ensure that all future cargo 

and crew systems adequately test all flight systems prior to operational use. 

In terms of the Constellation Program, the addition of more test flights would not 

allow NASA to achieve an accelerated first crewed flight. Acceleration is not merely 

a funding matter; the potential for acceleration is also influenced by hardware development and system testing schedules, and NASA has reached the point where 

the development schedule for most systems could not be accelerated due to testing 

needs and limits on the ability to further accelerate procurements. The ‘‘long pole’’ 

in getting to human flight is completing the system qualification testing, and the 

associated procurements, fabrication, and assembly for the qualification vehicle and 

hardware. To be clear, flight testing is different than qualification testing. Qualification testing exercises hardware through the full range of conditions it might experience (such as maximum and minimum operating temperatures). Flight tests, on the 

other hand, validate integrated real-world performance at a single set of conditions. 

Additional flight testing would not accelerate the Constellation Program’s development schedule asgiven the long pole lies with qualification testing.

Q2. Moving NASA beyond low Earth orbit will require a heavy lift launch vehicle. 

Ares 1 is developing many of the components needed for the heavy lift vehicle 

such as 5 segment solids, and the J–2X engines. Please comment on the role Ares 

1 plays as a risk reduction program for the ultimate heavy lift launcher?

A2. Although the President’s FY 2011 budget request does not include the Ares vehicles, the budget request includes three new robust research and development programs that will enable a renewed and reinvigorated effort for future crewed missions beyond LEO. One of the three programs is a Heavy Lift and Propulsion Technology Program, for which $559M is requested in FY 2011 and a total of $3.1B, is 

requested over five years. This aggressive R&D program will focus on the development of new engines and propellants, advanced engine materials and combustion 
120

processes that would increase our heavy-lift and other space propulsion capabilities 

and significantly lower operations costs, with the clear goal of taking us farther and 

faster into space. 

The specific risk reduction achieved by the Ares I work will depend on the architecture chosen for a new heavy lift vehicle. However, the lessons learned from Ares 

I will serve to inform those decisions. With regard to the current program of record, 

NASA’s Constellation architecture was designed to have two lift vehicles—the Ares 

I Crew Launch Vehicle and the Ares V Cargo Launch Vehicle (heavy-lift vehicle). 

The Ares I launch vehicle enabled early design and test of critical elements and subsystems that would be required by the later Ares V heavy-lift vehicle. Such common 

elements include the J–2X Upper Stage engine, solid rocket motor, avionics and 

software and other systems. 

The Ares I vehicle took Ares V needs into consideration during development of 

the J–2X engine. The J–2X was planned to function as the Ares V Earth Departure 

Stage engine with only minor modifications to the Ares I engine. These modifications would be implemented via engine modification kits. Likewise, reductions were 

made to the Ares I/V solid rocket motor risks such as motor and nozzle design, materials selection and testing, recovery system (parachutes) testing and operations, 

and motor manufacturing. 

Lastly, designing the Ares I allowed NASA to make an important technology leap 

in the design process. By transitioning from a 2-D, paper-based vehicle design and 

verification process to a 3-D model-based design environment, NASA was able to 

gain valuable experience with a new design system that can reduce costs while also 

increasing system reliability. 

The Program is working to capture all of the knowledge learned from development 

efforts, including test flights. The Program has spent significant time recently focusing on its Preliminary Design Review (PDR) elements of which concluded in March. 

NASA believes that completing the Constellation PDR will support not only the 

close-out process for Constellation, but also will ensure that historical data from 

Constellation work is documented, preserved and made accessible to future designers of other next-generation U.S. human spaceflight systems.

Questions submitted by Representative Dana Rohrabacher

Q1. In the Launch Services Program NASA has generally required that a launcher 

demonstrate multiple successful flights before being considered for use launching 

science payloads and satellites. In some cases, up to 14 successful flights of the 

rocket were required before being used to launch a ‘‘Class A’’ satellite. By contrast, the Constellation Program is currently planning (subject to review) only 

one full-up test flight before placing astronauts aboard the Orion/Ares I. I understand that these two parts of NASA—manned and unmanned—have different 

requirements and operate with different rules, but in both cases the overall mission success is a primary objective. Can you please explain how these two systems of evaluating launch vehicles have evolved so differently, what are the similarities, and in the above example how NASA’s Constellation program can comfortably accept a plan that demands 92 percent fewer test flights than what was 

required for a satellite program?

A1. The most important factor in determining when it is appropriate to fly crewmembers on a new test vehicle is the level of confidence the team has in safely conducting the test. In the case where NASA validates the technical requirements, designs and manufactures the flight and ground systems, writes the launch commit 

criteria and flight rules, performs all number of ground tests and engineering analyses, and conducts the reliability, safety and risk analyses, it has arguably maximized its understanding of and associated confidence in the system. Based on this, 

the team decides when to conduct its first crewed flight test. As the distance between NASA and the design, development, manufacturing, and operations increases, 

so does the Agency’s reliance on demonstrated reliability, and/or other government 

certifications (i.e. Russia’s ROSCOSMOS or the U.S.’s Federal Aviation Administration). NASA has not come to a final determination on the number of test flights that 

would be required prior to sending NASA astronauts into space using the crew 

launch vehicle under the Program of Record. 

Regarding the comparison with the LSP, NASA has a range of options available 

depending on the launch system’s proven reliability, the value of the payload, and 

the certification status of the provider. In some cases, this program has little insight 

into, or oversight of, the commercial launch providers. In those cases, NASA requires a demonstration of 14 successful launches for certification of the launch vehicle for high value payloads. This certification option, which is rarely chosen, is 
121

predicated on an assumption of no prior knowledge about launch vehicle performance, and limited government oversight into the design and operation. Another option is to fly the NASA payload on a relatively new system with as few as three 

flights (two successes in a row), but with substantial NASA process requirements 

and insight into the contractor’s design, engineering and operations processes. For 

lower value payloads with a higher risk tolerance, another certification category is 

available. It only requires one successful flight of the launch vehicle and a significant technical assessment. 

NASA’s ongoing human spaceflight program has established a host of safety and 

mission assurance activities including (subsystem) tests, verifications, and analyses, 

which would establish a level of confidence in the vehicle’s performance prior to the 

full-system test launches. Decisions regarding the needed number of full-system test 

launches should account for these assurance activities.
122

ANSWERS TO POST-HEARING QUESTIONS

Responses by Mr. John C. Marshall, Council Member, Aerospace Safety Advisory 

Panel, National Aeronautics and Space Administration

Questions submitted by Chairwoman Gabrielle Giffords

Q1. As you know, the Augustine Committee projected that commercial crew transportation could be available by 2016. It does not appear that this projection reflected the time needed for all of the milestones that must be met prior to the 

point at which NASA would be able to use such services to fly its astronauts 

to the ISS such as the time needed to get Congressional authorization and appropriation of funds; agreement on human-rating and other safety standards 

and means for verifying compliance; development of a regime for certification; 

and contract competition, negotiation and award of contract (S), and potential 

protest(s) by losing bidders. These are no small tasks, and it is not obvious that 

any of them could be skipped if the government is to make use of those services.

a. In your opinion, what are currently the largest technical challenges or hurdles 

that potential commercial crew transportation providers are facing that might 

cause delays to their projected initial operating dates?

A1, 1a. The milestones that you mention are all important. The process for enabling 

the current commercial cargo providers to provide crew transportation has not yet 

been initiated to any significant extent. Although there has been considerable discussion about this topic by some manufacturers’ leaders, and most recently by the 

Augustine Committee, the ‘‘COTS–D’’ portion in the current agreements still remains a potential add on to the commercial cargo delivery demonstration projects. 

Thus, the ‘‘projected initial operating dates’’ that might be achieved with the current 

designs are unclear. This said, the two NASA contractors currently in the program 

have stated that their designs could be adapted to human transport. However, they 

have made these statements without having the detailed requirements for the necessary safety certifications. This is because NASA has neither developed those requirements nor provided them to the contractors. 

Clearly, the single most important technical challenge to commercial crew transportation that remains is developing the standards by which the suitability for 

human transport will be judged. Likewise, the process and authority for validating 

that those standards have been met—initially in the capability of the design and 

then through the construction and maintenance of the vehicle for its entire life 

cycle—also must be developed. Without firm performance criteria and the definition 

of the certification process for these criteria, the contractors’ abilities to meet any 

initial operating dates for the current designs remains speculative. 

Key hurdles to achieving certifiable crew transportation capability include:

1. Clear technical criteria for the vehicle’s design performance and capability 

must be established and provided to all entities wishing to vie for providing 

the service.

2. The process for overseeing the design’s development and validation must be 

created.

3. The technical details for the necessary data submissions, design reviews, 

analysis, testing, and validation of results must be established and instituted 

via contract with the manufacturers.

4. The process and authority for overseeing that the necessary safety is maintained through proper maintenance and support throughout the vehicle’s life 

cycle must be developed, approved, and instituted.

b. How confident can the Congress be that a commercial crew capability can be 

operational in 2016 while still having to carry out all of the activities that 

need to be completed before the first NASA astronaut can safely ride on an 

operational vehicle to the International Space Station?

A1, 1b. NASA recently has begun to develop definitive standards for assessing design capability for crew transport. The criteria for safely docking vehicles with the 

ISS is already published and has been provided to the current commercial cargo 

contractors; however, it must be clear that this is only for protection of the ISS and 

does not provide any safety considerations for either humans or cargo inside the vehicle. If things move steadily and the Agency receives funding to contract for necessary activities, six years seems an adequate period to accomplish this objective. 

However, any effort to assess the feasibility of the 2016 operational start date for 

current designs would be premature since assessments of the current design devel-
123

opments against the criteria have not taken place. This is principally because the 

criteria necessary for that assessment are not yet fully determined. As a reference 

point, it took 10 years from program initiation to first flight for the space shuttle, 

and 10 years to reach the Moon with Apollo. Therefore six years duration, since we 

are building on the foundation of the existing cargo programs, seems like a reasonable time period. 

However, there are many variables that can have a profound effect on the duration, three of which are particularly noteworthy. First, these vehicles and their 

launch systems have to demonstrate that they are capable of reaching LEO and 

safely delivering cargo to ISS. Obviously, success in this endeavor would be a large 

risk mitigator for extending the use of these vehicles to human transport. Second, 

the current designs have to be assessed against the previously described criteria, 

which will in no doubt drive needed design changes or additions. These modifications must be within the vehicle’s design concept, i.e., technically feasible to incorporate into the design without causing the approach to be altered fundamentally. 

Third, these changes will have to be described in contractual documents and placed 

in an RFP. That RFP will result in a priced proposal that must be negotiated and 

funded. It has to be presumed that the funding needed to incorporate these changes/

modifications/certifications will be provided.

Q2. You make it clear in your prepared statement that the ASAP Panel recommends 

that NASA be ‘‘hands-on’’ in its approach. Why do you think NASA needs to be 

‘‘hands-on’’ in its involvement?

A2. Without direct involvement in planning, design, testing, and validating the design, NASA cannot state with assurance that the necessary safety level has been 

achieved. NASA must stay engaged in the entire process to ensure the level of safety is achieved.

Q3. ‘‘In your written testimony, you state that it is the ASAP position that ‘‘NASA 

is best qualified to be the oversight body for each of these actions (demonstration, verification, and certification prior to NASA’s use for crew transport) as today only NASA has the competence in hand to effectively audit the complex 

technical work required.’’ Can you elaborate on why the ASAP believes that?’’

A3. While NASA currently has no explicit safety requirements for crewed COTS 

systems and will have to tailor the existing processes significantly, it is the only 

agency in the US Government that has a knowledge base for the complex tasks necessary to determine whether a given space vehicle is safe enough to carry US astronauts. This knowledge base includes the myriad technical standards that hard won 

experience has shown to be essential to ensure inherent safety for the hardware. 

It also includes the test and evaluation capabilities and human rating process capabilities (noted previously) that validate proposed designs as safe for these astronauts. Please note that mission safety approval for NASA crew member transport 

to LEO, ISS docking and return is not the same as safety approval for private 

launches, for which the FAA is, and should remain, responsible.

Q4. In the ASAP’s 2008 Annual Report, the panel notes that ‘‘NASA has an important one-time opportunity to better interweave safety as a consistent and more 

powerful operating parameter by hardwiring safety into the fabric and procedures of the new flagship exploration program, Constellation.’’

How would NASA infuse a similar strong safety culture into the agency if NASA 

were to purchase crew services from a commercial provider in lieu of developing 

the Constellation launch system?

A4. In our 2008 Annual Report regarding Constellation safety opportunities, the 

ASAP wrote: NASA should institutionalize safety programs, systems, processes, and 

reporting procedures including:

• Robust, well-publicized safety programs that mirror industry best practices, 

including using current world-class systems and incentives as models

• A safety management system that tracks accidents, mishaps, close calls, audit 

results, lessons learned, and data trends for these and other leading indicators

• Consistent methodologies to identify hazards and to manage, articulate, and 

reduce risks

• Defined, timely process for investigating, analyzing, and reporting on accidents

• More rapid and thorough determination of root causes

• Standardized accident report format, timeline, database, and metrics
124

• Timely, possibly Web-based distribution of lessons learned to prevent mishap 

recurrences

Most of this still applies with little or no modification. However, the structure 

NASA will use to gain the insight and / or oversight to implement a safety program 

for commercial providers remains to be determined. Certainly, the U.S. Department 

of Defense (DoD) and the aerospace industry have learned how to work together to 

benefit safety when DoD engages in contracts with private industry for both weapon 

systems and critical services. Perhaps the DoD approach offers a good model. 

In the ASAP’s opinion, a sufficient safety program cannot be established in a 

‘‘hands-off’ contractual relationship.

Questions submitted by Representative Pete Olson

Q1. Since a significant portion of launch failures are due to human error it is critical to have a strong safety culture. The Columbia Accident Investigation Board 

reiterated again the importance of a strong safety culture. Would a shift to commercially provided low-Earth orbit launch vehicles disrupt that culture at 

NASA? Could that be cause for concern?

A1. The ASAP believes that a good safety culture is advisable for any organization, 

regardless of its work, and ideally is present due to ethical leadership, good systems, 

and the correct ‘‘tone at the top.’’ The ASAP continues to assess NASA’s safety culture, and while progress has been made since the CAIB report, our reports contain 

additional recommendations relative to safety culture. It is difficult and rare for an 

organization to achieve a ‘‘perfect’’ safety culture, and it is even more difficult to 

maintain one over time. 

In this regard, NASA will need to ensure that any organization that may provide 

a crewed vehicle in the future actually will value a strong safety culture. Role modeling and ensuring a strong safety culture among NASA’s contractors and potential 

partners will remain a difficult, yet doable, leadership task. Establishing a good 

safety culture in one’s own organization is hard work. Fostering it within another 

organization, where one does not have complete control, is even more difficult. 

NASA has experience working with many contractors and has been vigilant in establishing good safety partnerships with them. It is the Panel’s expectation that the 

current emphasis on contractor safety would continue if firms were contracted for 

Low Earth Orbit (LEO) launches, and that NASA would continue to work to improve its own safety culture and the safety culture of those firms.

Questions submitted by Representative Dana Rohrabacher

Q1. What does the Aerospace Safety Advisory Panel believe are the most important 

steps to enable NASA to seriously consider, evaluate, and possibly implement a 

commercial crew competition?

A1. On numerous occasions, the ASAP has addressed the urgent need for establishing the human rating requirements, airworthiness criteria, and certification requirements for a possible commercially developed vehicle that may be used to transport NASA crew. It is essential that these requirements be considered and, as appropriate, incorporated into the on-going design phase as early as possible. However, 

the scope of this question extends beyond the preparedness activities that are needed to ensure that an acceptable level of safety is achieved. To a large extent, it is 

equally important to ensure that the program’s budgeting and planning process is 

initiated quickly. With this in mind, the ASAP notes the following serious challenges that will need to be met to successfully implement a commercial crew competition and offers the following observations:

A. NASA has not yet committed to developing a commercial crew transportation capability. If NASA elects to proceed in that direction, a strong message needs to be communicated publicly that commercial crew transportation 

is a priority NASA mission and the mission’s requirements and objectives 

must be clearly stated. NASA should take steps to ensure that the impending Administration’s decision for Exploration (based on the review of the 

Augustine’s human spaceflight study) re-affirms the need for NASA to assist 

in developing a commercial crew transport capability.

B. It is not yet known which organization within NASA would assume responsibility for developing and implementing this program. Therefore, NASA will 

need to identify the Program Manager and provide adequate resources to ad-
125

dress the performance, technical, schedule, and cost requirements and analyses in formulating the overall program plan.

C. NASA has not developed a program, acquisition strategy, budget, or initiated 

the legislative process necessary to obtain authorization for a COTS–D vehicle. Currently, NASA only has an option to exercise a COTS–D (crew transport) program under the Commercial Cargo and Crew Transportation Program. Space X currently has an unfunded Space Act Agreement option to 

demonstrate a COTS–D program. While NASA may also conduct a new competition for one or more crew demonstration partners, plans for implementing these options cannot go forward without authorized funding.

D. NASA needs to determine to what extent and how it will be involved in the 

commercial providers’ processes and activities for defining the appropriate 

oversight and insight to ensure astronaut safety so that potential commercial partners can be informed.

E. NASA needs to determine to what extent it may provide enabling technologies and capabilities, including actual hardware or designs (such as that 

for the Orion), so that potential commercial partners can be informed.

Q2. During the Q&A period, you mentioned that the ASAP had visited with Orbital 

Sciences regarding their COTS development program, and stated that they did 

not see any existing commercial market for cargo (and potentially crew) delivery 

to ISS. Did you ask the same questions(s) of SpaceX, and what was their response?

A2. The original question by Chairwoman Giffords was ‘‘. . . do our witnesses believe that would-be commercial crew transport service providers be able to garner 

sufficient revenues from non-NASA passenger transport services to remain viable 

over this time period as well?’’ My response to this question where I noted that we 

asked Orbital Science if they had done a market analysis to find other revenue 

sources was directly to the issue of crew transport services, not commercial cargo 

markets. This said, SpaceX management was not asked this question. Neither did 

they indicate whether alternative markets have been identified for their vehicle.
126

ANSWERS TO POST-HEARING QUESTIONS

Responses by Mr. Bretton Alexander, President, Commercial Spaceflight Federation

Questions submitted by Chairwoman Gabrielle Giffords

Q1. What is the industry’s understanding of NASA’s human-rating and safety requirements, both technical and operational? Is there an expectation by the industry that finalized requirements will be developed in conjunction with NASA?

A1. The Aerospace Safety Advisory Panel correctly points out that NASA has not 

yet developed standards and processes for human-rating commercial vehicles. Until 

such time as commercial human-rating standards are determined, industry continues to develop vehicle hardware based on the only standards available: those 

NASA established for its own vehicles, known as NPR (NASA Procedural Requirement) 8705.2B, effective May 06, 2008. 

Early dialogue between NASA and the commercial spaceflight sector on the nature of human-rating requirements for commercial systems is crucial, with demonstrated reliability, robust test flights, and a reliable crew escape system being 

key. To work with NASA and the FAA, US. industry has established a Commercial 

Orbital Human Spaceflight Safety Working Group, under the leadership of the Commercial Spaceflight Federation. The goal of the effort is to develop industry consensus on principles for safety of commercial orbital human spaceflight. Consensus 

has been reached among a number of companies on fundamental principles that will 

form the basis for our engagement with the FAA and NASA, but much more work 

remains to be done.

Q2. During the hearing, Mr. Marshall said that some entities might not agree to a 

‘‘hands-on’’ NASA role. Have federation members discussed what activities and 

level of scrutiny by a federal entity would amount to a ‘‘hands-on’’ relationship 

with which they could not agree? Can you provide examples of the types of activities and level of scrutiny that would create an unacceptable ‘‘hands-on’’ relationship? What level of NASA involvement would be acceptable?

A2. The commercial spaceflight industry believes strongly in the importance of a 

close relationship with NASA. The level of oversight and insight shared between 

NASA and FAA is a critical topic that is being addressed by, among other bodies, 

the Commercial Orbital Human Spaceflight Safety Working Group. Since NASA, 

FAA, and commercial spaceflight providers are just beginning their dialogue, it is 

not yet possible to state whether any specific requirement will be a subject of dialogue or discussion between the stakeholders. 

As NASA Administrator Charles Bolden stated February 1: ‘‘Now, as 50 years ago 

when we upgraded existing rockets for the Gemini program, NASA will set standards and processes to ensure that these commercially built and operated crew vehicles are safe. No one cares about safety more than I. I flew on the space shuttle 

four times. I lost friends in the two space shuttle tragedies. So I give you my word 

these vehicles will be safe.’’ The commercial spaceflight industry will work closely 

with Administrator Bolden and others to make sure that this objective is realized.

Q3. Your prepared statement does not directly address how experience in reentry and 

landing will be obtained by potential commercial providers. By what means and 

in what timeframe will the commercial space transportation industry secure 

such experience?

A3. Reentry and landing is a critical portion of human spaceflight that is essential 

to safety. It is our expectation that commercial providers will not place astronauts 

on an untested capsule, but rather these systems will have gained flight experience 

with reentry and landing before commencing manned flights with NASA astronauts 

aboard. In addition to full orbital flight tests, commercial providers may also conduct suborbital tests, either as part of a subscale test launch or as a test of the 

launch abort system, which will therefore provide additional experience with the reentry and landing phases of the mission profile. As no provider agreements for a 

full Commercial Crew program have yet been signed, the exact timeframe is yet to 

be determined on a per-company basis. Further, US. aerospace companies have been 

a part of every US. human spaceflight since the program began and have substantial technical expertise in reentry and landing systems and environments.

Q4. In your prepared statement, you state that in addition to FAA’s existing regulatory authority as codified in U.S. law, industry will satisfy customer-specific 

requirements levied by NASA in partnership with industry. With regards to your 
127

reference to existing FAA authority, are you proposing that NASA astronauts fly 

under ‘‘informed consent’’, which is the existing regulatory framework?

A4. The Federal Aviation Authority’s Office of Commercial Space Transportation 

currently levies different requirements for different categories of individuals, which 

include ‘‘crew’’ and ‘‘space flight participants.’’ The exact nature of the regulatory 

framework that would apply to NASA astronauts will require dialogue between 

NASA, the FAA, and the commercial space industry. Through the Commercial Orbital Human Spaceflight Safety Working Group, industry stands ready to engage in 

this dialogue and determine the best path forward. However, it is vitally important 

for the viability of future commercial human spaceflight providers that launches be 

conducted under the same legal and regulatory framework, regardless of whether 

the customer is the U.S. government or a private entity.

Questions submitted by Representative Marcia L. Fudge

Q1. The discussion of safety requirements for crew and passengers on commercial 

transportation systems has, up to now, primarily focused on suborbital flights. 

Has the commercial space transportation industry identified any additional 

safety-related R&D requirements to enable future orbital flights by commercial 

crewed transportation systems?

A1. As compared to suborbital flights, orbital flights have more demanding engineering requirements in specific areas, such as: higher heat loads on re-entry, more 

powerful and longer engine firings, additional risk due to micrometeroid impact, 

more involved communications downlink to Earth, additional attitude control requirements, more complex abort scenarios, etc. Since the commercial crew program 

could be seen as commercializing accomplishments similar to those of the 1960s 

Gemini program, none of these problems require new technology to solve, but they 

would all benefit from additional R&D to improve capability, reduce risk, and reduce costs.

Q2. Are there any R&D efforts currently underway at NASA’s Glenn Research Center 

that would have applicability to potential commercial human space transportation systems? Does the commercial space transportation industry have suggestions on how NASA’s Center R&D programs could contribute to enhancing the 

safety of potential commercial human space transportation systems?

A2. Yes, there are multiple R&D efforts currently underway at Glenn Research 

Center that would be useful for commercial human space transportation providers. 

Facilities such as the Plum Brook Station (PBS), which has significant capability 

for full-scale upper-stage engine testing under simulated high-altitude conditions, 

would be useful to commercial providers. Plum Brook has the Space Power Facility 

as well as a hypersonic wind tunnel and cryogenic test facilities. Research in the 

fields of combustion, reacting flow systems, fluids, and materials testing of structures for atmospheric and vacuum/space environments are some of the areas of interest to the industry. Other R&D efforts underway at Glenn’s Zero Gravity Drop 

Tower and the Spacecraft Propulsion Research Facility will also help enable future 

innovation for commercial space launch providers. Some ways in which NASA’s Center R&D programs could contribute to commercial spaceflight safety is through easier access to government test facilities, as well as enhanced interchange of technical 

information from NASA.

Q3. If NASA were to use commercial transportation systems to fly its astronauts to 

the International Space Station, would the commercial space transportation industry envision these astronauts being passengers or crew members? What sort 

of training would the industry envision as needed for these astronaut passengers? If spacecraft are piloted by provider crew members, how would their 

training differ from that received by NASA’s astronaut passengers?

A3. The exact regulatory framework that would apply to NASA astronauts will require dialogue between NASA, the FAA, and the commercial space industry. 

Through the Commercial Orbital Human Spaceflight Safety Working Group, industry stands ready to engage in this dialogue and determine the best path forward 

for the FAA, NASA, and commercial industry.

Questions submitted by Representative Pete Olson

Q1. In preparation for commercial attempts to deliver cargo to the International 

Space Station, the COTS providers have been working closely with NASA to 
128

evaluate whether they can comply with NASA’s Visiting Vehicle requirements 

that govern proximity operations around the ISS. Is there anything preventing 

NASA from working with potential commercial providers, whether COTS companies or United Launch Alliance, to establish the safety requirements processes 

and identify the modifications that would be required for those vehicles to meet 

NASA’s human-rating requirements?

A1. We do not believe at this time that there are any obstacles to cooperation between NASA and commercial companies in the development of safety requirements 

processes and identification of needed modifications to vehicles. The Aerospace Safety Advisory Panel recently stated that NASA should ‘‘accelerate the level of effort 

underway’’ to develop these commercial requirements. The commercial spaceflight 

industry is ready to work with NASA on these critical issues, and in fact has already begun engaging with NASA through the Commercial Orbital Human 

Spaceflight Safety Working Group. While the Commercial Spaceflight Federation 

has taken the lead in organizing the effort, the working group includes representatives from a broader spectrum of companies, including several of the major aerospace primes and more traditional government space contractors. The goal of the effort is to develop industry consensus on principles for safety of commercial orbital 

human spaceflight. So far, we have met among industry and have begun to engage 

NASA and the FAA.

Q2. Recently there seems to be a great deal of interest among the potential commercial space providers to enlist the government as the primary buyer of space systems. Presumably, this is because the government is currently the only known 

market for these services, although the industry is hopeful that non-governmental buyers will emerge. If no outside commercial market materializes, as was 

the case with early claims that a backlog of commercial satellites would help to 

reduce the cost of the development and operations of EELVs, wouldn’t the governments’ costs ultimately be higher since it would eventually have to pay for 

all the development and operational costs?

A2. The Augustine Committee stated the following findings in its final report:

‘‘During its fact-finding process, the Committee received proprietary information 

from five different companies interested in the provision of commercial crew 

transportation services to low-Earth orbit. These included large and small companies, some of which have previously developed crew systems for NASA. The 

Committee also received input from prospective customers stating that there is 

a market for commercial crew transportation to low-Earth orbit for non-NASA 

purposes if the price is low enough and safety robust enough, and from prospective providers stating that it is technically possible to provide a commercially 

viable price on a marginal cost basis, given a developed system.

None of the input suggested that at the price obtainable for a capsule-plus expendable-launch vehicle system, the market was sufficient to provide a return 

on the investment of the initial capsule development. In other words, if a capsule is developed that meets commercial needs, there will be customers to share 

operating costs with NASA, but unless NASA creates significant incentives for 

the development of the capsule, the service is unlikely to be developed on a 

purely commercial basis.’’

That is, the Augustine Committee found that non-NASA customers for commercial 

crew services did exist, but not in sufficient quantity for the business cases of private companies to close if they had to fund the development entirely on their own. 

On the other hand, if private industry and NASA share the development costs, then 

all parties will benefit. In particular, one additional market has been proven on a 

small scale, which is private citizens paying to travel to space. Over $150 million 

has been already paid by seven private citizens to travel on a Russia Soyuz to the 

International Space Station, at a steady rate of about one mission a year. In fact, 

the demand for this service has continued to increase despite an almost doubling 

of price from under $20 million per seat to now over $35 million per seat. Furthermore, when Commercial Crew taxi services begin in the United States, demand will 

rise because would-be travelers, who are often business leaders running companies, 

will no longer have to spend six months training in Russia with limited contact with 

the outside world. Since American services will not require overseas training of that 

duration, will not require learning the Russian language, and will likely undercut 

the Russians in per-seat cost, the market is likely to increase for private space travelers. 

Other, not yet proven, markets for additional flights of the capsules include: (a) 

sovereign clients, in which other countries purchase seats on American vehicles 
129

rather than the Russian Soyuz, and (b) industrial clients: since as Commercial Crew 

reduces the cost and increases the frequency of access to space, there could be increased interest in on-orbit industrial applications. 

When considering the potential of other markets, it is important to note that all 

Commercial Crew providers will use launch vehicles that already exist, such as the 

Atlas V, or in the late stages of development, such as the Taurus II and Falcon 9, 

and all of these vehicles will launch satellites and cargo before putting astronauts 

on board. Accordingly, it is already the case that a proven commercial market exists 

for at least the launch vehicle portion of each rocket-and-capsule system. Spreading 

the costs of a commercial system between the cargo, satellite, and crew markets will 

reduce the burden for each customer (NASA, DoD, and commercial customers).

Q3. Given that the emerging commercial providers appear to believe strongly in an 

evolutionary approach to design and safety innovation to be achieved through 

flight experience gained from revenue flights undertaken without any prior safety certification regime, wouldn’t premature reliance on the government as the 

dominate or only customer inhibit the ability of the emerging commercial providers to sustain the innovation they believe is essential to their long-term commercial success?

A3. As the Augustine Committee stated the following findings in its final report: 

‘‘unless NASA creates significant incentives for the development of the capsule, the 

service is unlikely to be developed on a purely commercial basis.’’ With NASA as 

a significant early customer, commercial industry will still be able to more rapidly 

incorporate innovations and technology upgrades than under a government program 

designed to for a 20-to-30 year operating lifetime.

Q4. What do potential commercial crew transportation services providers consider to 

be an acceptable safety standard to conform to if their space transportation systems were to be chosen by NASA to carry its astronauts to low Earth orbit and 

the ISS? Would the same safety standard be used for non-NASA commercial 

human transportation missions?

A4. Safety is paramount for the commercial spaceflight providers. Indeed, commercial vehicles such as Atlas V and Delta IV, developed with substantial private funding and engineering expertise, are already trusted to launch key government national security assets upon which the lives of our troops overseas depend. Since 

probabilistic risk assessment calculations account for part failure, and do not account for most of the root causes of accidents historically, such as human error or 

design flaws, and since even reliable vehicles have historically suffered a period of 

‘‘infant mortality,’’ the commercial spaceflight industry believes that they will in fact 

achieve higher safety than that of government systems that intend to put human 

beings aboard on early orbital flights of the system. Commercial industry believes 

safety must include the following:

• Demonstrated reliability through multiple orbital unmanned flights of the full 

system

• Not placing crews on initial flights, since early flights are historically most 

risky

• A highly reliable crew escape system

• Standards-driven design and operations

Industry believes that the safety of commercial spaceflight must be significantly 

greater than that of the space shuttle in order to be successful. In addition to the 

FAA’s existing regulatory authority, as codified in U.S. law, industry will satisfy 

customer-specific requirements levied by NASA in partnership with industry. This 

process has already begun with the cooperation of the stakeholders involved. NASA 

and FAA will be there every step of the way, and will have oversight during design, 

testing, manufacturing, and operations.
130

ANSWERS TO POST-HEARING QUESTIONS

Responses by Dr. Joseph Fragola, Vice President, Valador, Inc.

Questions submitted by Chairwoman Gabrielle Giffords

Q1. The Augustine Committee’s report cited five basic questions that could for the 

basis of a plan for the U.S. space flight program, but ‘‘how could crew safety 

be dramatically improved’’ was not one of them. Should it have been? And if 

so how would it have informed their deliberations?

A1. It is my opinion that the question of how could crew safety be dramatically improved should have not only been one of the five basic questions for the basis of 

a plan of the U. S. space flight program, but that it should have been the primary 

question. In fact it is difficult for me to understand how a committee could, on the 

one hand state that crew safety was the sine qua non of their work, and yet not 

include crew safety as a primary question. I believe if they had included it as a primary question they would have understood better how deliberately during ESAS, 

and subsequent to ESAS in the development of the Ares I vehicle design the thrust 

of all decision making was toward the development of a dramatically safer crew 

launcher than heritage systems such as the Space Shuttle or commercially available 

systems, such as Atlas or Delta.

Q2. Reliability and safety seem to be used interchangeably by some when discussing 

crew safety. Are they really the same thing, and if not what is the distinction? 

How important a distinction is it?

A2. There is a lot of confusion in the meaning of the term safety. The definition 

varies and to some, particularly those in the systems safety community, safety includes any significant loss. Those in the risk assessment community include only 

losses of life. However neither community would accept the fact that the terms reliability and safety are interchangeable when it comes to loss of life. The important 

issue to recall as it relates to launch vehicles is that reliability is indistinguishable 

from safety for unmanned spacecraft payloads, but the two are crucially different 

for manned space vehicles. This is because of the important distinction between relatively benign vs. catastrophic failure modes, and because of the existence of an 

abort system. 

These distinctions mandate that safety consider the additional probability of the 

crew surviving conditioned on a mission failure. This latter conditional probability 

depends on the severity of the initiating mission loss accident and the robustness 

of the abort system. A good example would be Apollo 13. The mission failed in such 

a severe way that not only was the Command and Service Module disabled, but all 

the services in the service module were destroyed. This implied that the abort system, the Lunar Module, had to be robust enough not only to perform the electric 

power functions of the CSM, but also to provide all the other life sustaining functions until the Command Module could be employed for re-entry. A less severe accident, say a benign engine failure of the Service Module engine, would have not required the additional risk of conversion of the CO2 extraction system for example. 

The point is that the abort system must be robust enough to address the full spectrum of post accident conditions and allow the crew to survive them. So the conditional probability of an effective abort given a LOM event is an important distinction between reliability and safety.

Q3. How does one calculate meaningful safety characteristics such as loss of crew 

for vehicles that have not yet entered the hardware phase?

A3. Crew safety can never be guaranteed even with a vehicle that has been built 

and has had a significant record of mission success. However this does not mean 

that designs that include certain features are not more likely to produce a safer design than those that are not. In particular in my testimony I provided four rules 

that I believe would enhance the safety of a new launcher:

1. Make it as inherently safe as possible. That is, make it reliable AND select 

a design with benign failure modes.

2. Separate the crew from the likely source of failure. That is, put them on top 

of the stack where ‘‘God meant them to be’’.

3. Establish credible abort triggers balancing warning time with the threat of 

false positives.

4. Include an abort system tested and verified for robustness for safe escape 

and recovery.
131

To calculate meaningful safety characteristics for vehicles that have not entered 

the hardware phase one uses historical operational data from heritage systems to 

establish a ‘‘surrogate’’ model of the new design to estimate the inherent safety, that 

is mission reliability, and the spectrum and post incident environments likely for 

credible mission loss events. A surrogate is constructed for a new launcher much 

in the same way that an opening price is established for a new initial product offering in the marketplace. That is, in the case of an IPO the analyst looks at 

comparables that are in the market, their product lines, and their associated market 

prices, and constructs a ‘‘shadow price’’, by reflecting the product line of 

comparables onto the product line of the IPO and adjusting for competitive distinctions. This shadow price becomes the opening market price. In the case of a safety 

surrogate, the analyst reviews all type comparables, in this case launchers, their 

historical heritage launch reliabilities and risk driving features, and constructs a 

‘‘shadow risk’’ reflecting these features and associated risks onto the features in the 

new launcher adjusting for differences that make a difference in the risk driving elements of the new launcher design. 

Once the surrogate is established each of the credible incident environments are 

simulated to determine the physical impact of the radiative, impulse pressure wave, 

and fragmentation environments on the crew safe abort given the stack geometry, 

launch abort system design and crew module fragilities, throughout the ascent trajectory. The combination of the geometry, post accident insult environment and the 

fragilities of the crew module forecast the overall abort effectiveness of the configuration given the inherent reliability of the launcher once deployed. 

This approach is distinguished from the more traditional launch reliability approach used in the past by its reliance on historical data, the establishment of a 

vehicle surrogate from the top down, that is on a functional not component basis, 

so as to capture the primary causes of historical failures, and the use of first principles physics codes to establish the post accident environments and the corresponding abort effectiveness. 

It is believed that employing such an approach provides estimates of loss of crew 

probabilities, within reasonable uncertainty bounds, so as to allow for discrimination 

of the crew safety potential among proposed designs.

Q4. What are the key determinants in designing an effective abort and escape system? What compromises should be avoided?

A4. The most important determinants in designing an abort system are the balancing of escape acceleration and acceptable g load on the crew so as to provide for 

maximum separation distance from the approaching hazards without endangering 

the crew further during the abort and the avoidance of false positives that would 

cause aborts from an acceptable system. What should be avoided is to use the abort 

system as a crutch against unacceptable inherent safety for example, by claiming 

indefensibly high levels of abort effectiveness.

Q5. What safety considerations should guide the Congress’ evaluation of the implications of NASA relying solely on commercially provided crew transport and ISS 

crew rescue services?

A5. As was mentioned, even a significant record of mission success is not enough 

to ensure safety at dramatically higher levels than those currently provided by the 

shuttle. Congress should require that NASA become involved in a wholesale evaluation of the design features of each proposed design including that of the crew module. and the launch abort system. This evaluation should include the heritage of 

those features in terms of their historic performance especially as it relates to the 

post incident conditions that would be imposed on the crew. Congress should require 

that NASA impose strict first principles physics based simulations to establish a 

credible estimate of the abort effectiveness to be applied to the integrated crew 

launch stack, including the launcher, the launch abort system, and the crew module. 

Congress should also require that NASA establish resident inspectors at the production facilities of all the major manufacturers of the launch, crew module, and launch 

abort system. It also should require process control and inspection during manufacturing and testing, and the identification and close out of anomalies including design and or process changes implemented and their effectiveness. Finally Congress 

should require that NASA impose a strict and challenging ground and flight test 

program for the proposed launch abort system, including a full up flight test of the 

system to ensure its robustness.

Q6. The Augustine Committee’s report mentioned that a leading objective of the 

ESAS effort was to minimize the gap between the last shuttle flight and that 
132

of the new vehicle. You were a member of the study. Were there any other major 

objectives?

A6. Yes there were. The most important major objective, and the one that I was 

most intimately involved in, was to ensure that the CAIB recommendation that the 

replacement crew launcher for the shuttle would be an order of magnitude safer 

than the shuttle. Other major objectives were to fit into the funding profile, to allow 

for payload performance objectives to be met, and to ensure that the architecture 

chosen was capable of enabling a path forward to a crewed lunar and eventually 

a crewed Mars mission.

Q7. How meaningful are the distinctions between the Loss of Crew figures for different options contained in the Exploration Systems Architecture Study (ESAS)?

A7. The ESAS, as its name implies, was directed at the selection of an architecture 

to enable exploration beyond low earth orbit. The focus was therefore on discriminating among the suggested alternative architectures, and associated elements, so 

that the most effective one would be selected to be carried forward. In this regard 

the Loss of Crew estimates made at the time of ESAS were directed at highlighting 

differences that made a difference among the alternatives. The estimates were not 

intended to represent the absolute Loss of Crew risk of any of the alternatives but 

rather to distinguish among them. In particular, estimates of the abort effectiveness 

of the various alternatives were based upon rough estimates of the post accident 

physics, and not on the more detailed first principles physics code results subsequently obtained for the Ares I vehicle as it has progressed through development.

Q8. Having been on the ESAS effort, you have a unique perspective on what would 

be needed to replicate similar analyses of alternatives your team did not consider. If NASA was to be directed to perform a similar safety analysis on another alternative, what is the rough estimate of the cost and time it would take 

to perform the physics based analysis that was done for the recommended 

launch alternatives—those that resulted in Ares I and Ares V.

A8. First I have to correct two impressions that seem to be included in the question 

that are not precisely correct. The ESAS team considered many of the alternatives 

that have been subsequently suggested including the shuttle side-mount, and the 

EELV alternatives of the Atlas V and Delta IV families, we just did not consider 

them in the detail that we subsequently did for the selected Ares I alternative. Also, 

we did not, at least at the last of my involvement, consider the detailed physics 

analysis that we had performed on Ares I on the Ares V vehicle because subsequent 

to ESAS we were not considering it as a potential crew launcher. 

The performance of a similar analysis to another alternative would depend on how 

much of the work we have done so far could be used and how readily available finite 

element models of the alternative would be. The physics work would have to be done 

on a massively parallel computational system such as the Pleiades project at the 

NASA Advanced Supercomputing (NAS) Division at Ames. This Supercomputer is 

dedicated to the Exploration program so a cost is not available. We do know that 

it took 5 million hours of equivalent CPU time for the Ares I analysis. These estimates assume the availability of a basic understanding of the aerodynamics, trajectory information of any of the alternate vehicles, which are generated as a matter 

of course in the design process by the aero analysis teams at MSFC and ARC. That 

is, this information would have to be generated in order to perform a meaningful 

evaluation of abort effectiveness. NASA JSC has already completed some exploratory work on the side-mount. If this work not sufficient additional exploratory CFD 

would have to be performed whereas existing Orion abort trajectory/aerodynamic information for Ares I could be used to arrive at a first order approximation for other 

in-line concepts. 

The calendar time estimated for the side-mount would be 6 months if extra work 

were required and 4 months for each of the other concepts. The labor costs would 

vary depending on the concept, but a rough estimate of the cost would be between 

$250–350K per concept. However the actual cost would have to be negotiated between NASA Ames and its chosen contractor and work could be done in parallel if 

multiple concepts are to be considered.

Q9. In your opinion, what would be required in practice to implement the Augustine 

Committee’s suggestion that NASA exercise a strong oversight role in assuring 

commercial vehicle safety?

A9. To a degree this question has already been answered in the answer to question 

5, but a summary of what would have to be done is mentioned here. Firstly NASA 

would have to appoint a team of people to sit down with the proposed commercial 
133

supplier and learn the launch vehicle from top to bottom. Then the team would have 

to develop an understanding of the relationship of the various systems and components implementing the various critical functions on the proposed launcher and that 

of the historical heritage of launchers. The NASA team would then have to develop 

a surrogate of the proposed launcher by relating its critical functional implementation and associated failure modes to the historical heritage data set. The former 

analysis would attempt to establish the mission reliability of the proposed launcher 

in a crew application. (Note: This would be different from the launcher mission reliability in a payload application due the integration impact of the crew module and 

support systems module and the launch abort systems and due to modifications of 

the launcher systems, such as the addition of red lines on the engines and abort 

triggers on the vehicle.) The latter would establish the post accident conditions that 

would need to be modeled using the first principles physics simulations to establish 

the abort effectiveness. 

Then, if the launcher is seen to have met the minimum conditions for consideration as a crew launcher, NASA would have to establish an on site inspection team 

at the facility of the manufacturer of all the major elements of the design. The contractor would be required to involve NASA in all the major tests performed on the 

vehicle and the associate launch abort system and crew module and its support systems module, review all anomalies and work with the contractor to close them out 

by design or manufacturing process changes. In short NASA would have to perform 

the same investigation it has had to perform on the Russian Soyuz, plus the additional manufacturing and process inspection that it has been unable to conduct on 

Soyuz in order to ensure that the launcher has been developed as an equivalent to 

a NASA developed vehicle.

Questions submitted by Representative Pete Olson

Q1. Part of NASA’s rationale for selecting a solid rocket motor for the first stage of 

the Ares 1 is that it is inherently a simpler design with few moving parts. But 

other U.S. systems using liquid propulsion have been highly reliable as well. 

Taking into account their entire lifecycle, can you comment on the overall safety 

records of solids vs. liquid rocket motors and whether this should be a factor 

in the overall architecture? If a proposed commercial crew system relies on liquid boosters, or a combination of liquid and solid, how does that affect the Loss 

of Crew calculations.

A1. There is no doubt that liquid propulsion systems, especially those that have 

been proposed prior to the Ares I, have been shown to be highly reliable. In fact 

the work performed prior to and during the ESAS study indicated that a single core 

liquid would be an equivalent approach with the Atlas V being slightly preferred 

to the Delta IV from a safety perspective. The problem was that the payload of these 

vehicles was so limited that it was considered unacceptable as a crew replacement 

for the shuttle for either the lunar or ISS mission. The only single core alternative 

that had the thrust. capable of carrying the required payload was the 2.5 million 

pound thrust shuttle solid, (now about 3.0 million pounds with the 5th segment 

added). To compete with this capability the heavy EELV alternatives versions had 

to be considered and it is the addition of the two strap-on liquid core boosters that 

made the alternatives significantly more risky than the single core solid. In addition 

to the simple multiplication of engines and propulsion systems, which have been 

shown historically to be launch vehicle risk drivers, there were the additional fuel 

load and the potential for thrust imbalance problems. In addition, for the Delta IV 

heavy, the only heavy currently in operation, has flame pit H2 burn-off problems 

at liftoff. All of these contribute to the post accident risk consequences. It is the 

combination of the increased mission risk of the triple core heavy lift launcher and 

the post accident abort environment that causes the EELV alternatives to be forecasted to have almost three times the launch risk of the Ares I as I mentioned in 

my testimony. 

So if a single core liquid booster would be able to lift the required six passenger 

Orion to the ISS, especially if it were the Atlas V, it would be a competitor to the 

Ares I, but we would have to fly at least two, and possibly three Atlas Vs to meet 

the payload requirement. Even though the Atlas V might expose the crew to an individual launch risk equal to that of the Ares I, the cumulative risk of multiple 

launches would again be significantly higher than a single Ares I launch even without considering the benign failure impact of the dominant solid booster failure 

modes. Therefore if crew safety is to be a significant discriminator among alternatives then it should be a factor in the overall architecture, and if it is the sine 

qua non as the Augustine report indicates then it should be the most critical factor. 
134

Strap-on boosters in general represent a more difficult environment for crew escape in event of a launch catastrophe because they increase the probability of involvement of greater amounts of fuel in the post accident environment. This is true 

for both liquid and solid tandem or barreled boosters. However since liquid engines 

can be monitored and shut-down and since a significant portion of a liquid booster 

risk is in benign shutdown the impact on Loss of Crew risk is not as severe as with 

solids. When solids are used as either strap-ons (either tandem or barreled) to the 

central core booster the predominant historical failure modes of the solid, case 

breach or soft-goods (as in the case of the Challenger accident) or nozzle burn 

through, interact with the liquid core if the hot gas jet impinges upon the core as 

in the case of Challenger and the Delta II and Titan 34D accidents. The probability 

of this occurring is higher with a barreled solid because of its closer proximity to 

other solids and the liquid core so the solid angle of impingement is greater. However with tandem boosters there is the additional problem of thrust imbalance. That 

is the imbalanced thrust from one side to the other of the stack can cause significant 

abnormal additional loads on the stack that can cause aerodynamic breakup even 

if the hot gas plume does not impinge on the central core. This is particularly a 

problem when the tandem solid boosters are large and represent a major portion 

of that boost thrust as is the case for the shuttle and the Titan 34D. In fact post 

flight analysis of the Challenger accident indicated that the thrust imbalance was 

such that aerodynamic breakup would have probably occurred without impingement. 

This post-accident interaction effect was known well before ESAS and was documented as part of the previous OSP investigations contained in the Bullman Report 

that I am unable to attach because of ITAR restrictions, but which has been supplied to the Subcommittee staff. In fact the Bullman participants were so aware of 

this fact that they recommended that solids not be used in a configuration of any 

future crewed vehicle. Specifically they recommended: 

R8.2–2 Unless the Program is able to generate new data that demonstrates that 

SRM explosions are ‘‘abortable,’’ the program should not plan to use ELV configurations with strap-on SRMs for crewed flights of the spacecraft. In addition to the 

stack explosion issue, the inability to terminate SRM thrust and its affects on separation profile must be assessed. Refer to the report reliability discussion for a quantitative discussion. 

Thus, in answer to the second part of the question, yes the post accident impact 

of strap-on boosters would be felt for all cases and this is one of the reasons why, 

independent of the increased risk of additional hardware, a single core booster, either solid or liquid, is to be preferred to any configuration that would use strapons. Now the degree to which the incorporation of strap on boosters impacts the 

Loss of Crew risk depends on the type of strap-on and the overall configuration. In 

general liquid strap-ons have less of an impact than solids, and configurations with 

the crew on top have less of an impact than side-mount configurations. This can be 

seen in the comparative analysis chart given in my testimony where the liquid strap 

on configurations are slightly less risky than the solids, and the in-line Ares V 

crewed configuration is less risky than the shuttle derived side-mount. This figure 

can be used to grossly estimate the relative risk of the various strap-on configurations and explains why any of them, solid or liquid, in line or side-mount, would 

be expected to be more risky than the single core solid Ares I configuration. However, to understand the specifics and absolute values of the relative risks of the various configurations would require detailed post accident physical simulations similar 

to those already performed on the Ares I configuration.

Questions submitted by Representative Dana Rohrabacher

Q1. During the Q&A period, you seem to be explaining that in order to get the performance necessary to loft a crew capsule on an Atlas-class vehicle would require 

an Atlas 431 (or equivalent) with three strap-on boosters. Would you please explain the design and safety considerations associated with crew escape using existing or modified EELVs?

A1. The safest configurations, whether solid or liquid, are single core vehicles. This 

is not only because of the simpler design but also because of the limited fuel load 

and the elimination of potential interaction impacts subsequent to mission failure 

all of which increase the hazard potential of the post failure environment that the 

abort system must negotiate. 

So if a single core liquid booster would be able to lift the required six passenger 

payload to the ISS, especially if it were the Atlas V, it would be a competitor to 

the Ares I, but we would have to fly at least two, and possibly three Atlas Vs to 
135

meet the payload requirement. Even though the Atlas V might expose the crew to 

an individual launch risk equal to that of the Ares I, the cumulative risk of multiple 

launches would again be significantly higher than a single Ares I launch even without considering the benign failure impact of the dominant solid booster failure 

modes. 

Strap-on boosters in general represent a more difficult environment for crew escape in event of a launch catastrophe because they increase the probability of involvement of greater amounts of fuel in the post accident environment. This is true 

for both liquid and solid tandem or barreled boosters. However since liquid engines 

can be monitored and shut-down and since a significant portion of a liquid booster 

risk is in benign shutdown the impact on Loss of Crew risk is not as severe as with 

solids. When solids are used as either strap-ons (either tandem or barreled) to the 

central core booster the predominant historical failure modes of the solid, case 

breach or soft-goods (as in the case of the Challenger accident) or nozzle burn 

through, interact with the liquid core if the hot gas jet impinges upon the core as 

in the case of Challenger and the Delta II and Titan 34D accidents. The probability 

of this occurring is higher with a barreled solid because of its closer proximity to 

other solids and the liquid core so the solid angle of impingement is greater. However with tandem boosters there is the additional problem of thrust imbalance. That 

is the imbalanced thrust from one side to the other of the stack can cause significant 

abnormal additional loads on the stack that can cause aerodynamic breakup even 

if the hot gas plume does not impinge on the central core. This is particularly a 

problem when the tandem solid boosters are large and represent a major portion 

of that boost thrust as is the case for the shuttle and the Titan 34D. In fact post 

flight analysis of the Challenger accident indicated that the thrust imbalance was 

such that aerodynamic breakup would have probably occurred without impingement. 

This post-accident interaction effect was known well before ESAS and was documented as part of the previous OSP investigations contained in the Bullman Report 

that I am unable to attach because of ITAR restrictions, but which has been supplied to the Subcommittee staff. In fact the Bullman participants were so aware of 

this fact that they recommended that solids not be used in a configuration of any 

future crewed vehicle. Specifically they recommended: 

R8.2–2 Unless the Program is able to generate new data that demonstrates that 

SRM explosions are ‘‘abortable,’’ the program should not plan to use ELV configurations with strap-on SRMs for crewed flights of the spacecraft. In addition to the 

stack explosion issue, the inability to terminate SRM thrust and its affects on separation profile must be assessed. Refer to the report reliability discussion for a quantitative discussion. 

Thus, in answer to the second part of the question independent of the increased 

risk of additional hardware, a single core booster, either solid or liquid, is to be preferred to any configuration that would use strap-ons because it presents a less hazardous post mission failure escape environment. Now the degree to which the incorporation of strap on boosters impacts the Loss of Crew risk depends on the type of 

strap-on and the overall configuration. In general liquid strap-ons have less of an 

impact than solids, and configurations with the crew on top have less of an impact 

than side-mount configurations. This can be seen in the comparative analysis chart 

given in my testimony where the liquid strap-on configurations are slightly less 

risky than the solids, and the in-line Ares V crewed configuration is less risky than 

the shuttle derived side-mount. This figure can be used to grossly estimate the relative risk of the various strap-on configurations and explains why any of them, solid 

or liquid, in line or side-mount, would be expected to be more risky than the single 

core solid Ares I configuration. However, to understand the specifics and absolute 

values of the relative risks of the various configurations would require detailed post 

accident physical simulations similar to those already performed on the Ares I configuration.
136

ANSWERS TO POST-HEARING QUESTIONS

Responses by Lt. Gen. (Ret.) Thomas Stafford, United States Air Force

Questions submitted by Chairwoman Gabrielle Giffords

Q1. As you know, the Augustine Committee projected that commercial crew transportation could be available by 2016. It does not appear that this projection reflected the time needed for all of the milestones that must be met prior to the 

point at which NASA would be able to use such services to fly its astronauts 

to the ISS such as the time needed to get Congressional authorization and appropriation of funds; agreement on human-rating and other safety standards 

and means for verifying compliance; development of a regime for certification; 

and contract competition, negotiation and award of contract(s), and potential 

protest(s) by losing bidder(s). There are no small tasks, and it is not obvious that 

any of them could be skipped if the government is to make use of those services.

• In your opinion, what are currently the largest technical challenges or hurdles 

that potential commercial crew transportation providers are facing that might 

cause delays to their projected initial operating dates?

• How confident can the Congress be that a commercial crew capability can be 

operational in 2016 while still having to carry out all of the activities that 

need to be completed before the first NASA astronaut can safely ride on an 

operational vehicle to the International Space Station.

Q2. What was the extent of the testing and analyses performed on the Gemini spacecraft and Titan launch vehicle before NASA was comfortable with system’s safety? How ‘‘simple’’ was it to build safety into Gemini.

Q3. I understand that training for off-nominal operations is an important facet of 

crew training. Astronauts are acquainted with how to identify these off-nominal 

operations and apply ways to respond to them. During your illustrious career 

in human space flight, how important was training for off-nominal operations 

to enhance safety? What level of training would need to be performed to fly 

NASA astronauts on commercial transportation systems?

Q4. Do you have any concerns regarding the option of canceling Ares I to go to the 

ISS and relying on a new set of would-be commercial providers? Is there a risk 

of being in a situation where those emerging enterprises are deemed ‘‘too important to fail’’ and we end up having to support them at whatever cost and time 

it takes?

A1, A2, A3, A4. Chairwoman Giffords—With respect to your first question, I agree 

that the projections from the Augustine Committee did not reflect the time needed 

for milestones and issues that must be met for a certified rocket and a certified 

spacecraft before NASA astronauts would be launched to the International Space 

Station. As described in my testimony a human-rate launch vehicle and spacecraft 

must start from the first time drawings are put together. All of the issues you outlined can add a considerable length of time to the process. I have great confidence 

that to ‘‘really certify human-rated spacecraft with a launch vehicle will not be 

ready any sooner by any proposed commercial vehicles than those by NASA.’’ Ares 

I Orion would have flown in 2013, but funds were taken to fly the Space Shuttle 

and complete the ISS due to the OMB not allowing NASA to request the adequate 

funding. As I outlined in my testimony, I doubt that the President was aware of 

the gap that OMB was causing in the schedule by not allowing NASA to request 

adequate funding and would require our crews and international partner crews to 

pay to fly on Russian launch vehicles and spacecrafts. I agree that this is no small 

task and do not see any items skipped if the government uses a commercial provider. 

My opinion is that there are large technical challenges for potential commercial 

crew provided rockets and spacecrafts to meet the NASA Office of Safety and Mission Assurance requirements to meet initial operational dates. In response to your 

second point, as I expressed, due to experience in the Gemini and Apollo, I flew on 

three different types of vehicles and four different types of spacecraft and I do not 

feel that Congress can be confident that a commercial crew vehicle will be operational in 2016 and carry out all of the activities to be completed before a NASA 

crew is launched. 

With regard to your second question, NASA required 39 months of testing and 

analysis on the Titan II launch vehicle and similar time on the Gemini spacecraft 

prior to the first launch. The major Titan II components, tanks, and structures for 
137

the Gemini spacecraft were built at the Martin Denver plant then shipped to a separate controlled assembly line at Martin’s Baltimore plant. Here modifications were 

made to the booster and a series of safety modifications, including the Emergency 

Detection System, were installed on the booster. Most people today do not realize 

that there was a completely separate assembly line for the Gemini Titan II launch 

vehicle. The first and second stage Aerojet engines powered the Titan and were built 

in Sacramento under the special quality conditions; then shipped with an escort to 

the Martin plant where they were installed on the vehicle. These escorts stayed 

with the engines all the way through to Launch Pad 19 until launch. 

With regard to your third question, to the four prime missions that I flew and 

three back-up crew missions that I was a member of, we literally spent hundreds 

of hours in the factory for each mission. We also spent hundreds of hours in the 

spacecraft processing, testing, and checkout before launch. For simulations we 

worked hundreds of hours and ran all of the nominal and off nominal operations 

and all emergency situations. Many of the simulations were integrated with the 

Mission Control Center. The level of training needed to fly astronauts on commercial transport systems should be no less than our previous experience. 

With regard to your fourth question, I do not have concerns that Ares I, which 

has been designed from every piece part up onward to meet the NASA Mission and 

Safety Assurance and human rated factors similar to what we did on the Apollo program. With commercial providers, I know that none will start from the beginning 

design of the launch vehicle for human rated requirements. As I pointed out, the 

Gemini Titan Program was a high risk demonstration program. We knew that certain areas of launch from the time of ignition throughout the launch profile and into 

orbit, would be hazardous if not fatal, if failure occurred. 

With respect to the latter part of your fourth question, ‘‘Is there a risk of being 

in a situation where those emerging enterprises are deemed ‘too important to fail’ 

and we end up having to support them at whatever cost and time it takes’’, the answer is emphatically yes. Once the program starts and encounters major technical 

and cost difficulties it is very difficult to stop unless the program is cancelled.

Questions submitted by Representative Pete Olson

Q1. In your testimony you spoke briefly about the relationship between the President, 

the OMB, and the Congress in setting and carrying out our space programs. 

Would you please elaborate on what you see as the strengths, weaknesses, and 

potential problems impacting our nation’s ability to carry out effective space 

policies?

A1. Ranking Member Olson—In answer to your question in relation to the President, OMB, and Congress in a setting to carry out the US Space program, the political forces have been very visible in the last 18 years vs. what is experienced from 

the start of the human space flight program. In the many times that I have testified 

in front of Congressional bodies (Senate and House), the most important issue I 

have emphasized is that we need is a long range strategic plan that the country 

can follow with only slight modifications. This fact was brought out vividly by the 

Columbia Accident Investigation Board. 

My first recommendation to the Augustine Committee was to reestablish the National Space Council since it was written into law with the efforts of Senate Majority Leader, Lyndon Johnson, in 1958. Under this law, the President can enact the 

council and it worked extremely well during the Mercury, Gemini, and Apollo programs. It was also effective for four years under President George W. H. Bush. 

Without a strategic oversight group such as the National Space Council, you will 

have second level tier individuals like those in the OMB who makes major acts on 

programs. For example, I am sure that the President did not recognize at the time 

that an individual in 2004 told NASA that they have 15 flights to finish the Space 

Shuttle project by 2008 and this was during the time that the Space Shuttle was 

still grounded after the Columbia accident, which would result in the US buying 

launches from the Russians for many years. This is the same second tier level individual, at the OMB, who arbitrarily set the date at 2015 for the termination of US 

funding of this great international multi-partner laboratory and spacecraft, the ISS.

Questions submitted by Representative Dana Rohrabacher

Q1. There have been suggestions that a smaller, simpler vehicle designed just to access low Earth orbit and the International Space Station could be developed 

faster and less expensively than Orion. Furthermore, such a vehicle might be 

more easily lofted using either existing or modified EELV’s. From your experi-
138

ence aboard the two-person Gemini spacecraft, do you see any reason why a 

smaller version of a capsule would be any simpler or less expensive to certify 

as human-rated?

A1. Mr. Rohrabacher—To provide a safe launch of a spacecraft on a rocket booster 

to orbit a human crew is always a major disciplined task. Whether you go beyond 

LEO or not, the same discipline would have to be followed whether the spacecraft 

is to fly to the moon or Mars, or only operate in only LEO, would require the same 

discipline to achieve LEO and safely return. A larger more complex spacecraft naturally costs more than a smaller spacecraft. We do not need as extensive systems and 

fuel as for a Mars spacecraft would require as compared to LEO. 

My recommendation would be for the development of a crew module in a block 

series (i.e. Block I, II, III), LEO, Moon, or Mars mission. The smaller version would 

be only somewhat less expense to certify safety for a crew.

Æ