NASA Johnson Space Center
Oral History Project
Edited Oral History Transcript
Interviewed by Rebecca Wright
Houston, Texas – 28 December 2012
is December 28th, 2012. This oral history interview is being conducted
with Bryan O’Connor in Houston, Texas. Interviewer is Rebecca
Wright, assisted by Rebecca Hackler at the Johnson Space Center History
Office. Mr. O’Connor is the former Chief of NASA’s Office
of Safety and Mission Assurance and has served in a number of safety
related roles for the space agency throughout the past 25 years. Although
he retired from NASA in 2011, he currently serves as a member of the
NASA Aerospace Safety Advisory Panel. He’s talking with us today
about NASA’s involvement with commercial partners.
Thank you again for squeezing us in your busy schedule. If you can
get your mind back around 2005, you had been the chief of safety for
a couple years. It was a lot of change that year for NASA management
structure. [Sean] O’Keefe left. Mike [Michael D.] Griffin comes
in as [NASA] Administrator. [William H. “Bill”] Gerstenmaier
had been made AA [Associate Administrator] for Space Ops [Operations
Directorate], [Scott J.] Horowitz for Exploration [Systems Mission
Directorate]. For Constellation [Program Manager], [Jeffrey M.] Hanley
was named, and [Michael T.] Suffredini was [Manager of] ISS [International
Space Station Program Office].
Then in October of that year, the Commercial Orbital Transportation
Systems [COTS] Program Office was established here at JSC. They had
plans to solicit proposals from industry for Earth-to-orbit spaceflight
demonstrations. Then just a couple months after that there was the
announcement for the Round 1 selection. Could you go back to that
time period and tell us what your thoughts were and how you were involved
with those issues?
When they first came up with COTS—and it was before the establishment
of this program office it was designed to have four phases, A, B,
C, D. The A, B, C versions of COTS I thought were reasonably aligned
with the types of things that we had done before, and certainly consistent
with the Space Act [Agreement (SAA)]. I thought it was a reasonable
undertaking, the A, B, C COTS, because it was aligned with helping
emerging spaceflight companies to develop Earth-to-orbit cargo transport
There would be benefits to NASA in this, indirect benefits, because
we were going to need something to eventually help with transportation
of cargo. One of the things that had come out of the [Space Shuttle]
Columbia [STS-107] accident was that we decided that in the future
it would be a good idea if we flew the cargo on an unmanned vehicle
and flew the crews on their own human rated systems. Then if we wanted
them to go together somewhere outside of low-Earth orbit, ideally
you could rendezvous those together and join them up once you got
past the ascent. But then again, on entry you wouldn’t have
the crew coming back with the cargo either. They would separate and
come in as a crew module.
That concept is the kind of thing that we thought was meant by separating
crew and cargo. COTS was a way of saying, “If we’re talking
about low-Earth orbit, why should NASA continue to develop such a
capability when it looks like from these studies by Futron and others
that there could also be a commercial (as in non-government) need
for cargo to low-Earth orbit? Why not let the commercial guys do that?
Let’s help them out, let’s facilitate it. Let’s
encourage it and support it, but let’s not develop it ourselves.”
When I looked at COTS A, B, C with their Space Act Agreements, it
was really all about facilitating commercial people to do something
with investments rather than contracts; I saw the indirect benefit
to us. But as the lawyers reminded us from day one, you’ve got
to be careful with Space Act Agreements if they begin to look like
you’re getting around the acquisition rules to get products
or services on the cheap by avoiding contracts. That’s why people
were careful when they talked about these things, most of the time.
Sometimes they forgot about it, and they started talking about how
COTS will procure some capability with lower cost. The lawyers would
have to tug on them and say, “Let’s not say it that way.
Indirect benefits to partnerships and all these kinds of less direct
relationships will keep us out of trouble.”
I was okay with A through C, but [COTS] D threw me because COTS D
was a demonstration of a human transport capability. I thought that’s
where NASA probably ought to get more involved than simply facilitating
with money and advice, because we were the only people actually doing
that kind of mission in this country. Anybody else who wanted to do
human spaceflight outside of NASA would have an awful lot on their
plate. I had trouble figuring out how we would do that in the Space
Act Agreement, which to me is like a grant. How would NASA do justice
to safety in a grant environment where oversight is non-existent and
where human safety is such a high risk factor?
Normally when NASA does grants it’s not for high safety risk
things. Maybe for research, where people have to volunteer for some
risky research things, but that falls under a very rigid regime that’s
government regulated. It may involve some kind of aircraft flight
or something. But again that’s regulated by the FAA [Federal
Aviation Administration]. When people are doing relatively high risk
things in a commercial environment under regulatory regimes that are
well established and in place, like the FAA aircraft regs [regulations]
and OSHA [Occupational Safety and Health Administration] and the medical
community, that’s one thing. But here’s a case where not
only is NASA the only ones who have really run human spaceflight development
activities, we’re also in this unusual place since 2004 where
there’s no FAA regime for human commercial spaceflight safety
Not only that, but they’re prohibited from putting such a regime
out there. When I read the 2004 Commercial Space Act, which came out
about the same time we’re talking about COTS, I was blown away
by the obvious lack of interest in safety of the crew and participants.
In fact I saw it as even worse than lack of interest, it was a prohibition
against regulating safety, publishing rules, regs or even guidelines
for crew and passenger safety.
COTS D looked to me like we were trying to encourage and facilitate
commercial people, to take a lot of risk with their employees without
any kind of top cover safety regulatory regime out there. Of course
this sort of thing actually happened when Space Ship One [Mojave Aerospace
Ventures] flew out in Mohave with test pilots. When they flew those
several (purely commercial) test flights on Space Ship One, the FAA
had the regulatory responsibility for those activities, but their
scope was limited to public safety, people on the ground, the uninvolved
public. When they went out to license those three-, four-minute high
altitude zero-g flights, they laid down all the rules that would be
appropriate to make sure that people on the ground were safe from
this operation. Beyond that, they weren’t allowed to lay any
rules down about the safety of the crew member.
Now as it turns out, when they put those rules in place to make sure
that the public was safe, some of them actually indirectly protected
the safety of the crew, because that vehicle was manually flown. The
FAA did have rules that would protect the crew member from injury
and health problems, but only because he was the key part of the range
safety system. If you asked the FAA, “What sort of rules would
you have put in place if he were carrying passengers?” they
would have said, “That’s outside of our scope, because
passengers would not be part of the range safety system.”
Burt [Elbert L.] Rutan and the designers had to design the thing to
meet FAA’s requirement to keep the crew member alert and capable.
But the FAA did not take a look at his egress system. If they had
a crash landing on the runway can the crew member get out safely?
That was outside the FAA’s scope. Of course the FAA is all over
that on airliners. They make sure that the slides are going to work
and people can get out in case of crash landings or landing in the
water. But for human spaceflight, that was out of scope for them,
outside their authority.
The 2004 Commercial Space Act amendment said that this prohibition
against putting rules in place that protect the crew and passengers
uniquely is in effect until 2012 or until there’s been an accident
where that accident would take lives. Only then could they publish
some occupant safety regs.
But since the Space Ship One test flights there haven’t been
any commercial flights with people. The notion of this 2012 deadline
was that after 2012 the FAA would then be authorized to publish regulations.
When they wrote that law, they thought there’d be lots and lots
of flying going on between then and 2012, and a lot of learning to
go on in this regulation-free environment, where the companies would
not be slowed down by having to design systems in compliance with
a bunch of FAA regs, and therefore able to get their test flights
out and learn a lot faster. It didn’t work out that way. There
just haven’t been any flight tests, even without regulations.
It’s just hard to do. It takes a while to get that kind of capability.
The FAA tells me, by the way, that they have no near term intention
of publishing crew safety regulations, even after 2012. They believe
that the spirit of the 2004 Act was to give a regulatory-free environment
to these companies to allow them to be creative and to not be slowed
down by a bunch of technical requirements they have to meet while
they develop their systems.
With the 2004 Commercial Space Act in mind, and this idea of NASA
having a hands-off grant process to facilitate commercial people developing
human spaceflight systems, I thought NASA was in a dilemma, because
legally, or maybe even just morally, COTS D looked to me like incentivizing
people other than the government to go out and put their employees
at a high risk with no downside for us, because in a Space Act environment
we wouldn’t be responsible for safety of those flights. They’re
not our contractors. They’re simply partners in whom we invest.
If they want to take high risk, it’s up to them, not us.
At some point there around 2004, ’05 timeframe, I went to Mike
Griffin and asked that the General Counsel would be there, as well
as Bill Gerstenmaier. I think he was in place by then in his new job.
The purpose of the meeting was to make sure that we were all in synch
on this idea of human transport in the COTS environment and to decide
whether there was as legal issue for us as far as the safety of the
partner’s crew member or just a moral one or none.
When we were getting ready for that meeting, it occurred to me that
this may be more than COTS D, because even in COTS C, the company
may decide to demonstrate a cargo-carrying vehicle that is crewed.
What would our obligation as NASA be in sponsoring with these SAAs
a human-piloted cargo demonstration in COTS C or D?
Not long after though, the COTS C question went away, because none
of the competitors who we selected for COTS C had any plans to fly
people on the cargo missions. They were all going to be unmanned,
so that became a moot point. But the COTS D question still remained.
When we had the meeting, the General Counsel, Mike [Michael C.] Wholley,
said that he and his people had looked at this, and there was no legal
issue with this, that NASA was not legally responsible for the lives
of people who were at risk in a Space Act Agreement environment. Morally,
he said, of course might be different, after all, the perception of
the public would be that this was a NASA problem if somebody on a
COTS development got hurt, but again, legally we’d probably
be okay. The reason was it’s not a contract. It’s a partnership,
and as long as it remained that way, and it was a voluntary thing
on the other side by the partners, it was okay from a government liability
point of view.
Now it was during that meeting—I don’t know if I mentioned
this last time or not—that Mike Griffin pulled me aside and
said something to the effect of let’s not worry about COTS D.
He said that what we were trying to do here was to facilitate commercial
cargo capability, and that’s a reasonable thing to do. He admitted
that COTS D had thrown in on top of this the human safety thing. It
was apparent to me there was some pressure on him from elsewhere to
show COTS D in our plan, and to satisfy some external stakeholder’s
desires. I don’t know whether it was the administration or Congress,
but I know there was a pretty strong lobby of commercial human spaceflight
advocates outside of NASA pushing for this sort of thing. Mike said
we should keep it on the books. But then he said, “Don’t
worry. COTS D will never happen.”
I said, “Okay, fine, we’ll just keep an eye on it and
press on.” I guess at some point we may have to think harder
about this, if it looks like COTS D stays on the books. But right
now he’s telling me not to worry about it. We have a lot of
other things to worry about. This shouldn’t be one of them.
I remember talking to Bill Gerstenmaier early on about all this equipment
and samples, when it became apparent that the Shuttle was going to
go out of commission before the Space Station. I guess that discussion
was going on about that same time. The President [George W. Bush]
had come out before that when Sean O’Keefe was still here and
said that the Space Shuttle would fly till it completed the Space
Station in 2010. The policy actually had both those things –
complete the Space Station and a date. A bunch of us who had been
around Space Shuttle and Space Station realized that this was a real
policy shift, because the Space Station was designed and developed
to be assembled and logistically serviced by the Space Shuttle, but
the role of the Shuttle was not to be to transport crews. That was
the Soyuz’s job. It’s been the Soyuz’s job for years
(ever since the early 90s when the current Space Station design was
A little side note. I still to this day hear people saying when the
Shuttle went out we lost our ability to put people on the Station,
and now we have to depend on the Russians. We’d been depending
on the Russians for transport of people to the Space Station long
before Shuttle went out. Shuttle’s job was to build it and to
take pieces of cargo and science up and down, and the people transport
has been the Soyuz’s job. I don’t quite agree with how
some people talk about that.
But it is true that when Shuttle goes away we don’t have the
ability in the United States to use a US crew transport. We have nothing
to back up the Russians. That’s true. But I thought we had decided
that quite a long time ago, not just recently.
When we decided that the Shuttle was going to be at the end of assembly
rather than the end of Station, here’s another dilemma. How
do we deal with the down mass? The Japanese have an up mass system,
the HTV [H-II Transfer Vehicle]. The Europeans have the ATV [Automated
Transfer Vehicle] for up mass. The Russians have the Progress [vehicle]
for up mass. Soyuz isn’t really a cargo vehicle, but there’s
a little bit of cargo that it takes up and down. But basically there’s
no down mass capability after Shuttle. That means we won’t be
able to bring down a bad CMG [Control Moment Gyroscope, attitude control
device] or big LRUs [Line Replaceable Unit, modular component] that
might fail, because all you can bring down after Shuttle is stuff
that fits in the Soyuz, and that’s not much, especially when
it’s full of people, which is its primary function.
What about all of the Human Research Program cargo, blood samples,
urine samples, saliva samples, the experimental results from these
life science experiments that are critical to getting us to Mars someday?
A lot of that has to come down. We don’t actually do the analysis
of those things on orbit. Did somebody forget to tell the President
that when he decided we don’t need it [the Shuttle] beyond assembly?
I don’t know. I don’t know all the details there, but
obviously we’re going to need something if we really believe
that that science on ISS is important.
The cargo up and cargo down was important, and when I talked to Gerstenmaier
he thought this was really good that we facilitate commercial. There
were a couple companies out there, Orbital [Sciences Corporation]
and certainly SpaceX, that were just starting to talk about how they
might be able to do something like this. Of course then that played
out, and they became our contracted cargo vehicles of choice for the
When Gerstenmaier thought about potential for future commercial human
transport activities, he told me that he believed that the best way
to do that would be allow these companies to get their feet wet with
cargo, to get lots and lots of experience transporting cargo up and
down, to develop these new rockets and get lots of experience and
learning from the not so critical missions, and then they might be
ready to develop crew modules and fly people.
That’s the way he looked at it, that COTS D to him was something
that really should be downstream, after they’ve been able to
get a lot of experience in the commercial cargo environment. Now at
some point this whole term COTS went away. We phased out of it at
the end of the COTS C demos. It had other names. I’ve heard
four or five different ones now, CCiCap [Commercial Crew Integrated
Capability] and Commercial Crew Program. The COTS program goes away
at the end of COTS, a new program team phases in and has its own agreements
with companies, mostly the same ones, to continue their development
under a different program office oversight.
Unlike what Mr. Griffin told me, COTS D didn’t really go away,
it just got a different name, and now it’s Commercial Crew.
It’s really hard to ignore commercial crew development now,
because it’s got legs on it, and we’ve put out requirements
and talked a lot about how to acquire it. They’re not talking
about waiting until companies get lots and lots of data from unmanned
launches, but to actually develop a commercial crew vehicle and see
if we could then certify it somehow with very little flight test
What made me a little nervous was that as we transitioned into this
commercial cargo environment, the commercial cargo thing became what
I think of as a low constraint, relatively easy ramp into flying NASA
material to the Space Station, with none of the certification rigor
that you see when we bring on a new rocket to fly satellites under
the Launch Service Program, [LSP] in Florida. The decision was don’t
do it with the LSP program. They have a contract, and a rigid certification
which covers all aspects of the flight, because they’re all
about making sure that we get satellites to orbit that work. They
don’t want to drop them in the drink. Although they’re
not human crewed—they don’t worry about entries—they
certainly are some of the best experts in the agency on ascent and
getting expensive payloads to orbit. But, we’re not going to
use that approach.
What we’re going to do with commercial cargo is just stay hands
off on ascent and entry. No rules, no regs, no NASA certification
for that. The only thing NASA will certify is to make sure that when
the cargo vehicle gets close to the Space Station, then we’ll
oversee its ISS safety there, making sure it doesn’t pose a
risk to ISS hardware or crew.
They’re going to look at all of the same proximity operations
and docked operations as they would for any vehicle that goes up and
latches on to the Space Station, but they won’t look at all
at ascent and entry. Of course the FAA doesn’t look at ascent
and entry either, other than its risk to public safety. The reliability
of it as a cargo carrier is something that we’re hoping comes
out okay, and we’re offering advice if they ask for it, but
we’re not overseeing that development or operation.
As you’ve seen SpaceX has operated in that relatively hands
off environment and delivered cargo to the Space Station, once on
the COTS demo flight, and then on the first CRS [Commercial Resupply
the Safety Office and you, or one of your designates involved with
those interface documents that were created to certify that the vehicle
could go to the Station?
Yes. But the only thing that was in scope was the proximity and docked
operations. The launch and the entry, the ascent, till you get close
proximity—they call it the ellipsoid—was out of scope
for our community. When the visiting vehicle is within that ellipsoid
then it’s within NASA certification territory. That was all
done per the book and just like we normally do, and the ISS Safety
team was and is integrally involved in that.
Even though in the COTS environment there was no contract with SpaceX
to do the demonstration—it was strictly a Space Act Agreement—because
they said that during that demo they didn’t want to just go
demonstrate a low-Earth orbit and a virtual rendezvous with some object
and then come down, which would have satisfied our COTS C demo milestone.
Going to the Space Station was not required in COTS C demos. But when
the company asked to go to the Space Station as part of that demonstration,
then we were able to certify against our regulations, our rules, and
to sign off that yes you’re certified to get within our ellipsoid
and join up and dock and depart.
I make that point because the legal guys reminded us that you cannot
put requirements on people in these Space Act Agreements, because
requirements and certification implies buying a service or a product,
a delivery, something like that, and that’s not what we’re
doing. That was a demo. But if they ask to go up to the Space Station
and we say, “Yes, but we have to certify that you’re safe
for our system and people.”
you part of the safety review panel?
you share some of the discussion?
It was only for the initial cert [certification], and it was, as mentioned
earlier, scope limited. Subsequent readiness reviews were not brought
to headquarters, but rather they were conducted at JSC at the Center
level, same as the other cargo vehicle missions. ISS has straightforward
requirements. We’ve been through them before with ATV, HTV,
Soyuz, lots of experience with that. It took the new companies a while
to understand the requirements, but they eventually got to where everybody
agreed with them. To the extent that there were waivers and some residual
risk, it was very limited. They were able to meet the requirements
by and large. Those where they couldn’t quite do it, the rationale
was fine. Our SR&QA community was fine with it. Looked good. We
certainly wondered about what happens if they plop it into the drink,
but that was out of scope. We had no oversight of that, or if they
burn up on entry.
What that does is it says okay, wait a minute. We have this very rigid
regime of government accountability we’ve put in place for expensive
high priority satellite launches (also called commercial launches).
Then over here for ISS cargo, we have what most people thought was
really expensive high priority stuff going up and down to the Space
Station. Why is it that the science satellite launch guys in the Launch
Service Program have to spend all this time, attention, money, put
out contracts, certify, do all that in the interest of getting science
payloads to orbit reliably, yet over here we have people that are
hands off taking cargo to and from the Space Station?
That was another big meeting at NASA Headquarters [Washington, DC].
It came to the highest level. The question was, should we be flying
these really expensive and important payloads to the Space Station
with an uncertified launch vehicle? Isn’t that a policy shift
for the agency?
What we agreed in the meeting was that we have not changed our policy.
The ELV [Expendable Launch Vehicle] policy allows us to contract a
company to fly a low priority payload, a low cost, low value, low
stakes. Any number of things can cause a payload to be considered
to be what they call Class D. Class D payloads are the kind of payloads
that we fly on the low reliability sounding rockets out of [NASA]
Wallops [Flight Facility, Wallops Island, Virginia]. They purchased
these surplus Army rockets that they’ve made into sounding rockets
that go up for their short 20-minute mission, and they take measurements
in the high atmosphere or pictures of the Earth, etc. They don’t
spend much money on the payloads, because when we have these low reliability
rockets, we can’t afford to be sending expensive payloads up
to gather science. The payloads by definition are what they call Class
D low cost, high risk tolerance.
If we did have something really important and critical to the mission
of the Space Station that needed to go up or down, we wouldn’t
fly it on these uncertified vehicles. We would fly it on the International
Partner systems, because that’s the only other capability we
have. All of these systems are certified to standards NASA concurs
in for reliability.
Now granted, NASA has not certified reliability of the launch vehicle
for HTV and ATV. Why should NASA certify the US launch vehicles that
go up and take payloads to and from the Station?”
NASA depended on the Japanese to certify their launch vehicle, and
the European Space Agency to certify theirs for reliability. They
put a lot of stock in those agencies doing the right thing. The right
thing for them was to make sure those launch vehicles were capable
of doing a really important mission. If for no other reason, just
the grief they would catch in their own country if a Japanese launch
vehicle is launching an HTV up to the Space Station with a lot of
ISS payloads, and it goes in the drink, the prestige of Japan would
be at stake for such a loss. The Japanese Space Agency has done a
lot to make sure those vehicles are good vehicles.
Without NASA, there is no government agency making sure that SpaceX
is going to be a reliable launch vehicle. FAA doesn’t oversee
mission reliability. Public safety is the only scope they have. If
NASA is not going to do it, that means that there’s no government
oversight at all of this particular launch vehicle going to and from
the Station ellipsoid. Again, when we officially declared those payloads
Class D equivalent and we said that we would not fly Space Station-critical
cargo to and from the Station on those vehicles, that got us out of
I think it raises other questions, like if all we’re doing is
Class D equivalent logistics on Space Station, isn’t that [ISS
Program] an awfully expensive program. Awfully expensive. We spend
a few million on sounding rockets. We’re spending $2 billion
a year on Space Station to do Class D science? Is that what this means?
People don’t want to talk about that. When I would ask that
next question, they just—please go away. This is hard enough
as it is.
I say that in that way tongue in cheek to just show you that we’re
hanging it out there. Now speaking personally, once the agency wrote
down this is Class D equivalent, my concern about not certifying the
launch vehicle to do the mission was pretty much allayed. I thought
fine, this is good. In fact there’s some goodness in this in
that it allows these companies to go basically with no NASA oversight.
It’ll make them go quicker. Yeah, there may be an accident or
two here and there. But they’re not going to be bogged down
by NASA contract and certification process, and it’ll allow
them maybe to get more flights out in a shorter period of time to
learn from. Then with that in mind, they’ll get more experience.
That’s good for the commercial people and it is a bit of goodness
for NASA as well.
I don’t think it’s better than NASA certifying those vehicles,
because that’s another way to get goodness in a launch vehicle.
Taking the time to do it right has proven time and again to be the
best way to develop these launch vehicles. We found that out the hard
way in the ELV and the EELV [Evolved Expendable Launch Vehicle] world,
that it’s best to get in there with the contractors and lay
down the standards, and then certify that they met them, and get your
overseers comfortable that these things are designed for reliability
than to just hope that they are and save everybody a lot of money
by not having oversight, because the accident rates are higher that
second way. History says they’re going to be higher.
you feel that your confidence level was where it needed to be when
SpaceX did their first demo to the Station?
No, not for a human launch. But it was OK for the cargo mission, and
it was considering that it’s Class D payloads. But the reason
I started with the word no is that that cannot be how we do human
spaceflight. Of course, we cannot declare astronauts Class D payload.
We will certify to our human rating standards the commercial human
Now as soon as you say that, the lawyers come in and say, “You
can’t do that on a Space Act Agreement. You can’t put
requirements on your partner in an investment. You just can’t
do it, because now you’re buying a service or a product. The
product is the cargo on orbit, or the people on orbit. If you’re
buying those kind of things, you’re not in a partnership, a
Space Act environment.”
Now somebody along the way has said that this Space Act Agreement
approach is a really good deal. Look how little it has cost NASA to
get that cargo demo up to the Space Station. Look how few bucks NASA
had to pay for that SpaceX cargo delivery flight. Now the fact that
most of the money that it took to develop that “commercial”
capability was NASA money is glossed over a little bit. It may be
a partnership, but, we’re paying most of the money.
The fact is though that the money we paid in COTS and CRS demo is
quite a bit less than if we had contracted for a full development
of that vehicle from day one. It’s been cheap. A lot of people
think therefore that’s a good model for the future, as in commercial
crew, let’s do that cheap thing again. Of course the commercial
advocacy out there is pushing on that too. See how easy this was,
if you government guys just get out of our way.
FAA got out of their way in 2004. They didn’t have regulatory
speed bumps. Now NASA is out of their way, and paying a whole lot
of money. Basically hands off. Here’s a bunch of money. We’re
here if you need us. There’s this little cert thing for prox
ops [proximity operations] we’ll deal with you on, but other
than that have a ball. Wouldn’t that be a great model for human
transport too? That’s where we’ve had several discussions
and meetings, and we’ve decided we just can’t do that.
It’s not going to work. All the rationale for doing these other
things that way just doesn’t apply to human (or as some call
it, “biological”) cargo.
So, for crew, we have decided, NASA has decided, that in order to
certify these vehicles it needs to be in a contract environment. Now
they tried to push that off as far as they could. On this last iteration
of the Space Act Agreement regime, I had a dissenting vote when it
came to the acquisition strategy meeting. Unfortunately, it didn’t
get adjudicated until after I retired. I heard that after I left Charlie
[Charles F. Bolden] decided to override my dissent and go ahead and
continue the Space Act Agreement regime for Commercial Crew Development
for the first phase of it when the contractors are munching on the
NASA requirements and making sure that they’re okay and they
understand them, and running their designs across it to see how they’re
doing. I had argued for a contract, and in fact a cost type contract
as opposed to fixed-price, because my experience told me that there’ll
be a lot of issues that come up we don’t even know about yet.
You need to have a contract to do development work so that you can
formally issue requirements and you can formally start the certification
process as early as you can.
There were a lot of people that thought I was way off base because
they said that certification is what you do at the end. They argued
for letting the partners go on a contract-free, hands-off environment
as long as they can. Then when it’s time for NASA to ask, “can
we fly on this thing?” then we would put a contract in place
and certify it. I told them that that’s not my understanding
of certification. My understanding of certification is that it has
three Vs. The first V is validation. This validation means, “Are
the requirements valid?” That’s done at an early stage
called System Requirements Review [SRR]. SRR is part of your certification
that says here are my requirements. You and I have signed up to them
on the dotted line somewhere, and where we couldn’t agree we
have put work in effect to come up with waivers, deviations, exceptions
to those requirements. We have reworded the ones we didn’t agree
on and gotten them to where we’re comfortable with them. We
have tailored our requirements to your concept, because there’s
no perfect set of requirements anywhere. There’s always going
to be something about those requirements that just don’t work
for that particular company or design concept.
When the NASA program folks said we don’t need a contract up
front, or there’s no real risk up front, it’s pretty easy
things to do up front, pretty straightforward, I disagreed. I wrote
a paper on it and turned it in as part of my dissent. Part of my rationale
was that we don’t have a set of requirements for human spaceflight
that has made it past PDR [Preliminary Design Review] since 1972,
because every other Earth-to-orbit transport system that we’ve
tried to start developing since then, the NASP [National Aero Space
Plane], the OSP [Orbital Space Plane], even a couple of shots at an
escape vehicle that would do entry from the Station that would be
an American one, ACRV [Assured Crew Return Vehicle], and then more
recently the Constellation concept—none of those has survived
You don’t really validate a set of requirements until you have
run them through and designed, developed and flown something, allowing
you to say, “That set of requirements, we all signed up up front
on what we thought was the right requirements, but there were a lot
of changes that came later because we weren’t as smart as we
thought we were, and we learned some things in flight, so we had to
change the requirements.”
The plan said that later on when the higher risk work comes, the other
two Vs, why, maybe we’ll think about a contract then. I had
big trouble with that. I told them I didn’t think that was a
good idea, and that they’re just kicking the can downstream.
But if there are problems with it, that’s what they’ll
do. They won’t have the money and the time to really deal with
these things up front like you should, because they decided not to
do a good cost contract for the first part of this. But again I asked
them, “Why did you do it that way? It’s just not the standard
acquisition approach for high risk high stakes activities.”
The answer was we don’t have the money. We’re just not
getting the money we need to do this the traditional way. Okay, I
don’t think anybody is going to die because of this, because
they’re going to kick it downstream. Your schedule may suffer.
It could be a bow wave that you’re pushing out just so you can
say you’ve gotten fast, quickly through the first part here.
But if you’re kicking problems out further on, because you don’t
have the money to pay for them, someday you’re going to have
to fix those things. It’s harder to fix them later than earlier.
Here we have this flight system that’s pretty much all designed.
They haven’t had an SRR on it yet. The contractor says, the
company, SpaceX, says, “Don’t worry. We know what your
requirements are. We built this thing to comply with them. We think
it’ll be fine.” But there’s nothing formal there,
because we weren’t allowed to be formal, and had to limit our
reviews to informal winks and nods (as the companies called them).
you left, I’ve found some testimony that you gave to a congressional
committee that talked about a requirements document that was in process
of being written, that you had hoped would be done by the end of 2010.
Was that a completed document to formulate these guidelines?
Yes. It’s what we called the 1100 series of requirements. These
are the Commercial Crew Program Office requirements documents, although
they are not actual requirements until there’s a contract to
put them on.
There’s been a lot of back-and-forth. There were a lot of people
who are pretty proud of the requirements. They think they’re
in pretty good shape. As a skeptic, my thought was, “Yeah, I
bet they’re saying that now, but there will be a few things
that are just going to hang everybody up. It’d be good to deal
with those up front.” Some of the things I worry about is the
safety factor of structures for human spaceflight is 1.4. It’s
1.25 for ELVs. Now some people argue and say, “They’re
too conservative over there on the human side.” Yeah, that may
be true. But there’s usually some reason behind almost every
one of these requirements. They weren’t arbitrary. They wanted
a little extra margin on the human side. The difference between a
1.25 and a 1.4 rocket could be that if the rocket loses control and
it starts yawing into the wind, the wind will break it up, and wouldn’t
it be nice if you had a little bit more time to escape the crew before
it actually breaks up. That could be just one example of why some
of the rules are different for the manned and the unmanned.
The second V is verify compliance with those requirements. This is
where you’ve agreed on the requirements. Now you’re going
to do your design, and you’re going to show the design to the
overseer, the government certifier, which would be us. The certifier
is going to say, “Show me the data from your ground tests or
your analysis that says that you’re meeting this requirement
that we laid on you.” They will show us the data and then we
will agree (or not) and sign off on it (or not). Part of that gets
done at the critical design review, because that’s about the
time where you got 90 percent of your drawings complete, and you’re
certifying to the government that the design is going to be okay.
Then the rest of it is a bunch more testing that you do between CDR
and when the design and flight certification happens at the end.
But that second V is about what happens in that part of the development
– verifying compliance. Again, where there’s not compliance,
is it okay? That part of the discussion is of great importance to
me from Shuttle experience, because that’s where you talk about
variances (like waivers). Variances are where you talk about residual
risk. Residual risk is where almost all your discussions are held
when you get up there close to the first flight. Nobody’s discussing
the design that’s compliant at that point. They’re talking
about the things that aren’t, and why is that okay, and what
is the risk, does anybody know, do we really believe this risk analysis
that says risk is in the yellow, maybe it’s in the red. Those
are the discussions you have at the end. But that’s all part
of that second V, verification of compliance.
Then the third V is another validation. This validation is in-flight
validation. You’re validating that the system actually works
in flight in a real environment, that’s flight test. That’s
another big issue because right now the commercial crew guys are talking
about maybe one test flight. I keep thinking, look, we can’t
have our cake and eat it too. Gerstenmaier from day one when I first
talked to him about this had it right. If you’re going to do
a hands-off development where the government responsible for the safety
of crew members decides they’re not going to get involved very
much in the front part, and they’re going to do Space Act Agreements
and fixed-price contracts where they just stand back and watch and
hope and claim that all the risk is on the other guy rather than on
us, at some point you can’t say that anymore, because we’re
flying our people. When you do that, what are you going to base that
okay to go fly on?
Here we are someday in 2018 or so if we’re lucky, the SpaceX
guys are ready to fly the first test flight. Because they’re
finally on a contract, even though the two crew members on that first
test flight are SpaceX crew members, there’s still NASA accountability
because they’re contractors. We, NASA, are accountable for our
contractors’ safety and health on things that we pay them to
do, just as if they were government employees. No difference at all.
Now part of that is just my understanding of that and my assumption
about that. The lawyers could possibly say, “No, that’s
wrong, there’s a little difference there.” Whatever. But
I have always thought about our contractors as part of our accountability.
After all, when a contractor gets hurt here at JSC inside our gate,
it’s a NASA accident. We have a NASA accident investigation.
We decide what it was the contractor did and we did and how to avoid
this in the future. It goes on the books as a JSC NASA accident. Contractor
That’s the model I’m thinking of when we talk about contractor
test flight. Whether it’s all contractors or some mixed crew
or even if it’s NASA astronauts flying the first test flight
doesn’t matter. We’re going to be saying, “You guys
go and fly on this new vehicle that hasn’t flown a human spaceflight
yet so that we can get off of the Soyuz.” Which, by the way,
by this time will have had something like 130 flights in a row without
a failure, and will have very high demonstrated reliability. I know
it’s a foreign machine, and there’s this big thing about
Americans shouldn’t be flying our astronauts on Russian space
vehicles. But is that a good enough reason why you would put people
at risk on something that hasn’t been demonstrated yet at all?
What are we going to think about that decision if it fails and we
lose a crew?
We took people off the Soyuz, which was a certified system and highly
reliable, and put them on this experimental flight system so that
we could have an American launch vehicle. Now after the accident and
the memorial services attended by the President, the Presidential
Commission is going to come in and they’re going to ask us questions.
“Why were you doing this? Tell us again why you were putting
people at risk when you had a perfectly acceptable alternative here.”
“Well, because we don’t like the idea of putting Americans
on Russian vehicles.” Then they’ll point to our space
policy, which says that we’re doing partnerships and in the
future our partnerships will not necessarily be NASA-led. We’ll
fly to the Moon or to Mars or whatever, and we’ll just be one
of the partners. Having the Russians or the Germans or somebody else
in charge where they’re the lead and we’re the backup
or we’re the lead, we’re not hung up on that anymore.
It’s okay to put the partners in the critical path.
This is what we’re saying right now, with one exception. Transport
to the Station, that’s got to be American. The idea of how we
acquire this human spaceflight system is a big deal. Not only was
I opposed to fixed-price contracts, which is what people said we’re
going to be using on this system, when we finally get to contracts,
but certainly I was opposed to Space Act Agreements any more than
we needed to. The latest plan is that when they get through this CCiCap
Space Act Agreement thing, there’s a $10 million fixed-price
contract to do the first phase of certification work. There are three
companies that are going to get these $10 million contracts. The idea
behind these contracts is to do what I consider to be the first V,
validating that the requirements are good. They still don’t
have an SRR to formalize that. Why, I just don’t understand
that. But they’ll have to have some way to have formal signatures
by NASA on a set of requirements that says, “We’ve all
agreed on these, and here they are.” Maybe they just don’t
want to call it an SRR for some reason.
I didn’t like the idea of that first phase being fixed-price,
but again, I wasn’t even around when that decision was made.
What I thought was irrelevant. I know that there are some in NASA
who felt the same way. My replacement, Terry [Terrence W.] Wilcutt
was on the same wavelength, the Chief Engineer, same thing. Again,
the program said that again, if there’s a problem in this first
phase we can always kick it into the second phase where maybe we’ll
have some other kind of contract mechanism.
Right now they’re talking about when they do the second phase,
get through this first $10 million thing, fixed-price, that anything
that’s too hard to do in a fixed-price environment they’ll
pick up in the second phase. They’ll have another competition
to see who wins the second phase. I think they’re going to go
down to two companies then. In that phase, that’ll take them
right up to flight test.
I’m a little concerned they may talk themselves again into another
fixed-price contract for that. Then the question will be, “Where
do you kick things then?” Into flight test? Is that where you
put the problems? In the flight test phase? I don’t know. I
don’t get that. But I told you about some meetings where we
made some decisions and talked about some of these. There was a meeting
in 2010 where we talked about this business of fixed-price versus
cost contracts in the Office of the Deputy Administrator. She chaired
the meeting, and told us that we had direction to go with fixed price
from the White House, so there was no need to discuss.
Now personally I thought that was a little unusual, to get that sort
of direction from the White House. As far as I was concerned though,
that didn’t end it for me as far as the worrying about how to
deal with risks. It’s still important for NASA to say, “Okay,
if we have some constraints we’ve been given by the administration
or by the Congress, and they cause residual risk, it’s up to
us to make sure they know what we know about that risk. You’re
having us do something that causes risk. We’re going to need
some money to mitigate that. Or whatever.”
You don’t just blindly accept high risk designs or operations
without honest assessment and analysis—because after an accident
they will all say, “NASA said they could do this. They didn’t
complain about it. I think you can’t just take something like
that and say, “I guess we’re done with that issue.”
It ended the meeting. It didn’t end the worry.
Up till the time I left I was saying that we really need to work on
convincing people that cost contracting is the right way to do this,
because that’s the way you deal with changes. That’s the
way you accept the risk that’s rightfully yours. Nobody in government
is supposed to be doing fixed-price contracts on things where it’s
high stakes and high risk, and where your requirements are not well
known. Those are the three things that all the schools will tell you.
If you got fuzzy requirements—and by golly, if we don’t,
nobody does—you got fuzzy requirements and it’s high stakes
and high personal safety risk, that’s when it’s okay to
do, and in fact encouraged to do cost type contracts. Because those
are the contracts where you can make changes really quickly. They
are consistent with the notion that the contractee, not the contractor,
the government that’s putting out the contract, rightfully is
obliged to accept the risk. The contractor does what they’re
told to do and advises these guys that they’re taking risk,
but the risk is really not on the contractor. It can’t be, if
we’re accountable for crew safety.
did the conversations change in any way after Constellation was canceled?
Yes. A lot of them did. When the Constellation was canceled, that’s
when we knew for sure that we were either going to have to buy crew
rides from the Soyuz or we were going to have to do commercial crew.
Before Constellation was canceled, the idea was that transport to
and from the ISS, i.e., the NASA mission of crew to orbit, was going
to be done by Constellation. If there was a commercial crew facilitation
activity going on, it wouldn’t have anything to do with Space
Station. It would just be grants to people who someday want to fly
people to and from space. We’ll give some money, we’ll
give some advice. We’ll be encouraging. We’ll help them
out. But we’re not going to do NASA missions with that new vehicle,
because we have Constellation.
The idea there was that that—they called it a launch vehicle.
Ares I was going to fly lots of flights, flying people to and from
the Space Station with the crew capsule. That’s how we would
really get a lot of test-flying going on that would be helpful later
for the Ares V when it would fly the capsule modified with different
crew size to and from the Moon and then Mars.
When Constellation went away, then we knew for sure we were going
to have to discuss whether or not this commercial crew thing is just
facilitating a pure commercial activity or actually buying a service
for us. That second thing is what of course came out of that, because
about the same time we were canceling Constellation, we were claiming
that we cannot any longer depend on the Russians, or it’s not
right to depend on the foreigners for transport, even though we’ve
been doing it for 10 years, and didn’t think it was too bad.
Now all of a sudden it’s bad.
I can tell you one thing I have determined from all this is that the
commercial crew lobby is very powerful. Mr [Elon] Musk is very very
persuasive, smart as a whip, of course very efficient and very creative
guy. Just a genius. But also knowledgeable enough of how to work with
the government to really get a bunch of people in the Beltway environment
on his side.
I’m sure he was very much welcomed by the long-suffering commercial
transport, commercial rocket people out there who for many many years
had been complaining about how hard it is to make money and to do
commercial launches of anything with those Boeing and Lockheed people
out there taking up all the government contracts.
He has convinced the government to do pretty much a hands off thing;
very little oversight to get a lot of money from the government to
do missions that the Boeings and Lockheeds charge us a lot of money
for. I think the end result may be the history books will look at
this, and they’ll look at guys like me as a bunch of naysayers.
But the real result will be that wow, spaceflight finally became cheap
when these SpaceX guys were allowed to do design, development and
ops without any oversight. That’s fine and good. I just hate
the idea that we may lose somebody in the process, in our zeal to
do this faster, better, cheaper thing.
understand when the COTS program opened up that they had a person,
or a component of safety. Was that any way connected with your office?
Were you getting reports of safety on how they were developing and
laying out their plan to do the work?
Not really. There was one guy down at JSC who was accountable to the
Johnson Space Center Director through his Safety Directorate. They’re
the ones that had the oversight of that program, not Headquarters,
because it was a JSC program.
His name was Mark Erminger. Now I occasionally would communicate with
Mark, and he and I knew each other for years. He would let me know
what was going on. Sometimes I would ask him, “What do you know
about this? I’m hearing that such and such happened on a test
or something. What are you hearing?” He would send me the SpaceX
press release. I said, “Hell, I could have got that.”
He says, “Yeah but they don’t tell us much, and we’re
not in their knickers. It’s really a laid-back sort of oversight.
We’re trying not to get in their way.” So, yeah I can
say there was a safety guy there, but he really wasn’t anything
like what we do with our contracts and our normal development programs.
you think your involvement with the Aerospace Safety [Advisory] Panel
[ASAP] will have any influence on further development of the crew?
I was encouraged when I came onto the Aerospace Safety Advisory Panel
because several of the people on there had the same kind of concerns
I did. But they were so far behind in timing. The ASAP wasn’t
really plugged in that well, because they’re a FACA [Federal
Advisory Committee Act] committee. The idea at NASA is that you don’t
tell FACA committees anything that’s not public, because their
work is all public. If we’re doing predecisional discussions,
and a decision has not yet been made by the Administrator.
Now think about that. Sometimes a discussion happens here, and then
it works to this level, and then this level, and this level. It’s
over a year. That whole time, that whole discussion is predecisional.
It’s not public until the very end of that time. Then it becomes
public. Then you go tell the ASAP, “Here’s what we decided.”
The ASAP’s job, by its congressional charter, is to advise the
agency on its program plans and operations. When the ASAP hears about
something after it’s been discussed within the agency for a
year and then decided and signed off on by agency leadership, and
then the ASAP comes in and says that was a dumb idea, is that really
advice? It’s not. ASAP has been working this way for many years.
I think it’s worthless when we operate that way.
That’s why Vice Admiral Joe [Joseph W.] Dyer, chairman of the
ASAP, has been working real hard with the agency—to try to get
the agency to plug us in early on predecisional matters in ways that
are considered to be working discussions and therefore not necessarily
public. Too many in NASA think about this public thing too strictly.
The ASAP does have the ability to receive briefings that are predecisional.
As long as they don’t make them public and treat them accordingly
it’s okay for them to do that. They just can’t take that
information and put it in their public records. It has to be treated
as data gathering.
I think the agency is coming around now. They’re actually asking
for advice when they’re thinking about things now. Then the
ASAP can give them their thoughts on various matters. But the lawyers
tell us that you can’t use the word advice unless you’re
in the FACA environment because that’s what ASAP is, a FACA
thing. The word advisory has a legal meaning, which is tied to public
material. You can give your thoughts or your comments or questions.
You can give everything except advice when you go to these working
meetings. It’s a strange environment. That’s why I don’t
get these advisory councils. What kind of advice is that?
We think you guys decided wrong. Is that advice? How much use is that?
That’s another bugaboo.
your retirement you’ve been doing some contracting work. You’ve
been able to apply some of those lessons learned with these commercial
Yes, a little bit. Well, I’ve had one get-together with Orbital
where they asked me to just come in and take a look at what they were
doing about their Glory [satellite] and OCO [Orbiting Carbon Observatory]
failures. Remember, they put those two satellites in the water in
a two-year period of time. Turned out it was probably the same cause.
They were really frustrated and so was NASA. In each case, the payload
fairing didn’t open, so the satellite was too heavy and it went
in the drink. Several hundred million dollars’ worth of important
science down the tubes.
The Orbital guys asked me shortly after I retired, “Would you
mind coming and looking at what our mishap investigation came up with,
and then what our return to flight plan looks like, to see if you
think we’re missing anything?”
It’s the kind of thing somebody like me has done before. It’s
fresh eyes, I come in from the outside. But I’ve told all these
folks that I really can’t do any consulting, because several
have asked me to consult on human spaceflight. I said, “If you
guys are working with the commercial crew NASA activities or with
any NASA human spaceflight things like the SLS [Space Launch System]
and the MPCV [Multi-Purpose Crew Vehicle] programs, I’m not
going to work for you on those, because I think that would be a conflict
with my ASAP job, because that’s almost all we look at in ASAP.
I keep my consulting to things not human spaceflight. Then if the
ASAP ever wants to go and talk to somebody about something that I’m
consulting on, I simply recuse myself. I don’t mind recusing
myself from something like that.
sounds good. We thank you for squeezing us in.
Thanks for your interest.
certainly learned a lot. We appreciate you being here. Thanks, Bryan.