[House Hearing, 111 Congress]
[From the U.S. Government Publishing Office]


 
                ENSURING THE SAFETY OF HUMAN SPACEFLIGHT 

=======================================================================

                                HEARING

                               BEFORE THE

                 SUBCOMMITTEE ON SPACE AND AERONAUTICS

                  COMMITTEE ON SCIENCE AND TECHNOLOGY
                        HOUSE OF REPRESENTATIVES

                     ONE HUNDRED ELEVENTH CONGRESS

                             FIRST SESSION

                               __________

                            DECEMBER 2, 2009

                               __________

                           Serial No. 111-66

                               __________

     Printed for the use of the Committee on Science and Technology


     Available via the World Wide Web: http://www.science.house.gov

                               ----------
                         U.S. GOVERNMENT PRINTING OFFICE 

53-689 PDF                       WASHINGTON : 2010 

For sale by the Superintendent of Documents, U.S. Government Printing 
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; 
DC area (202) 512-1800 Fax: (202) 512-2104 Mail: Stop IDCC, 
Washington, DC 20402-0001 















                  COMMITTEE ON SCIENCE AND TECHNOLOGY

                   HON. BART GORDON, Tennessee, Chair
JERRY F. COSTELLO, Illinois          RALPH M. HALL, Texas
EDDIE BERNICE JOHNSON, Texas         F. JAMES SENSENBRENNER JR., 
LYNN C. WOOLSEY, California              Wisconsin
DAVID WU, Oregon                     LAMAR S. SMITH, Texas
BRIAN BAIRD, Washington              DANA ROHRABACHER, California
BRAD MILLER, North Carolina          ROSCOE G. BARTLETT, Maryland
DANIEL LIPINSKI, Illinois            VERNON J. EHLERS, Michigan
GABRIELLE GIFFORDS, Arizona          FRANK D. LUCAS, Oklahoma
DONNA F. EDWARDS, Maryland           JUDY BIGGERT, Illinois
MARCIA L. FUDGE, Ohio                W. TODD AKIN, Missouri
BEN R. LUJAN, New Mexico             RANDY NEUGEBAUER, Texas
PAUL D. TONKO, New York              BOB INGLIS, South Carolina
PARKER GRIFFITH, Alabama             MICHAEL T. MCCAUL, Texas
JOHN GARAMENDI, California           MARIO DIAZ-BALART, Florida
STEVEN R. ROTHMAN, New Jersey        BRIAN P. BILBRAY, California
JIM MATHESON, Utah                   ADRIAN SMITH, Nebraska
LINCOLN DAVIS, Tennessee             PAUL C. BROUN, Georgia
BEN CHANDLER, Kentucky               PETE OLSON, Texas
RUSS CARNAHAN, Missouri
BARON P. HILL, Indiana
HARRY E. MITCHELL, Arizona
CHARLES A. WILSON, Ohio
KATHLEEN DAHLKEMPER, Pennsylvania
ALAN GRAYSON, Florida
SUZANNE M. KOSMAS, Florida
GARY C. PETERS, Michigan
VACANCY
                                 ------                                

                 Subcommittee on Space and Aeronautics

                HON. GABRIELLE GIFFORDS, Arizona, Chair
DAVID WU, Oregon                     PETE OLSON, Texas
DONNA F. EDWARDS, Maryland           F. JAMES SENSENBRENNER JR., 
MARCIA L. FUDGE, Ohio                    Wisconsin
PARKER GRIFFITH, Alabama             DANA ROHRABACHER, California
STEVEN R. ROTHMAN, New Jersey        FRANK D. LUCAS, Oklahoma
BARON P. HILL, Indiana               MICHAEL T. MCCAUL, Texas
CHARLES A. WILSON, Ohio                  
ALAN GRAYSON, Florida                    
SUZANNE M. KOSMAS, Florida               
BART GORDON, Tennessee               RALPH M. HALL, Texas
              RICHARD OBERMANN Subcommittee Staff Director
            PAM WHITNEY Democratic Professional Staff Member
             ALLEN LI Democratic Professional Staff Member
            KEN MONROE Republican Professional Staff Member
            ED FEDDEMAN Republican Professional Staff Member
                    DEVIN BRYANT Research Assistant





















                            C O N T E N T S

                            December 2, 2009

                                                                   Page
Hearing Charter..................................................     2

                           Opening Statements

Statement by Representative Gabrielle Giffords, Chairwoman, 
  Subcommittee on Space and Aeronautics, Committee on Science and 
  Technology, U.S. House of Representatives......................    19
    Written Statement............................................    20

Statement by Representative Ralph M. Hall, Ranking Minority 
  Member, Committee on Science and Technology, U.S. House of 
  Representatives................................................    22
    Written Statement............................................    36

Statement by Representative Pete Olson, Ranking Minority Member, 
  Subcommittee on Space and Aeronautics, Committee on Science and 
  Technology, U.S. House of Representatives......................    36
    Written Statement............................................    38

                               Witnesses:

Mr. Bryan O'Connor, Chief of Safety and Mission Assurance, 
  National Aeronautics and Space Administration
    Oral Statement...............................................    39
    Written Statement............................................    41

Mr. Jeff Hanley, Program Manager, Constellation Program, 
  Exploration Systems Mission Directorate, National Aeronautics 
  and Space Administration
    Oral Statement...............................................    45
    Written Statement............................................    47

Mr. John C. Marshall, Council Member, Aerospace Safety Advisory 
  Panel, National Aeronautics and Space Administration
    Oral Statement...............................................    52
    Written Statement............................................    54

Mr. Bretton Alexander, President, Commercial Spaceflight 
  Federation
    Oral Statement...............................................    57
    Written Statement............................................    58

Dr. Joseph Fragola, Vice President, Valador, Inc.
    Oral Statement...............................................    66
    Written Statement............................................    68

Lt. Gen. (Ret.) Thomas Stafford, United States Air Force
    Oral Statement...............................................    73
    Written Statement............................................    76

Discussion
  Safety of Launch Systems.......................................    80
  NASA--Commercial Industry: Sharing of Safety Standards.........    82
  Potential Impact of Constellation Program on Commercial Sector.    83
  Human Rating for Commercial Sector.............................    84
  Program Management and Scheduling Issues Between Congress, 
    Administration, and NASA Over Time...........................    85
  Implementation and Application of Safety Standards.............    87
  Constellation Program: Human and Certification Options Concerns    89
  ESAS Recommendations for Human Space Flight....................    91
  Availability and Economic Viability of Commercial Crew 
    Transport....................................................    92
  Orbital Sciences and SpaceX....................................    94
  Timetable: Commercial Crew Transport...........................    94
  Ares Program: Safety and Future Impact.........................    95
  COTS vs. Constellation Program.................................    96
  Risk Assessment: Commercial Vehicle............................    97
  Ares, Delta, Atlas: Comparison.................................    97
  Orion Space Craft..............................................    98
  Commercial Crew Development Program............................    99
  Training for Commercial Space Operatives.......................    99
  Soyuz Space Craft: Concerns Moving Forward.....................   101
  Addressing the Gap in Human Spaceflight........................   103
  Ares...........................................................   103
  Delta IV and Atlas.............................................   103

              Appendix: Answers to Post-Hearing Questions

Mr. Bryan O'Connor, Chief of Safety and Mission Assurance, 
  National Aeronautics and Space Administration..................   108

Mr. Jeff Hanley, Program Manager, Constellation Program, 
  Exploration Systems Mission Directorate, National Aeronautics 
  and Space Administration.......................................   116

Mr. John C. Marshall, Council Member, Aerospace Safety Advisory 
  Panel, National Aeronautics and Space Administration...........   122

Mr. Bretton Alexander, President, Commercial Spaceflight 
  Federation.....................................................   126

Dr. Joseph Fragola, Vice President, Valador, Inc.................   130

Lt. Gen. (Ret.) Thomas Stafford, United States Air Force.........   136


                ENSURING THE SAFETY OF HUMAN SPACEFLIGHT

                              ----------                              


                      WEDNESDAY, DECEMBER 2, 2009

                  House of Representatives,
             Subcommittee on Space and Aeronautics,
                       Committee on Science and Technology,
                                                    Washington, DC.

    The Subcommittee met, pursuant to call, at 10:00 a.m., in 
Room 2318 of the Rayburn House Office Building, Hon. Gabrielle 
Giffords [Chairwoman of the Subcommittee] presiding.
                            hearing charter

                  COMMITTEE ON SCIENCE AND TECHNOLOGY

                 SUBCOMMITTEE ON SPACE AND AERONAUTICS

                     U.S. HOUSE OF REPRESENTATIVES

                         Ensuring the Safety of

                           Human Space Flight

                            december 2, 2009
                              10 a.m.-noon
                   2318 rayburn house office building

I. Purpose

    On December 2, 2009 the Subcommittee on Space and Aeronautics will 
hold a hearing focused on issues related to ensuring the safety of 
future human space flight in government and non-government space 
transportation systems. The hearing will examine (1) the steps needed 
to establish confidence in a space transportation system's ability to 
transport U.S. and partner astronauts to low Earth orbit and return 
them to Earth in a safe manner, (2) the issues associated with 
implementing safety standards and establishing processes for certifying 
that a space transportation vehicle is safe for human transport, and 
(3) the roles that training and experience play in enhancing the safety 
of human space missions.

II. Scheduled Witnesses:

Mr. Bryan D. O'Connor
Chief of Safety and Mission Assurance
National Aeronautics and Space Administration

Mr. Jeff Hanley
Program Manager
Constellation Program
Exploration Systems Mission Directorate
National Aeronautics and Space Administration

Mr. John C. Marshall
Council Member
Aerospace Safety Advisory Panel
National Aeronautics and Space Administration

Mr. Bretton Alexander
President
Commercial Spaceflight Federation

Dr. Joseph R. Fragola
Vice President
Valador, Inc.

Lt. Gen. Thomas P. Stafford, USAF (ret.)

III. Overview

    The Review of U.S. Human Space Flight Plans Committee, also known 
as the Augustine committee, recently issued its final report. The 
committee was tasked to ``conduct an independent review of ongoing U.S. 
human space flight plans and programs, as well as alternatives, to 
ensure the Nation is pursuing the best trajectory for the future of 
human space flight--one that is safe, innovative, affordable, and 
sustainable. The review committee should aim to identify and 
characterize a range of options that spans the reasonable possibilities 
for continuation of U.S. human space flight activities beyond 
retirement of the Space Shuttle.''
    As directed, the committee's final report offered a number of 
options to the president for the conduct of future space exploration, 
ranging from continuing with the Constellation Program of Record (with 
slight modifications) to pursuing a ``flexible path'' with alternative 
launch vehicles, including modified Evolved Expendable Launch Vehicles 
(EELV) currently used primarily by the Department of Defense to 
transport military payloads. Several of the committee's options 
included the use of as-yet-to-be-developed commercial services to 
provide future crew transportation to and from the International Space 
Station (ISS) following retirement of the Space Shuttle. While the 
committee stated that it recognized both the risks and opportunities 
presented by commercial crew services, it believed such services could 
be available by 2016. Specifically, the report stated:

         ``The United States needs a way to launch astronauts to low-
        Earth orbit, but it does not necessarily have to be provided by 
        the government. As we move from the complex, reusable Shuttle 
        back to a simpler, smaller capsule, it is an appropriate time 
        to consider turning this transport service over to the 
        commercial sector. This approach is not without technical and 
        programmatic risks, but it creates the possibility of lower 
        operating costs for the system and potentially accelerates the 
        availability of U.S. access to low-Earth orbit by about a year, 
        to 2016. The Committee suggests establishing a new competition 
        for this service, in which both large and small companies could 
        participate.''

    Using commercial providers for space transportation is not a new 
idea. Congress has encouraged NASA to use commercial transportation 
services when appropriate as part of its space exploration strategy. 
Support for the commercial space industry was affirmed in P.L. 110-422, 
the National Aeronautics and Space Administration Authorization Act of 
2008. Along with that support however was a requirement for commercial 
services' prior conformance with NASA's safety requirements. 
Specifically, regarding crew transportation, the Act stated in Sec. 902 
that the National Aeronautics and Space Administration (NASA) shall:

         ``make use of United States commercially provided 
        International Space Station crew transfer and crew rescue 
        services to the maximum extent practicable, if those commercial 
        services have demonstrated the capability to meet NASA-
        specified ascent, entry, and International Space Station 
        proximity operations safety requirements.''

    Those NASA safety requirements are primarily embodied in NASA 
Procedural Requirements (NPR) document NPR 8705.2B, ``Human-Rating 
Requirements for Space Systems'' as well as in the ISS Visiting Vehicle 
requirements that govern proximity operations around the ISS. While the 
NPR requirements apply to the development and operation of crewed space 
systems developed by NASA and used to conduct NASA human spaceflight 
missions, the NPR also states that it ``may apply to other crewed space 
systems when documented in separate requirements or agreements''.
    Progress has been made in the past few years by commercial entities 
in designing and developing cargo launch capabilities which have the 
potential to access the ISS. However, they are not scheduled to 
demonstrate the capability to transport cargo to the ISS as part of 
NASA's Commercial Orbital Transportation Services (COTS) Demonstration 
project until the second quarter of Fiscal Year 2010, at the earliest. 
The transporting of NASA astronauts to low Earth orbit and ensuring 
their safe reentry to Earth is considered to be significantly more 
challenging than transporting cargo to the ISS.
    That is the crux of the issue. Establishing and enforcing safety 
standards for the transport of crew on commercially provided orbital 
crew transportation services is in many ways uncharted territory. 
Furthermore, a process has yet to be advanced by the government on how 
the ``airworthiness'' of commercial space flight vehicles used to 
transport government passengers will be ``certified''. While the 
Augustine committee's report projected that commercial crew 
transportation services could be available in 2016, it does not appear 
that the committee's projection accounts for all of the milestones that 
must be met prior to the point at which NASA would be able to use such 
services to fly its astronauts to the ISS. Notionally, these include: 
prior Congressional authorization and appropriation of funds for such 
an activity, which could not occur before enactment of the FY 2011 
appropriation for NASA at the earliest; agreement on human-rating and 
other safety standards and means for verifying compliance, development 
and implementation of new safety processes, testing and verification 
procedures to ensure safety, and potentially a new regulatory regime 
for certification; development of a COTS-like demonstration program 
open to multiple participants and competition/award of Space Act 
Agreements for the demonstration program; completion of the 
development/demonstration program, which would need to include a TBD 
number of demonstration flights, including tests of launch escape 
systems, etc.; subsequent preparation of an RFP for commercial crew 
transportation/ISS crew rescue services; contract competition, 
negotiation and award of contract(s), and potential protest(s) by 
losing bidder(s) [which unfortunately has become a more frequent 
occurrence in recent Department of Defense (DoD)/NASA contract 
competitions]; manufacturing of the operational flight vehicle systems 
[some of which could potentially be initiated during the development/
demonstration phase, assuming the companies would be able to fund those 
tasks with private capital]; TBD number of ``certification'' flights of 
the production vehicle system prior to NASA agreement to put its 
astronauts on board; and finally, commencement of initial operations to 
and from the ISS.
    Any mismatch between the timetable asserted in the Augustine 
committee's report and the actual time required to bring commercially 
provided crew transportation services to operational status is relevant 
because it highlights a potential inability to meet even a fraction of 
NASA's crew transfer needs for the ISS prior to the end of even an 
extended ISS operations period [i.e., an ISS extension to 2020], which 
in turn calls into question the ability of would-be commercial 
providers to identify a credible government market when seeking private 
capital commitments. In the absence of a government commitment to pay 
for services whether or not they are available when needed, would-be 
commercial providers could face pressures to cut costs [or cease to 
compete], and the government would thus have to be vigilant to ensure 
that safety-related processes and practices were not compromised as a 
result.
    Regardless of the approach to NASA's human space flight and 
exploration program that is recommended to Congress by the president, 
commercial space providers may well play an expanding role in 
transporting cargo to low Earth orbit (LEO) and eventually beyond LEO, 
and potentially transporting crew to and from LEO in the future. 
Consequently, it is prudent to initiate a detailed examination of the 
steps needed to establish confidence in commercial space transportation 
systems' capabilities to transport U.S. and partner astronauts to low 
Earth orbit and return them to Earth safely.
    At the hearing, witnesses will provide a historical perspective on 
the establishment of safety requirements in NASA human space flight 
systems; NASA's efforts to develop human safety standards and 
requirements; the incorporation of crew safety requirements in the 
design of NASA's Constellation Program; and the commercial space 
transportation companies' expectations of how NASA's safety standards 
and requirements would be applied to commercial spacecraft as well as 
the level of governmental insight and oversight over their development 
activities and operations that they would consider appropriate.

IV. Issues

    The hearing will focus on the following questions and issues:

          What are the most important safety-related issues 
        that need to be addressed in either a government or non-
        government space transportation system?

          What would be the safety implications of terminating 
        the government crew transportation system currently under 
        development in favor of relying on as-yet-to-be-developed 
        commercially provided crew transportation services? What would 
        the government be able to do, if anything, to ensure that no 
        reduction in planned safety levels occurred as a result?

          What expectations should Congress have regarding the 
        safety standards commercial providers should meet if their 
        proposed crew transportation and ISS crew rescue services were 
        to be chosen by NASA to carry its astronauts to low Earth 
        orbit? What would be required to verify compliance with those 
        standards?

          If a policy decision were made to require NASA to 
        rely solely on commercial crew transfer services, which would 
        have to meet NASA's safety requirements to be considered for 
        use by NASA astronauts, what impact would that have on the 
        ability of emerging space companies to pursue innovation and 
        design improvements made possible [as the industry has argued] 
        by the accumulation of flight experience gained from commencing 
        revenue operations unconstrained by a prior safety 
        certification regime? Would it be in the interest of the 
        emerging commercial orbital crew transportation industry to 
        have to be reliant on the government as its primary/sole 
        customer at this stage in its development?

          What lessons learned from the evolution of NASA's 
        human space flight systems should be reflected in the design 
        and operation of future crewed space transportation systems, 
        whether government or non-government?

          What role does NASA's Office of Safety and Mission 
        Assurance play in ensuring the safety of human space flight at 
        NASA? What initiatives does the office have underway to enhance 
        the safety of human space flight at NASA?

          What is being done to communicate NASA's safety and 
        human-rating requirements to potential commercial crew space 
        transportation and ISS crew rescue services providers?

          How and to what extent did safety considerations, 
        especially with respect to launch, inform the choices made in 
        NASA's Exploration Systems Architecture Study (ESAS)?

          How has the Constellation Program incorporated safety 
        and applicable human-rating requirements, as well as Astronaut 
        Office input on launch/entry systems safety, into the program's 
        design, development, and testing activities?

          What has NASA learned so far in executing the 
        Constellation Program that can assist in developing a better 
        understanding of the impact of design features, development and 
        testing and manufacturing processes, and operations procedures 
        on the safety of crewed space transportation system 
        alternatives?

          What are the expectations of potential commercial 
        crew transportation services providers as to how safety 
        standards and processes will be determined if the government 
        decided to use commercial services for the transport of NASA 
        astronauts to and from low Earth orbit and the ISS?

          What do potential commercial crew transportation 
        services providers consider to be an acceptable safety standard 
        to which potential commercial providers must conform if their 
        space transportation systems were to be chosen by NASA to carry 
        its astronauts to low Earth orbit and the ISS? Would the same 
        safety standard be used for non-NASA commercial human 
        transportation missions?

          What do potential commercial crew transportation 
        services providers consider to be an acceptable level of 
        insight and oversight over their development, test, and 
        manufacturing process, their vehicles, and operations if their 
        services are used to transport NASA astronauts to and from low 
        Earth orbit and provide ISS crew rescue services?

          What do potential commercial crew transportation 
        services providers consider to be an acceptable certification 
        regime that potential commercial services providers must comply 
        with to address the government's regulatory responsibilities 
        over the safety and ``air worthiness'' of commercial crew 
        transportation vehicles prior to their approval for use in 
        revenue-generating flight operations, whether for government or 
        non-government customers?

          What training and familiarization with non-NASA 
        crewed spacecraft and launch vehicles would astronauts flying 
        on such non-NASA spacecraft and launch vehicles need in order 
        to deal with off-nominal conditions, contingency operations and 
        emergencies?

V. Background

Relevant Legislation and Hearing on Safety Issues Associated with 
        Commercial Space Launches

NASA Authorization Act of 2005

    P.L. 109-155, the National Aeronautics and Space Administration 
Authorization Act of 2005, directed that an independent presidential 
commission be established to investigate incidents resulting in the 
loss of a U.S. space vehicle used pursuant to a contract with the 
Federal government or loss of a crew member or passenger in such a 
vehicle. The Act made clear that Congress believed that an accident 
involving astronauts riding on a commercial vehicle would be treated as 
at least as serious a matter as one involving a government vehicle. 
Specifically, the Act specified:

        ``(a) ESTABLISHMENT.--The President shall establish an 
        independent, nonpartisan Commission within the executive branch 
        to investigate any incident that results in the loss of--
                (1) a Space Shuttle;
                (2) the International Space Station or its operational 
                viability;
                (3) any other United States space vehicle carrying 
                humans that is owned by the Federal Government or that 
                is being used pursuant to a contract with the Federal 
                Government; or
                (4) a crew member or passenger of any space vehicle 
                described in this subsection.
        (b) DEADLINE FOR ESTABLISHMENT.--The President shall establish 
        a Commission within 7 days after an incident specified in 
        subsection (a).''

    The independent commission would be tasked, to the extent possible, 
to investigate the incident; determine the cause of the incident; 
identify all contributing factors to the cause of the incident; make 
recommendations for corrective actions; providing any additional 
findings or recommendations deemed by the Commission to be important; 
and prepare a report to Congress, the president, and the public.

NASA Authorization Act of 2008

    The Congress affirmed its support for the commercial space industry 
in P.L. 110-422, the National Aeronautics and Space Administration 
Authorization Act of 2008. The Act states in its findings that

         ``Commercial activities have substantially contributed to the 
        strength of both the United States space program and the 
        national economy, and the development of a healthy and robust 
        United States commercial space sector should continue to be 
        encouraged.''

    With regards to the potential use of commercially-provided ISS crew 
transfer and crew rescue services, the Act states that NASA may make 
use of commercial services if those commercial services have 
demonstrated the capability to meet NASA's safety requirements. 
Specifically, the Act states:

        ``(a) IN GENERAL.--In order to stimulate commercial use of 
        space, help maximize the utility and productivity of the 
        International Space Station, and enable a commercial means of 
        providing crew transfer and crew rescue services for the 
        International Space Station, NASA shall--
                (1) make use of United States commercially provided 
                International Space Station crew transfer and crew 
                rescue services to the maximum extent practicable, if 
                those commercial services have demonstrated the 
                capability to meet NASA-specified ascent, entry, and 
                International Space Station proximity operations safety 
                requirements;
                (2) limit, to the maximum extent practicable, the use 
                of the Crew Exploration Vehicle to missions carrying 
                astronauts beyond low Earth orbit once commercial crew 
                transfer and crew rescue services that meet safety 
                requirements become operational;
                (3) facilitate, to the maximum extent practicable, the 
                transfer of NASA-developed technologies to potential 
                United States commercial crew transfer and rescue 
                service providers, consistent with United States law; 
                and
                (4) issue a notice of intent, not later than 180 days 
                after the date of enactment of this Act, to enter into 
                a funded, competitively awarded Space Act Agreement 
                with 2 or more commercial entities for a Phase 1 
                Commercial Orbital Transportation Services crewed 
                vehicle demonstration program.''

    However, with respect to subsection (4) above, the 2008 Act also 
made clear in Sec. 902(b) that:

        ``(b) CONGRESSIONAL INTENT.--It is the intent of Congress that 
        funding for the program described in subsection (a)(4) shall 
        not come at the expense of full funding of the amounts 
        authorized under section 101(3)(A), and for future fiscal 
        years, for Orion Crew Exploration Vehicle development, Ares I 
        Crew Launch Vehicle development, or International Space Station 
        cargo delivery.''

Government Indemnification for Commercial Space Launch Operations

    In 1988, Congress amended the Commercial Space Launch Act of 1984 
to indemnify the commercial space launch industry against successful 
claims by third parties. Specifically, the United States agreed, 
subject to appropriation of funds, to pay third party claims against 
licensees in amounts up to $1.5 billion [in 1989 dollars] above the 
amount of insurance that a licensee carries. The Act's definition of 
``third party'' excludes all government employees, private employees, 
and contractors involved directly with the launch of a vehicle.
    The Act requires that private launch companies purchase sufficient 
liability insurance. This amount is determined by the Federal Aviation 
Administration (FAA) on a case-by-case basis depending on its 
calculation of the ``maximum probable loss'' from claims by a third 
party. This amount is capped at $500 million for coverage against suits 
by private entities.
    Since the majority of commercial launch activity occurs at federal 
launch ranges, the Act also requires any insurance policy a company 
obtains to also protect the federal government, its agencies, 
personnel, contractors, and subcontractors. The liability insurance 
section of the Act requires reciprocal waivers of claims between the 
licensee and its contractors, subcontractors, and customers. In effect, 
the licensee and any other organization assisting in the actual launch 
are prevented from seeking damages from one another. The 
indemnification and liability regime was first established by Congress 
as part of the Commercial Space Launch Act Amendments of 1988 and has 
been extended four times since its original enactment. On October 20, 
2009, the U.S. House of Representatives passed H.R. 3819, a bill to 
extend the commercial space transportation indemnification and 
liability regime, by a voice vote. The liability risk-sharing regime 
extension is set to expire at the end of the year; H.R. 3819 would 
extend it for three more years. Congress has not yet explicitly 
addressed the issues of indemnification and liability for future 
commercially provided orbital human space flight services.

Commercial Space Launch Amendments Act of 2004

    The Commercial Space Launch Amendments Act of 2004 put an initial 
regulatory framework in place for commercial human space flight. The 
intent of the law was to support the development of this private sector 
effort while also protecting the safety of uninvolved public on the 
ground. The law established an ``informed consent'' regime for carrying 
space flight crew and participants (passengers). The Act also created a 
new experimental launch permit for test and development of reusable 
suborbital launch vehicles. The 2004 law called for FAA to ``encourage, 
facilitate, and promote the continuous improvement of the safety of 
launch vehicles designed to carry humans.'' To allow the industry to 
grow and innovate, the Act stated that ``Beginning 8 years after the 
date of enactment of the Commercial Space Launch Amendments Act of 
2004, the Secretary may propose regulations'' pertaining to crew and 
passengers, further adding that ``Any such regulations shall take into 
consideration the evolving standards of safety in the commercial space 
flight industry.'' The eight year period [which ends in 2012] reflected 
the view that by then, the commercial human space flight industry would 
be ``less experimental.''
    As part of the ``informed consent'' regime, FAA regulations require 
an operator to inform in writing any individual serving as crew that 
the United States Government has not certified the launch vehicle and 
any reentry vehicle as safe for carrying flight crew or space flight 
participants. Similarly, the operator must inform each space flight 
participant in writing about the risks of the launch and reentry, 
including the safety record of the launch or reentry vehicle type. The 
``informed consent'' rules became effective in December 2006.
    FAA's subsequent rules call for launch vehicle operators to provide 
certain safety-related information and identify what an operator must 
do to conduct a licensed launch with a human on board. The protocols 
also include training and general security requirements for space 
flight participants. As part of the new measures, launch providers must 
also establish requirements for crew notification, medical 
qualifications, and training, as well as requirements governing 
environmental control and life-support systems. An operator must also 
verify the integrated performance of a vehicle's hardware and any 
software in an operational flight environment before carrying a space 
flight passenger. However, in issuing operator licenses, FAA does not 
certify the launch vehicle as safe as the agency customarily does with 
aircraft. In the latter case, the agency's Office of Aviation Safety 
provides initial certification of aircraft and periodically inspects an 
aircraft and certifies it as safe to fly. With regards to spacecraft, 
FAA can also issue experimental permits for launches of reusable 
vehicles conducted for research and development activities related to 
suborbital flight, for demonstrations of compliance with licensing 
requirements, or for crew training before obtaining a license.

2003 Joint Hearing on Commercial Human Space Flight

    The Subcommittee and the Senate's Subcommittee on Science, 
Technology, and Space of the Committee on Commerce, Science and 
Transportation held a hearing entitled Commercial Human Space Flight in 
July 2003. Among the issues discussed at the joint hearing were when 
revenue launches would begin to happen, ``what is safe enough'', and 
whether the government should certify the safety of commercial vehicles 
prior to the commencement of passenger-carrying operations.
    At the 2003 hearing, Senator Sam Brownback asked the witnesses when 
they could take their first commercial paying human customer into 
space. Mr. Jeff Greason, President of XCOR Aerospace said:

         ``That depends, in part, on factors that are not entirely in 
        my control, like how fast we lock up some of the remaining 
        investment. But if the investment is in hand, not sooner than 
        about three years, because we have an extensive test program we 
        have to go through.''

    In response to Senator Brownback's question, Mr. Elon Musk, the CEO 
of Space Exploration Technologies, said:

         ``Well, the task that SpaceX has set for itself is probably an 
        order of magnitude greater than sub-orbital flight. We've 
        really aimed at orbital flight, really essentially the job that 
        the Space Shuttle does. That's a longer road. But I think it's 
        conceivable we could get something done in the 2006 time frame, 
        as well.''

    With regards to safety, then-Subcommittee Ranking Member Bart 
Gordon asked Mr. Greason ``What is safe enough, and who should verify 
that?'' Mr. Greason replied:

         ``I mean, it's safe enough when the customers start to show 
        up, and you go through a process of demonstrating the vehicle 
        over and over and over again. Now, we have our own internal 
        business targets about how safe we have to know it is before we 
        can base a business on it. But it's important to realize that 
        long before we get to the point where we know it's safe enough 
        that our expensive asset won't crash and be lost to revenue 
        service, something we have to do for our own business, long 
        before that point, we will have demonstrated safety far 
        superior to what people think of as space flight safety as 
        being right now. I mean, the test program, alone is probably 
        going to be 50 flights.''

    In a response to a question for the record posed by then-
Subcommittee Chairman Dana Rohrabacher to Mr. Dennis A. Tito, CEO of 
Wilshire Associates, Inc, on what features of current aircraft 
standards and space launch safety standards should be applied to 
commercial human space flight, Mr. Tito provided the following 
response:

         ``As I stated in my testimony, commercial aviation is a mature 
        and well-established industry. Aircraft safety standards 
        reflect 100 years of powered flight experience, and are part of 
        a 75+ year history of federal regulation increasingly focused 
        on protecting the safety of airline passengers as well as 
        uninvolved third parties. The commercial space launch industry 
        is a somewhat less mature industry, with just over two decades 
        of commercial experience. This industry's heritage, however, is 
        based on over a half-century of military and civilian 
        development and testing of ballistic missiles and their 
        descendant launch vehicles. Missiles and most current launch 
        vehicles have significant destructive potential and, because 
        they are expendable, cannot be flight tested, fixed, and re-
        tested in the way aircraft or other reusable systems can. 
        Launch safety standards have therefore focused on detailed 
        oversight, complex system redundancy and flight termination 
        (self-destruct) capabilities. Neither of these two operational 
        safety paradigms is appropriate for commercial human space 
        flight. There may be some similarities between aircraft and 
        sub-orbital reusable launch vehicles, and others between RLVs 
        [Reusable Launch Vehicles] and expendable rockets. However, I 
        predict that these new space planes will in fact merit their 
        own operational safety approaches. At this point, we need to 
        develop and fly some vehicles so we can learn what to do and 
        what not to do. That, after all, is the beauty of the 
        competitive marketplace: better ideas are rewarded while less-
        good approaches suffer until they are improved or die off.''

    Responding to a similar question for the record by Mr. Gordon on 
whether the government should certify the safety of his vehicles prior 
to commencement of passenger-carrying operations, Mr. Greason replied:

         ``The government should absolutely not certify the safety of 
        our vehicles prior to the commencement of commercial, 
        passenger-carrying operations. Today, we have a gap of one-
        million-to-one between the safety of space flight (roughly 40 
        fatalities per thousand emplanements for U.S. space missions) 
        and aircraft (roughly 25 fatalities per billion emplanements 
        for U.S. scheduled air carriers). When aviation started, its 
        accident rate was as bad or worse than today's space 
        transportation technology. In the early days, carrying 
        passengers for ``barnstorming'' was one of the few sources of 
        revenue in the aircraft industry. Today, risk tolerance is 
        lower than in the 1920s. We believe we can and must do better. 
        But if commercial RLV operators are ten times safer than 
        government space flight efforts (which may be achievable), that 
        is still 100,000 times less safe than aircraft. We are clearly 
        too early for any kind of certification regime as that 
        practiced in commercial aviation.

         Early generation RLVs should be allowed to fly as long as the 
        uninvolved general public are kept reasonably safe. The key is 
        a system which investigates failures and shares the methods 
        used successfully. The best and fastest path to safety is 
        establishing a regulatory culture of continuous improvement 
        based on experience; and the more flights we get, the faster we 
        will gain that experience. Attempts to shortcut this process by 
        establishing standards based on guesses or predictions about 
        future technologies will stifle innovation, fix in place 
        present practices, and slow the pace of safety improvement. 
        This might not be so bad if the current safety record of space 
        transportation were something to preserve. But it is not; it is 
        something to change for the better.''

         ``The current safety situation will change when operational 
        track records are established. It is very likely that there 
        will be dramatic differences in safety between vehicle types. 
        When that happens, AST, industry, and the NTSB need to 
        collaborate on raising the bar, perhaps by establishing minimum 
        safety records, perhaps by design standards, or a mix of both. 
        As this evolves, it will be important to avoid applying these 
        new regulations to vehicle test flights. Research and 
        development test flights should continue with the sole burden 
        of protecting the safety of the general uninvolved public. In 
        this way we can hope that people will look back on the first 
        century of private space flight and see the same dramatic 
        improvement in safety which has been demonstrated by 
        aircraft.''

    In addition to illuminating the discrepancy between the schedule 
predictions of the emerging commercial providers and their actual 
performance to date, the testimony cited above raises the policy issue 
of the potential impact of a decision to require NASA to rely on 
commercially provided crew transportation services, which would have to 
meet NASA's safety requirements prior to NASA having its astronauts 
utilize those services. Given that the emerging commercial providers 
appear to believe strongly in an evolutionary approach to design and 
safety innovation to be achieved through flight experience gained from 
revenue flights undertaken without any prior safety certification 
regime, premature reliance on the government as the dominant/only 
customer would call into question the ability of the emerging 
commercial providers to sustain the approach to innovation that they 
appear to believe is essential to their long-term success.

NASA's Incorporation of Safety Measures into Its Human Space Flight 
        Programs
    Several key safety initiatives were undertaken by NASA following 
the experience gained from flight missions:

          In January 1986, the Space Shuttle Challenger and its 
        crew were lost 73 seconds after launch because of the failure 
        of a seal (an O-ring) between two segments of a Solid Rocket 
        Booster. In response to the findings of the Rogers Commission 
        that investigated the Challenger accident, NASA established 
        what is now known as the Office of Safety and Mission Assurance 
        (OSMA) at Headquarters to independently monitor safety and 
        ensure communication and accountability agency-wide. The Office 
        monitors ``out of family'' anomalies and establishes agency-
        wide Safety and Mission Assurance policy and guidance such as 
        human-rating requirements to which NASA program managers must 
        adhere. OSMA also reviews the Space Shuttle Program's Flight 
        Readiness Process and signs the Certificate of Flight 
        Readiness.

          In February 2003, Shuttle Columbia disintegrated as 
        it returned to Earth. In the ensuing investigation by the 
        Columbia Accident Investigation Board (CAIB), the CAIB found 
        that Columbia broke apart from aerodynamic forces after the 
        left wing was deformed from the heat of gases that entered the 
        wing through a hole caused during launch by a piece of foam 
        insulation that detached from the External Tank. The CAIB found 
        that the tragedy was caused by technical and organizational 
        failures and provided 29 recommendations.
           Then-NASA Administrator Sean O'Keefe requested that Lt. Gen. 
        Thomas Stafford, U.S. Air Force (Ret.) assign his Task Force on 
        International Space Station Operational Readiness to undertake 
        an assessment of NASA's plans to return the Space Shuttle to 
        flight. At that time, the Stafford Task Force was a standing 
        body chartered by the NASA Advisory Council, an independent 
        advisory group to the NASA Administrator. Lt. Gen. Stafford 
        activated a sub-organization with Col. Richard O. Covey, U.S. 
        Air Force (Ret.) leading the day-to-day effort of conducting an 
        independent assessment of the 15 CAIB ``return-to-flight'' 
        recommendations. As a result, the Return to Flight Task Group 
        was chartered in July 2003. Over the next two years, using 
        expertise from academia, aerospace industry, the federal 
        government, and the military, the task group, with Lt. Gen. 
        Stafford and Col. Covey as co-chairs, assessed the actions 
        taken by NASA to implement the 15 CAIB return-to-flight 
        recommendations plus one additional item the Space Shuttle 
        Program assigned to itself as a ``raising the bar'' action. The 
        task group conducted fact-finding activities, reviewed 
        documentation, held public meetings, reported the status of its 
        assessments to NASA's Space Flight Leadership Council, and 
        released three interim reports. The task group issued its final 
        report (dated July 2005) on August 17, 2005.
           Lt. Gen. Stafford will be a witness at the hearing and can 
        provide insights into safety challenges associated with human 
        space flight.

          Among the CAIB's recommendations was one for NASA to 
        establish an independent Technical Engineering Authority 
        responsible for technical requirements and all waivers to them. 
        In response, NASA created the NASA Engineering and Safety 
        Center's (NESC) whose mission is to perform value-added 
        independent testing, analysis, and assessments of NASA's high-
        risk projects to ensure safety and mission success.
           According to NASA, rather than relieving NASA program 
        managers of their responsibility for safety, the NESC 
        complements the programs by providing an independent technical 
        review. Additionally, NASA states that the NESC provides a 
        centralized location for the management of independent 
        engineering assessment by expert personnel and state of the art 
        tools and methods for the purpose of assuring safety. The NESC 
        Management Office is located at NASA Langley Research Center in 
        Hampton Virginia, but the NESC has technical resources at all 
        10 NASA Centers and Headquarters, as well as partnerships with 
        academia, industry and other Government organizations. These 
        technical resources are pooled to perform NESC activities and 
        services. Operationally, the NESC falls under the 
        responsibility of NASA's Office of Safety and Mission 
        Assurance.

          NASA said that it recognized the importance of 
        capturing the lessons learned from the loss of Columbia and her 
        crew to benefit future human exploration, particularly future 
        crewed vehicle system design. Consequently, the Space Shuttle 
        Program commissioned the Spacecraft Crew Survival Integrated 
        Investigation Team (SCSIIT) to perform a comprehensive analysis 
        of the accident, focusing on factors and events affecting crew 
        survival; and to develop recommendations for improving crew 
        survival for all future human space flight vehicles. The Team's 
        final report was released in December 2008, although findings 
        were shared within NASA during the 3-year effort. Some 
        illustrative recommendations with regards to future space craft 
        design were as follows:

                  ``Future spacecraft seats and suits should be 
                integrated to ensure proper restraint of the crew in 
                offnominal situations while not affecting operational 
                performance. Future crewed spacecraft vehicle design 
                should account for vehicle loss of control to maximize 
                the probability of crew survival.''

                  ``Future vehicle design should incorporate an 
                analysis for loss of control/breakup to optimize for 
                the most graceful degradation of vehicle systems and 
                structure to enhance chances for crew survival. 
                Operational procedures can then integrate the most 
                likely scenarios into survival strategies.''

                  ``Future spacecraft crew survival systems 
                should not rely on manual activation to protect the 
                crew.''

    The Constellation Program's design is in conformance with the 
Team's findings. For example, with regards to the recommendation listed 
above on crew restraint, the program has (a) outfitted the Orion seats 
with the latest innovations in seat and restraint systems for enhanced 
occupant protection; (b) implemented limb flail requirements and 
additional protections to ensure proper arm positioning to maintain 
control of the vehicle under high acceleration events; and (c) is 
designing suit and seat in an integrated fashion with the entire 
spacecraft.
    Mr. Jeff Hanley, Program Manager of the Constellation Program, will 
be a witness at the hearing and can provide additional details on how 
that Program is incorporating safety and applicable human-rating 
requirements, as well as Astronaut Office input on launch/entry systems 
safety, into the Constellation program's design, development, and 
testing activities.

NASA's Human Rating and Safety Requirements
    According to NASA's Inspector General, NASA assembled a diversified 
group in 2007 composed of astronauts, engineers, safety engineers, 
flight surgeons, and mission operations specialists to rewrite the 
agency's human-rating requirements, which had been embodied in NPR 
8705.2A, ``Human-Rating Requirements for Space Systems.'' As stated in 
the NASA Inspector General's report IG-09-016 dated May 21, 2009:

         ``This group reviewed human-rating documents from the last 45 
        years that were used in the development of Mercury, Gemini, 
        Apollo, Skylab, the Space Shuttle, and the International Space 
        Station. The lessons learned from these programs, and 
        information from numerous books and studies, resulted in NPR 
        8705.2B, issued May 6, 2008.''

    The stated purpose of NPR 8705.2B is ``to define and implement the 
additional processes, procedures, and requirements necessary to produce 
human-rated space systems that protect the safety of crew members and 
passengers on NASA space missions.''
    The NPR states that ``a human-rated system accommodates human 
needs, effectively utilizes human capabilities, controls hazards and 
manages safety risk associated with human spaceflight, and provides, to 
the maximum extent practical, the capability to safely recover the crew 
from hazardous situations. Human-rating is not and should not be 
construed as certification for any activities other than carefully 
managed missions where safety risks are evaluated and determined to be 
acceptable for human spaceflight.''
    The NPR further states that ``Human-rating must be an integral part 
of all program activities throughout the life cycle of the system, 
including design and development; test and verification; program 
management and control; flight readiness certification; mission 
operations; sustaining engineering; maintenance, upgrades, and 
disposal.''
    As to applicability, the NPR states that ``The human-rating 
requirements in this NPR apply to the development and operation of 
crewed space systems developed by NASA used to conduct NASA human 
spaceflight missions. This NPR may apply to other crewed space systems 
when documented in separate requirements or agreements.'' The NPR notes 
that ``The Space Shuttle, the International Space Station (ISS), and 
Soyuz spacecraft are not required to obtain a Human-Rating 
Certification in accordance with this NPR. These programs utilize 
existing policies, procedures, and requirements to certify their 
systems for NASA missions.'' The NPR is applicable to the Constellation 
Program.
    The NPR views human-rating as consisting of three fundamental 
tenets:

        1.  Human-rating is the process of designing, evaluating, and 
        assuring that the total system can safely conduct the required 
        human missions.

        2.  Human-rating includes the incorporation of design features 
        and capabilities that accommodate human interaction with the 
        system to enhance overall safety and mission success.

        3.  Human-rating includes the incorporation of design features 
        and capabilities to enable safe recovery of the crew from 
        hazardous situations.

    According to NASA's guidance, human-rating is an integral part of 
all program activities throughout the life cycle of the system, 
including design and development; test and verification; program 
management and control; flight readiness certification; mission 
operations; sustaining engineering; maintenance/upgrades; and disposal.
    The NPR technical requirements for human-rating address system 
safety, crew/human control of the system, and crew survival/aborts. The 
requirements associated with crew survival and abort capability were 
established following the two previously cited Shuttle accidents. For 
example, the NPR states that for Earth Ascent Systems:

          ``The space system shall provide the capability for 
        unassisted crew emergency egress to a safe haven during Earth 
        prelaunch activities.''

          ``The space system shall provide abort capability 
        from the launch pad until Earth-orbit insertion to protect for 
        the following ascent failure scenarios (minimum list):

                a.  Complete loss of ascent thrust/propulsion

                b.  Loss of attitude or flight path.''

          ``The crewed space system shall monitor the Earth 
        ascent launch vehicle performance and automatically initiate an 
        abort when an impending catastrophic failure is detected.''

    Regarding Earth ascent abort, the NPR states that:

          ``The space system shall provide the capability for 
        the crew to initiate the Earth ascent abort sequence.''

          ``The space system shall provide the capability for 
        the ground control to initiate the Earth ascent abort 
        sequence.''

          ``If a range safety destruct system is incorporated 
        into the design, the space system shall automatically initiate 
        the Earth ascent abort sequence when range safety destruct 
        commands are received onboard, with an adequate time delay 
        prior to destruction of the launch vehicle to allow a 
        successful abort.''

    Once in orbit, the NPR requires the crewed space system to 
``provide the capability to autonomously abort the mission from Earth 
orbit by targeting and performing a deorbit to a safe landing on 
Earth.''
    In addition, NPR 8715.3C which establishes NASA's General Safety 
Program Requirements, has a section entitled ``Hazardous Work 
Activities That Are Outside NASA Operational Control.'' The NPR states 
that it is NASA policy to ``document and verify that risks are 
adequately controlled and any residual risk is acceptable''. 
Applicability to commercial human space flight is cited. Specifically, 
Section 1.14.1 states:

         ``It is NASA policy to formally review and approve NASA 
        participation in hazardous work activities that are outside 
        NASA operational control as needed to ensure that NASA safety 
        and health responsibilities are satisfied. This policy applies 
        unconditionally to NASA participation in commercial human 
        spaceflight where current federal regulations do not 
        necessarily provide for the safety of spaceflight vehicle 
        occupants. This policy is non-retroactive and applies to 
        hazardous ground or flight activities that involve research, 
        development, test and evaluation, operations, or training, 
        where all five of the following conditions exist:

                a.  NASA civil service personnel, Government detailees, 
                specified contractors, or specified grantees are 
                performing work for NASA.

                b.  The activity is outside NASA's direct operational 
                control/oversight.

                c.  An assessment by the responsible NASA manager 
                indicates there are insufficient safeguards and/or 
                oversight in place.

                d.  The activity is not covered by a basic contract, 
                grant, or agreement where Federal, State, and/or local 
                requirements address personnel safety.

                e.  The nature of the activity is such that, if NASA 
                were controlling it, a formal safety and/or health 
                review would be required as part of the NASA approval 
                process.''

    In terms of responsibilities, the NASA Associate Administrator, as 
chair of the Agency Program Management Council, is the authority for 
human-rating and is responsible for certifying systems as human-rated. 
In this capacity, the NASA Associate Administrator makes the 
determination to certify a system as human-rated. Appeals for 
exceptions and waivers to the NPR are made to the NASA Associate 
Administrator. The Chief, Safety and Mission Assurance, is the 
Technical Authority for Safety and Mission Assurance and is responsible 
for assuring the implementation of safety-related aspects of human-
rating.
    In its 2008 Annual Report, the Aerospace Safety Advisory Board 
(ASAP), the congressionally established body which evaluates and 
provides advice on NASA's safety performance, noted changes in NPR 
8705.2B from the prior guidance:

         ``The ASAP is concerned about HRR [human rating requirements] 
        substance, application, and standardization NASA-wide.

          After several briefings, the Panel is just beginning 
        to fully understand the changes (e.g., in failure tolerance, 
        inadvertent actions, redundancy, and integrated design 
        analysis) and the implications for future system development--
        an index of the challenge facing NASA.

          The new HRR standards move from validating compliance 
        with mandatory failure tolerance requirements to an approach of 
        designing to acceptable risk, but without any apparent clear 
        and visible criteria for estimating ``how safe is safe enough'' 
        for various mission categories.

          A direct linkage between current standards and 
        engineering directives is missing.

          NASA training materials on the new HRR standards are 
        still in development and should be accelerated to distribute 
        information before new Constellation systems are developed.''

    Mr. Bryan O'Connor, Chief of Safety and Mission Assurance and 
former astronaut, will be a witness at the hearing and can provide 
additional details on OSMA's latest activities associated with 
implementing safety-related aspects of human-rating, including 
addressing the ASAP's concerns. Mr. John Marshall, a member of the 
ASAP, will also be testifying at the hearing.

Enhancing Safety through Crew Training
    As evidenced by the performance of the crew of Apollo 13 after the 
incident that created a serious emergency situation en route to the 
Moon, astronauts play a major role in ensuring human safety in space. 
In that situation, the crew detected, reacted, and with the help of 
engineers and technicians on the ground, overcame problems that 
mechanical systems could not. Integral to that crew's ability to 
improvise under difficult conditions was the training they received.
    Today's astronaut training program builds on years of flight 
experience. Once selected as candidates, astronauts undergo a rigorous 
training program that ranges from basic training in generic vehicle 
systems to being trained to operate spacecraft systems using 
simulators. Survival training includes emergency egress from the 
Shuttle and surviving in a water or wilderness environment. As a final 
step, crews conduct integrated operational training with flight 
controllers in NASA's Mission Control Center at the Johnson Space 
Center.
    Training for off-nominal operations is an important facet of crew 
training. Astronauts are acquainted with non-safety-critical failure 
modes and the ways to respond to them. Training for off-nominal 
conditions is primarily accomplished by inserting failures during 
simulations at which time astronauts are trained to recognize the off-
nominal conditions and identify corrective measures. The level of 
difficulty arises when several failures are injected during simulations 
and crew members must perform failure analyses in an integrated manner 
and apply corrective procedures in sequence. Emergency training is 
needed for those situations where all measures identified through other 
forms of training cannot be used. The most critical emergencies 
primarily involve fire, depressurization, and toxic contamination. The 
goal of NASA's training is to have a trained astronaut who is able to 
respond and assist in any contingency situation that may arise.

Safety Considerations in NASA's Selection of Space Exploration Vehicles
    In January 2004, President Bush announced his Vision for Space 
Exploration, which called for NASA to safely return the Space Shuttle 
to flight; complete the International Space Station (ISS); return to 
the Moon to gain experience and knowledge for human missions beyond the 
Moon, including Mars; and increase the use of robotic exploration to 
maximize our understanding of the solar system and pave the way for 
more ambitious human missions. Congressional support for a new 
direction in the Nation's human spaceflight program was clearly 
articulated in the 2005 NASA Authorization Act. Specifically, the Act 
directed the NASA Administrator ``to establish a program to develop a 
sustained human presence on the Moon, including a robust precursor 
program, to promote exploration, science, commerce, and United States 
preeminence in space, and as a stepping-stone to future exploration of 
Mars and other destinations. The Administrator was further authorized 
to develop and conduct appropriate international collaborations in 
pursuit of these goals.''
    Shortly after Dr. Michael Griffin was named the new NASA 
Administrator in April 2005, he set out to restructure the Exploration 
Program by giving priority to accelerating the development of the Crew 
Exploration Vehicle (CEV) to reduce or eliminate the anticipated gap in 
U.S. human access to space following the retirement of the Space 
Shuttle. Specifically, he established a goal for the CEV to begin 
operation as early as 2011and to be capable of ferrying crew and cargo 
to and from the ISS. He also decided to focus on existing technology 
and proven approaches for exploration systems development. In order to 
reduce the number of required launches for exploration missions and to 
ease the transition after Space Shuttle retirement in 2010, the 
Administrator, consistent with the congressional guidance contained in 
the NASA Authorization Act of 2005, directed the Agency to examine the 
cost and benefits of developing a Shuttle-derived Heavy-Lift Launch 
Vehicle to be used in lunar and Mars exploration. As a result, the 
Exploration Systems Architecture Study (ESAS) team was established to 
determine the best exploration architecture and strategy to implement 
these changes.
    In November 2005, NASA released the results of the ESAS, an initial 
framework for implementing the VSE and a blueprint for the next 
generation of spacecraft to take humans back to the Moon and on to Mars 
and other destinations. ESAS made specific design recommendations for a 
vehicle to carry crews into space, a family of launch vehicles to take 
crews to the Moon and beyond, and a lunar mission ``architecture'' for 
human lunar exploration. ESAS presented a time-phased, evolutionary 
architectural approach to returning humans to the Moon, servicing the 
ISS after the Space Shuttle's retirement, and eventually transporting 
humans to Mars. Under the 2005 ESAS plan, a Crew Exploration Vehicle 
(CEV and now called Orion) and Crew Launch Vehicle (CLV and now called 
Ares I) development activities would begin immediately, leading to the 
goal of a first crewed flight to the ISS in 2011. Options for 
transporting cargo to and from the ISS would be pursued in cooperation 
with industry, with a goal of purchasing transportation services 
commercially. In 2011, the development of the major elements required 
to return humans to the Moon would begin--the lunar lander (now called 
Altair), heavy lift cargo launcher (now called Ares V), and an Earth 
Departure Stage vehicle. These elements would be developed and tested 
in an integrated fashion, with the internal goal of a human lunar 
landing in 2018. When resources needed to achieve the 2011 goal for CEV 
operations were not forthcoming, the Constellation Program established 
a formal target of 2015 for initial CEV flights to the ISS.
    According to the ESAS report, the team's major trade study was a 
detailed examination of the relative costs, schedule, reliability, 
safety, and risk of using DoD's Evolved Expendable Launch Vehicle 
(EELV) and Shuttle derived launchers for crew and cargo missions. Among 
its operational ground rules and assumptions was the CAIB finding on 
the desirability of an architecture that will ``separate crew and large 
cargo to the maximum extent practical''.
    The EELV options examined for suitability for crew transport by the 
ESAS team were derived from the Delta IV and Atlas V families. The team 
found that:

          None of the medium versions of either vehicle had the 
        capability to accommodate CEV lift requirements. Augmentation 
        of the medium-lift class systems with solid strap-on boosters 
        was thought by the team to pose an issue for crew safety 
        because of small strap-on Solid Rocket Motor reliability.

          Both vehicles required modification for human-rating, 
        particularly in the areas of avionics, telemetry, structures, 
        and propulsion systems.

          Both Atlas- and Delta-derived systems required new 
        upper stages to meet the lift and human rating requirements.

          Both Atlas and Delta single-engine upper stages fly 
        highly lofted trajectories, which can produce high deceleration 
        loads on the crew during an abort an, in some cases, can exceed 
        crew load limits as defined by NASA standards.

    CLV options derived from Shuttle elements focused on the 
configurations that used a Reusable Solid Rocket Booster (RSRB), either 
as a four-segment version nearly identical to the RSRB flown today or a 
higher-performance five-segment version of the RSRB. The team sought to 
develop options that could meet the lift requirement using a four-
segment RSRB. To achieve this, a 500,000-lbf vacuum thrust class 
propulsion system would be needed. Two types of upper stage engines 
were assessed. According to ESAS, the option chosen, including using 
the Space Shuttle Main Engine (SSME) for the upper stage, was selected 
due to projected lower cost, higher safety/reliability, its ability to 
utilize existing human-rated systems and infrastructure and the fact 
that it gave the most straightforward path to a heavy lift launch 
vehicle for cargo. Subsequently, to achieve lower recurring costs, the 
rocket motor powering the upper stage was changed to a variant of the 
J-2S Saturn-era motor and now called J-2X.
    The following chart from the ESAS report summarizes the team's 
findings with regards to CLV options and compares these options on the 
basis of Loss of Mission (LOM) and Loss of Crew (LOC) probabilities:

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]


Source: NASA (ESAS)

    With regards to crew safety, as shown in the table above, analysis 
by the ESAS team showed that the initially recommended concept had a 
mean LOC of 1 in 2,021 and the current design had a mean LOC of 1 in 
1,918. As such, initially both concepts met the recommendations from 
the CAIB and the Astronaut's Office that a Shuttle replacement have at 
least a LOC of 1 in 1,000 missions. In comparison, the other options 
ranged from 1 in 614 to 1 in 1,100. The selected CLV design, which 
later became known as Ares I, was also projected to offer significant 
improvement in Loss of Mission over other launch options.
    In his presentation to the Augustine Committee on July 29, 2009, 
Dr. Joseph Fragola, a member of the ESAS team and Vice President of 
Valador, Inc., told the Committee that this meant that ``Ares I is at 
least a factor of 2 safer from a loss of crew perspective and in some 
cases closer to a factor of 3.'' In a recent conversation between 
Subcommittee staff and Dr. Fragola, he indicated that the ESAS team was 
more interested in establishing the relative risk among the options and 
not in their absolute risk values. According to NASA, the recommended 
concept's lower LOC estimate is a direct reflection of the use of a 
simpler design and fewer moving parts characteristic of a single solid 
propellant first stage. The recommended concept was accepted and formed 
the basis of the Ares I crew launch vehicle.
    Dr. Fragola will be a witness at the hearing and can provide 
additional details on the ESAS Team's analysis of how alternative 
configurations compared with regards to loss of crew and loss of 
mission projections.

Safety Oversight by the Aerospace Safety Advisory Panel
    Since it was established in 1968 by Congress, the Aerospace Safety 
Advisory Panel (ASAP) has been evaluating NASA's safety performance and 
advising the agency on ways to improve that performance. The Panel 
consists of members appointed by the NASA Administrator and is 
comprised of recognized safety, management, and engineering experts 
from industry, academia, and other government agencies.
    The ASAP reports to the NASA Administrator and Congress. The Panel 
was established by Congress in the aftermath of the January 1967 Apollo 
204 spacecraft fire. The Panel's statutory duties, as prescribed in 
Section 6 of the NASA Authorization Act of 1968, Public Law 90-67, 42 
U.S.C. 2477 are as follows:

         ``The Panel shall review safety studies and operations plans 
        that are referred to it and shall make reports thereon, shall 
        advise the Administrator with respect to the hazards of 
        proposed operations and with respect to the adequacy of 
        proposed or existing safety standards, and shall perform such 
        other duties as the Administrator may request.''

    The Panel was authorized in Section 106, Safety Management, of the 
National Aeronautics and Space Administration Authorization Act of 
2005, [P.L. 109-155]. The ASAP bases its advice on direct observation 
of NASA operations and decision-making. The Panel provides an annual 
report. In addition to examining NASA's management and culture related 
to safety, the report also examines NASA's compliance with the 
recommendations of the CAIB. Advice from the ASAP on technical 
authority, workforce and risk management practices has been provided to 
the NASA Administrator.
    Critical human space flight safety issues the Panel identified in 
its 2008 Annual Report included the proposed extension of the Space 
Shuttle Program; the use of commercial transportation sources; the 
safety and reliability of the Russian Soyuz spacecraft; an opportunity 
to hardwire safety into the fabric of the Constellation Program; the 
suitability of agency management approaches; and technical Standards 
Program focused on safety and risks.
    In his testimony at the Subcommittee's June 2009 hearing on 
``External Perspectives on the FY 2010 NASA Budget Request and Related 
Issues'', the ASAP witness stated that while the Panel endorses and 
supports investing in a Commercial Orbital Transportation Services 
(COTS) program, it believes ``at this juncture that NASA needs to take 
a more aggressive role articulating human rating requirements for the 
COTS Program since most programs are well underway. To do otherwise 
may, at a later time, pressure NASA into accepting a system for 
expediency that is below its normal standard for safety''. In its 2008 
report, the ASAP stated:

         ``COTS vehicles currently are not subject to the Human-Rating 
        Requirements (HRR) standards and are not proven to be 
        appropriate to transport NASA personnel.''

    and

         ``The capability of COTS vehicles to safely dock with the ISS 
        still must be demonstrated.''

    In addition to its annual report, the Panel submits Minutes with 
recommendations to the NASA Administrator resulting from its quarterly 
meetings. The Panel held its Third Quarterly Meeting in July 2009 [the 
Panel's most recent Quarterly Meeting was held on October 22, 2009 at 
the Kennedy Space Flight Center]. At that meeting, the Panel's official 
minutes referenced the panel's continuing concerns regarding the 
application of human rating criteria to commercial crew transportation 
services:

         ``As far as the safety issues, they basically boil down to 
        expanding the cargo capability to include crew. If that is 
        done, the traditional method would be to apply full human 
        rating criteria initially at the beginning of the program's 
        development. However, thus far NASA has consciously chosen to 
        not use a traditional approach, and there yet have been any 
        performance requirements identified to put crews on board a 
        COTS vehicle. The Panel previously had made a recommendation 
        regarding this issue and continues to be perplexed as to why 
        NASA has delayed this important action.''

         ``The Panel has addressed its concern in its previous 
        quarterly and annual reports. The issue is becoming more 
        focused and more urgent. The prospect of a COTS delivery of 
        cargo to space is organizationally and politically simpler than 
        crew transport. The issue of human rating with COTS and the 
        delivery of NASA astronauts into space is the primary concern. 
        Admiral Dyer [Chairman of the ASAP] noted that the Panel 
        remains concerned that in the probing of this question, NASA 
        looks to the FAA, which doesn't have the institutional history 
        and people to speak clearly to the topic. This issue represents 
        an opportunity for improved interagency performance.''

    Admiral Dyer also noted at the July meeting that ``If the 
[commercial] vehicle is being designed to be a cargo hauler, that is a 
different mission and a different set of designs than a crew 
transporter.'' Mr. John Frost, a Panel member, added that ``the human 
rating requirements for the Agency are built around the design process 
and those processes are ongoing now at the COTS contractors. It would 
be problematic to come back later to put these requirements into a 
process that is already complete.''
    As mentioned above, Mr. John Marshall, a member of the ASAP, will 
be a witness at the hearing and can provide additional details on the 
Panel's work and safety-related concerns.

Commercially Provided Crew and Cargo Space Transportation Services
    At present there are no commercially owned and operated human space 
transportation systems in service. Only one company, Scaled Composites, 
has successfully launched and returned humans safely to space and back 
on suborbital flights in an experimental spacecraft [SpaceShipOne] and 
launch system. Virgin Galactic intends to purchase operational vehicles 
from Scaled Composites and enter into commercial operations. Originally 
slated to enter into commercial operations in 2007, they are currently 
projecting a 2011 debut for SpaceShipTwo's suborbital flight 
operations. Several other companies/ventures also have plans to take 
paying passengers on suborbital 'tourism' trips, but have not yet flown 
any craft to space with humans aboard.
    Along with space tourism, the `NewSpace' community has stated that 
suborbital services will be able to provide opportunities for 
suborbital science experiments, suborbital travel and package delivery. 
According to members of this `Newspace' community, after carrying out 
suborbital business operation, a number of them have hopes of being 
able to undertake orbital operations in the future. However, there are 
a number of regulatory concerns and technical issues that would have to 
be addressed, as well as significant investments made, before such a 
future could be realized. Orbital flight operations are considered 
significantly more challenging than suborbital flight operations.

Commercial Orbital Transportation Services Demonstrations
    Under the Commercial Orbital Transportation Services (COTS) 
Demonstration project, NASA is helping industry develop and demonstrate 
cargo space transportation capabilities. According to NASA, the COTS 
project provides a vehicle for industry to lead and direct its own 
efforts with NASA providing technical and financial assistance. NASA 
will invest approximately $500 million toward cargo space 
transportation flight demonstrations. There are currently two funded 
participants in the COTS demonstration project, namely Space 
Exploration Technologies (SpaceX) and Orbital Sciences Corporation 
(Orbital).
    According to NASA, as of September 16, 2009, SpaceX had completed 
15 of 22 milestones and has received a total of $243 million in 
payments, with $35 million available for the remaining milestones. 
Milestone tasks range from Project Plan Review to Flight Demonstration. 
SpaceX has begun manufacturing the flight Dragon capsule and Falcon 9 
launcher to be used for the COTS demonstration flight 1. Under the 
terms of the current Space Act Agreement, SpaceX was scheduled to 
complete its first demonstration flight in June 2009 (The initial Space 
Act Agreement between NASA and SpaceX was signed in August 2006 and 
called for a scheduled first demonstration flight by September 2008).
    To allow additional time for Dragon and Falcon 9 manufacturing and 
testing programs, SpaceX indicated in June 2009 that it expected to 
complete its first demonstration flight in January 2010, with the 
second and third flights then planned for June 2010 and August 2010, 
respectively. However, making the first COTS demonstration flight in 
January 2010 will be challenging. According to an October 29th, 2009 
Space News article, development of the Falcon 9 rocket--along with that 
of its smaller sibling, the Falcon 1--has taken longer than SpaceX 
expected. The same Space News article reports that SpaceX's range 
request for the inaugural Falcon 9 flight made for February 2010 
conflicts with another already approved launch. This is significant 
because of the relationship between the Falcon 9 inaugural flight and 
the first COTS demonstration flight. The first COTS flight must receive 
an FAA license before it is launched. In its June 2009 briefing to the 
Augustine Committee, SpaceX projected that the first COTS demonstration 
flight would occur 2 months after the inaugural Falcon 9 flight. The 
smaller Falcon 1, which is designed for transport of satellites to low 
Earth orbit and is not part of the COTS project, has encountered its 
share of developmental challenges. In July 2009, Falcon 1 successfully 
delivered the Malaysian RazakSAT satellite to orbit. Prior to a 
successful test flight in September 2008 at which time a dummy payload 
reached orbit, there had been three unsuccessful Falcon 1 flights, the 
first of which occurred in March 2006.
    As of September 16, 2009, NASA says that Orbital has completed 10 
of its planned 19 milestones and has received a total of $120 million 
to date with an additional $50 million available for future milestones. 
The Orbital demonstration flight is currently planned for March 2011 
due to the company's decision to change its cargo transportation 
architecture from an unpressurized (external) cargo system to a 
pressurized (internal) cargo system. The initial Space Act Agreement 
signed in February 2008 had a scheduled first demonstration flight date 
of December 2010.
    According to NASA, the agency will not pay for any milestone until 
the milestone is successfully completed per the Space Act Agreement and 
approved by the agency. Should a milestone be missed, NASA says that it 
will evaluate partner progress made and recommend future actions that 
are in the best interest of the government.

Commercial Resupply Services

    In December 2008, NASA awarded contracts to two companies for the 
delivery of cargo to the ISS after the retirement of the Space Shuttle. 
The successful bidders for Commercial Resupply Services (CRS) contracts 
were Orbital and SpaceX, the two COTS demonstration program funded 
participants. NASA says that it awarded two contracts to mitigate the 
risk of being dependent on a single contractor. A protest lodged to the 
Government Accountability Office (GAO) in January 2009 by PlanetSpace, 
Inc, an unsuccessful bidder, was subsequently denied by GAO in April 
2009.
    The scope of the CRS effort includes the delivery of pressurized 
and/or unpressurized cargo to the ISS and the disposal or return of 
cargo from the ISS. In addition, there are non-standard services and 
special task assignments and studies that can be ordered to support the 
primary standard resupply service. NASA ordered 8 flights valued at 
$1.88 billion from OSC and 12 flights valued at $1.59 billion from 
SpaceX. According to NASA's press release announcing the contracts, the 
maximum potential value of each contract is $3.1 billion. Based on 
known requirements, the combined value of the two awards is projected 
at $3.5 billion.
    Each award under the contracts calls for the delivery of a minimum 
of 20 metric tons of cargo to the ISS, as well as the return or 
disposal of 3 metric tons of cargo from the orbiting complex. The CRS 
contracts are firm-fixed price, Indefinite Delivery Indefinite Quantity 
procurements with a period of performance from January 1, 2009, through 
December 30, 2015.

Commercial Crew Transportation Services

    Although NASA currently has no contracts for the transportation of 
crew by commercially provided space transportation services [which do 
not at present exist], it has recently applied funds from the American 
Recovery and Reinvestment Act of 2009 to work on the Commercial Crew 
and Cargo Program:

          A modification to the Bioastronautics contract with 
        Wyle Integrated Science & Engineering Group was made to develop 
        a set of human system integration requirements for application 
        to commercial spacecraft in support of NASA's Commercial Crew 
        and Cargo Program. According to NASA, the human system 
        integration requirements developed under this task order will 
        be based on a review of existing Human Rating requirements, 
        Spaceflight Human Systems Standards, Constellation Program 
        requirements, Commercial Crew and Cargo Program Office 
        operational concepts and requirements, and the Johnson Space 
        Center Space Life Sciences Directorate Human Interface Design 
        Handbook.

          NASA's Commercial Crew and Cargo Program is applying 
        Recovery Act funds to solicit proposals from all interested 
        U.S. industry participants to mature the design and development 
        of commercial crew spaceflight concepts and associated enabling 
        technologies and capabilities. NASA plans to use its Space Act 
        authority to invest up to $50 million dollars in multiple 
        competitively awarded, funded agreements. This activity is 
        referred to as Commercial Crew Development, or CCDev.

Commercial Spaceflight Federation
    According to the Commercial Spaceflight Federation (CSF), its 
mission is to ``promote the development of commercial human 
spaceflight, pursue ever higher levels of safety, and share best 
practices and expertise throughout the industry. CSF member 
organizations include commercial spaceflight developers, operators, and 
spaceports''. The Commercial Spaceflight Federation is governed by a 
board of directors, composed of the member companies' CEO-level 
officers and entrepreneurs.
    The Federation recently voiced strong support for the report by the 
Review of U.S. Human Space Flight Plans Committee which included in its 
options the creation of a Commercial Crew program to develop commercial 
capabilities to transport crew to the International Space Station.
    Mr. Bretton Alexander, President of the Commercial Spaceflight 
Federation, will be a witness at the hearing and can provide details 
related to commercial provider plans to human rate commercial space 
transportation systems as well as the commercial space industry 
expectations of how NASA's safety standards and requirements would be 
applied to commercially crewed spacecraft.
    Chairwoman Giffords. Good morning. This hearing has now 
come to order.
    This hearing this morning is the latest in a series of 
hearings that this Subcommittee is holding on a critical issue, 
an issue that we will have to take into consideration as 
Members of Congress and also the White House in considering the 
future direction and funding for NASA. In many ways, the topic 
of today's hearing is one of the most important issues 
confronting us, namely, how to ensure the safety of those brave 
men and women whom the Nation sends into space to explore and 
push back the boundaries of the space frontier. Of course, I am 
not under any illusion that human spaceflight can ever be risk-
free. Nothing in life, of course, is.
    The Apollo 1 fire, the Challenger, Columbia, these fatal 
accidents, as well as other spaceflight incidents that could 
have led to loss of life, have driven that point home in stark 
and tragic terms. Indeed, this Subcommittee is holding today's 
hearing because we need to be sure that any decision being 
contemplated by the White House or by the Congress are informed 
by our best understanding of the fundamental crew safety issues 
facing our human spaceflight program. And in making those 
decisions, we should not let either advocacy or unexamined 
optimism replace probing questions and thoughtful analysis.
    That is why the Subcommittee has invited this distinguished 
panel of witnesses to appear before us today. We need the 
benefit from your perspective and experience as we examine 
critically important questions that Congress will need to have 
answered if we are to assess the various proposals that are 
being put forth.
    Much has been said about the potential future plans for 
exploration in recent months, but there has been precious 
little discussion about safety. Today's hearing is the first 
step in rectifying that situation.
    Let me list just a few questions that we hope our witnesses 
will answer today. As several of the witnesses have put in 
their prepared testimony, the Constellation program strove to 
respond to the recommendations of the Columbia Accident 
Investigation Board that the design of the system that replaces 
the shuttle should give overriding priority to crew safety. The 
result is a system that is calculated to be significantly safer 
than the space shuttle, and two to three times safer than the 
alternative approaches considered by NASA. Given that, we hope 
that our witnesses as to whether--we will hear from them 
whether or not they believe that the burden of proof should be 
put on those who would propose alternatives to Constellation to 
demonstrate that their systems will be at least as safe as Ares 
and Orion. Alternatively, we would like to hear whether or not 
it would be acceptable to reduce the required level of crew 
safety on commercially provided crew transport services used to 
transport U.S. astronauts much below what looks likely to be 
achievable in the Constellation program.
    In addition, we need to hear our witnesses' views on 
whether the timetable suggested for the availability of 
commercial crew transport services is realistic or not. That 
is, when one takes into account all of the steps, not just 
those that are explicitly safety related, that will need to be 
taken before the first NASA astronaut can ride to the 
International Space Station on an operational commercial crew 
vehicle, do our witnesses believe that such vehicles will be 
available in time to meet a significant fraction of NASA's ISS 
crew transfer and crew rescue needs prior to 2020 or not. 
Similarly, given those required steps, do our witnesses believe 
that would-be commercial crew transport service providers will 
be able to garner sufficient revenues from non-NASA passenger 
transport services to remain viable over that same time period 
or not.
    I ask these questions, and we will hear other questions of 
course from our members, because it is going to be difficult to 
make reasoned judgments about the wisdom of investing 
significant taxpayer dollars in would-be commercial providers 
or of altering Congress's commitment to the existing 
Constellation program in the absence of clear answers.
    Finally, what do our witnesses consider to be the most 
important safety-related issues that will need to be addressed 
if we are to make our decisions on the future of NASA's human 
spaceflight and exploration program, and, at the end of the 
day, what will Congress need to do to have the assurance that 
we have done all we can to ensure the safety of our Nation's 
future human spaceflight activities? This is not a hypothetical 
question. It is fundamental for fulfilling our responsibilities 
as Members of Congress. With so much for our Subcommittee to 
consider, I am comforted that we have a very distinguished 
panel who can speak with conviction and knowledge about safety 
issues and everything that needs to be considered.
    So I welcome all of you to today's hearing. All of us here 
of course are passionate about space, whether in the private 
sector or the public sector. We want the best possible future 
for our Nation in its space endeavors. I hope that this 
morning's hearing will help us chart a productive and a 
responsible path forward.
    And finally, I would be remiss if we did not acknowledge 
the unique contributions of one of our witnesses to the 
advancement of safety in human spaceflight, and I want to 
welcome each of you to our hearing but particularly Gen. Tom 
Stafford, a veteran of Gemini, Apollo, Apollo-Soyuz, Shuttle 
Return to Flight, and countless other space flight efforts. He 
can speak as a true national hero and an authority.
    So in closing, I know that my colleagues join me in saying 
that we all owe General Stafford a great amount of debt for 
everything you have done for our country and we are honored, 
sir, that you are here with us today. Thank you.
    [The prepared statement of Chairwoman Giffords follows:]
          Prepared Statement of Chairwoman Gabrielle Giffords
    Good morning. This morning's hearing is the latest in a series of 
hearings that this subcommittee is holding on critical issues that the 
White House and Congress need to consider as decisions are made on the 
future direction and funding for NASA. In many ways, the topic of 
today's hearing is one of the most important issues confronting us--
namely, how to ensure the safety of those brave men and women whom the 
nation sends into space to explore and push back the boundaries of the 
space frontier. Of course, I am under no illusions that human 
spaceflight can ever be made risk-free. Nothing in life is.
    The Apollo 1 fire, the Challenger and Columbia fatal accidents, as 
well as other space flight incidents that could have led to loss of 
life, have driven that point home in stark and tragic terms. Indeed, 
this subcommittee is holding today's hearing because we need to be sure 
that any decisions being contemplated by the White House and Congress 
are informed by our best understanding of the fundamental crew safety 
issues facing our human space flight program. And in making those 
decisions, we should not let either advocacy or unexamined optimism 
replace probing questions and thoughtful analysis.
    That is why the subcommittee has invited this distinguished set of 
witnesses to appear before us today. We need the benefit of your 
perspectives and experience as we examine critically important 
questions that Congress will need to have answered if we are to assess 
the various proposals that have been put forth.
    Much has been said about potential future plans for exploration in 
recent months, but there has been precious little discussion of crew 
safety Today's hearing is a first step in rectifying that situation.
    Let me list just a few of the questions that we would like our 
witnesses to address today. As several of the witnesses at today's 
hearing will testify, the Constellation program strove to respond to 
the recommendation of the Columbia Accident Investigation Board that 
``The design of the system [that replaces the Shuttle] should give 
overriding priority to crew safety . . .'' The result is a system that 
is calculated to be significantly safer than the Space Shuttle, and two 
to three times safer than the alternative approaches considered by 
NASA. Given that, we hope to hear from our witnesses as to whether they 
believe that the burden of proof should be put on those who would 
propose alternatives to the Constellation program to demonstrate that 
their systems will be at least as safe as Ares/Orion. Alternatively, do 
they think it would it be acceptable to reduce the required level of 
crew safety on commercially provided crew transport services used to 
transport U.S. astronauts much below what looks to be achievable in the 
Constellation program?
    In addition, we need to hear our witnesses' views on whether the 
timetable suggested for the availability of commercial crew transport 
services is realistic or not.
    That is, when one takes into account all of the steps--not just 
those that are explicitly safety-related--that will need to be taken 
before the first NASA astronaut can take a ride to the ISS on an 
operational commercial crew vehicle, do our witnesses believe that such 
vehicles will be available in time to meet a significant fraction of 
NASA's ISS crew transfer and crew rescue needs prior to 2020 or not? 
Similarly, given those required steps, do our witnesses believe that 
would-be commercial crew transport services providers will be able to 
garner sufficient revenues from non-NASA passenger transport services 
to remain viable over that same time period or not?
    It will be difficult to make reasoned judgments about the wisdom of 
investing significant taxpayer dollars in would-be commercial providers 
or of altering Congress's commitment to the existing Constellation 
program in the absence of clear answers to those questions.
    Finally, what do our witnesses consider to be the most important 
safety-related issues that will need to be addressed as we make our 
decisions on the future of NASA's human space flight and exploration 
program.
    And, at the end of the day, what will Congress need to do to have 
the assurance that we have done all we could to ensure the safety of 
the nation's future human space flight activities? That is not a 
hypothetical question. It is fundamental to fulfilling our 
responsibilities as Members of Congress. With so much for this 
subcommittee to consider, I am comforted by the realization that we 
have a very distinguished panel who can speak with conviction and 
knowledge about the safety issues that will need to be considered.
    I want to welcome each of you to today's hearing. All of us who are 
passionate about space, whether in the private sector or the public 
sector, want the best possible future for our nation in its space 
endeavors. I hope that this morning's hearing will help us chart a 
productive and responsible path forward.
    Finally, I would be remiss if I did not acknowledge the unique 
contributions of one of our witnesses to the advancement of safety in 
human space flight. I want to welcome each of you to today's hearing. 
Lt. Gen. Thomas P. Stafford, a veteran of the Gemini, Apollo, Apollo-
Soyuz, Shuttle Return-to-Flight, and countless other space flight 
efforts, can speak with authority on safety issues--he has lived them. 
He is a true national hero.
    So in closing, I know that my colleagues join me in saying that we 
owe Gen. Stafford and the other pioneers of human space flight a debt 
of gratitude. Without their efforts--and bravery--NASA would not have 
made the safety advances that it has.

    Chairwoman Giffords. The Chair now recognizes Mr. Olson for 
his opening statement.
    Mr. Olson. Madam Chairwoman, I would like to yield to the 
ranking member of our full Committee if he is ready to make his 
statement at this time.
    Mr. Hall. I don't know how ready I am but I will take a 
shot at it.
    I really enjoyed, Madam Chairman, your speech and I agree 
with everything you have said. You are in an unusual position 
to know what you are talking about and have more than just a 
passing interest and more than a committee chairman's interest 
in the safety that we are going to talk about today, and I want 
to thank you for allowing me to make the statement and for 
holding this hearing. It is one of the topics that I think I am 
most passionate about and that is the safety of our crews. It 
simply has to be at the heart of everything NASA does in space.
    Also, I want to sincerely thank all of today's witnesses 
for taking the time and effort. I know it takes time. You 
prepared yourself back during your lifetime for this 
presentation to us and you are the very type of citizen that 
comes here that gives us information from which we glean the 
ingredients that go into the bills, and we know it takes your 
time. Your time is valuable and you didn't suffer to get here 
but you paid the price to get here. We are very honored to have 
each one of you. I want to sincerely thank all of you for 
taking the time and effort.
    I especially want to welcome a friend of mine here and have 
the liberty of saying a word or so about Gen. Tom Stafford. He 
is a good friend. He is a national hero. I have relied on his 
advice for many years. He is the kind of guy that I call and 
get him out of the garden or wherever he is, the library, 
wherever he may be, but I have called on him for a lot of 
information on many occasions and we have exchanged personal 
letters through the years, most recently when he chaired the 
Stafford-Covey Return to Flight Task Force established to 
ensure that the Columbia Accident Investigation Board's 
recommendations were carried out.
    And we have a lot of important issues to cover today. The 
Columbia Accident Board gave NASA many safety recommendations 
and principles to follow in the design of future launch 
vehicles. In May of 2004, after carefully reviewing the 
findings, the Astronaut Office published their position on the 
safety of future launch systems. One recommendation was to 
include a crew escape system module as part of any new launch 
vehicle. In the NASA authorization bill of 2005, many of us 
worked together to ensure that such a system was part of NASA's 
plans for the next human exploration vehicle, and I know we all 
will continue to insist that this remains the case.
    Much of what I say today is in a piece in Monday's edition 
of Space News. Madam Chair, I would like to ask unanimous 
consent to include a copy of the May 4, 2004, Astronaut Office 
position on future launch system safety and throw in a copy of 
my November 30th Space News editorial into the record.
    [The information follows:]

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

    Chairwoman Giffords. Without objection.
    Mr. Hall. And with that, I want to just say another word or 
so about Tom Stafford. He graduated from the U.S. Naval Academy 
ten years after Sam Rayburn came to my breakfast table to talk 
to my mother to tell her why he couldn't appoint me to the 
Naval Academy. They were in school together at Mayo College 
there. It is now Texas A&M at Commerce, but they were friends 
forever. She was part of the first team to ever get Sam Rayburn 
to run for office. She wanted him to appoint me to the Naval 
Academy. He said there are just four reasons and all four 
reasons are his grades. Later, Madam Chairman, that came home 
to me because they ran an article in the paper when I was 
running for reelection for judge one time that I had made four 
F's and a D one time and my dad had punished me for spending 
too much time on one subject. That wasn't very good. But Tom 
has also flown two Gemini missions. He is the first Gemini 
mission, and he piloted the first rendezvous in space. He is 
cited by the Guinness Book of World Records for the highest 
speed ever obtained by a man, or a woman, I am sure, 24,791 
miles per hour during the reentry of Apollo 10. He was 
instrumental in our early space missions with the Russians. He 
logged over 507 hours in space and flew four different types of 
spacecrafts. He obtained the rank of three-star general and he 
served as a defense advisor to one of the great Presidents of 
the century, President Ronald Reagan. Tom and you other five 
gentlemen, we thank all of you for what you are doing and your 
presence here today.
    I yield back. Thank you, Madam Chairman.
    [The prepared statement of Mr. Hall follows:]
           Prepared Statement of Representative Ralph M. Hall
    Madame Chair I want to thank you for recognizing me to make a 
statement, and for holding today's hearing on ensuring the safety of 
human space flight in future space transportation systems. It is one of 
the topics I am most passionate about. Safety of our crews simply must 
be at the heart of everything NASA does in space.
    I also want to sincerely thank all of today's witnesses for taking 
the time and effort to share their unique and valuable wisdom and 
expertise with us. I especially want to welcome General Tom Stafford. 
Tom is a good friend and a real national hero. I have relied on Tom's 
advice for many years, most recently when he chaired the Stafford-Covey 
Return to Flight Task Group that was established to ensure the Columbia 
Accident Investigation Board's recommendations were carried out.
    We have a lot of very important issues to cover today so I will be 
brief.
    The Columbia accident board gave NASA many safety recommendations 
and principles to follow in the design of future launch vehicles. In 
May 2004, after carefully reviewing the findings, the Astronaut office 
published their position on the safety of future launch systems. One 
recommendation was to include a crew escape system as part of any new 
launch vehicles. In the NASA Authorization Bill of 2005, I ensured that 
such a system was part of NASA's plans for the next human exploration 
vehicle, and I will continue to insist that this remains the case.
    Much of what I would say today is in my editorial piece in Monday's 
edition of Space News. Madame Chair I'd like to ask unanimous consent 
to include a copy of the May 4, 2004 Astronaut Office Position on 
Future Launch System Safety; and a copy of my November 30, 2009 Space 
News editorial into the record.
    With that, I look forward to a very productive hearing and yield 
back my time.

    Chairwoman Giffords. Thank you, Mr. Hall.
    If there are other members who wish to submit additional 
opening statements, your statements will be added to the record 
at this point.
    Mr. Olson. Madam Chairwoman?
    Chairwoman Giffords. Yes.
    Mr. Olson. May I make an opening statement?
    Chairwoman Giffords. Sure.
    Mr. Olson. Thank you very much. I appreciate that, and I 
know part of this is my fault for getting the ranking member in 
here.
    Madam Chairwoman, thank you for calling this morning's 
hearing on a topic of paramount importance to the future of our 
human spaceflight program. The issue of safety is really the 
starting point from which all discussions about the course and 
purpose of our Nation's human spaceflight program should begin. 
I am certain we would have a line of people out the door to 
test-drive the new rocket. That pioneering spirit is in the 
fabric of our Nation, but we must not take it for granted, not 
cheapen it by failing to provide the direction or performance, 
performing the diligence necessary to ensure the astronauts' 
safety.
    I would like to thank our witnesses for their appearance 
before the Subcommittee today. I recognize that each of you has 
spent considerable time and effort preparing for this hearing 
and in some cases traveling long, long distances to be here, 
and we are not going to calculate General Stafford's distance 
that he has traveled because he has got a big advantage over 
the rest of us. But please know that the Subcommittee 
appreciates your efforts as well as the wisdom and experience 
you bring and that we will refer to your guidance in the coming 
months and years ahead as the Committee goes forward.
    NASA is facing a transition away from the space shuttle to 
the Constellation program, a program that is in the midst of 
testing and design, desperately needs more funds, and thank 
you, Mr. Hanley, for all you have done for the Constellation 
program. But there is a theme across our entire spaceflight 
program, human spaceflight program. An increase in resources 
would enhance the abilities and capabilities of the commercial 
sector to allow their increased participation as well. I fully 
support all of the current endeavors including commercial 
cargo, but sadly, from my position, fully supporting and fully 
funding are not synonymous. I truly wish they were.
    Safety is and must be on the minds of the men and women of 
NASA all the time. We have astronauts orbiting in the ISS right 
now and each shuttle flight carries with it the extra increment 
of risk that an accident could end NASA as we know it.
    I would like in my brief time to focus on an area of 
concern to me that is just as critical as design standards, 
human ratings requirements, airworthiness, to name a few, and 
that is the issue of culture. Culture is difficult to define. I 
know that. But it is something that the Columbia Accident 
Investigation Board spent a great deal of time on. It found 
that, and this is a quote, ``The NASA organizational culture 
had as much to do with this accident as the foam.'' The 
Augustine report cites that, another quote, ``Significant space 
achievements require continuity of support over many years. One 
way to assure that no successes are achieved is to continually 
introduce change.''
    It must not be lost on this committee that the increased 
participation of commercial providers will necessitate a change 
in business as usual at NASA. We cannot take that lightly. 
Changing the way a bureaucracy operates is not easy. In many 
cases, it is not advisable, and frustratingly, in most cases, 
not achievable, but make no mistake, I am not for letting the 
status quo dictate the way our government runs. I am just 
stating that in this case, a change like this brings challenges 
and risk that we must not overlook.
    The agency faces limited budgets, massive contractor 
layoffs and retirement of the signature program and perhaps a 
new way of doing things. Again, a new way of doing things is 
not inherently bad. I am not saying that. I am just saying it 
would bring forth challenges to a workforce and systems and 
processes that are every bit as difficult as designing rockets.
    I do not believe the CAIB report is a historical artifact 
but a guiding document. The Constellation program was designed 
with the CAIB freshly in mind, and we must keep that report 
fresh in ours as time goes on.
    The challenge of a lack of funding permeates every 
discussion we have about NASA but not a distant second is a 
lack of commitment to a defined program. We have a program 
before us. It is time we committed to it with our actions and 
the funding necessary to see it through. In my mind, the cost 
of not doing so far exceeds the amount needed to complete the 
task. We are a Nation founded by great explorers who were 
willing to take great risks. Great success is achieved out of 
the willingness to make great sacrifice. However, as a Nation, 
especially at taxpayer expense, we must be diligent in making 
sure that the promised success is worth the promised sacrifice.
    Thank you, Madam Chairwoman. I yield back my time.
    [The prepared statement of Mr. Olson follows:]
            Prepared Statement of Representative Pete Olson
    Madam Chairwoman, thank you for calling this morning's hearing on a 
topic of paramount importance to the future of our human space flight 
program. The issue of safety really is the starting point from which 
all discussions about the course and purpose of our nation's human 
space flight program should begin.
    I am certain we would have a line of people out the door (and 
behind me, by the way) to test ride a new rocket. That pioneering 
spirit is in the fabric of our nation, but we must not take it for 
granted, nor cheapen it by failing to provide the direction or 
performing the diligence necessary to ensure their safety.
    I'd like to thank our witnesses for their appearance today before 
this subcommittee. I recognize that each of you has spent considerable 
time and effort preparing for this hearing, and in some cases traveling 
considerable distance (although we won't calculate all of Gen. 
Stafford's career miles) to be here. Please know that this subcommittee 
appreciates your efforts, as well as the wisdom and experience that you 
bring, and that we will refer to your guidance in the months and years 
ahead.
    NASA is facing the transition away from the space shuttle and to 
the Constellation program, a program that although is in the midst of 
testing and design, desperately needs more funds. But that is a theme 
across our entire human space flight program. An increase in resources 
would enhance the abilities and capabilities of the commercial sector 
to allow their increased participation in space as well. I fully 
support all of the current endeavors, including commercial cargo, but 
sadly from my position, fully supporting and fully funding are not 
synonymous. I truly wish they were.
    Safety is and must be on the minds of the men and women at NASA all 
the time. We have astronauts orbiting in the ISS right now, and each 
shuttle flight carries with it the extra increment of risk that an 
accident could end NASA as we know it.
    I would like in my brief time to focus on an area of concern that 
to me is just as critical as design standards, human-ratings 
requirements, and airworthiness, to name a few (and not making light of 
any of them) and that is the issue of culture.
    Culture is difficult to define I know, but it is something that the 
Columbia Accident Investigation Board spent a great deal of time on. It 
found that ``the NASA organizational culture had as much to do with 
this accident as the foam.''
    The Augustine report cites that ``significant space achievements 
require continuity of support over many years. One way to assure that 
no successes are achieved is to continually introduce change.'' It must 
not be lost on this committee that the increased participation of 
commercial providers will necessitate a change in business as usual at 
NASA. We cannot take that lightly. Changing the way a bureaucracy 
operates is not easy, in many cases not advisable, and frustratingly, 
in most cases, not achievable. Make no mistake, I am not for letting 
the status quo dictate the way our government runs, I am just stating 
that in this case a change like this brings challenges, and risks, that 
we must not overlook.
    The agency faces limited budgets, massive contractor layoffs, the 
retirement of a signature program, and perhaps a new way of doing 
things. Again, a new way of doing things is not inherently bad, I am 
not saying that, I'm just saying that it will bring forth challenges to 
a workforce and to systems and processes that are every bit as 
difficult as designing rockets.
    I do not believe the CAIB report is a historical artifact, but a 
guiding document. The Constellation program was designed with CAIB 
freshly in mind, and we must keep that report fresh in ours as time 
goes on.
    The challenge of a lack of funding permeates every discussion we 
have about NASA. But a not distant second is the lack of a commitment 
to a defined program. We have a program before us; it is time we 
committed to it with our actions and the funding necessary to see it 
through. In my mind, the cost of not doing so far exceeds the amount 
needed to complete the task.
    We are a nation founded by explorers who were willing to take 
risks. Great success is achieved out of the willingness to make great 
sacrifice. However, as a nation, especially at taxpayer expense, we 
must be diligent in making sure that the promised success is worth the 
possible sacrifice.
    Thank you, Madam Chairwoman. I yield back by time.

    Mr. Hall. Will the gentleman yield to me just one minute 
before he yields back his time?
    Mr. Olson. Yes, sir. Yield back to the ranking member.
    Mr. Hall. Madam Chairperson, we have in the audience a 
longtime staffer and part of the bedrock of the NASA program 
and the bedrock of this Committee, Tom Tate. Tom, we are always 
glad to have you back here and thanks for the many years you 
have spent back on this side of the desk.
    Thank you, Madam Chairman. I yield back.
    Chairwoman Giffords. Thank you.
    Because we anticipate votes probably occurring in about 45 
minutes, I am going to ask if other members have additional 
opening statements that we submit them for the record at this 
point.
    We do have a distinguished set of panelists today. I would 
like to introduce them briefly. Mr. Bryan O'Connor is here. He 
is a veteran of two space shuttle missions and is currently the 
Chief of Safety and Mission Assurance at NASA. He will be 
discussing NASA's processes and plans for resolving safety and 
human rating issues. Next we will hear from Mr. Jeff Hanley, 
who is Program Manager for the Constellation program at NASA. 
He will be discussing the steps taken by the Constellation 
program to maximize crew safety in its Ares-Orion System. We 
will also hear from Mr. John C. Marshall, who is a Council 
Member on NASA's Aerospace Safety Advisory Panel. He will 
provide the perspectives of the agency's outside safety 
advisory board. Welcome. Also, we will hear from Mr. Bretton 
Alexander, who is currently the President of the Commercial 
Spaceflight Federation. He will provide the commercial 
industry's perspectives and plans for addressing crew safety 
issues. Welcome. Dr. Joseph Fragola is Vice President of 
Valador Incorporated. He has more than 40 years experience in 
risk analysis in the aerospace and nuclear industries and will 
provide his perspectives on the issues involved in ensuring the 
safety of both government and non-government crew space 
transportation systems, a true expert. Welcome, Dr. Fragola. 
And of course, Lt. Gen. Tom Stafford, who has been introduced a 
couple times already. We are just very, very delighted that you 
are here.
    As our witnesses should know, you will each have five 
minutes for your spoken testimony. Your written testimony will 
be included in the record for the hearing, and when you have 
completed your spoken testimony, we will begin with questions, 
and each member will have five minutes to question the panel, 
and we would like to begin this morning with Mr. O'Connor.

   STATEMENT OF BRYAN O'CONNOR, CHIEF OF SAFETY AND MISSION 
    ASSURANCE, NATIONAL AERONAUTICS AND SPACE ADMINISTRATION

    Mr. O'Connor. Thank you, Chairwoman Giffords, members of 
the Subcommittee. I appreciate the opportunity to appear here 
today to discuss how NASA works to ensure the safety of human 
spaceflight. In your letter inviting me to testify at today's 
hearing, you asked that I address a number of questions related 
to the Office of Safety and Mission Assurance at NASA and how 
we work with safety of human spaceflight. My statement will 
address those questions and provide additional context.
    The Office of Safety and Mission Assurance provides policy 
direction, functional oversight and assessment for all agency 
safety reliability and quality engineering activities. We are 
responsible for the agency's safety and mission assurance 
requirements and standards and we serve as principal advisor to 
the Administrator on matters pertaining to human spaceflight 
safety and mission success.
    In the past several years, my organization has sponsored 
several initiatives to take advantage of our lessons learned 
from the past 50 years of human spaceflight. Included are 
increased emphasis on the qualifications and credibility of our 
professional workforce, formal technical authority for 
associated safety and mission assurance requirements as well as 
the authority to determine safety risk acceptability for 
designs and for operations including human spaceflight launch, 
increased emphasis on safety culture throughout the human 
spaceflight programs. This includes more open communications 
including encouragement for dissenting opinions, clear appeal 
paths all the way to the Administrator as necessary for safety 
dissenting opinion, and something we started recently called 
the ``Yes If'' initiative. It is an incentive that promotes the 
ideal that credible and capable safety and mission assurance 
professionals don't simply just know the rules but they 
understand the rationale behind those rules to the point that 
they can help the designer and the operator with alternative 
approaches consistent with safety and mission success, 
improvements in critical software, independent validation and 
verification and improvements in our knowledge management 
systems. A significant portion of these activities as well as 
improved audits, assessment and mishap investigation procedures 
and capabilities in the agency are primarily managed at the new 
NASA Safety Center, which we established two years ago in 
Cleveland near the Glenn Research Center.
    As I mentioned, much of our current thinking comes from 
hard lessons learned from the past. The Columbia Accident 
Investigation Board documented for us once again the inherent 
risk of human spaceflight, noting that ``the laws of physics 
make it extraordinarily difficult to reach earth orbit and 
return safely.'' To justify that risk the CAIB called for ``a 
national mandate providing NASA a compelling mission requiring 
human presence in space.'' It also recommended that design of 
the shuttle replacement should give overriding priority to crew 
safety rather than to trade safety against other performance 
criteria such as low cost and reusability or against advanced 
space operations capabilities other than crew transfer. The X-
15 incidents, the Apollo fire, the Challenger, the Columbia 
accidents have caused us to insist on clear lines of 
accountability in what we do with strong checks and balances, 
capable systems integration and a strong safety culture with 
open communications in all directions. We treat every crewed 
spaceflight like an engineering test flight, retaining adequate 
program resources to thoroughly prepare for each flight and to 
analyze and resolve ground and flight anomalies. Finally, we 
emphasize crew escape and emergency systems to improve crew 
survivability during anticipated or unanticipated flight 
contingencies.
    We have also learned an awful lot working with our Russian 
counterparts beginning in Apollo-Soyuz and continuing with 
Shuttle-Mir and the International Space Station about the 
challenges of spaceflight and safety of human spaceflight. For 
example, we note in the Soyuz design the robust reliability and 
failure tolerance features. The systems for unknown 
contingencies are treated with capable, highly capable abort, 
escape and emergency systems.
    On the matter of crew egress and escape and abort, the 
Columbia Crew Survival Investigation Report prepared by NASA 
Spacecraft Crew Survival Integrated Investigation Team released 
last December is a comprehensive study of crew safety equipment 
and procedures used during the Space Shuttle Columbia accident. 
We have made this report available to the Constellation program 
as well as to industry for use and guidance in their design for 
survivability.
    Finally, as we review the options presented by the 
Augustine panel, we are considering how best to address their 
suggested commercial crew transportation options. We are using 
fiscal year 2009 Recovery Act funds to supplement or to support 
activities related to technologies that enable commercial human 
spaceflight capabilities. We are also investing Recovery Act 
funds to begin development of a more concise set of human 
rating technical requirements that might apply to non-NASA 
developers and we are looking at appropriate oversight and 
insight approaches to be used for such a venture.
    In closing, the Office of Safety and Mission Assurance 
plays a significant role in assuring safety of human 
spaceflight. Chairwoman Giffords, I would be happy to respond 
to any questions you or other members have on this matter.
    [The prepared statement of Mr. O'Connor follows:]
                  Prepared Statement of Bryan O'Connor
    Chairwoman Giffords and other Members of the Subcommittee, thank 
you for the opportunity to appear today to discuss how NASA works to 
ensure the safety of human spaceflight. In your letter inviting me to 
testify at today's hearing, you asked that I address a number of 
questions related to the Office of Safety and Mission Assurance and the 
safety of human spaceflight at NASA. My statement will address those 
questions, and provide additional context.

The Role of OSMA in Ensuring Human Spaceflight Safety

    The NASA Office of Safety and Mission Assurance provides policy 
direction, functional oversight, and assessment for all Agency safety, 
reliability, maintainability, and quality engineering and assurance 
activities and serves as a principal advisory resource for the 
Administrator and other senior officials on matters pertaining to human 
spaceflight safety and mission success. As Chief of the Office of 
Safety and Mission Assurance, I report directly to the Administrator. 
OSMA supports the activities of--but is organizationally separate 
from--the human spaceflight Mission Directorates and the Office of the 
Chief Engineer, thus providing the Administrator an independent view of 
the safety and effectiveness of human spaceflight designs, flight test 
and mission operations in addition to all other mission roles of the 
Agency.
    Specifically, the Office of Safety and Mission Assurance:

          Develops strategies, policies, technical 
        requirements, standards, and guidelines for system safety, 
        reliability, maintainability, and quality engineering and 
        assurance;

          Establishes the applicable set of Safety and Mission 
        Assurance (SMA) requirements for all human spaceflight 
        programs, and, through delegated technical authority, formally 
        approves or disapproves waivers, deviations and/or exceptions 
        to same;

          Verifies the effectiveness of safety and mission 
        assurance requirements, activities, and processes, and updates, 
        cancels or changes them as time, technology and/or 
        circumstances dictate;

          Advises NASA leadership on significant safety and 
        mission assurance issues, including investigation of human 
        spaceflight-related mishaps and close calls, and provides 
        guidance for corrective actions stemming from those 
        investigations as well as corrective actions related to ground 
        and flight test anomalies;

          Performs broad-reaching independent assessments of 
        human spaceflight-related activities, including formal 
        Independent Validation and Verification (IV&V) of flight and 
        ground software critical to flight crew safety;

          Oversees and assesses the technical excellence of 
        safety and mission assurance tools, techniques, and practices 
        throughout the human spaceflight program life cycle;

          Provides knowledge management and training in safety 
        and mission assurance disciplines to the assigned workforce; 
        and,

          Assures that adequate levels of both programmatic and 
        Center institutional resources are applied to safety and 
        mission assurance functions.

NASA Human Spaceflight Safety Initiatives

    In the past several years, OSMA has sponsored several initiatives 
with the intent of enhancing the safety of human spaceflight. OSMA has 
increased its emphasis on the qualification and credibility of safety 
and mission assurance professionals by working with the Center 
Directors to assign some of their best and brightest employees to 
safety and mission assurance positions. We have also established a new 
Technical Excellence Program with a four-tier training and 
qualification system for all safety and mission assurance professionals 
across the Agency. Additionally, safety and mission assurance 
professionals assigned to human spaceflight programs now have formal 
technical authority for associated safety and mission assurance 
requirements as well as the authority to determine safety risk 
acceptability for designs and/or operations, including human 
spaceflight launch.
    Another initiative is an increased emphasis on safety culture 
throughout the human spaceflight programs. This includes more open 
communications, including encouragement for dissenting opinions; clear 
appeal paths to the Administrator for safety dissenting opinions; and 
the ``Yes if'' initiative, an incentive that promotes the ideal that 
credible and capable safety and mission assurance professionals not 
simply know the rules, but understand their rationale to the point that 
they can help the design or operations team with alternative approaches 
consistent with safety and mission success.
    OSMA has also made improvements in critical software IV&V by 
increasing the emphasis on validation of critical software requirements 
early in design. The IV&V team is also increasing the use of modeling 
and other systems engineering techniques to enhance their effectiveness 
in assessing the safety and utility of the critical software.
    Improved knowledge management and requirements management tools and 
processes have also been put into place. This includes dedicated 
knowledge capture, archiving and dissemination activities, as well as 
better tools for tracking, updating, and rationalizing the more than 
3,000 NASA technical and operational SMA requirements (many of which 
apply to human spaceflight). These activities, as well as improved 
audit, assessment and mishap investigation procedures and capabilities, 
are all primarily managed at the NASA Safety Center located near the 
Glenn Research Center.
    Finally, OSMA has increased the amount of mentoring, training and 
technical assistance provided by our Headquarters SMA experts to the 
human spaceflight programs and their host Center SMA and engineering 
organizations.

Incorporating Lessons Learned into Agency Standards and Procedures

    The Columbia Accident Investigation Board (CAIB) documented for us 
once again the inherent risk of human spaceflight, noting that ``the 
laws of physics make it extraordinarily difficult to reach earth orbit 
and return safely.'' To justify the risk, the CAIB called for ``a 
national mandate providing NASA a compelling mission requiring human 
presence in space.'' The Board also recommended that `` the design of 
the Shuttle replacement] should give overriding priority to crew 
safety, rather than trade safety against other performance criteria, 
such as low cost and reusability, or against advanced space operation 
capabilities other than crew transfer.''
    The many CAIB recommendations dealing with root causal factors, as 
well as NASA's own Return to Flight assessments, pointed to several 
important lessons including, but not limited to, those outlined below. 
These recommendations and lessons indicate that NASA should:

          Maintain clear lines of accountability including 
        strong checks and balances between program/project managers and 
        their assigned independent technical authorities.

          Organize for a strong program-level systems 
        integration function for complex, multi-element human 
        spaceflight programs.

          Infuse the organization with a strong safety culture 
        with open communications in all directions, encouragement of 
        alternate opinions, and formal appeal paths for dissent.

          Treat every crewed space flight like an engineering 
        test flight, and retain adequate program resources to 
        thoroughly prepare for each flight and analyze and resolve 
        ground and flight anomalies.

          Emphasize crew escape, abort and emergency systems 
        and procedures to improve crew survivability during anticipated 
        or unanticipated flight contingencies.

    In the early 1990s NASA engaged in a joint U.S.-Russian project 
called Shuttle-Mir, picking up where the Apollo-Soyuz Test Project had 
left off in 1975. In preparation for the joint activity, NASA technical 
experts, including senior safety engineers, spent a significant amount 
of time over a three-year period talking with Apollo-Soyuz veterans, 
visiting with current Russian counterparts, and reviewing the long 
history of Soyuz, Salyut, and Mir operations in an effort to understand 
the Russian approach to human spaceflight safety. The two governments 
also established a high-level, joint technical oversight body (the 
Stafford-Utkin, now Stafford-Anfimov, Commission) in January 1995 to 
independently review Soyuz readiness for flight and to report its 
findings directly to the heads of agencies. In March 1995, Norm Thagard 
became the first U.S. astronaut to launch on the Soyuz. He and the 
other five astronauts who spent time on Mir used the Shuttle for 
subsequent transportation, but they all received training in Soyuz as 
their primary escape system.
    Following on the success of the Shuttle-Mir program, NASA and the 
Russian Federal Space Agency (Roscosmos) agreed to create a joint space 
station in 1993. The International Space Station (ISS) 
Intergovernmental Agreement and Memorandum of Understanding (the final 
version of which was signed in 1998) recognized the Russian 
government's responsibility for crewmember safety for their elements, 
including Soyuz. The next American to launch on Soyuz was Bill 
Shepherd, the Commander of the first ISS increment in October 2000. 
Like Thagard, Shepherd returned to Earth on Shuttle, and like the Mir 
astronauts, he was trained on the Soyuz spacecraft. Since then, 14 
different NASA astronauts have flown on Soyuz, bringing the total NASA 
astronaut trips to 14 up, and 13 down, several of which were made 
during the post-Columbia Return-to-Flight timeframe. Canadian and 
European partner astronauts have flown to and from ISS on Soyuz, and 
the next Soyuz will carry a Japanese partner astronaut. As we speak, 
Soyuz is the primary mode of transportation to and from the ISS for all 
ISS crewmembers.
    NASA's Russian partner engineers and managers have been open with 
their designs, operations, system anomalies, and close calls; however, 
there have been occasions when, for various reasons, they have 
restricted technical information transfer to our engineers. On these 
occasions, perseverance by our technical staff on the ground and 
dependence on the Russians' proven engineering and operational savvy 
that spans more than 40 years of human spaceflight, have resulted in 
sufficient confidence in their systems and operations (approximately 96 
percent mission success rate, and 98 percent crew safety record for all 
versions since 1967), and mutual trust initiated during the ApolloSoyuz 
program, and reinforced most recently with over 15 years of joint space 
station operations. Some of the many human spaceflight safety lessons 
from NASA's joint work with the Russians on Soyuz, Mir, and ISS 
include:

          The Russian design philosophy depends heavily upon 
        reliability in addition to adherence to a strong design 
        heritage (robust systems and failure tolerance, often using 
        dissimilar redundancy), but they are big believers in abort, 
        escape, and emergency systems for known or unknown 
        contingencies that are not covered by reliability alone.

          The Russian design philosophy also rests heavily on 
        testing. During the Soyuz update from the TM (modified 
        transport) to TMA (TM anthropometric) version (enlarged in the 
        1990's to accommodate larger astronauts), they performed 
        multiple tests, including drop tests, to ensure that the design 
        was equivalent, or superior, to previous versions. This testing 
        is often carried to conditions beyond the nominal expected 
        environments. As Roscosmos prepares to upgrade the control 
        computer system on the Soyuz, they are first installing and 
        testing this upgrade in the Progress cargo vehicles. In this 
        way, they can flight test the system with less critical cargo 
        before it is required to transport crew. This provides an 
        additional rigorous test and helps to insure overall crew 
        safety.

          The Russian development philosophy is based on 
        evolutionary upgrades, keeping what works, and modifying or 
        replacing what does not.

          The Russian design and operational organizations 
        include reliability and quality engineering staffs, but they do 
        not have an independent safety engineering staff like NASA 
        does. That said, they include many of the same safety functions 
        as NASA does as part of the other engineering disciplines, and 
        they do provide one of their most experienced engineers as 
        NASA's SMA counterpart.

          The Russian technical staff is very skilled and 
        displays outstanding knowledge of the flight systems. With 
        relatively low turnover, they also have excellent corporate 
        memory, which helps them deal with any repeat problems.

          The Russians, unlike NASA, rely on automation and 
        ground control for certain critical dynamic events like abort 
        initiation, landing, proximity operations and docking.

    Although NASA and Roscosmos have occasionally disagreed about 
relative risk levels for such things as orbital debris, battery 
hazards, etc., our experience to date shows us that they have no 
intention of putting crewmembers in known unsafe situations for the 
sake of expediency.
    The Columbia Crew Survival Investigation Report, prepared by the 
NASA Spacecraft Crew Survival Integrated Investigation Team (SCSIIT) 
and released in December 2008, is a comprehensive study of crew safety, 
equipment and procedures used during the Space Shuttle Columbia 
accident. The report contains 29 specific findings, half of which apply 
to Space Shuttle and to NASA investigation procedures, and half to 
future designs. The Constellation Program has assessed the report's 
findings, incorporating several of them into the Orion design, and the 
Program plans to incorporate others as the design matures. The 
fundamental theme of the findings is that human spaceflight programs 
should include crew survivability in the system design, and that 
operational plans should provide for safe egress, abort and/or escape 
from contingency situations. This is a top level requirement in NASA's 
most recent human rating requirements policy contained in NASA 
Procedural Requirement (NPR) 8705.2B (May 6, 2008). The rationale comes 
from our three fatal human spaceflight accidents. It is not enough to 
design a human spaceflight system to be reliable. The Earth-to-orbit 
mission is about managing incredibly high-energy systems and 
environments, with very little room for error. When measured by number 
of flights, human spaceflight transportation is still relatively 
immature, and the designers and operators are continuously learning 
about the real risks involved with spaceflight activities. Thus, as the 
report highlights, and the human rating requirements mandate, there is 
a need to provide the crew with a fighting chance for survival if and 
when something goes wrong, anticipated or not.
    The Constellation Program is using the SCSIIT report as a design 
guideline; and as the Program tailors its suggestions into Program 
requirements, we in OSMA are drafting a follow-on technical standard 
for use by future human spaceflight system developers. The design 
standard will provide cues for designers and will also make it clear 
that the addition of any systems to increase the survivability of the 
crew needs to consider both the system design and concept of 
operations. In the meantime, NASA has made the SCSIIT report available 
to the public, sending copies directly to all known commercial space 
companies. The SCS1IT has also given presentations about the associated 
lessons-learned to NASA Centers, as well as to the National 
Transportation Safety Board, Federal Aviation Administration, the 
Department of Defense, the Defense Contract Management Agency, and 
others totaling over 4000 people to date.

Safety and Commercial Spaceflight

    NASA will require that any Earth-to-orbit and/or orbit-to-Earth 
system that carries NASA astronauts be human rated, thus ensuring that 
all of our stringent crew and launch safety requirements would be met 
before any NASA crew would be allowed to travel on a spaceflight 
vehicle. As part of that process, the Agency's Technical Authorities 
(Engineering, SMA and Health and Medical) will determine which of 
NASA's mandatory standards apply in designing, manufacturing and 
operating their system. OSMA and the Johnson Space Center SMA 
organization worked closely with the Constellation program for over six 
months in 2008 to establish and tailor the applicable SMA requirements 
for the Constellation Program. This was a very detailed and involved 
activity that reminded us that the job of validating the right set of 
requirements for a new crewed flight system is not a simple cookie-
cutter or checklist task. Nor is it expected to be a one-time task. The 
requirements refining and tailoring process will continue as we learn 
more about the design, the environment and the operational concepts. 
NASA's Commercial Crew and Cargo Program Office has initiated an effort 
to determine and establish the requirements (both process and design) 
as well as any other standards that should apply to commercial partners 
when engaging in services for transporting astronauts.
    Currently, NASA is working with two companies, Space Explorations 
Technologies Corporation (Space X) and Orbital Sciences Corporation 
(Orbital), as part of individual Commercial Orbital Transportation 
Services (COTS) projects designed to develop and demonstrate commercial 
cargo capabilities to and from low-Earth orbit. In doing so, NASA has 
agreed to pay both companies prenegotiated amounts when each company 
achieves pre-negotiated milestones outlined in Space Act Agreements, 
and OSMA is part of the review team assessing each company's progress 
toward meeting required milestones. Last year, NASA also issued 
contracts to both Space X and Orbital, for cargo delivery to the ISS 
under the Commercial Resupply Services (CRS) Program.
    NASA is utilizing FY 2009 Recovery Act funds to support activities 
to stimulate efforts to develop and demonstrate technologies that 
enable commercial human spaceflight capabilities. NASA is also 
investing Recovery Act funds to begin development of a more concise set 
of NASA human rating technical requirements. These requirements would 
be applicable to NASA developed crew transportation systems as well as 
commercially-developed crew transportation systems for use by NASA. 
This task is being performed by a team comprised of representatives 
from NASA's human spaceflight programs, the Astronaut Office, and 
Agency technical authorities, including OSMA. We are also consulting 
with other Government partners such as the Federal Aviation 
Administration and with commercial stakeholders.

Conclusion

    In closing, the Office of Safety and Mission Assurance plays a 
significant role in ensuring the safety of human spaceflight. By 
continually improving its workforce, communications, and processes, the 
Office of Safety and Mission Assurance is an organization of technical 
excellence that is well-equipped to support the Agency's human 
spaceflight safety efforts. By disseminating and incorporating into its 
standards and policies the many lessons learned throughout the history 
of human spaceflight, NASA is able to improve safety in its own future 
designs, and to facilitate safety in those that may be developed 
commercially.
    Chairwoman Giffords, I would be happy to respond to any questions 
you or the other Members of the Subcommittee may have.

    Chairwoman Giffords. Thank you, Mr. O'Connor.
    Mr. Hanley.

   STATEMENT OF JEFF HANLEY, PROGRAM MANAGER, CONSTELLATION 
  PROGRAM, EXPLORATION SYSTEMS MISSION DIRECTORATE, NATIONAL 
              AERONAUTICS AND SPACE ADMINISTRATION

    Mr. Hanley. Good morning. Chairwoman Giffords and members 
of the Subcommittee, thank you for the opportunity to appear 
here today to discuss NASA's emphasis on the continuing effort 
to improve safety factors for our most valuable commodity, 
NASA's astronauts. Simply put, safety is a top priority of 
NASA's Constellation program.
    My testimony today will outline how the Constellation 
program has sought to improve crew safety above that achieved 
in previous crewed spacecraft. This has been accomplished by 
incorporating safety into the Constellation design process from 
the very beginning, and in doing so, we are ensuring that the 
Constellation vehicles are being designed to account for future 
missions beyond low earth orbit as well as the less challenging 
requirements of our current Space Station missions.
    However, before we delve too far into the Constellation 
program's risk-informed design process, I think it is first 
important that we take a look back where we came from. Many of 
you have touched on some of that foundation here this morning 
already. Following the loss of the Space Shuttle Columbia, NASA 
chartered the Columbia Accident Investigation Board to provide 
the agency with the guidelines for moving forward with our 
return to flight activities. Mr. O'Connor cited the finding in 
their report, and I won't repeat it here again, that informed 
our design efforts going forward from there. The crew office 
also put out a memo then in 2004 weighing in on the discussion 
about how the next generation human spaceflight system should 
be designed, stating that an order of magnitude reduction ``in 
the risk of loss of human life during ascent compared to the 
space shuttle is both achievable with current technology and 
consistent with NASA's focus on steadily improving rocket 
reliability and should therefore represent a minimum safety 
benchmark for future systems.'' NASA's Exploration Systems 
Architecture Study of 2005 used this guidance in recommending 
that NASA select a single, solid first-stage concept that would 
later become known as the Ares I Crew Launch Vehicle.
    Today, the Constellation program has a design goal of 
increasing astronaut safety 10-fold relative to shuttle 
missions and we believe that this goal is achievable for four 
key reasons. First, Constellation is utilizing a multifaceted 
design approach that remains unchanged since Apollo: design the 
system to be inherently as safe as we can make it, eliminate 
known risks and hazards where we find them and then add backup 
such as an abort system to mitigate the residual risk. In 
addition to leveraging systems with human-rated heritage such 
as the space shuttle solid rocket motor, NASA is utilizing 
improved computer modeling to help identify, reduce and 
eliminate hazards and risks where we find them.
    Second, unlike the space shuttle, the Orion capsule will 
have a launch abort system. During Apollo, NASA had 
comparatively little experience and computational capability 
and the abort effectiveness of such a system was only 
estimated. Today we can use advanced simulation tools and 
computers to test within the computer so that NASA can conduct 
a more thorough analysis in addition to utilizing test flights.
    Third, Constellation has chosen to tightly interweave 
design and safety team members into the design process. The 
team has actively worked with design engineers to provide 
expertise and feedback via various assessments and analyses 
throughout the design maturation process and that process is 
ongoing and continues.
    And finally, Constellation has used the agency's active 
risk management approach that identifies technical challenges 
early in the design process and aggressively works solutions. 
Technical risks are identified by likelihood of occurrence and 
consequence, allowing designers to modify the emerging design 
to reduce or eliminate hazards.
    Currently, the Constellation program is progressing through 
an active phase of hardware and software tests, and as tests 
are completed and data analyzed, our models will be updated, 
allowing us to improve safety and improve system performance. 
At the same time, we are investing heavily in risk-reduction 
hardware and activities that will help better calibrate and 
refine our models and simulations data that is essential to 
incorporate as early as possible into the Ares I and Orion 
designs.
    NASA is also developing an integrated test and verification 
plan as part of its program preliminary design review in the 
next calendar year that includes a series of developmental 
tests to further refine and validate our designs. For example, 
on October 28, NASA completed the Ares I-X test flight at the 
Kennedy Space Center in Florida, and although the data is still 
being collected and processed from more than 700 onboard 
sensors, the data is already providing tremendous insight into 
the aerodynamic, acoustic, structural, vibrational and thermal 
forces that Ares I is expected to experience, knowledge that 
will contribute substantially to the reliability and safety of 
the Ares I design.
    In closing, I would like to reiterate that safety is and 
always will be our number one priority in everything we do and 
that everyone at NASA is dedicated to ensuring that our 
astronauts are equipped to safely conduct the missions asked of 
them and that they are able to return safely home.
    Chairwoman Giffords, I would be pleased to respond to any 
questions the member might have.
    [The prepared statement of Mr. Hanley follows:]
                  Prepared Statement of Jeffrey Hanley
    Chairwoman Giffords and Members of the Subcommittee, thank you for 
the opportunity to appear today to discuss NASA's next-generation human 
spaceflight program and the Agency's emphasis on continuing to improve 
safety factors for our most valuable assets--the men and women who dare 
to explore the mysteries of our universe. Everyone at NASA is dedicated 
to ensuring that these brave pioneers are equipped to safely conduct 
the missions asked of them, and that they are then able to safely 
return home to their loved ones. Simply put, safety is the first of our 
core values at NASA, and it is also the top priority of the Agency's 
Constellation Program.
    As requested in your invitation to me to testify at today's 
hearing, my testimony will outline NASA's ongoing focus on safety 
matters with regard to human spaceflight, focusing primarily on how the 
Agency sought to improve crew safety for the Constellation Program 
above that achieved on previous crewed spacecraft. This has been 
accomplished by incorporating safety in all aspects of Constellation 
from the beginning of the design process. My testimony will also 
outline how the Constellation Program has progressed into the early 
developmental testing stages, and how data from those tests is being 
used to improve our models and to validate the rigorous safety 
requirements developed for the Constellation vehicles.

Columbia Accident Investigation Board and the Exploration Systems 
                    Architecture Study

    In 2003, the Columbia Accident Investigation Board (CAIB) report 
provided NASA with guidelines for moving forward with our return to 
flight efforts. In addition to determining the causes of the Columbia 
accident, the CAIB also provided the Agency with a set of comprehensive 
recommendations to improve the safety of the Space Shuttle Program and 
to change the corporate culture of the Agency--changes that have 
positively impacted the Constellation Program. NASA has also 
established processes that enhance our ability to assess risk and to 
improve communication across all levels and organizations within the 
Constellation team.
    More specifically, with regard to the design of the next-generation 
crew launch vehicle, the CAIB recommended that:

         ``The design of the system [that replaces the Shuttle] should 
        give overriding priority to crew safety, rather than trade 
        safety against other performance criteria, such as low cost and 
        reusability, or against advanced space operation capabilities 
        other than crew transfer.''

    In other words, the CAIB gave NASA clear guidance that the next-
generation crew launch vehicle should be simpler and safer, and that 
crew safety should be the driving design principle. Now the question 
became, how did we meet this challenge? More specifically, how did we 
make a vehicle ``inherently safe'' while also protecting against 
residual risk, in a mass-constrained, highly-energetic system such as a 
launch vehicle? We started by going back to the basics, first 
identifying the known risks and hazards and then working to eliminate, 
or at least to minimize, each one of them. From there, the designers 
turned their attention to developing acceptable mitigation approaches 
for the residual risks. From the beginning, this complicated and 
lengthy process, known as risk-informed design, has been at the heart 
of NASA's Constellation Program.
    However, before there was even a program known as Constellation, 
NASA used the CAIB guidance and other policy directives to initiate the 
Exploration Systems Architecture Study (ESAS) in 2005 with the purpose 
of assessing and defining the top-level requirements and configurations 
for crew and cargo launch systems, not only to support future lunar and 
Mars exploration programs, but also to support the International Space 
Station.
    In conducting its review, the ESAS team focused on guidance issued 
by the Chief of the Astronaut Office in May 2004--particularly on one 
key statement, which states:

         The Astronaut Office believes that an order-of-magnitude 
        reduction in the risk of loss of human life during ascent, 
        compared to the Space Shuttle, is both achievable with current 
        technology and consistent with NASA 's focus on steadily 
        improving rocket reliability, and should therefore represent a 
        minimum safety benchmark for future systems. This corresponds 
        to a predicted ascent reliability of at least 0.999.

    Keeping in mind the CAIB recommendation of focusing on crew safety 
first, ESAS placed a premium on crew safety. All candidate crew launch 
vehicle concepts considered during ESAS included an escape capability 
referenced as a launch abort system or LAS. During the study, NASA 
eliminated any launch vehicle concept that did not approach at least a 
predicted probability for loss of crew (LOC) of 1 in 1,000 missions. In 
addition, concepts that would place the crew module in close proximity 
to the boosters and/or other potential sources of accident initiation 
were eliminated to improve the reliability of a LAS and to improve the 
likelihood of crew survival in the event of an accident during ascent. 
This process resulted in the selection of the single solid First Stage 
concept, which would later become known as the Ares I Crew Launch 
Vehicle. In the end, the potential for increased safety provided by 
Ares I (compared to other alternatives considered during ESAS) was 
based primarily on the simplicity of the First Stage.
    As compared to the Space Shuttle, the Ares I will be a simpler 
vehicle to process prior to launch because NASA has designed the Ares 
Ito have fewer moving parts, thus requiring less hands-on labor prior 
to launch, and also reducing the potential for human error. In addition 
to the inherent safety associated with the rocket's simplified design, 
the Ares I integrated rocket will have a LAS for crew, as will be 
outlined in greater detail during the next section of this testimony.

The Constellation Program and Risk-Informed Design

    In the Apollo era, crewed launchers were designed with the best 
level of expertise available, tested to exhaustion, and then robustness 
or redundancy was added to mitigate the residual risk. The goal was to 
make the design as reliable as possible, so that backup systems would 
never have to be used, and to make the backup systems as robust as 
possible to maximize the likelihood of crew survival and return, should 
a failure (anticipated or not) of the primary system or element take 
place. This approach worked, producing dramatic advances in reliability 
and crew safety, as proven, for example, when the Lunar Module did not 
experience a single anomaly on the final lunar mission, and the crew 
survived despite the explosion aboard the Command/Service Module during 
the Apollo 13 mission. However, as my colleague, Bryan O'Connor, will 
outline in his testimony, safety at NASA is also about more than 
design. NASA's focus on safety also includes ensuring that our crews 
and operators know how to deal with contingencies, and that, when 
someone has a concern about a safety issue, whether it be a crew 
member, a design team member etc. that there are clear paths for those 
who have dissenting opinions to raise their concerns to senior 
management.
    Today, NASA's Constellation Program has a goal of increasing 
astronaut safety tenfold relative to Shuttle missions. While a 
seemingly daunting challenge, NASA believes that this goal is 
achievable for many reasons.
    First, NASA is utilizing a multi-faceted design objective for 
safety that remains the same as during the Apollo era--design the 
system to be as inherently safe as we can make it, and then add backup 
to mitigate the predicted as well as unknown residual risk. This, along 
with aforementioned guidance issued by the Chief of the Astronaut 
Office in May 2004, was the starting point of the Constellation design 
team. As has been stated, inherent safety implies the elimination of 
hazards that have historically been associated with the operation of 
the type of system being designed. This, in turn, implies the 
systematic identification of the hazards associated with operation of 
the system alternatives being considered.
    The key to a risk-informed design is integrating risk analysis into 
the design alternative evaluation and selection process in a 
fundamental way by using newly capable, logical, and phenomenological 
(or physics-based) computer models. These models help focus the design 
effort toward identifying and reducing or eliminating design hazards, 
which, in turn, helps NASA identify and develop mitigation approaches 
to address the residual risks. In addition, NASA recognizes that safety 
of an overall system can be improved by addressing human factors 
issues, which is why the Ares I Upper Stage and Orion designs have been 
developed to simplify and automate processing and operations as much as 
possible, thus reducing the potential for human error.
    Second, unlike the Space Shuttle, the Orion crew capsule will have 
a LAS that will offer a safer and more reliable method of moving the 
entire crew out of danger in the event of an emergency on the launch 
pad or during the climb to Earth orbit. Mounted at the top of the Orion 
and Ares I launch vehicle stack, LAS will be capable of automatically 
separating the Orion from the launch vehicles and positioning the Orion 
and its crew for landing. In comparison, during Apollo, NASA had 
comparatively little experience and computational capability, and the 
abort effectiveness was estimated by comparison to escapes from high-
performance military aircraft combined with the results of a few escape 
system tests. Today, with the flight tests combined with advanced 
simulation tools and advanced computers available, NASA can conduct a 
more thorough analysis. Specifically, the integrated abort system's 
effectiveness can now be calculated using computer models of the blast 
environment by employing more realistic, physics-based, simulations of 
abort conditions. While computer models and computational capability 
were much less capable during the Apollo era, today this calculation 
can be carried out with remarkable speed and accuracy given NASA's 
evolved engineering expertise and the computational power of our 
computers.
    Third, Constellation has chosen to tightly interweave the design 
and safety team members into the decision making process. As a result, 
the Constellation team represents skills from safety and reliability 
engineering disciplines traditionally found under the Safety and 
Mission Assurance organizations, as well as engineers with backgrounds 
such as computational fluid dynamics, aerospace, and physics 
disciplines. The team has been given the clear direction to work daily 
with the design engineers to provide expertise and feedback via various 
assessments and analysis techniques throughout the design maturation 
process. This investment demonstrates a sincere commitment to the CAIB 
findings.
    Finally, as a key element of our risk-informed design process, the 
Agency has an active risk-management process that identifies technical 
challenges early in the process and aggressively works solutions. The 
Program identified key risks during the risk management process and 
associated mitigation steps to inform the designs. Technical risks are 
identified by likelihood of occurrence and consequence. For example, 
NASA is currently working a thrust oscillation risk for the Ares I 
First Stage. This phenomenon is a characteristic of all solid rocket 
motors. NASA has made significant progress in identifying both primary 
and backup approaches to mitigate the oscillation effect, and we now 
believe that we have now baselined a passive mitigation technique. 
However, additional testing will continue to ensure we have the best 
mitigation prior to making the final decision at the Constellation 
Program's Preliminary Design Review (PDR) early next year. With regard 
to the Upper Stage, the J-2X engine remains a priority, with the focus 
being on achieving needed performance requirements while also 
incorporating modem approaches (e.g., materials, manufacturing, 
electronics, etc) into this Apollo-era heritage hardware.
    In choosing a Shuttle-derived architecture, NASA recognized from 
the outset that some of the heritage hardware would need to be modified 
or replaced so as to achieve improved safety, reliability, as well as 
to meet needed performance and lower lifecycle costs. At the same time, 
the Agency recognized that leveraging systems with human-rated heritage 
would reduce the uncertainties and risks associated with developing a 
new human-rated crew launch vehicle. For example, the Ares I First 
Stage consists of a five-segment reusable solid rocket motor (RSRM), an 
aft skirt, a forward skirt, and a frustum. The five-segment RSRM is an 
evolutionary development from the four-segment solid RSRM strap-ons 
currently utilized to power the Space Shuttle. As a result, the 
Constellation Program is building on the proven track record of this 
heritage hardware. There have been 252 solids flown in the Shuttle 
Program with one failure (Challenger STS-51L). The Ares I also benefits 
from the improvements in the RSRMs that have resulted from recovery and 
post-flight inspections along with modifications that have been made to 
the Shuttle boosters. The Ares I booster also will continue the 
protocol of recovery and post-flight inspection that began in the 
Shuttle Program.
    The J-2X engine would be used for both the Ares I and Ares V 
vehicles, thus creating a common link between the two vehicles that is 
based on evolved heritage hardware, specifically the powerful J-2 
engine that propelled the Apollo-era Upper Stage on the Saturn I-B and 
Saturn V rockets, and the J-2S that was developed and tested in the 
early 1970s. In addition, the J-2X will leverage knowledge from the 
Delta IV's RS-68 by incorporating manufacturing techniques from the RS-
68 into the J-2X engine. However, NASA recognizes that there are also 
challenges involved with utilizing and integrating heritage systems 
into new vehicles, so for the J-2X, NASA has taken steps to increase 
the amount of component-level testing, to procure additional 
development hardware, and to work to make a third test stand available 
to the contractor earlier than originally planned.
    Already, the Ares I risk assessment and failure analysis teams have 
provided input and/or impacted the outcome of Ares I design issues, 
trades, or risks on numerous challenges, including:

          Abort triggers study: Provided LOC and Abort 
        Effectiveness assessments, including engineering models and 
        timing, to determine what potentially catastrophic scenarios 
        warrant abort sensors and software algorithms;

          Separation study (booster deceleration motors ): 
        Hazard analysis combined with probabilistic design analysis led 
        to the design decision to increase the number of booster 
        deceleration motors from eight to 10; and,

          The Hazards Team identified that the First Stage and 
        Upper Stage designs failed to meet properly at the interface 
        flange (due to differing number of bolts) and a re-design was 
        instituted. The team provided an assessment to Upper Stage that 
        resulted in clocking of the hydrogen and oxygen vents to 
        improve separation distance.

    While NASA awaits further direction from the President and Congress 
with regard to the future of human spaceflight, the Agency is 
continuing to pursue our current programs, per direction from the 
Office of Science and Technology Policy. Currently, the Constellation 
Program is progressing through an active phase of hardware and software 
tests and, as tests are completed and data analyzed, our models will be 
updated, allowing us to improve safety and improve systems performance. 
At the same time, we are investing heavily in risk-reduction hardware 
and activities that will help calibrate and refine our models and 
simulations related to the Ares I and Orion--data that is essential to 
incorporate as early as possible into vehicle designs, based on the 
Program's risk-based design approach. NASA is developing an Integrated 
Test and Verification plan that includes a series of developmental 
tests to further refine and validate our designs. Test flights, for 
example, are being designed to include several hundred measurement 
points that will characterize the actual operating environment and 
system performance in the most stressing of cases. NASA is in the 
process of continuing to refine this test and verification strategy 
prior to the Program's PDR early next year, when the Integrated Test 
and Verification plan will be baselined.
    Following are just a few examples of recent and upcoming 
developmental tests which have yielded, or are expected to yield, 
significant amounts of data that will be incorporated into our risk-
based design effort:

          In September 2009, NASA and ATK conducted the first 
        test of the Ares I's five-segment development motor in 
        Promontory, Utah. This test provided NASA with valuable thrust, 
        roll-control, acoustics and vibration data as engineers 
        continue to design the Ares I. In all, seven ground tests are 
        scheduled for the five-segment booster.

          In October 2009, the Ares I-X test flight took place 
        at Kennedy Space Center in Florida. Although data is still 
        being collected and processed from more than 700 on-board 
        sensors, preliminary results show that the vehicle performed 
        precisely as it was meant to perform. Early data shows that the 
        vehicle was effectively controlled and stable in flight. Thrust 
        oscillation frequencies and magnitude data from the Ares I-X 
        flight are consistent with measurements from recent Shuttle 
        flights that were instrumented, leading us to conclude that the 
        oscillation vibration on the Ares I would be within the bounds 
        that the Ares I is currently being designed to. When assessment 
        of this data is finalized, we believe it will provide 
        tremendous insight into the aerodynamic, acoustic, structural, 
        vibration, and thermal forces that Ares I is expected to 
        experience--knowledge that will contribute substantially to the 
        reliability and safety of the Ares I design, as well as to 
        enhancing NASA's modeling capabilities for future vehicles.

          In March 2010, NASA plans to perform its first 
        developmental test of the Orion LAS at the White Sands Missile 
        Range, New Mexico. This test will validate the LAS design 
        approach and will contribute substantially to the Orion's final 
        designs for reliability and safety. NASA plans a series of 
        tests to characterize the LAS. The Pad Abort I test is the 
        first of these tests, and it will address what happens if an 
        emergency occurs while the Orion and the launch vehicle are 
        still on the launch pad. Other tests will determine how the LAS 
        performs in critical parts of the flight regime.

Human Rating and the Constellation Vehicles

    The launch of any spacecraft is a very dynamic event that requires 
a tremendous amount of energy to accelerate to orbital velocities in a 
matter of minutes. There also is significant inherent risk that exposes 
a flight crew to potential hazards that could be catastrophic, if not 
controlled. Therefore, through a very stringent process of human 
rating, NASA attempts to eliminate hazards that could harm the crew, 
control the hazards that do remain, train the crews and operators to 
react appropriately, control the manufacturing and test of all 
components to minimize errors, and provide for crew survival even in 
the presence of system failures. Spaceflight vehicles are cleared by 
NASA to carry crew for missions that are associated with specific 
mission and performance requirements in an engineering flight test 
environment. It is also important to note that certification is made 
for an entire spaceflight system (i.e. Ares I, Orion, and associated 
ground support infrastructure count as one entire system), and not for 
specific elements of a system. NASA is currently in the process of 
developing those specific mission requirements for Ares I and Orion.
    To guide the evolution of human rating requirements for any 
mission, NASA is developing Agency-level requirements documents. 
However, human rating a spaceflight system is not as easy as following 
one document. Instead, it is an intricate, continuing process, 
involving the translation of requirements into designs that can be 
built, tested, and certified for flight, and an understanding of risks 
with mitigation approaches in place. However, the challenge to projects 
such as Ares I and Orion is that there is no single document that 
spells out what they should do to receive a human rating certification 
from the Agency.
    NASA is investing FY 2009 Recovery Act funds to begin development 
of a more concise set of NASA human rating technical requirements. 
These requirements would be applicable to NASA developed crew 
transportation systems as well as commercially-developed crew 
transportation systems for use by NASA. This task is being performed by 
a team comprised of representatives from NASA's human spaceflight 
programs, the Astronaut Office, Agency technical authorities, including 
the Office of Safety and Mission Assurance. We are also consulting with 
other Government partners such as the Federal Aviation Administration 
and with commercial stakeholders.

Conclusion

    In closing, I would like to quote from the October 2009 Review of 
U.S. Human Spaceflight Plans report: ``Human space travel has many 
benefits, but it is an inherently dangerous behavior.'' NASA 
wholeheartedly endorses this statement because it is a challenge we 
live with day in and day out. Safety is and will always be our number 
one priority in everything we do. That is why the Constellation Program 
has employed a continuous risk-informed design process, and that is why 
our designs are being developed with an overriding priority given to 
crew safety at every stage of the design and operational process.
    Chairwoman Giffords, I would be pleased to respond to any questions 
that you or the other Members of the Subcommittee may have.

    Chairwoman Giffords. Thank you, Mr. Hanley, for your 
testimony.
    Next we will hear from Mr. Marshall.

STATEMENT OF JOHN C. MARSHALL, COUNCIL MEMBER, AEROSPACE SAFETY 
 ADVISORY PANEL, NATIONAL AERONAUTICS AND SPACE ADMINISTRATION

    Mr. Marshall. Chairwoman Giffords and other distinguished 
members of the committee, good morning. Thank you again for 
inviting the ASAP to testify before your Subcommittee today.
    As you may know, today's topic has been area of interest 
that the ASAP has focused on for a sustained period. Most 
recently we visited SpaceX and Orbital Sciences, both currently 
commercial providers to NASA for logistics re-supply to the 
Space Station, to discuss firsthand their approach to 
integrating safety into their vehicles.
    Of course, interest in using the commercial space industry 
to fulfill NASA's crew delivery services to low earth orbit, 
LEO, has spiked because of the recent Augustine report 
recommendations that appropriate consideration be given to 
turning the service over to the commercial sector. In making 
this recommendation, they also noted that while safety never 
can be absolutely assured, safety was assumed to be a given. 
The ASAP believes this assumption was premature and an 
oversimplification of a complex and challenging problem in that 
there is no cookie cutter approach to safety in space nor is it 
a ``given.''
    NASA's Procedural Requirements, NPR 8705.2b, identifies the 
human rating process for NASA space systems. It specifies a 
risk-based approach to evaluate a system against pre-
established requirements. It does not, however, establish what 
those requirements are. NASA emphatically intends this document 
to be a starting point with detailed requirements to be 
tailored specifically for each NASA human spaceflight program 
including a possible NASA-crewed COTS mission.
    Because it is illogical to rely on commercial providers to 
develop their own requirements for contractual services on 
human spaceflight to NASA, the ASAP strongly believes that 
specific criteria should be developed to establish how safe is 
safe enough for these services. In addition, it is imperative 
that the COTS enterprises understand in detail how verification 
of compliance shall be demonstrated. This just now is being 
developed by NASA.
    With the above background, I will now briefly address the 
four questions that you asked us to talk to. First was, what do 
you consider to be the most safety-related issues that will 
have to be addressed if NASA were to consider using commercial 
providers for crew transportation and station crew rescue 
services. The ASAP believes that ensuring the safety of NASA's 
astronauts that we send into space may be the hardest part of 
commercialization of the LEO crew transportation mission. 
Significant challenges to be solved include first establishing 
detailed safety requirements that NASA deems essential to safe 
flight. There must be clear and enforceable form that can be 
placed into a contract and tested for compliance. Second, 
because no launch vehicle can be considered truly safe in the 
conventional sense of the word, establishing minimum acceptable 
safety levels to guide systems safety design and a baseline for 
both NASA and their contractors as to what is safe enough is 
critical. Third, much of the inherent safety of spacecraft 
design depends upon choices and decisions where risks are 
weighed against performance costs and schedule. A process to 
ensure that all the potential hazards are properly vetted by 
both the government and contractors is important. This will 
require more than the hands-off approach that some envision. 
And finally, establishing a disciplined process-related checks 
and balances so that NASA can verify that the contractor has 
demonstrated compliance with the launch vehicle designs 
requirements is necessary.
    The next question was, what safety standards should 
commercial entities have to meet if they are chosen by NASA to 
carry U.S. government astronauts to low earth orbit and what 
will be required for verification? As noted previously, NASA's 
NPR procedures prescribe a human rating process for NASA's 
space system. This document, changed in 2008, represents a 
significant and substantive shift from the prescriptive 
approach to one that applies good engineering standards and 
judgments. Prescriptive standards describe how things get done 
and are applied rigidly. A good-judgment approach offers less 
specific direction and guidance. The ASAP sees advantages in 
both but with a clear need for written guidance of record of 
change and direct connectivity to establish time-tested 
engineering standards.
    In this regard, it is the ASAP position that any new 
standards for commercial entities should begin with NASA's NPR 
and that the human rating for each system must appropriately be 
tailored to combine robust design, solid engineering, and 
testing along with a system safety approach for examining 
options to minimize the probability and impact of failure. 
Doing so will in the end provide both higher reliability and 
safety for human life. With respect to demonstration, 
verification and certification, the ASAP agrees that each of 
these actions must be performed for both government and 
commercial programs prior to NASA's use. It also is the ASAP's 
position that NASA is the best qualified to be the oversight 
body for each of these actions.
    Three: What would be required to certify the airworthiness 
of any commercially provided crew transportation system or 
station rescue service prior to its use by U.S. government 
astronauts? How long do you anticipate such certification would 
take? As you know, airworthiness certification is a process 
that is carried out by a regulatory body. Typically, it is an 
agency such as the FAA or government organization. 
Certification gives assurance that necessary practices, 
policies and criteria have been satisfied to protect the safety 
of the crew, passengers and the public from harm due to a 
design or operational flaw in the functioning of the vehicle. 
For certification of any commercial or government space 
transportation system, it is clear that the human rating 
standard would have to be understood by all of the 
participating parties once those standards are known and it is 
incumbent upon any party presenting a vehicle for use to 
present compelling evidence that the standards have been met. 
That evidence can take several forms, most of which are covered 
by standard industry practices. In the case of crew delivery, 
cargo delivery, rescue from the station, it is well to remember 
that it must not only be certified for its own safe operations 
in itself but must also be able to approach, dock and interface 
with the station without presenting a hazard to that vehicle as 
well.
    In response to the question of how long such a process 
would take, our experience indicates that this is a function of 
two things. First, there must be clarity and mutual 
understanding the requirements and a process for verifying the 
requirements have been met. Second, there must be an openness 
and degree of sharing of cooperation of the design process to 
the reviewing authority. Of course, the completion of the 
review remains directly proportional to the complexity and 
uniqueness of the proposed system.
    Finally, in the annual report that ASAP published for 2008, 
the ASAP is concerned about human rating requirements 
substance, applications and standards NASA-wide. What is the 
basis for this concern? The basis for our concern is that in 
more than two years into the COTS program, efforts to develop 
human rating standards for a COTS-D-like program have only just 
begun and no guidance thus far has been promulgated. Therefore, 
it is premature to consider any potential COTS-D vehicle as 
being human rated. If COTS entities are to ever provide the 
level of safety expected for NASA crews, it is imperative that 
NASA's criteria for safety design of such systems quickly be 
agreed upon and provided to current or future providers.
    I would be happy to respond to any other questions you or 
any other members may have.
    [The prepared statement of Mr. Marshall follows:]
                  Prepared Statement of John Marshall
    Chairwoman Giffords and other distinguished members of the 
Subcommittee, good morning. Thank you for inviting the Aerospace Safety 
Advisory Panel (ASAP) to testify again before your Subcommittee on the 
topic of ensuring human space flight safety in future government and 
potential future non-government space transportation systems.
    As you may know, this topic has been an area of interest that the 
ASAP has focused on over a sustained period. Most recently we have 
visited the Space Exploration Technologies Corporation (Space X) and 
Orbital Sciences Corporation, both currently commercial providers to 
NASA for logistical re-supply to the International Space Station 
(ISS)--and possible Commercial Orbital Transportation Services (COTS-D) 
providers in the future, to discuss firsthand their approach towards 
integrating safety into their vehicles.
    Of course interest in using the commercial space industry to 
fulfill NASA crew-delivery services to Low Earth Orbit (LOE) has spiked 
because of the recent Augustine report recommendation that appropriate 
consideration be given to turning this service over to the commercial 
sector.
    Unfortunately, in making this recommendation they also note that 
while human safety never can be absolutely assured, safety was assumed 
to be ``sine qua non,'' or ``a given'' in their recommendation. The 
ASAP believes this assumption is premature and over simplifies a 
complex and challenging problem, in that there is no ``cookie-cutter 
approach'' to safety in space. Nor is it ``a given.''
    We further believe that since NASA has given serious consideration 
only recently to what their approach will be in establishing human 
rating requirements for a vehicle that is occupied by NASA personnel, 
the commercial sector may be substantially behind in addressing human 
rating requirements for the future.
    NASA's Procedural Requirements (NPR) 8705.2b identifies the human 
rating requirements for NASA's space systems. It contains recently 
updated requirements and captured lessons learned that are applicable 
to the development and operation of crewed space systems. NASA 
emphatically intends this document to be a starting point with detailed 
requirements to be tailored specifically for each NASA human 
spaceflight program, including a possible NASAcrewed COTS mission. 
Additionally, NASA specifically caveats that the results of any 
tailored effort for a NASA-crewed COTS mission could be different from 
that developed for a NASA program.
    Because it is illogical to rely on commercial providers to develop 
their own requirements for contractual services on human spaceflight to 
NASA, the ASAP strongly believes that specific criteria should be 
developed to establish how safe is ``safe enough'' for these services, 
including the need to stipulate directly the acceptable risk levels for 
various categories of activity. In addition, it is imperative that the 
COTS enterprises understand in detail how verification of compliance 
shall be demonstrated. This too is just now beginning development by 
NASA.
    With the above background, I will now briefly address the four 
specific questions that you posed to the panel:

        1.  What do you consider to be the most significant safety-
        related issues that will have to be addressed if NASA were to 
        consider using commercially provided crew transportation and 
        International Space Station (ISS) crew rescue services?

    Response: Ensuring the safety of the NASA astronauts that we send 
into space may be the hardest part of commercializing LEO crew 
transportation. The significant challenges to be solved include:

          Establishing detailed safety requirements that NASA 
        deems essential to safe flight. These must be in a clear and 
        enforceable form that can be placed on contract(s) and tested 
        for compliance.

          Because of their energy, speed, and complexity, no 
        launch vehicle can be considered truly ``safe'' in the 
        conventional sense of the word. Therefore, establishing minimum 
        acceptable safety levels to guide system designs and set the 
        baseline for both NASA and their contractors as to what is 
        ``safe enough'' is critical.

          Even with clear safety requirements and levels, much 
        of the inherent safety of complex systems like spacecraft 
        depends upon the design choices and decisions where risks are 
        weighed against performance, costs, and of course, schedules. 
        An open and effective system has been developed within NASA to 
        accomplish this. A similar process needs to be 
        institutionalized by any commercial provider as well, whereby 
        all potential hazards are properly vetted by both government 
        and contractors. This will not be easy and may require more 
        than the ``hands off' approach envisioned by some.

          Establishing disciplined program and process-related 
        checks and balances so that NASA can verify that the contractor 
        has evidence of compliance with the launch vehicle design 
        requirements in the as-built vehicle and successful completion 
        of the activities necessary to demonstrate mission readiness.

        2.  What safety standard should commercial entities have to 
        meet if they are chosen by NASA to carry U.S. government 
        astronauts to LEO, and what will be required to verify 
        compliance?

    Response: As noted previously, NASA's NPR 8705.2b prescribes human 
rating requirements for NASA's space systems. This document, changed in 
2008, represents a significant and substantive shift from a 
prescriptive approach to one that applies good engineering judgment. 
Prescriptive standards describe how to do things and are applied 
rigidly. Good judgment offers less specific direction and guidance. The 
ASAP sees advantages in both, but with a need for clear written record-
of-change and direct connectivity to establish and time-tested 
engineering standards.
    In this regard, it is the ASAP's position that any new standards 
for commercial entities should begin with NASA's NPR--the ``gold 
standard'' if you will--and that the human rating for each system must 
appropriately be tailored to combine testing, solid engineering, and 
robust design along with a system safety approach for examining options 
to prevent and minimize the impact of failures. Doing so will, in the 
end, provide both high reliability and safety of human life.
    With respect to demonstration, verification, and certification, the 
ASAP agrees that each of these actions must be performed for both 
government and commercial programs prior to NASA's use. Further, it 
also is the ASAP position that NASA is best qualified to be the 
oversight body for each of these actions as today only NASA has the 
competence in hand to effectively audit the complex technical work 
required.

        3.  What would be required to certify the ``airworthiness'' of 
        any commercially provided crew transportation and ISS rescue 
        service prior to its use by U.S. government astronauts? How 
        long do you anticipate such certification would take?

    Response: Similar to other certifications, ``airworthiness 
certification'' is a process that is carried out by a regulatory body. 
Typically that is an agency such as the Federal Aviation Administration 
or other governmental body that acts in the interest of the party 
having the most critical concern in the outcome. Certification is an 
oversight process, which serves to give assurance that necessary 
practices, policies, and criteria have been satisfied to protect the 
safety of the crew, passengers, and the public from harm due to a 
design or operational flaw in the functioning of the vehicle.
    Building on this basic principal, for certification of any 
commercial or government space transportation system, it is clear that 
human rating standards that have been discussed in prior answers would 
have to be developed, published, and understood by all participating 
parties.
    Once those standards are known, it then is incumbent on any party 
presenting a vehicle for utilization covered under the certification 
process to present compelling evidence that the standards have been 
met. That evidence can take several forms, most of which are covered by 
standard industry practice.
    Testing typically is used to verify that the design meets the 
standard. The simplest of these would be the proof testing of pressure 
vessels that has been common for most of the last century. When testing 
is not possible because it is either too dangerous or involves 
conditions that cannot be set up in the laboratory, then analysis or 
sub-scale experiment is accomplished. Finally, well-validated analysis 
(finite element structural analysis, computational fluid dynamics, 
physics based simulations) can form an acceptable mechanism to show 
compliance.
    In the case of crew delivery, cargo delivery, and rescue from the 
ISS it is well to remember that not only must the certified vehicle be 
safe in and of itself, but it must be able to approach, dock, and 
interface with the ISS without presenting a hazard to that vehicle as 
well. This means that besides the certification standards for the 
vehicle in question it will also have to meet additional requirements 
for operation in the vicinity of and docking to/departing from the ISS. 
These standards have already been developed and thus any new vehicle 
certification would also have to meet these requirements.
    In response to the question of how long such a process would take, 
our experience indicates that this is most certainly a function of two 
things. First, there must be clarity and mutual understanding of the 
requirements and a process for verifying that the requirements have 
been met. Second, there must be openness and a degree of sharing/
cooperation/transparency of the design process to the reviewing 
authority. Waiting until the design is complete and all parts and 
pieces are in place, sealed, and potentially inaccessible before 
inviting review of the design would be a recipe for failure. 
Conversely, providing periodic design reviews, openness for witnessing 
testing, clarity of analytical methods as the work progresses can 
assure a process with minimum to no delay. If the data is delivered as 
requested, testing is witnessed as it takes place, and the analysis 
uses known and validated methods, the finalization of the review 
remains directly proportional to the complexity and uniqueness of the 
proposed system. Missing or absent data, analysis that is incorrect or 
faulty, and tests that have been done but not confirmed can extend the 
process indefinitely.

        4.  In its annual report for 2008, the ASAP stated ``the ASAP 
        is concerned about human rating requirements substance, 
        application, and standardization NASA-wide.'' What is the basis 
        of ASAP's concern?

    Response: The basis for our concern is that more than two years 
into the COTS program, efforts to develop human rating standards for a 
COTS-D like program have only just begun and no guidance thus far has 
been promulgated. If COTS entities are ever to provide the level of 
safety expected for NASA crews, it is imperative that NASA's criteria 
for safety design of such systems immediately be agreed upon and 
provided to current or future COTS providers.
    As a minimum, the ASAP believes that NASA should begin a dialogue 
with the funded COTS partners to address requirements for human rating. 
Additionally, NASA needs to clarify how much or how little they will be 
involved in the design, approval and operation of the NASA-crewed 
vehicles in order to verify that the funded COTS partners are compliant 
with the human rating requirements. The ASAP recommends the agency be 
``hands-on.''
    NASA has indicated that they are considering a tiered or stair-step 
approach in addressing the technical review and approval processes to 
confirm safe flight and operational readiness, starting first with some 
level of technical insight for the unmanned services for routine 
supplies, then with greater insight for unmanned services involving 
high-valued cargo, and finally building up to the technical insight and 
process to be used for a NASA-crewed COTS mission. In modeling the COTS 
tiered technical insight processes, NASA will use its experience gained 
in the ISS program for transfer of routine supplies, and in the launch 
services program for commercial Expendable Launch Vehicle launches of 
high valued payloads. The ASAP concurs with this methodology.
    Finally, as part of the launch certification requirements, NASA 
should immediately identify the number of launch successes that COTS 
partners will need to achieve with the unmanned vehicle in order to 
demonstrate the required vehicle reliability for a NASA-crewed launch. 
In developing the criteria for manned launch vehicle certification, 
NASA may also need to address whether and how the successful flights 
and results from the COTS ISS cargo reservicing and NASA launch 
services programs, can provide evidence for consideration in assessing 
launch reliability for NASA-crewed vehicle.
    Chairwoman Giffords, I would be happy to respond to any questions 
you or the other members of the Subcommittee may have.

    Chairwoman Giffords. Thank you, Mr. Marshall. It is good to 
have you back.
    Mr. Alexander.

     STATEMENT OF BRETTON ALEXANDER, PRESIDENT, COMMERCIAL 
                     SPACEFLIGHT FEDERATION

    Mr. Alexander. Chairwoman Giffords, Ranking Member Olson, 
distinguished members of the Subcommittee, thank you for the 
opportunity to testify this morning on behalf of the 20 member 
organizations of the Commercial Spaceflight Federation. We 
appreciate the Committee's longstanding support of commercial 
space.
    Commercial crew transportation is complementary, not 
competitive, with NASA's mission and it is crucial to the 
future of our Nation's human spaceflight program for several 
reasons. First, after shuttle retirement, the United States 
will not have the capability to launch humans into space for 
likely six to seven years. Entering this gap, we will send 
billions of dollars overseas as we purchase seats on Russian 
vehicles at $51 million a seat and rising. A commercial crew 
can help prevent future Russian price increases, preserve 
redundant access to the space station and potentially shorten 
the gap. Second, enhanced commercial spaceflight will allow us 
to more fully utilize the space station, which is just now 
being completed. Third, commercial missions to low earth orbit 
will allow NASA to focus its resources and expertise on 
exploration beyond low earth orbit.
    Commercial crew has been endorsed by a long line of 
Presidents and Congresses from the 2004 Vision for Space 
Exploration to the 2005 and 2008 NASA Authorization Acts. As 
such, it should come as no surprise that the Augustine 
committee stated, ``There is little doubt that the U.S. 
aerospace industry has the technical capability to build and 
operate a crew taxi to low earth orbit.''
    Just as important, the committee stated their unequivocal 
belief that commercial spaceflight could be done safely. 
Indeed, safety is paramount to everyone in this industry. A 
group of 13 former NASA astronauts recently wrote in the Wall 
Street Journal that ``We believe that the commercial sector is 
fully capable of safely handling the critical task of low earth 
orbit human transportation.''
    A taxi service to low earth orbit is a less difficult, more 
narrowly focused mission than the Orion Crew Exploration 
Vehicle and can therefore have more robust margins. For these 
reasons, commercial vehicles can be more cost-effective for 
Space Station operations without sacrificing safety.
    In order to meet stringent safety goals, NASA and industry 
must agree upon a detailed, thoughtful plan. The commercial 
spaceflight industry believes the following four principles are 
key. First, demonstrated reliability through a robust test 
program is crucial. Robust testing throughout development and 
production is necessary to demonstrate confidence in the 
overall system. Commercial crew systems will only begin crewed 
flights once reliability has been demonstrated through multiple 
successful test flights without crew. Demonstrated launch 
reliability is essential for overall safety. The Atlas family, 
for example, has had over 90 consecutive successes. The Atlas V 
has a perfect record of 19 successful launches. And the Falcon 
9 will have launched more than a dozen times for cargo and 
satellite missions before crew missions begin.
    Second, robust safety will require additional human rating 
of the launch vehicle and a reliable crew escape system to 
protect the crew in the event of a launch vehicle anomaly.
    Third, clear safety standards and requirements are crucial. 
It is vitally important that NASA and industry agree on the 
safety requirements up front and this dialog must begin in 
earnest now. NASA's human rating requirements document will 
serve as a starting point for this dialog but must be tailored 
for commercial systems just as it is for NASA-developed 
vehicles. NASA is currently reviewing their applicability to 
commercial systems and the commercial spaceflight industry is 
also conducting a similar review.
    Finally, let me address government oversight. Any 
commercial crew program must be conducted under the current 
regulatory regime established by law, namely FAA licensing. FAA 
licensing is important to ensuring a consistent regulatory 
regime for both government and commercial missions, which is 
key to attracting private investment and non-NASA customers. 
While the FAA would retain the overall licensing authority, 
NASA would maintain oversight as the customer. In particular, 
NASA would establish astronaut safety requirements in 
consultation with industry, establish mission-unique 
requirements such as crew capacity and requirements for space 
station docking, and most importantly, have final approval 
authority over the launch of NASA astronauts, which would be 
granted only after NASA is satisfied that the vehicle is safe, 
just as NASA does for today's shuttle missions.
    In conclusion, we firmly believe that NASA and commercial 
industry can and must work together to develop safer human 
spaceflight capabilities. We must begin that dialog now.
    Thank you for the opportunity to be here today and I look 
forward to your questions.
    [The prepared statement of Mr. Alexander follows:]
                Prepared Statement of Bretton Alexander

Introduction

    Chairwoman Giffords and distinguished members of the Space and 
Aeronautics Subcommittee, thank you for the opportunity to testify. I 
am pleased to be here.
    The Commercial Spaceflight Federation is an association of 20 
leading businesses and organizations working to make commercial human 
spaceflight a reality. Our members include developers and operators of 
orbital spacecraft, suborbital spacecraft, and the spaceports from 
which they fly. Our membership also includes product and service 
providers for human spaceflight training, medical, and life support 
needs. Our mission is to promote the development of commercial human 
spaceflight, pursue ever higher levels of safety, and share best 
practices and expertise throughout the industry. One goal of all of our 
member organizations is to greatly increase the number of people that 
fly into space, generating new economic activity here on Earth.
    Significant investment has already been committed to the 
development of commercial human spaceflight. According to a recent 
survey done by The Tauri Group, $1.46 billion in investment has been 
committed to commercial human spaceflight activities to date. Coupled 
with the more than $500 million in development funding provided by NASA 
under the Commercial Orbital Transportation Services, or COTS, program, 
more than $2 billion has been pledged for the development of commercial 
spaceflight capabilities. I want to take this opportunity to thank the 
Congress and NASA for your support of the COTS program.
    In my testimony today, I will address the safety and oversight 
questions relating to commercially procured crew services. In order to 
understand these issues, it is important to first discuss the context 
of commercial spaceflight. My testimony covers the following key 
topics:

Summary of Key Points

        1.  Commercial crew transportation to Low Earth Orbit (LEO) is 
        a goal endorsed by the Vision for Space Exploration (2004), the 
        Aldridge Commission (2004), the 2005 NASA Authorization Act, 
        the 2008 NASA Authorization Act, and the Augustine Committee.

                  Commercial crew is complementary, not competitive, 
                with NASA activities, as commercial crew transportation 
                to LEO will allow NASA to focus its unique resources on 
                the more difficult task of beyond LEO exploration.

                  After shuttle retirement, the United States will 
                send billions of dollars overseas to purchase seats on 
                Russian vehicles during the gap in U.S. government 
                launch capability. Only commercial crew allows us to 
                reduce the gap, prevent future Russian price increases, 
                and preserve redundant access to the Space Station.

        2.  Safety is paramount for the commercial spaceflight 
        providers. Indeed, commercial vehicles such as Atlas V and 
        Delta IV, developed with substantial private funding and 
        engineering expertise, are already trusted to launch key 
        government national security assets upon which the lives of our 
        troops overseas depend.

        3.  Since computer calculations of vehicle safety cannot 
        account for most of the root causes of accidents historically, 
        such as human error or design flaws, and since even reliable 
        vehicles have historically suffered a period of ``infant 
        mortality,'' the commercial spaceflight industry believes that 
        safety must include the following:

                  Demonstrated reliability from orbital flight tests 
                of the full system

                  Not placing crews on initial flights, since early 
                flights are historically most risky

                  A highly reliable crew escape system

                  Standards-driven design and operations

        4.  Industry believes that the safety of commercial spaceflight 
        must be greater than that of any vehicle currently in operation 
        today. In addition to the FAA's existing regulatory authority, 
        as codified in U.S. law, industry will satisfy customer-
        specific requirements levied by NASA in partnership with 
        industry. This process has already begun with the cooperation 
        of the stakeholders involved.

        5.  NASA and FAA will be there every step of the way, and will 
        have oversight during design, testing, manufacturing, and 
        operations. As codified in existing U.S. law, a licensing, 
        rather than certification, regime is appropriate for these 
        vehicles.

Government Beyond LEO, Commercial to LEO

    Support and encouragement for the commercial development of space, 
including commercial space transportation services, has been a 
cornerstone of civil space policy for decades. It has been endorsed by 
numerous Presidential Administrations and Congresses, and by both 
parties. A quarter-century ago, the law that created NASA, known as the 
Space Act, was amended to specify that NASA is to ``seek and encourage, 
to the maximum extent possible, the fullest commercial use of space'' 
and ``to encourage and provide for Federal Government use of 
commercially provided space services and hardware.'' Additionally, the 
Commercial Space Act of 1998 directed all agencies including NASA to 
``acquire space transportation services from United States commercial 
providers whenever such services are required in the course of its 
activities.''
    In 2004, following the Space Shuttle Columbia accident, the Vision 
for Space Exploration (U.S. Space Exploration Policy, National Security 
Policy Directive-31), announced by President George W. Bush on January 
14, 2004, directed NASA to:

                  ``Develop a new crew exploration vehicle [now called 
                Orion] to provide crew transportation for missions 
                beyond low Earth orbit.''

                  ``Acquire''--and it's important to note here the 
                intentional use of the word ``acquire,'' not 
                ``develop''--``cargo transportation as soon as 
                practical and affordable to support missions to and 
                from the International Space Station.''

                  And again ``Acquire crew transportation to and from 
                the International Space Station, as required, after the 
                Space Shuttle is retired from service.''

                  To put further emphasis on this point, the policy 
                directed NASA to ``Pursue commercial opportunities for 
                providing transportation and other services supporting 
                the International Space Station . . . .''

    This was reinforced by the Aldridge Commission on implementation of 
the Vision which recommended in June 2004 that ``NASA recognize and 
implement a far larger presence of private industry in space operations 
. . . most immediately in accessing low-Earth orbit.''
    This fall, the Review of U.S. Human Space Flight Plans Committee 
endorsed the development of commercial crew capabilities as the primary 
means to transport astronauts to and from the International Space 
Station. Astronaut Sally Ride, a member of the Committee, stated, ``We 
would like to be able to get NASA out of the business of getting people 
to low Earth orbit.''
    Given the above history, the Augustine Committee's endorsement of 
the development of commercial crew capabilities should come as no 
surprise. Commercial crew and cargo to the Station has always been part 
of the Vision for Space Exploration, which had at its most fundamental 
core the philosophy that government should explore beyond low Earth 
orbit and the commercial sector should provide transportation to low 
Earth orbit. As such, commercial is complementary to government 
activities, not competitive.
    Congress has noted the importance of commercial spaceflight as 
well, as the 2005 and 2008 NASA Authorization bills endorsed commercial 
cargo and crew. The 2005 NASA Authorization Act directed NASA to ``work 
closely with the private sector, including by . . . contracting with 
the private sector for crew and cargo services, including to the 
International Space Station, to the extent practicable.'' The 2008 NASA 
Authorization Act directed NASA to initiate a commercial crew program 
and to fund ``two or more commercial entities . . . for a crewed 
vehicle demonstration program.''
    To its credit, NASA has already been acquiring cargo delivery to 
the Station. First, NASA invested $500 million in the development of 
two commercial systems, with additional investment contributed by the 
companies themselves, through the Commercial Orbital Transportation 
Services (COTS) program. After several years of development, NASA 
demonstrated its confidence in the commercial cargo sector by declining 
to purchase additional Russian cargo flights after 2011 and instead 
awarding over $3 billion in domestic Commercial Resupply Services (CRS) 
contracts for Space Station cargo. In just four years, commercial cargo 
has transitioned from a small initiative to a program that is crucial 
to the continued existence of the Space Station. The bottom line is 
that commercial space services are on the critical path for cargo to 
the Station and NASA has a vested interest in its success.
    With commercial cargo now on the critical path for the Space 
Station, it is time to consider the value of commercial crew services 
for Space Station as well.

Commercial Crew is Essential to Mitigate the Gap

    Despite having an option for crew transportation in the COTS 
program--the so-called Capability D option--NASA has not yet invested 
in the development of full commercial crew capabilities, opting to 
prove out cargo services first with the possibility of crew later. The 
case for beginning a commercial crew program has grown stronger in the 
years since the COTS cargo program began:

                  Flights of the Atlas, Delta, Falcon, and other 
                vehicles have helped mature the capabilities that will 
                be needed during a future commercial crew program;

                  Commercial companies have invested their own 
                internal R&D and study money to explore commercial 
                crew;

                  NASA's $50m CCDev program is revealing the strength 
                of interest in commercial crew by both large and 
                medium-sized companies in the aerospace industry;

                  And the Augustine Committee notes that ``the use of 
                commercial vehicles to transport crews to low-Earth 
                orbit is much more of an option today than it might 
                have been in 2005.''

    Today, three years after the award of the COTS Space Act Agreements 
(SAAs), we no longer have the luxury of time. The Space Shuttle will be 
retired next year, or shortly thereafter, while the first flight of 
Ares I and Orion has slipped to at least 2017, according to the 
Augustine Committee. In fact, the Committee added that if the Space 
Station is extended to 2020 as seems likely, the first human launch of 
Ares I would slip further, even if NASA receives the extra money the 
Committee recommended. As a result, we will be dependent on the 
Russians for crew transportation to the International Space Station for 
at least five years, if not longer.
    Given that Ares I/Orion is not likely to be ready until at least 
2017 and that system is optimized for the unique requirements of 
exploration beyond Low Earth Orbit, we believe a vibrant U.S. 
commercial crew program is essential for avoiding a sole-source 
reliance on the Russian Soyuz vehicles in the interim. In fact, we have 
already purchased rides on Russian Soyuz spacecraft at the price of $51 
million per seat, having taken extraordinary measures and changing U.S. 
nonproliferation laws to allow these payments. Buying crew services 
from U.S. industry should not be viewed as nearly so extraordinary.
    Moreover, Russia's prices are rising and are certain to increase 
once we become totally reliant on them. A robust U.S. commercial crew 
program, however, will apply competitive pressure on Russia to keep 
costs down. Also, NASA's ability to purchase Soyuz vehicles from Russia 
expires in 2016. Ares/Orion is not likely to be ready by then. It is 
impossible to know with certainty whether another extension of INKSNA 
(Iran, North Korea, and Syria Nonproliferation Act) will be granted by 
Congress at that time. Pursuing a commercial option to meet near-term 
needs for Station could help alleviate the risks inherent in Russian 
reliance. By not pursuing commercial, it is almost certain Congress 
will have to re-address the INKSNA issue.

Complementary, Not Competitive

    Commercial crew is complementary, not competitive with NASA's 
exploration program. NASA should once again be focused on exploration 
beyond low Earth orbit, and turn over to the private sector the 
repetitive tasks of resupplying the Station--and that includes 
transporting people there too. Not just a few people, but a multitude 
of researchers, engineers, and technical specialists. We need more 
activity in low Earth orbit, not less.
    Exploration beyond low Earth orbit will not be sustainable--if it 
happens at all--without a vibrant commercial sector providing 
transportation services to and from low Earth orbit. The Center for 
Strategic and International Studies recently released a report on the 
U.S. space program which stated: ``Without commercial engagement, 
exploration will . . . continually expand the scale of government 
obligations, rather than keeping civil space programs focused on the 
frontiers of exploration.'' None of us believes that the government can 
continuously expand the obligations and expectations of our civil space 
program without reaching a breaking point, regardless of where one 
thinks that breaking point is. The additional resources and 
capabilities of the private sector are essential.

Commercial to LEO is Less Difficult than Exploration Beyond LEO

    The Augustine Committee, like the Aldridge Commission before it, 
found that the commercial sector is ready and capable to handle the 
task of transportation to Low Earth Orbit. Low Earth Orbit is less 
difficult, and therefore more achievable by the private sector, 
compared to the more capable tasks that NASA's current exploration 
vehicles are optimized for.
    Thus, it is not an apples-to-apples comparison to compare a 
commercial crew capability to the Orion crew exploration vehicle. 
Rather, it is apples and oranges, because transporting crew to and from 
the International Space Station requires a far less complex spacecraft 
than exploring beyond low Earth orbit. It is akin to developing a 
Gemini spacecraft for low Earth orbit, rather than an Apollo spacecraft 
for reaching the Moon. The Orion spacecraft, for example, must reenter 
the atmosphere at one-and-a-half times orbital velocity, encountering 
heat loads nearly double those when returning from low Earth orbit, and 
Orion must do so with far more precision. Orion must also operate 
autonomously in lunar orbit untended while astronauts explore the 
surface, acting more like a space station than a crew taxi, and 
requiring more complex onboard vehicle systems.
    As a result, the Orion spacecraft is a 25 metric ton (mT) vehicle, 
whereas spacecraft designed solely for low Earth orbit transportation 
are expected to be in the 8-12 mT range, or less than half the size for 
the same number of crew. Quite simply, you don't take an 18-wheeler to 
the corner grocery store. Nor do you drive a Formula One racecar. The 
Orion crew exploration vehicle is, in fact, far more capability than is 
needed to go to and from the Space Station.
    Because it serves a simpler mission, any vehicle that is designed 
simply to service the Space Station--and not go beyond--should be 
faster and more cost effective to develop without sacrificing safety, 
regardless of whether it is a government or commercial capability. The 
Gemini spacecraft, for example, was developed in just under 2 1/2 
years, and had a perfect crew safety track record.
    Regardless of the extent to which ``the gap'' can be reduced, a 
spacecraft designed solely for low Earth orbit transportation will be 
more cost effective to operate and require smaller launch vehicles. The 
result will be more frequent missions to the Station, increased 
research and other utilization of the Station, and more resources 
available for exploration beyond low Earth orbit.

Implementing a Commercial Crew Program

    In light of all the considerations above, the Augustine Committee 
outlined a $2.5-3.0 billion fixed-price Commercial Crew program, in 
which NASA would invest in multiple private companies, each of which 
would also be required to invest their own funds, thereby putting their 
own ``skin in the game.'' The committee also suggested that NASA fund 
human rating of a proven U.S. launch vehicle to mitigate the dependence 
on the development of new launch systems in addition to the spacecraft 
themselves.
    A Commercial Crew program of $2.5-3.0 billion over 5 years should 
be sufficient funding. For example, one major aerospace company 
conducted a study that concluded they could develop a commercial 
capsule to transport crew to low Earth orbit and human rate an existing 
U.S. launch vehicle for around $1 billion. As another example, SpaceX 
has an unfunded option in its COTS Agreement for $308 million to 
upgrade its Dragon spacecraft to carry crew to and from the Station. 
Demonstrating the diversity of interest and capability, the Augustine 
Committee received price estimates from, according to the report, 
``five different companies interested in the provision of commercial 
crew transportation services to low-Earth orbit. These included large 
and small companies, some of which have previously developed crew 
systems for NASA.''
    Additional evidence that a Commercial Crew program is viable at 
$2.5-3.0 billion is again provided by the Gemini program. Despite only 
having access to 1960s technology, and with only a few years of total 
experience with spaceflight, NASA and industry human-rated the Titan II 
launch vehicle (which required 39 months), and designed and tested a 
crew capsule, for about $2.5 billion in today's dollars. The Gemini 
program completed all missions safely.
    Since NASA's budget for the next five years is almost $95 billion, 
a $2.5 billion Commercial Crew program represents less than 3% of total 
NASA expenditures. Clearly, it is not an either/or proposition between 
commercial crew and NASA exploration. Commercial vehicles will not have 
the capability to go beyond low Earth orbit, while NASA must develop 
the capability to conduct exploration beyond low Earth orbit.
    To promote competition and innovation, NASA's investment in a 
Commercial Crew program should be structured using milestone-based, 
fixed-price agreements as it is in the COTS program, unlike traditional 
cost-plus contracts. The COTS Cargo program has shown the wisdom in 
this approach. NASA initially selected two winners, SpaceX and 
Rocketplane-Kistler, rather than putting all of its eggs into one 
basket. When Rocketplane-Kistler failed to raise the capital to meet 
its milestones under its Space Act Agreement with NASA, NASA terminated 
its funding, held a new competition, and had 85 percent of the funding 
left over to give to the new winner, Orbital Sciences. This ``portfolio 
approach'' diversified the risk to NASA, greatly enhancing the 
likelihood that NASA will get the expected level of capability that it 
needs.

Safety of Commercial Human Spaceflight

    Let me now address the safety of commercial human spaceflight 
systems. Safety is paramount. Private companies understand that they 
will not be in business if the systems they develop are not safe. In 
fact, private industry recognizes that it must increase safety from 
that demonstrated in the past in order to fulfill its vision of greatly 
increasing human activity in space. I believe industry has a healthy 
respect for the limits of their knowledge when it comes to safety. They 
do not presume to know it all and they maintain a strict discipline of 
safety. At the same time, they bring fresh eyes and insights from other 
cultures and I believe this will ultimately enhance safety.
    Human spaceflight is an inherently risky endeavor. This has been 
true for government human spaceflight and will also be true for 
commercial. Working in partnership with NASA, U.S. industry firmly 
believes it can develop the capability to transport crew to low Earth 
orbit safely. Last month, 13 former NASA astronauts \1\ endorsed 
commercial human spaceflight in a statement in the Wall Street Journal. 
This group of astronauts are highly experienced with spaceflight--
collectively, they have flown a total 42 space missions and logged a 
total of 2 years and 48 days in space flying six different spacecraft 
including Gemini, Apollo, Space Shuttle, Soyuz, Mir, and the 
International Space Station. They stated:
---------------------------------------------------------------------------
    \1\ The astronaut signatories were Buzz Aldrin, Ken Bowersox, Jake 
Garn, Robert Gibson, Hank Hartsfield, John Herrington, Byron 
Lichtenberg, John Lounge, Rick Searfoss, Norman Thagard, Kathryn 
Thornton, Jim Voss and Charles Walker.

         ``As astronauts, we know that safety is important. We are 
        fully confident that the commercial spaceflight sector can 
        provide a level of safety equal to that offered by the 
        venerable Russian Soyuz system, which has flown safely for the 
        last 38 years, and exceeding that of the Space Shuttle. 
        Commercial transportation systems using boosters such as the 
        Atlas V, Taurus II, or Falcon 9 will have the advantage of 
        multiple unmanned flights to build a track record of safe 
        operations prior to carrying humans. These vehicles are already 
---------------------------------------------------------------------------
        set to fly over 40 flights to orbit in the next four years.''

    Working together, NASA and the commercial industry can develop the 
capabilities to safely conduct human spaceflight. NASA and industry 
must begin the dialogue now on the requirements, standards, and 
processes necessary to make this successful for all involved. Agreement 
on the requirements is essential to the success of any partnership 
between NASA and the commercial sector.
    There are several important factors to keep in mind when discussing 
the safety of commercial crew vehicles:

Commercial Spaceflight Has a Demonstrated Track Record

    First, when we discuss commercial spaceflight, some tend to think 
of an activity in the future. In fact, commercial spaceflight occurs 
right now and has for years. Currently, the Atlas V and Delta IV launch 
vehicles--both commercially developed with substantial private 
funding--are used to launch multi-billion dollar national security 
payloads upon which the lives of our troops overseas depend. These 
vehicles are also entrusted by NASA to handle some of the most safety-
critical applications in the civil space sector. For example, the Atlas 
V is Category 3 certified by NASA for launch of NASA's most critical 
payloads, and is also certified for launch of nuclear payloads, such as 
NASA's New Horizons spacecraft to Pluto, launched with radioactive 
plutonium onboard.
    Not only is the commercial spaceflight sector real, but it has an 
extensive history of successful flights to orbit: the Atlas and Delta 
families of rockets, many of which were developed with substantial 
private investment and serve multiple customers, have a combined record 
of 114 consecutive successful flights since 2000. The Atlas V, for 
instance, has had 19 consecutive successful flights since its 
inception.
    We must now turn our efforts to extending this demonstrated track 
record and depth of operational experience to human spaceflight. 
Fortunately, commercial human spaceflight to LEO will not require the 
development of new launch vehicles. Instead, it can be accomplished 
using existing launch vehicles and those currently under commercial 
development, such as the Atlas V, Falcon 9, and Taurus II launch 
vehicles. This will allow us to leverage our existing track record.
    I will now examine some of the key requirements for ensuring the 
safety of commercial spaceflight, and explain how the commercial 
spaceflight sector can meet these high standards.

Key Requirements for Commercial Spaceflight Safety

    Since computer calculations of vehicle safety cannot account for 
most of the root causes of accidents historically, such as human error 
or design flaws, and since even reliable vehicles have historically 
suffered a period of ``infant mortality,'' the commercial spaceflight 
industry believes that safety must include the following:

                  Demonstrated reliability from orbital flight tests 
                of the full system

                  Not placing crews on initial flights, since early 
                flights are historically most risky

                  A highly reliable crew escape system

                  Standards-driven design and operations

    I will now consider each of these topics in turn.
    I. Demonstrated Reliability from Orbital Flight Tests: By the time 
any astronaut climbs onboard a commercial vehicle, including the Atlas 
V, Falcon 9, and Taurus 2, each will have had multiple demonstrated 
successful flights to orbit. For example, SpaceX's Falcon 9 would 
likely have more than 15 missions prior to its first crewed launch, due 
to customers such as the COTS Cargo program and satellite launches. As 
the Wall Street Journal astronauts pointed out, the Atlas, Falcon, 
Delta, and Taurus systems combined have over 40 more missions on the 
manifest before 2014, in addition to numerous flights of commercial 
systems that have taken place before this year.
    Human-rating of existing launch systems will cost money, and care 
must be taken, but as a recent study by The Aerospace Corporation 
concluded, there are no show-stoppers to human rating the existing 
proven fleet of launch vehicles. Norm Augustine pointed out that we did 
it safely for Mercury and Gemini, when our expertise in human 
spaceflight was much lower than it is today, and we can do it now.
    Demonstrated reliability is so important because computer models 
and Probabilistic Risk Assessments (PRAs) are not sufficient to capture 
the majority of failure modes that affect real, flying vehicles--
especially vehicles that are flying their first few missions. The 
Augustine Committee, which included two experienced astronauts, pointed 
out the following on PRAs:

         ``Studies of risk associated with different launch vehicles 
        (both human-rated and non-human-rated) reveal that many 
        accidents are a result of poor processes, process lapses, human 
        error, or design flaws. Very few result from so-called random 
        component failures. The often-used Probabilistic Risk 
        Assessment (PRA) is a measure of a launch vehicle's 
        susceptibility to these component or system failures. It 
        provides a useful way to compare the relative risks of mature 
        launch vehicles (in which the design is well understood and 
        processes are in place); it is not as useful a guide as to 
        whether a new launch vehicle will fail during operations, 
        especially during its early flights.''

    Probabilistic Risk Assessments and computer models are useful 
tools, but they have limitations. While the commercial spaceflight 
industry will make use of every tool that is available to improve 
safety, computer models are just one tool among many. Demonstrated 
reliability and a robust flight test program are crucial. Reasonable 
minds can differ on how many successful launches is sufficient before 
putting people on top, but there is no debate that more is better.
    At this point, let me briefly address two myths surrounding the 
safety of commercially procured crew transportation systems. First, 
some have claimed that commercial crew systems will only be able to 
produce cost savings for NASA by cutting corners and being less safe. 
In fact, commercial crew systems are cheaper for a different reason--
because they have a less ambitious mission than systems designed for 
exploration. Since commercial LEO systems are simply tackling a less 
difficult challenge, commercial crew will be able to achieve cost 
savings for Space Station missions without cutting any safety corners. 
By focusing on a less ambitious mission that requires less capable 
vehicle performance, the commercial spaceflight industry is following a 
statement of the Columbia Accident Investigation Board that ``the 
design of the system should give overriding priority to crew safety, 
rather than trade safety against other performance criteria.''
    Second, some have claimed that NASA's Exploration Systems 
Architecture Study (ESAS) shows that the current exploration vehicles 
are safer than commercial crew vehicles. In actuality, commercial crew 
vehicles were never even analyzed in the ESAS report--the ESAS report 
only looked at vehicles large enough to carry Orion, such as Ares I and 
variants of the triple-core Delta IV Heavy, and did not examine the 
smaller, simple, single-core vehicles, such as Atlas V Medium and 
Falcon 9 Medium that are sufficiently sized for commercial crew 
missions. Moreover, even if ESAS had compared exploration vehicles to 
commercial crew-sized vehicles, the comparisons would be ``apples vs. 
oranges,'' because of the dramatically different tasks of these two 
types of vehicles.
    II. Not Risking Crew During Initial Flight Tests: Historical 
records show that even reliable vehicles, such as the Soyuz, initially 
go through a period of lower reliability (``infant mortality'') as 
design flaws are caught and corrected. The use of proven launch 
vehicles enhances safety by using a mature system with a demonstrated 
track record that has gone through the infant mortality stage 
experienced by most new launch systems.
    By leveraging the cargo and satellite flights, such as the COTS 
Cargo flights, that precede the first crewed flights, the commercial 
sector can help ensure that the infant mortality phase does not risk 
human lives. Commercial providers are free to pursue multiple 
customers, such as NASA science missions, national security missions, 
or commercial satellite missions, to help extend and strengthen the 
crucial test flight phase before humans are launched. Again, reasonable 
minds can differ on how many test flights are needed in light of infant 
mortality, but all can agree that it is good that the commercial sector 
can leverage non-crewed flights, such as cargo and satellite launches, 
to help alleviate crew risks associated with flying during the infant 
mortality phase.
    III. A Robust Crew Escape System: In addition to demonstrated 
reliability of the launch vehicle, ascent safety will be based on an 
emergency detection system to detect any anomalies during launch and a 
crew escape system to separate the spacecraft from the launch vehicle 
in the event of an anomaly.
    The commercial spaceflight industry understands that safety 
requires not just a reliable launch vehicle, but an integrated system 
with robust crew escape capabilities. As the Augustine Committee notes, 
``It is unquestionable that crews need access to low-Earth orbit at 
significantly lower risk than the Shuttle provides. The best 
architecture to assure such safe access would be the combination of a 
high reliability rocket and . . . a launch escape system.'' The 
commercial spaceflight industry is committed to meeting this 
combination.
    IV. Effective Government Oversight: Human spaceflight is now almost 
50 years old with the first flights of Alan Shepard and John Glenn 
occurring before I was born. It is time to transition access to low 
Earth orbit to the private sector so NASA can once again lead 
exploration beyond. Nevertheless, NASA and the FAA will be involved in 
every step of a Commercial Crew Program. In fact, every human 
spacecraft to date has been developed in partnership between NASA and 
U.S. industry, and this will also be true for a Commercial Crew 
Program. I will now address this crucial topic in more detail.
    First, any NASA Commercial Crew Program must be conducted under the 
current regulatory regime established by law, namely, licensing by the 
Federal Aviation Administration (FAA) Office of Commercial Space 
Transportation. FAA licensing of commercial spaceflight activities is 
established by law, requires a high degree of system safety, and 
provides a stable and predictable regulatory environment necessary for 
the success of commercial human spaceflight businesses. As codified in 
existing U.S. law, a licensing regime, rather than a certification 
regime, is appropriate for these vehicles.
    While the FAA would retain overall licensing approval authority, 
NASA would maintain strong oversight as the mission customer. As with 
today's commercial expendable launches, the customer has go/no-go 
authority over the readiness of the mission and, therefore, NASA would 
maintain its role as safety approval authority for its crew onboard any 
commercial vehicle. NASA-unique requirements would be imposed as 
customer requirements, rather than as the overall regulator of the 
commercial spaceflight activity. (This is discussed in more detail in 
the next section.)
    While it is appropriate for NASA to establish customer-specific 
requirements, an entirely new licensing or regulatory regime, separate 
from the current FAA regime, should not be established for NASA or any 
other entity that would require compliance with different rules and 
regulations for commercial human spaceflight services provided for U.S. 
Government and commercial customers. The creation of a NASA-specific 
regulatory regime would impose parallel regulatory and operating 
environments for commercial operations for private customers and 
``commercial'' operations for NASA. A two-track regulatory environment 
could hurt industry's ability to obtain non-NASA customers, impacting 
business viability by lowering the total number of flights. Such a 
situation would be the opposite of the more robust flight history and 
greater operational experience that is crucial to enhance safety.

NASA Will Be There Every Step of the Way

    In any Commercial Crew program, NASA will play a pivotal role in 
the design, development, and operation of the commercial vehicles. NASA 
will be there every step of the way. In particular:

                  NASA, in consultation with industry, will establish 
                baseline human spaceflight safety requirements. That 
                dialogue must begin now.

                  NASA will also establish its mission-unique 
                requirements, such as crew capacity; ability to dock 
                with the International Space Station, including meeting 
                visiting vehicle requirements; and functionality as a 
                crew rescue vehicle, among others.

                  And NASA will have final approval authority over the 
                launch of NASA astronauts on commercial vehicles, which 
                would be granted only after being satisfied that the 
                vehicle is safe for launch, just as it does for today's 
                Space Shuttle missions.

    Whether or not these safety requirements are the same as those 
found in NASA's current human-rating requirements document (NPR 
8705.2B) is currently under consideration. NASA is reviewing its human-
rating requirements as they would be applied to commercial human 
spaceflight capabilities. This is the right thing for NASA to do and I 
applaud them for doing so.
    In fact, there is already a precedent for reviewing human-rating 
requirements. During the Constellation Program, NASA revised its human-
rating requirements document in May 2008, going from the original 
version A to the current version B. Based on the judgment of NASA 
engineers, version B revised some requirements related to structural 
safety margins and dual-fault tolerance. In fact, no existing U.S. 
spacecraft--or Russian, for that matter--has ever met all of NASA's 
human-rating requirements, but rather have obtained waivers to certain 
requirements. These examples demonstrate the importance of early 
dialogue between NASA and the commercial spaceflight sector on the 
nature of human-rating requirements for commercial systems, with 
demonstrated reliability, robust test flights, and a reliable crew 
escape system being key.
    While NASA is conducting its review, U.S. industry is also 
conducting a similar review. We have established a Commercial Orbital 
Human Spaceflight Safety Working Group. While the Commercial 
Spaceflight Federation has taken the lead in organizing the effort, the 
working group includes representatives from a broader spectrum of 
companies, including several of the major aerospace primes and more 
traditional government space contractors. The goal of the effort is to 
develop industry consensus on principles for safety of commercial 
orbital human spaceflight. So far, we have met among industry and have 
begun to engage NASA and the FAA. There is much more work to be done. 
However, consensus has been reached among a number of companies on 
principles with other companies currently reviewing the document. 
Regardless, it has already been useful in illuminating the issues and 
differing perspectives of those involved and is an important step in 
the right direction.
    Finally, I note that industry and NASA standards will include more 
than just the launch vehicle. For example, once in orbit, spacecraft 
must rendezvous with the Space Station, dock or berth with it, and then 
undock and de-orbit, reentering the atmosphere and landing safely back 
on Earth. The technologies to rendezvous and dock with the Station have 
been demonstrated by the United States, Russia, Europe and Japan. 
Working in partnership with NASA, Europe and Japan demonstrated these 
capabilities this year, and NASA is working with SpaceX and Orbital 
Sciences here at home to demonstrate the same capabilities under the 
COTS Cargo program. Examples such as these illustrate the importance of 
cooperation between the private sector and NASA to ensure safe 
operations.

Conclusion: A Partnership Between NASA and U.S. Industry

    The discussion of standards brings me to one of the most important 
prerequisites for success of any Commercial Crew Program--how NASA 
engages with the private sector is ultimately as important, if not more 
important, than the amount of funding provided. NASA's COTS Cargo 
program is an excellent example. While some were initially resistant to 
commercial resupply of the Station, once it became a necessity NASA 
engaged the private sector in true partnership in order to ensure that 
the capability is available as soon as possible.
    I have every confidence that we are at such a turning point with 
Commercial Crew as well. It is now a necessity, and I believe that NASA 
and industry will both step up to make it happen.
    Thank you for the opportunity to be here today and I look forward 
to your questions.

    Chairwoman Giffords. Thank you, Mr. Alexander.
    Dr. Fragola.

   STATEMENT OF JOSEPH FRAGOLA, VICE PRESIDENT, VALADOR, INC.

    Mr. Fragola. Madam Chairwoman and distinguished members, it 
is an honor to be able to be before you today, and I would like 
to share with you some of the experience that I have had in the 
form of four simple laws for a safe space launcher design.
    The first law has been referred to before, and that is to 
make the design as inherently safe as possible. That involves 
two important aspects: first, to make the launcher reliable, 
and second, and this is four times not mentioned in discussion, 
to make sure that the failure modes of the launch vehicle 
present a benign environment to the abort system. This is so 
important I would like to repeat it: to assess the vehicle to 
make sure that the abort modes given a failure represent a 
benign environment for the system for escape. Second, separate 
the crew from the source of failure as far as possible in the 
design, or as I like to say, put them on top where God meant 
them to be. Third, establish a credible abort trigger set, and 
in doing so, balancing the warning time available with the 
threat of false positives against the G load on the crew. 
Fourth, include an abort system that is tested and verified for 
robustness to allow for a safe crew escape and recovery.
    I would mention that from my experience, the Ares I vehicle 
is the singular vehicle that has been designed from the very 
moment of its conception with safety in mind. What I mean by 
that is that other launches, for example, have emphasized 
launch reliability but investigation of subsequent two accident 
conditions allowing for abort is something they usually don't 
address, and the reason for it is very simple. They are 
interested primarily in payload to orbit. When a payload fails, 
the subsequent conditions are no matter to the person who pays 
for the payload. When a crew launcher fails, the conditions 
subsequent to that launch failure are important to the payload, 
which is the crew.
    We hope that the alternatives to the Ares I will follow the 
remainder of the rules that we mentioned, but in most of the 
literature discussing it, the importance of an abort system and 
the testing of an abort system independent of the number of 
experiences of the launcher has not really been addressed. Many 
times, for example, we speak of successes in terms of maybe 19 
successes of the Atlas V, which is a credible, wonderful, 
reliable record but I will remind the Subcommittee that the 
space shuttle had 25 successes prior to the Challenger 
accident.
    One of the things to remember in the design of a new launch 
vehicle or the application of an existing launch vehicle to 
crew is to understand that invariably in modifications of 
designs or the development of new designs we have an issue of 
reliability growth. Immature designs need time to become 
mature, and that is why the abort system testing and 
integration into the design and the benign nature of the 
failure initiators is extremely important for a crewed 
launcher.
    Now, as was mentioned, we did an independent assessment of 
the Ares on an apples-to-apples comparative basis to all the 
other alternatives we were provided, and I showed this on a 
slide that is presented there. On a comparative basis, you can 
see that from the standpoint of loss of crew, the Ares vehicle 
is somewhere between two to three times safer than all the 
alternatives, in some cases more than three times safer than 
the alternative vehicles. If we look at this, people often 
mention yes, but there is a certain amount of uncertainty, 
there certainly is uncertainty but even with the uncertainty 
taken into consideration, the loss of crew benefits from the 
Ares I vehicle are significant above the alternatives. The 
reason for it is not only its inherent reliability in the first 
stage proven in 255 successful shuttle launches but also the 
nature of a solid rocket booster. The predominant failure mode 
by far is case breach, nozzle burn-through or joint burn-
through. All of those alternatives, although they are very 
significant when combined with a single core liquid or a tandem 
booster in a singular solid rocket booster present a rather 
benign abort environment to launch abort system. It is the 
combination of this inherent reliability and its inherent 
benign abort conditions that make the Ares I such a safe 
launcher and that is the reason why it was designed from the 
beginning in that way. Thank you.
    [The prepared statement of Mr. Fragola follows:]
                Prepared Statement of Joseph R. Fragola
    Madam Chairwoman, distinguished members of the Subcommittee: I want 
to thank you for the opportunity to address you today. My testimony 
will detail my personal perspective on the ongoing focus on safety 
matters with regard to human space flight, focusing primarily on how 
NASA sought to better safety ratios for the Constellation Program via a 
risk-informed design process whose overriding priority has always been 
and will always be crew safety.

Introduction

         Risk-based Design for Inherently Safe Crewed Launchers: The 
        design of the system [that replaces the shuttle] should give 
        overriding priority to crew safety, than trade safety against 
        other performance criteria, such as low cost and reusability, 
        or against advanced space operation capabilities other than 
        crew transfer. (Columbia Accident Investigation Board (CAIB) 
        Report Section 9.3)

    This quote from the CAIB gives NASA clear direction to the design 
of the next generation crew launch system: make it simple, make it 
safe, and let the driving design principle be crew safety. That is 
simple enough to say, but how do we design for safety from the start? 
In other words, how do we make it ``inherently safe'' while also 
protecting against residual risk, in a mass-constrained, highly-
energetic system such as a launch vehicle? To paraphrase the definition 
of inherently safe design is to say that the principle objective of the 
design process should be to eliminate, or at least reduce to a minimum, 
the hazards associated with the process so that the elimination or 
reduction is both permanent and inseparable from the design. Once a 
design concept has eliminated or reduced the hazards to a minimum, the 
designers can focus on developing acceptable mitigation approaches for 
the residual risks. This process is referred to as a risk-based or 
risk-informed design.
    NASA has utilized the May 2004 memo from the Chief of the Astronaut 
Office on future system launch safety as guidance in designing for 
ascent safety. A key statement from this memo is,

         The Astronaut Office believes that an order-of-magnitude 
        reduction in the risk of loss of human life during ascent, 
        compared to the Space Shuttle, is both achievable with current 
        technology and consistent with NASA's focus on steadily 
        improving rocket reliability, and should therefore represent a 
        minimum safety benchmark for future systems. This corresponds 
        to a predicted ascent reliability of at least 0.999. To ensure 
        that a new system will achieve or surpass its safety 
        requirement, it should be designed and tested to do so with a 
        statistical confidence level of 95%. (Astronaut Office Memo)

    The paragraphs that follow explain how this is being accomplished 
in the development of what has come to be the Ares I crew launcher and 
Orion spacecraft, and why the current design is believed to be 
inherently safer and operationally safer than alternative design 
concepts that might be equal in operational capability, or in some 
cases even more capable. The Constellation system is the only launch 
system that has been specifically engineered to meet the Crew Office 
memorandum guidance of 1 in 1,000 missions loss of crew (LOC).

The Two Elements of Risk-Informed Design

    In the Apollo era, crewed launchers were fundamentally designed 
with the best level of expertise available, tested to exhaustion, and 
then robustness or redundancy was added to mitigate the residual risk. 
This redundancy was applied across the design and included engine-out 
capability during at least portions of ascent, launch escape 
capability, a ``life boat'' vehicle on the way to the Moon, an abort 
stage possibility during descent to the lunar surface, and component 
robustness or redundancy where element redundancy was no longer 
possible. Reliability and risk-informing analyses were primarily 
qualitative, such as Failure Modes and Effects Analyses (FMEAs), which 
were applied as a check of the design rather than being integral to the 
design development.
    Design development for Constellation, therefore, has consisted of 
two key tenets related to safety. These are to make the design as 
reliable as possible (inherent safety), so that backup systems would 
never have to be used, and to make the backup systems as robust as 
possible to maximize the likelihood of crew survival and return given a 
failure of the primary system or element. Notice that, in the Apollo 
era, redundancy or robustness was not added for mission continuance as 
it was in the shuttle era in some cases at least, but was applied to 
ensure safe return of the crew.

Tenet Number 1--Make the Design Inherently Safe

    As codified in Constellation Program safety policy, inherent safety 
implies the elimination of hazards that have historically been 
associated with the operation of the type of system being designed. 
This in turn implies the systematic identification of the hazards 
associated with operation of the system alternatives being considered. 
The process of hazard identification is implemented in a global sense 
by a hazard analysis, which essentially establishes the potential 
spectrum of generic hazards that might be applicable to a particular 
design. The hazard analysis also establishes a local evaluation of the 
credibility of these hazards being applicable to the design in terms of 
their likelihood of being activated, as well as the local conditions 
that would determine their consequences if unmitigated. Both the 
likelihood of activation and the associated consequences once activated 
are established and developed from historical data on heritage systems 
and the combined judgment of design and safety experts on how this 
heritage data applies to each specific design alternative.
    If mission reliability, i.e., inherent safety, were equivalent to 
crew safety as it is for payload ``safety,'' then the task that would 
be left to the analysts would be to inform the decision makers of the 
forecasted mission reliability of each design. Even in this case, an 
alternative that employed a first stage that made use of a solid, which 
could subsume the reliability of the shuttle solid, would be a strong 
contender because the shuttle solid has demonstrated a mission 
reliability of just a single failure in approximately 250+ booster 
firings. This implied demonstrated reliability of 0.996, or 99.6%, 
rivals the best of the best of the boosters worldwide. However, in the 
case of crew safety, mission reliability is not the entire story.

Tenet Number 2--Adequacy of ``Abort Effectiveness''

    The shuttle designers, unlike the Apollo designers before them, 
concentrated fully and completely on the inherent safety of the 
vehicle--that is, they relied on the forecasted mission reliability of 
the design alone to guarantee crew safety. Clearly, the primary focus 
of a launcher design should be on mission reliability, regardless of 
whether or not it is crewed. The primary objective of the design should 
always be to avoid failure.
    A mitigating system, given a failure, should never be used as a 
crutch to enhance crew safety, but rather only be used as a way to 
abort the mission and recover the crew. However, unless the reliability 
of the primary design can be assured to a significantly high degree, a 
mitigating system (such as the Orion Launch Abort System) is essential 
to ensuring crew safety. The crew safety enhancing power of an abort 
system is generated by the fact that it provides an additional or 
conditional crew survival probability given the occurrence of a crew 
threatening event. This conditional probability of a successful abort 
and return given a crew-threatening event is referred to as the ``Abort 
Effectiveness.''
    The abort effectiveness value is a function of several things: the 
probability that the abort can be initiated in time to allow for a safe 
distance to be established for crew survival with employing an 
acceleration that also allows for survival, the reliability of the 
abort system, and the conditions that the crew vehicle will be 
obligated to negotiate subsequent to the abort initiation. In the days 
of Apollo, when NASA had comparatively little experience and 
computational capability, the abort effectiveness was estimated by 
comparison to escapes from high-performance military aircraft combined 
with the results of a few escape system tests, Little Joe I and II.
    Today, Constellation is systematically applying throughout the 
design process the software simulation tools and advanced computers 
that allow us to do a much better analytic design assessment than 
Apollo. Specifically, the integrated abort effectiveness can now be 
calculated by employing more realistic simulations of abort conditions. 
The integrated abort effectiveness is the effectiveness of each abort 
against each initiated abort scenario weighted by the occurrence 
probability of the scenario. While simulation tools and computational 
capability were unavailable in the Apollo era, today this calculation 
can be carried out with reasonable accuracy.
    The value of the abort effectiveness for each acceptable, payload-
capable alternative is possible but complicated to determine. However, 
what is known is that the primary determinate of the effectiveness of 
an abort is the time available to affect the abort along with the 
severity and extent of the environment in the abort locale.

Top Level Risk-Informed Design Selection During ESAS

    The above paragraphs have indicated the importance of incorporating 
risk evaluation from the very beginning of the crewed launcher design 
selection process to achieve an overriding priority for crew safety. 
Without this focus on safety risk evaluation, the crew launcher focus 
can slip into one emphasizing performance over safety. Even with safety 
as the overriding priority, the launcher must have acceptable payload 
capability and be affordable. Safety risk alone cannot be the criteria 
for the selection of a crew launcher design. Decisions must be made 
with safety risk as a priority, but within the context of a risk, 
performance, and cost picture. This implies that from a top-down 
perspective, potential crewed launchers should be each evaluated on the 
basis of cost, performance, and risk simultaneously, and this is just 
how the ESAS study efforts for the selection of a crewed launcher 
design proceeded.
    During ESAS, any launch vehicle concept that did not approach at 
least 1 in 1,000 forecasted launch Loss of Crew (LOC) risk was 
eliminated. In addition, concepts that would place the crew module in 
close proximity to the boosters and/or other potential sources of 
accident initiation were eliminated because it as anticipated they 
would interfere in NASA's ability to incorporate a launch abort system 
into the next-generation launch vehicles. Lastly, as part of its 
findings, the ESAS team recommended that this risk-informed design 
process be extended to the development of the design of the selected 
single solid First Stage concept, which would later be known as the 
Ares 1 Crew Launch Vehicle.

Constellation Safety Story

    The Constellation program baseline was derived directly from the 
ESAS recommendations, and a clear discriminator among crew launch 
vehicle alternatives was the relative complexity of the launcher's 
first stage and the effectiveness of the crew escape system.
    The Ares I first stage (FS) consists of a 5-segment reusable solid 
rocket motor (RSRM), an aft skirt, a forward skirt, and a frustum. The 
5-segment solid is an evolutionary growth from the 4-segment solid RSRM 
tandem boosters utilized to power the space shuttle. The Ares I booster 
will continue the protocol of recovery and post-flight inspection that 
began in the Shuttle Program. To summarize, the 5-segment solid for the 
Ares I has many advantages over other designs, including:

          Drawing extensively from the heritage and knowledge 
        derived from the Shuttle RSRM Program. There have been 252 
        solids flown in the Shuttle Program with one failure 
        (Challenger STS-51L).

          Applying the knowledge gained from that experience-
        base to actively improve design features.

          Utilizing extensive qualification and flight test 
        programs.

          Incorporating a failure-tolerant design against the 
        primary failure modes of joint leakage and case burn-through.

          Incorporating an extensive system of process controls 
        in manufacturing and assembly.

          Benefiting from the basic Ares ``single-stick'' 
        architecture, which eliminates the possibility of engaging 
        elements that are radially or tandem mounted.

    The Orion crew capsule will have a Launch Abort System (LAS) that 
will offer a safe, reliable method of moving the entire crew out of 
danger in the event of an emergency on the launch pad or during entire 
first stage and the most risk intense portion of the second stage climb 
to Earth orbit. Mounted at the top of the Orion and Ares I launch 
vehicle stack, the abort system will be capable of automatically 
separating the Orion from the launch vehicle and positioning the Orion 
and its crew for a safe landing. NASA plans a series of tests to 
characterize the LAS. Pad Abort (PA)-1, which is planned for March 
2010, is the first of these tests and will address what happens if an 
emergency occurs while the Orion and the launch vehicle are still on 
the launch pad. Other such tests will determine how the LAS behaves 
during critical parts of the flight regime. These tests will take place 
at White Sands Missile Range, New Mexico.
    NASA is making substantial progress in maturing its approach and 
design methodology for designing a robust crew-launch system. From the 
very onset of the Constellation Program, the NASA design team insisted 
on the application of a risk-informed design approach. That is, safety 
risk members are included as integral parts of the Constellation design 
team. They are chartered to develop risk-informed approaches for the 
Ares I and Orion design concept refinement, and are included in all 
trade studies that involved safety risk.
    The skill mix of the NASA team includes not only the Failure Modes 
and Effects Analyses, Integrated Hazard, and Probabilistic Risk 
Assessment (PRA) disciplines traditionally found under the Safety and 
Mission Assurance (S&MA) organizations, but also engineers with such 
backgrounds as computational fluid dynamics (CFD), Aerospace, and 
Physics disciplines. The team functions as a single group entitled Crew 
Safety and Reliability (CSR) and has been given the clear direction to 
work daily with the design engineers to provide expertise and feedback 
via various assessments and analysis techniques throughout the design 
maturation process. This investment continuously emphasizes a sincere 
commitment to the CAIB findings.
    Additionally, the primary modus operandi of past programs has been 
to provide intermittent reviews of design ``drops'' at the prescribed 
reviews. This limited meaningful insight into the systems development, 
which was occurring in the everyday work environment where design 
risks, nuances, trade studies, etc., are introduced. The Constellation 
approach, by contrast, has fostered the development of a truly risk-
informed culture on a continuing and synergistic basis.
    In parallel and in concert with the Ares I design development; 
NASA's Constellation team is providing the resources for the 
development of the supporting logical and phenomenological (or physics-
based) computer models and associated historical data sets. This allows 
for the identification of all credible potential events that might 
initiate an accident, the extant local external environmental 
conditions as determined by aero-physics computer models, and internal 
conditions, as determined initially by judgment and then later by motor 
and engine physics computer models, at the postulated time in the 
ascent trajectory that initiator was to occur. Then the global 
environment is imposed upon the integrated ascending Ares I stack and 
on the Orion crew module as determined by sophisticated computer models 
replicating those environments seen as potentially assaulting the 
vulnerabilities of Orion. Specifically, fragmentation fields, 
propagated impulse and pressure fields, and thermal radiation fields 
generated by the accident scenarios are initiated, forming the basis of 
the `blast environment' that the Orion must escape from.
    Currently the Ares I has an estimated AE of about 84%, which when 
combined with its high heritage based inherent reliability makes it two 
to three times safer than alternative launchers as shown in Table 1 and 
in graphical form in Figure 1. This corresponds to a LOM of 1 in 200 in 
ascent, which leads to LOC of about 1 in 1300 according to our 
independent calculations.

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]


    Meanwhile, examples of cases where the risk assessment and failure 
analysis teams have provided input and/or impacted the outcome of 
Constellation design issues, trades, or risks include the following.

          Abort triggers study: Provided LOC and Abort 
        Effectiveness assessments, including engineering models and 
        timing, to determine what potentially catastrophic scenarios 
        warrant abort sensors and software algorithms.

          Separation study (booster deceleration motors 
        (BDMs)): Hazard analysis combined with probabilistic design 
        analysis (PDA) led to the design decision to increase the 
        number of BDMs from 8 to 10.

          The Hazards Team identified that the first stage and 
        upper stage designs failed to meet properly at the interface 
        flange (different number of bolts) and a re-design was 
        instituted. Hazards team provided assessment to Upper Stage 
        that resulted in clocking of the hydrogen and oxygen vents to 
        improve separation distance.

          Orion and Ares systems architecture trades: risk 
        assessment and failure analysis teams have informed the active 
        mitigation of systems design vulnerabilities for both the 
        rocket and spacecraft.

          Failure Modes and Effects Analysis teams:

                  J-2X FMEA was used to support redline sensor 
                selection in order to detect failure modes prior to 
                their propagation to a catastrophic condition.

                  Upper Stage Main Propulsion System (MPS) FMEA 
                identified need for modifications related to solenoid 
                valves to increase reliability and failure mitigation.

                  US Reaction Control System FMEA identified need for 
                additional temperature sensors to detect freezing of 
                hydrazine to support launch commit criteria.

                  US Flight Safety System (FSS) FMEA identified need 
                to relocate cryogenic helium line that was adjacent to 
                Flight Termination System (FTS) linear shaped charge.

                  FS Roll Control System was changed from bipropellant 
                to monopropellant due to significant reduction in 
                critical failure modes.

Summary

    The Constellation design development process has, and continues to 
employ, a continuous risk-informed design process adopted from the 
outset of the program. This process has included both logical and 
physical simulation models as appropriate in a way that has had a 
synergistically beneficial impact on Orion and Ares I designs by 
allowing them to be developed with an ``overriding priority'' given to 
crew safety at every stage of the design and operational processes. I 
believe that the Constellation development represents a successful, 
pioneering application of a new approach to engineering design, a type 
of engineering risk design, which will have multiple applications and 
refinements in aerospace system designs in the future.

Closing

    In closing, I would be remiss if 1 did not bring your attention to 
a statement from the Augustine report that I believe to be problematic. 
Specifically, on page 9 of their report the Committee states:

         Can we explore with reasonable assurances of human safety? 
        Human space travel has many benefits, but it is an inherently 
        dangerous endeavor. Human safety can never be absolutely 
        assured, but throughout this report, safety is treated as a 
        sine qua non. It is not discussed in extensive detail because 
        any concepts falling short in human safety have simply been 
        eliminated from consideration. (Augustine 9)

    I believe this statement to be problematic because I believe it to 
be indicative of what I like to call a ``goal post'' mentality rather 
than the proper safety mentality which should be ``As low as reasonably 
achievable'', or ALARA. In the former case items are considered safe if 
they meet the criterion, in this case ``human safety'', or not if they 
don't. If they meet the criterion and are considered safe they are 
retained, and if they don't they are considered unsafe and are 
eliminated from consideration. It matters not if some alternatives just 
miss the criterion, or they miss it by a mile, they are eliminated 
nonetheless. And if they just make the criterion or they are much 
better, they are all considered ``safe''. While it is certainly true 
that safety cannot be assured in spaceflight and it is also true that 
the safety level of concepts are uncertain this approach has led in the 
past in other industries, such as the commercial nuclear power 
industry, to a safety perspective that focused only on which concepts 
or designs should be considered safe and which not. In this way the 
safety bar is set to include the lowest acceptable rather than focusing 
on which designs were as safe as achievable. There are always 
uncertainties in every analysis, and risk analysis is no exception. 
Still when solid, heritage-based analysis shows significant differences 
in safety risk amongst alternatives it is questionable how an 
investigation that claims safety as a sine qua non can fail to 
highlight these discriminations.
    Now it is true that the goal post approach will eliminate design 
concepts that are clearly unacceptable, but it also fails to 
discriminate designs that are clearly desirable among those that are 
acceptably safe. It is my belief that the Ares I vehicle, because of 
its inherent focus on being as safe as achievable from the very start, 
has the best chance to be an outstandingly safe crew launcher. There is 
no way to insure safety, and spaceflight will always be a risky 
endeavor, but a launcher that is designed to be safe from the start, at 
least to me, is a good way to begin.
    Madam Chairwoman, I would like to thank you and the members of this 
Subcommittee for the opportunity to express my ideas. I would be 
pleased to respond to any questions that you or the other Members may 
have.

    Chairwoman Giffords. Thank you, Dr. Fragola.
    General Stafford.

STATEMENT OF LT. GEN. (RET.) THOMAS STAFFORD, UNITED STATES AIR 
                             FORCE

    Lt. Gen. Stafford. Chairwoman Giffords, Ranking Member 
Olson, distinguished members of the Committee, many old 
friends, I am honored to be invited here to appear before you 
today to testify on the matter of crew safety in human 
spaceflight.
    As a result of the Augustine Committee report, it is 
imperative that the information and their observations that 
resulted in recommendations be considered carefully before the 
Congress directs or allows changes to be made to the program 
that NASA has pursued and the Congress has approved over the 
past years. Mr. Augustine invited me to be the first presenter 
to the committee due to the fact that I presently chair the ISS 
Independent Advisory Taskforce and previously had chaired the 
Shuttle-Mir Taskforce. I had also chaired a yearlong study at 
the direction of the Vice President on how NASA should return 
to the moon and go on to Mars in a safer, better and a more 
rapid timeframe at a minimum cost. The study was titled 
``America at the Threshold'' and Mr. Augustine provided a copy 
to all members of the committee prior to that first meeting 
they had.
    After the Columbia accident in 2003, I was asked by the 
NASA Administrator to chair the Return to Flight Task Group to 
review the Columbia Accident Investigation Board 
recommendations to ensure that these recommendations are 
carried out by NASA before the space shuttle return to light, 
and today I want to acknowledge the work performed by the 
Augustine Commission that covered these broad-based subjects in 
a relatively short period of time. After my own extensive 
examination of the committee's reports, I strongly agree with 
the majority of their findings. However, on a few I disagree.
    I would strongly agree that the NASA Administrator who is 
assigned responsibility for the management of NASA needs to be 
given authority to manage the agency. This includes 
restructuring resources, the workforce and facilities to meet 
the needs. The Augustine committee has pointed out to some of 
the underlying concerns and all the deliberations on the future 
of U.S. human spaceflight program are that NASA has been 
inadequately funded for many years, and on this point I 
strongly agree. I certainly hope that this year a satisfactory 
appropriations bill for NASA will be passed.
    I agree with the committee's recommendation that the 
remaining space shuttle flights should be launched on a 
schedule that is compatible with the normal procedures that are 
used for safe checkout and test for launch operations and which 
may extend to flights into 2011. We presently have a shuttle at 
KSC standby on notice for rescue if required. If funding were 
available, this shuttle should launch large cargo that could 
enhance the viability of the ISS six-person crew capability.
    The committee wisely recommended the continuation of U.S. 
participation in the ISS to be extended to 2020. We must 
remember that the United States cannot make a unilateral 
decision to end and deorbit the International Space Station. 
However, the ISS will never be fully and effectively utilized 
unless researchers and all the ISS international partners have 
confidence that the facility will be supported and sustained as 
long as it is operationally viable and technically useful. To 
effectively use this great international laboratory, the ISS 
requires a guaranteed cargo and crew delivery to be available 
as soon as possible after the space shuttle retirement. Yet the 
committee suggested that the responsibility be removed from 
NASA and offered to commercial contractors. It is feasible for 
the U.S. industry to develop a commercial cargo crew delivery 
system to the ISS. However, the cargo dimensions are somewhat 
limited.
    The commercial transport of government crews to the ISS has 
major implications of which I have a very different view. I 
would like to differentiate the two subjects: potential 
commercial crew cargo delivery to the ISS and commercial crew 
delivery to the ISS. NASA has incentivized and selected two 
contractors to provide commercial cargo delivery to the ISS, 
and for commercial cargo delivery, the first issue is 
development of a reliable booster to low earth orbit. The 
second issue is to develop an autonomous transfer vehicle to 
transfer the cargo from the booster to the ISS in a safe manner 
that would meet the ISS visiting spacecraft requirements, which 
were recently complied with by the European Space Agency's ATV 
and the Japanese HTV.
    The development of a transfer vehicle is in itself a 
significant challenge. The European Space Agency recently 
delivered their first ATV payload approximately four years 
later than their initial target delivery date. The Japanese 
delivered their HTV some two years later than their initial 
target date. Both government entities used considerable 
resources to develop these individual transfer vehicles. I 
certainly wish the two U.S. entities success in meeting their 
NASA milestones for cargo delivery since the ISS is dependent 
upon continued supply of cargo delivery by the partners.
    With respect to commercial government crew launch delivery 
to the ISS, I would like to recall my own experience. I flew on 
two Gemini missions with a specially modified Titan II ICBM 
booster and two Apollo missions, one on the small Saturn IB and 
one on a giant Saturn V, and over the period of 13 years I 
experienced and participated in development of high 
reliability, human-rated boosters, human-rated spacecraft and 
launch abort systems. I was the backup pilot for the first 
manned Gemini flight and spent many months in the factory and 
countless hours in the spacecraft as it was being built and 
tested. I was then pilot of Gemini VI, the world's first 
rendezvous mission, and on that the Titan II stage ignited and 
then shut down at T0. Wally Schira and I had the liftoff 
signals in the spacecraft and a fire broke out down below the 
base of the booster. The special emergency detection system 
that had been installed on that Titan II helped us resolve a 
couple of critical failures and our own decisions prevented a 
fatality. Had that not been modified and the decisions right, I 
would not be here today, Madam Chairman, and you would have 
been reading about me in the obituary column.
    I was also backup commander for the second Block I Apollo 
flight and had my crew performing a similar test in the sister 
spacecraft at the same time the Apollo I accident occurred and 
the Apollo I crew died in the fire at the Cape. I was a backup 
commander on the first Apollo Block II spacecraft, Apollo VII, 
and again spent considerable time in the factory as it was 
undergoing tests and fabrication. At that time there were 
numerous NASA engineers, inspectors, support technicians to 
facilitate this effort.
    I was then commander of Apollo X, the first flight of the 
lunar module to the Moon and again I spent an inordinate amount 
of time in performing the tests to check out the command and 
the lunar module.
    My fourth mission was commander of the Apollo-Soyuz Test 
Program. Again, I spent considerable time in that spacecraft 
and also a brief time in the Soyuz spacecraft for the first 
flew we ever flew. These flights both as prime and backup crew 
members were accompanied by thousands of hours of training in 
different types of spacecraft simulators and mockups in which 
numerous emergency situations were simulated and resolved. 
Therefore, safe delivery of a government crew to the ISS 
involves the human rating of a launch vehicle, the spacecraft, 
the launch abort system, successful integration of all three 
elements. The process of requirements, design and construction, 
all these parts start with the NASA safety and mission 
assurance requirements. There also has to be a process where 
there is not excessive creep in these requirements which could 
result in cost increases and launch schedule delay.
    Unfortunately, the Augustine report gave just a very brief 
mention of crew safety for launch, orbit and recovery 
operations. The report had no in-depth discussion of these 
vital issues of safe launch to orbit and return to Earth of 
government crews. If NASA can provide incentive seed money, can 
industry raise or finance the funds? What are the safety 
requirements for commercial government crew vehicle? That must 
be commensurate with other government operating crew transport 
systems.
    The commercial entities that propose to provide safe 
government crew transport will require a guarantee of a certain 
number of flights for a certain period of time and a price in 
order to minimize or to recover the reoccurring investment and 
have a satisfactory return.
    A major issue is, who assumes liability for the safe 
government crew delivery. If it is commercial, would insurance 
be available and at what cost? If safe commercial flight 
transportation for government crew does evolve, other questions 
will arise. On page 72 of the committee report it states, ``It 
is critical to the success of the program that multiple 
providers be carried through to operational service,'' and that 
statement in itself has a huge financial implication for both 
the government and the commercial providers. If NASA is buying 
a government crew ride rather than a spacecraft, then how, by 
whom and to what standards will the government's equipment and 
operations be certified? What entity other than NASA can 
establish and verify appropriate standards for human 
spaceflight? That question becomes very crucial.
    Madam Chairman, thank you and the members of the 
Subcommittee for the opportunity to express my opinions. I will 
be glad to respond to any questions you or the other 
distinguished members have. Thank you.
    [The prepared statement of Lt. General Stafford follows:]
          Prepared Statement of Lt. General Thomas P. Stafford
    Chairwoman Giffords, Ranking Member Olson, and Members of the 
Subcommittee, I am honored to be invited to appear before you today to 
testify on the matter of crew safety in human spaceflight. In the wake 
of the Augustine Committee report, it is imperative that the 
implications of that Committee's recommendations be considered 
carefully before this Congress directs, or allows, changes to be made 
to the program NASA has pursued and the Congress has approved for more 
than four years.
    Before proceeding to answer your questions, I would like to make a 
few observations concerning the Augustine Committee report.
    The most important observation of that Committee, and the 
underlying concern in all deliberations on the future of U.S. Human 
Spaceflight, is that it has been inadequately funded for many years 
now. The budget projected for NASA in the next decade and beyond is 
inadequate to accomplish the core objectives with which NASA has been 
charged. The funding is inadequate to build a timely replacement for 
the Space Shuttle, to return our astronauts and other international 
partner nations from the Space Station to the Earth and then to visit 
the moon, near-Earth asteroids, and to develop the technology and 
systems required for the first human voyages to Mars.
    This plan for NASA has been approved by the Congress. It is a 
program offering the strategic vision for human spaceflight that was 
demanded by Adm. Gehman and the Columbia Accident Investigation Board. 
It is a program worthy of our nation. The Augustine Committee notes 
that at least three billion dollars per year must be added to NASA's 
appropriation to accomplish the mission. Even more importantly, the 
Committee notes that there is no other worthwhile program of human 
spaceflight which could be accomplished for the amount of money 
presently planned for NASA.
    The choice is now plain: either we will provide the funding 
necessary to accomplish worthy objectives in space, or this nation will 
cede its leadership on the space frontier to others. I wish to add my 
voice to those who say that this leadership, the result of five decades 
of effort purchased at the cost of nearly a trillion of today's dollars 
and many lives, some of them given by close friends of mine, must not 
be allowed simply to drift away. As a nation, as a people, we must be 
better than that.
    Today, I want to acknowledge the intense work performed by the 
Augustine Committee to cover these broad based subjects in such a 
relatively short period of time. After extensive examination of the 
Committee's report, I strongly agree with the majority of their 
findings and recommendations. I also strongly agree that the NASA 
Administrator, who has been assigned the responsibility for the 
management of NASA, needs to be given authority to manage NASA. This 
includes restructuring resources, the workforce, and facilities to meet 
mission needs. However, on some of the Committee's findings, I have a 
different opinion.
    I agree with the Committee's recommendation that the remaining 
Space Shuttle flights should be launched on a schedule that is 
compatible with the normal procedures used for safe check out test and 
launch operations, which may extend the flights into 2011. We presently 
have a Shuttle at KSC on standby to launch on short notice, if 
required. If funding were available this Shuttle could carry cargo 
delivery that would enhance the viability of the ISS six-person crew 
capability.
    The Committee wisely recommends the extension of the International 
Space Station past 2015 to at least the year 2020. However, the ISS 
will never be fully and effectively utilized unless researchers in all 
of the ISS partner nation have confidence that it will be supported and 
sustained as long as it is operationally viable and technically useful.
    To have and to use this great international laboratory requires a 
guaranteed space transportation capability to be available as soon as 
possible after Space Shuttle retirement. The Committee recommends that 
this responsibility be removed from NASA and offered to commercial 
providers.
    I would like to differentiate the two subjects, Potential 
Commercial Cargo delivery to the ISS and Potential Commercial 
Government Crew delivery to the ISS. NASA has incentivized and selected 
two contractors to provide commercial cargo delivery to the ISS. For 
commercial cargo delivery, the first issue is the development of a 
reliable booster to low earth orbit. The second issue is to develop an 
autonomous transfer vehicle to transport cargo from the booster to the 
ISS in a safe manner that would meet the stated ISS visiting spacecraft 
requirements that were complied with by the European Union Space Agency 
ATV and Japan's HTV. The development of this type of a transfer vehicle 
is a major challenge. The European Space Agency recently delivered 
their first ATV payload approximately four years later than their 
initial target delivery date. Japan delivered their HTV some two years 
later than their initial target date. Both government entities used 
considerable resources to develop their individual transfer vehicles. I 
certainly wish the two U.S. entities success in meeting their NASA 
milestones for cargo delivery since the ISS is dependent upon a 
continued supply of cargo deliveries by the partners.
    With respect to commercial crew launch delivery to the ISS, I would 
like to recall my own experience. I have flown two Gemini missions on a 
modified TITAN II, ICBM, booster and two Apollo missions, one on the 
Saturn IB and one on the giant Saturn V. Over a period of thirteen 
years, I have experienced and participated in the development of high 
reliability boosters, spacecraft, and launch abort systems. I was a 
back-up pilot for the first manned Gemini spacecraft and spent many 
months in the factory and countless hours of testing in the spacecraft 
as it was being built and tested. I was then pilot of Gemini VI, the 
world's first rendezvous mission. On that mission, the TITAN II first 
stage engines ignited and then shutdown at T=0. Wally Schira and I had 
the lift off signals and a fire broke out below the base of the 
booster. The emergency detection system that had been installed on the 
TITAN II helped us to resolve the two critical failures that we 
experienced in that extremely short period of time.
    I was the back-up commander for the second Block I Apollo flight 
and had my crew performing a similar test, in the sister spacecraft, at 
the same time that the Apollo I accident occurred and the crew died in 
the spacecraft fire on the launch pad. I was then back-up commander of 
the first Block II Apollo spacecraft, Apollo VII, and spent 
considerable time in the command module which was being built and 
tested. There were also numerous NASA engineers, inspectors and support 
technicians at the factory to facilitate this effort. This support 
effort was similar to the Gemini program, where numerous NASA 
engineers, inspectors and support technicians participated in the 
manufacturing and test at the factory. I was then the Commander of 
Apollo X, the first flight of the Lunar module to the moon. Again, I 
spent an inordinate amount of time in performing test and check-out in 
the command module and the lunar module.
    My fourth mission, I was commander of Apollo for the Apollo-Soyuz 
Test Program. Again, I spent considerable time for the test and check 
out of the Apollo spacecraft and a brief time in the Soyuz spacecraft. 
These flights, both as a prime and as a backup crew member were 
accompanied with hundreds of hours of training in different types of 
spacecraft simulators and mockups where numerous emergency situations 
were simulated and resolved.
    Therefore, safe delivery of a government crew to the ISS involves 
the human rating of the launch vehicle, the spacecraft, and the launch 
abort system, and the successful integration of all three elements. The 
process of requirements, design, and construction all begin with the 
NASA safety and mission assurance requirements. There also has to be a 
process where there is not an excessive creep in requirements that 
would result in cost increases and launch schedule delays of the 
vehicles. The Augustine Committee report gave just brief mention of 
crew safety for launch, orbital, and recovery operations. 
Unfortunately, there were no in-depth discussions of the vital issue of 
safe launch to orbit and return to earth of government crews.
    It may be that the complexity of developing a new government crew 
space transportation capability, and the difficulty of conducting 
spaceflight operations safely and reliably, it is not fully appreciated 
by those who are recommending the cancellation of the present system 
being developed by NASA, and the early adaptation of the presently non-
existent commercial government crew delivery alternatives. There seems 
to be some belief that if NASA would ``step aside'', private 
alternatives would rapidly emerge to offer inexpensive, safe, reliable, 
dependable government crew delivery space transportation at an earlier 
date.
    Human spaceflight is the most technically challenging enterprise of 
our time. No other activity is so rigorously demanding across such a 
wide range of disciplines, while at the same time holding out such 
harsh consequences for minor performance shortfalls. Aerodynamics, 
aerospace medicine, combustion, cryogenics, guidance, and navigation, 
human factors, manufacturing technology, materials science, structural 
design and analysis--these disciplines and many more are pushed to 
their current limits to make it possible and just barely possible at 
that, to fly in space. Space is very, very hard.
    We've learned a lot about human spaceflight in the last five 
decades, but not yet nearly enough to make it ``routine'' in any 
meaningful sense of the word. As Adm. Gehman and the CAIB outlined, 
these flights in the past have been developmental flights and the 
relatively small number in the future will be the same. Thus far, it 
has been a government enterprise with only three nations yet to have 
accomplished it. Development of new systems is very costly, operational 
risks are extremely high, and profitable activities are elusive. It may 
not always be this way, but it is that way at present.
    Apart from questions of technical and operational complexity and 
risk, there are business issues to be considered if the U.S. is to rely 
upon commercial providers for government crew access to space. It is 
not that industry is incapable of building space systems. Far from it. 
It is American industry which actually constructs our nation's space 
systems today, and carries out most of the day-to-day tasks to 
implement flight operations, subject to the government supervision and 
control which is required in managing the expenditure of public funds.
    So the question is not whether industry can eventually develop 
government crew delivery systems and procedures to fly in low Earth 
orbit. It can. The relevant questions in connection with doing so 
commercially are much broader than that of the relatively simple matter 
of whether it is possible. Let us consider a few of those questions.
    Absent significant government backing, will industry provide the 
sustained investment necessary to carry out the multi-year development 
of new commercial government crew delivery systems to LEO? Will 
industry undertake to develop such products with only one presently 
known customer, the U.S. Government? What happens if, midway through 
the effort, stockholders or boards of directors conclude that such 
activities are ultimately not in the best interests of the corporation?
    What happens if, during development or flight operations, an 
accident occurs with collateral damages exceeding the net worth of the 
company which is the responsible party? A key lesson from the 
development of human spaceflight is that safety is expensive, and the 
failure to attain it is even more expensive. Apollo 1, Challenger, and 
Columbia have shown that spaceflight accidents generate billions of 
dollars in direct and collateral liabilities. Who will bear this risk 
in ``commercial'' space operations? If the company, how much insurance 
will be required, where will it be obtained, and at what cost? If 
government indemnification is expected, upon what legal basis will it 
be granted, and if the government is bearing the risk, in what sense 
will the operation then be ``commercial''?
    When commercial government crew delivery space transportation does 
come about, other questions will arise. Will there be competition in 
this new sector, or will there be a monopoly supplier? If NASA is to 
contract with the first, or only, commercial government crew space 
transportation supplier, and if there is no price ceiling established 
by a government alternative, how do we ensure a fair price for the 
taxpayer in a market environment in which the government is the only 
customer for the products of a single provider? And how is a space 
operation ``commercial'' if the government is both regulatory agency 
and sole customer?
    Leaving aside technical, operation, and business concerns, there is 
the matter of the schedule by which these new commercial systems are 
expected to come into being. The Augustine Committee has been 
particularly pointed in its clams that, with suitable government 
backing, such systems can be made before the comparable Constellation 
systems, Ares 1 and Orion, could be ready. Page 71 of their report 
offers such a claim.
    Are such claims optimistic? Any launch system and crew vehicle that 
can transport a half-dozen people to and from the ISS, and loiter on-
orbit for a six-month crew rotation period while serving as an 
emergency crew return vehicle, is necessarily on the same order of 
complexity as that of the old Saturn 1 and the Apollo systems. The 
Saturn 1 conducted its first test flight, with a dummy upper stage, in 
October 1961, and carried a crew for the first time in October 1968. 
The Apollo VII spacecraft which carried that crew, of which I served as 
back-up Commander, began its own development in 1962. Thus, the Earth-
orbital segment of the Apollo system architecture required a half-dozen 
years and more to complete. These developments were carried out by 
highly experienced teams with virtually unlimited development funds in 
the cause of a great national priority.
    If, in the fashion of airline travel, NASA is buying a ride rather 
than a spacecraft, then how, by whom, and to what standards will the 
company's equipment and operation be certified? How is NASA to 
determine that the system is truly ready to fly? Does the government 
merely accept the claims of a self-interested provider, on the basis of 
possibly very limited flight experience by company pilots? We certainly 
do not do that for military aircraft, and even less so is this the case 
for civilian transport aircraft. Extensive development and hundreds or 
even thousands of hours of flight testing followed by operational test 
and evaluation by the government is required before a new military 
aircraft is released into operational service; I've done that kind of 
testing. Similarly, new civilian aircraft are subject to extensive 
testing involving certification of systems and hundreds of flights to 
exact certification standards before they are allowed to be put in 
passenger service. Will we accept less for new, ``commercial'' space 
systems which carry government astronauts, or those of our 
international partners? In my opinion, the Congress should certainly 
not accept less.
    Yet, today, we do not even know what standards should exist for the 
certification of commercial spacecraft to carry government crew members 
into orbit. What entity other than NASA can establish and verify 
appropriate standards for human spaceflight? I will tell you that from 
my perspective and from the history that I have lived, these standards, 
like airworthiness standards, are written in other people's blood. Some 
of that blood was shed by friends of mine. We don't know enough, yet, 
about human spaceflight to relax the hard-learned standards by which we 
do it. And we certainly do not yet know enough to make the assumption 
that new and untried teams can accomplish it on a schedule that is 
better than was achieved during Apollo.
    This takes me to another point. Some of you may recall that, a few 
years back, I chaired a Task Force on International Space Station 
Operational Readiness. This task force was charged with making an 
independent assessment of our readiness to put crew on the ISS, and to 
sustain it with the transportation systems, Russian and American, which 
were necessary for cargo delivery and crew rotation. We did not take 
this matter lightly. The ISS was new, and much smaller. We did not then 
have the years of experience we have since accumulated in building the 
ISS and flying on it. Our then-recent long-duration spaceflight 
experience had mostly been accumulated during the Shuttle-Mir program, 
and Russian experience in resupplying the Mir and the earlier Salyut 
space stations was not unblemished. Numerous docking failures had 
occurred over the lifetimes of these programs, resulting not only in 
cargo which went undelivered but also, in one case, the collision of an 
unmanned Progress resupply vehicle with the Mir. An in another instance 
there had been a fire on Mir itself and the first crew to visit their 
first very small space station Salyut died after performing the orbit 
maneuver to reenter the atmosphere.
    These indicants and accidents gave us pause. Not because we doubted 
the capability of the team; the Shuttle had been flying for over 
fifteen years by that time, and the Russians had accumulated decades of 
experience in long-duration spaceflight. I've flown with them; I know 
how capable they are. No, our concerns were heightened by our awareness 
of just how careful one has to be in this most demanding of 
enterprises. We cannot afford to relax that vigilance today as we go 
forward into a new era of ISS utilization, and as we prepare once again 
to voyage outward from Earth, first to the moon or the asteroids and 
then beyond. There is a place in these plans for the contributions of 
commercial government crew space transport entrepreneurs, but not yet 
demonstrated, and not to the exclusion of NASA's own systems.
    I have asked many questions in this testimony, questions which I 
believe must be answered if commercial government crew human 
spaceflight is to become viable. I believe that these questions and 
others yet to come can and will be answered at some date. However, 
America's continued leadership in space should not depend upon the 
nature and timing of those answers. When commercial entities can 
provide dependable transportation reliable, U.S. government crews as 
well as partner nation crews, the government should buy it. But until 
that time, there should be an assured government capability to 
accomplish the task.
    Thank you.

    Chairwoman Giffords. Thank you, General.
    I want to thank all of our witnesses today, and we are 
really blessed to have such a star-studded group of individuals 
with lifetimes worth of knowledge and expertise.
    We are going to begin our round of questions now. I am 
going to start with 5 minutes, and because we have so many 
members, I will try to really make sure that we all speak for 
five minutes including cutting myself off.

                        Safety of Launch Systems

    Let me begin with something that Dr. Fragola had put in his 
testimony and touched on it with his slides. You had stated 
that it was your belief that the Ares I launch vehicle because 
of its inherent focus on being as safe as achievable from the 
very beginning has the best chance to be outstandingly safer in 
terms of it being a crew launcher. You talked about that as a 
good way to begin from just the very start. Given the fact that 
we are under enormous budget constraints here in the Congress 
and that funds available for NASA's human spaceflight and 
exploration program are always going to be more constrained 
than we would like, we need to think about how we prioritize, 
and I would like to hear from I think General Stafford and Mr. 
Marshall on how important a factor should the inherent safety 
of the Ares I vehicle be for Congress to consider as we make a 
decision on which launch system or systems to pursue in meeting 
NASA's International Space Station and exploration needs. I 
would also like to hear whether or not this should be the 
inherent safety of the Ares I, should this be a significant 
discriminator when choosing among alternatives and also who 
should carry the burden of proof? General, let me start with 
you.
    Lt. Gen. Stafford. Madam Chairwoman, again it starts with 
the requirements stated there by the NASA Safety and Mission 
Assurance, and I noticed that the astronaut group had stated 
their own requirements, that the reliability of the crew from 
launch into orbit is three nines. In other words, you have had 
a failure no more than one out of 10,000. I did my own review 
and my best memory back from Apollo, and we were striving for 
four nines at that time, Madam Chairman, 40 years ago, and just 
to be sure that I had this right I checked with Dr. Chris 
Kraft, who was there with the space task group and director of 
mission operations and then was later center director, and he 
said that they were striving for four nines, and in fact, Dr. 
Kraft said he would like to give a few of his thoughts on his 
how to distinguish reliability of boosters.
    ``Since the first time a pencil was put to paper, the 
engineers and technicians are all responsible that the vehicle 
be used to carry astronauts and others into space. They know 
that the life of the individual depends on it. This is true of 
the first-level engineer, the lead designer, the chief 
engineer, the program manager and company executives. This is 
also true of the machinists, the contract buyer, the piece part 
selector and the safety, reliability and quality control 
experts and the test engineers and eventually by the person who 
has to stand up on launch day and say `go' when that launch 
director asks.
    ``In my opinion, that is the case for the Ares I and Orion. 
It is not the case for the COTS-crewed government vehicles. To 
think that it is the large and dedicated oversight, you know, 
group could provide the same amount of credibility and 
reliability and safety and quality for a machine is to say that 
the first paragraph was misunderstood and has probably not been 
experienced.''
    So it starts right from the very start. And I know from my 
own experience that the Titan II had several dead zones in it. 
That program in Titan Gemini was a high-risk demonstration 
program only.
    Chairwoman Giffords. Thank you, General.
    Mr. Marshall?
    Mr. Marshall. Well, first of all, as you have heard today 
from this panel, I think everybody agrees that safety has got 
to be an integral process of selection and enforcement of any 
vehicle that is used in the future for human flight to provide 
astronaut travel to any place in low earth orbit or beyond. So 
I think that that is an absolute given that it has to be 
fundamentally thought through from the very beginning. That 
said, the ASAP has had the opportunity to look and observe the 
evolution of the Ares process. We have challenged Jeff and his 
team on numerous occasions and we have been very, very 
impressed by the product and the processes that they have 
employed. The commercial side is just now beginning, and as I 
noted in my opening statement, we, the ASAP, believe actually 
that NASA is behind because they haven't articulated what the 
requirements are from a human ratings requirement. We find good 
receptivity from the commercial providers thus far but the 
truth is, if they are building vehicles today and we would 
rather have had those rating requirements articulated so that 
they could be integrated into the design processes at that 
moment rather than let them transpire and move forward for 
integration at some other time. So we are very concerned about 
where the COTS-D program or the like or similar name is in this 
process case, so the basic bottom line is, safety has to be a 
primary consideration in any selection of any vehicle.
    Chairwoman Giffords. Thank you, Mr. Marshall.
    Next we will hear from Mr. Olson.

         NASA--Commercial Industry: Sharing of Safety Standards

    Mr. Olson. Thank you very much, Madam Chairwoman, and I 
would like to follow up on Mr. Marshall's comments but with 
you, Mr. O'Connor. I mean, that is one of the criticisms we 
have heard about the COTS-D program, NASA's commercial space, 
is that NASA is behind in getting the information to the 
industry as to what they need to do to become human rated. And 
so could you briefly explain how NASA uses its human rating 
requirements to tailor the design of a particular crewed system 
such as the Ares and the Orion, and again, following up on the 
line of questioning of Mr. Marshall's comments, if the human 
rating requirements are the top-level requirements, how would a 
potential commercial provider gain the insight to design a 
system that meets NASA's requirements? And one more question, 
how did NASA get comfortable enough to finally certify the 
Soyuz for human spaceflight?
    Mr. O'Connor. Yes, sir, glad to answer those. The first 
part of this is the commercial crew transport. Currently, there 
is no formal start of that program. We have been talking about 
it. We have asked for people to--commercial companies to give 
us information on how they think that might go. We have made 
our regulations, our policies, our requirements known. All that 
have asked for them, we have made them available. As I 
mentioned, even those things that are not yet transformed into 
requirements and standards, the results of the survivability 
study that we did in 2008, that has not yet been flowed into a 
set of standards but we tried to make that available as well. 
The human rating requirements document at the top level is 31 
technical requirements, or what I call ``shall'' statements. It 
is very limited. It is very top level. It is the kind of thing 
that says that shall have an abort escape system, you shall 
have failure tolerance in your design. But in the beginning of 
that document it says that there are three pieces to this. The 
first piece is that you are expected with your design to do all 
the things in a NASA development that are required throughout 
the whole set of standards and requirements, not just those 31 
but all the mandatory standards and requirements are given 
before you get into this human rating requirements document.
    This is where tailoring comes in. We spent six to eight 
months with the Constellation team and my team going over the 
flow-down of all the safety and mission assurance requirements. 
These requirements come in the form of documents that are 
called mandatory standards or mandatory requirements. But in 
order to know which of the ``shall'' statements that are 
embedded in those things really apply, you have to go through a 
pretty thorough flow-down activity and we did that with 
Constellation. It took about 6 to 8 months to go through that 
tailoring process to figure out for this particular concept, 
for this particular mission, for this particular design which 
of our ``shall'' statements would apply. We also invited the 
team to come in with alternatives. There is a NASA standard but 
there is also alternatives. Industry has some standards, for 
example, on how to do soldering and so on. We start with the 
NASA standard but we invite our contractors and our projects to 
come in with alternatives if they think they can do it just as 
well. This is part of that ``Yes If'' thing I was telling you 
about earlier.
    Now, as far as something that we don't design because our 
NASA human rating requirements document is for a NASA 
development. Now, in the past we said we would like to fly with 
the Russians. We would like to fly one of our astronauts. Norm 
Thagard back in 1995 flew on the Soyuz. The Soyuz was not built 
to any given NASA standards of the day. It was built to Russian 
standards back in the 1960s. The process for building and 
assembling and launching the Soyuz was not to NASA standards. 
It was to longstanding Russian procedures. To get to the 
comfort level we needed to fly our person on their mission, we 
spent about three years with some of our best engineers working 
with the Russians to understand the equivalence of their 
system. We know they don't do things exactly the way we do but 
can we get confident about it, and we took some time and a lot 
of good people to develop that confidence, and in the end we 
got to the point where we believed that even though they may 
not do things exactly the way we do, we are confident to the 
same level that we would if we were flying them on one of our 
systems. This business of acceptability of risk is part meeting 
requirements. It is also part building the confidence where the 
requirements don't exist or where they are someone else's 
requirements. We need to do a risk-informed confidence-type 
activity to get to where we feel comfortable doing it.
    Mr. Olson. Well, thank you for that very thorough answer to 
my question. I see my time is over. I yield back.
    Mr. Marshall. Sir, may I make an addition if I may?
    Chairwoman Giffords. Yes, Mr. Marshall, just briefly, 
though.
    Mr. Marshall. I just wanted to report that we have followed 
up with NASA as to where they are. We received a detailed 
briefing in November and are satisfied that the approach that 
they are moving forward is now appropriate and timely.
    Mr. Olson. Thank you, Mr. Marshall.
    Chairwoman Giffords. Thank you, Mr. Olson.
    Dr. Griffith, please.

     Potential Impact of Constellation Program on Commercial Sector

    Mr. Griffith. Thank you, Madam Chair, and thank the panel 
for being here. We have been in numerous, numerous hearings 
prior to the Augustine report and after the Augustine report. 
Each time the Ares I comes to the top as a respected and well-
thought-out plan some four, five years in the making. The 
successful test of Ares I-X was an achievement that we truly, 
truly appreciated and with the 700 sensors that were mentioned 
and the data that is going to be collected, it seems to me that 
the commercial aspect of this was an introduction into the 
Augustine report that was fascinating and it is greatly 
discussed but it is not hard science as we have now today with 
documentable evidence of safety. It is probably three, maybe 
four or five years out and it seems that we could achieve our 
commercial aspirations in space by developing the Ares I to the 
point where it is reliable, consistent. Our solid fuel engine 
is reliable. Our liquid fuel motor is reliable. Our Orion 
capsule is going to be reliable. We have every reason to 
believe that it is and it seems like our steppingstone into the 
commercial venture is successful development of Ares where it 
can be insured, where we can be confident that our human 
spaceflight, our astronauts can be insured and it can be 
successful.
    My question is, why wouldn't we take the approach of asking 
our government to fund the Constellation project with the idea 
in 36 months or 48 months we could transfer much of that 
information into the commercial sector with a great deal of 
confidence and not delay the challenge that we are facing with 
China, India and Japan? Mr. Alexander, would you address that, 
please?
    Mr. Alexander. First of all, I think it is important to 
remember that Ares, Orion, particular Orion, is designed for 
exploration beyond LEO. It is a spacecraft whose prime purpose 
is to take--originally designed to take people to the Moon and 
back and the space station if necessary if there were not 
alternatives. As such, it is a more complex spacecraft and more 
expensive spacecraft than I think what you would want to do 
commercially. As for the Ares I rocket in terms of commercial 
use, I think you also have an infrastructure, a per-flight cost 
that would be prohibitive from a commercial perspective. That 
being said, the Commercial Spaceflight Federation, you know, 
takes no position over whether the Ares I program should 
continue as is or should be changed or Orion for that matter. I 
personally believe that, you know, this country needs an 
exploration program and it needs a crew exploration vehicle 
like Orion to go beyond low earth orbit. That is very important 
for the Nation's human spaceflight program. But at the same 
time, we don't need to be serving all missions with the same 
vehicle because then you are not optimized for any one mission, 
and I believe and I think the Augustine Committee found that 
the capability or the technology, the knowledge is resident in 
U.S. industry to do crew transfer and cargo transfer to low 
earth orbit and that if NASA wants to get on with the business 
of exploring beyond low earth orbit, it needs to transition 
operational tasks like that to commercial sector so that it is 
not continually taking on more obligations than it can afford 
to take on.
    Mr. Griffith. Thank you.

                   Human Rating for Commercial Sector

    Mr. Hanley, the timeframe for human rating on Atlas or 
Delta for the astronauts would be what? What would we look at 
if we said today that we are going to develop commercial sector 
with taxpayer-funded money and a commercially or human-rated 
launch vehicle?
    Mr. Hanley. Well, the work that we have done over this last 
year, we had a study that was performed by the Aerospace 
Corporation for NASA. They projected, and I am going on memory 
now--we can get an answer for the record if I misstate this but 
I believe it is on the order of six years from start to develop 
a system that would have been derived off the Delta IV heavy 
launch vehicle. That booster as Aerospace studied it would have 
used the existing core stage and a new upper stage. Not 
included in that study, of course, were the implications to the 
Orion if Orion had to change at all, and that would be 
something that would have to be further studied.
    Mr. Griffith. Thank you.
    Thank you, Madam Chairman.
    Mr. Alexander. Could I follow up on that, please?
    Chairwoman Giffords. Sure, Mr. Alexander.
    Mr. Alexander. That study as described by Mr. Hanley was 
talking about a Delta IV heavy vehicle that is for the Orion 
spacecraft to low earth orbit, a 25-metric-ton spacecraft. It 
did not address or at least in the comments did not address the 
Atlas V version vehicle which has flown 19 times successfully, 
which would be used to put commercial crew capsules that are on 
the order of 8 to 12 metric tons up into low earth orbit. So it 
is not an apples-to-apples comparison to talk about a six- or 
seven-year human rating process for one vehicle when in the 
commercial world we are talking about a different vehicle that 
has already, you know, achieved a certain demonstrated 
reliability, would go through a human rating process but is 
certainly not at the six- to seven-year timeframe.
    Mr. Griffith. But what would be your estimate other than 
the six to seven years. Would you say three?
    Mr. Alexander. I would say that. I think the capsule is 
what is going to drive the timeline, not the human rating and 
the launch vehicle.
    Mr. Griffith. Lieutenant General?
    Lt. Gen. Stafford. The experience we had with the Gemini 
Titan, and that was an all-out push, was 39 months. It was over 
three years. And we had some dead zones in that, and I don't 
see how this could be any sooner. It will probably be longer. 
One thing I might add about this gap, and I would rather not 
transfer money to Russia just like anybody on this Committee 
would, but I think one thing to look at that has occurred is 
that the OMB to me in de facto has set space policy when they 
came in and cut money back and said you will finish--first 
originally came in just a person over there a second-level tier 
said the Administrator will finish it, 15 flights 2008, they 
said, but the President said we are going to complete the space 
station, phase out the shuttle and said maybe so but this is 
what it is. So to me, there needs to be an institution, someone 
like the National Space Council used to have that would oversee 
that so that second-level tier and groups like that would not 
cut back. If the proper money, it is my understanding, sir, had 
been applied, we would have had the Ares Orion flying in 2012 
or 2013 so there would not have been too much of a gap. And I 
don't know that the President ever really got the word back 
because he had other major issues on his desk at that time like 
Iraq and Afghanistan.
    Mr. Griffith. Thank you, Madam Chair.
    Chairwoman Giffords. Thank you, General Stafford. Thank 
you, Dr. Griffith.
    Next we will hear from Mr. Hall, please.

      Program Management and Scheduling Issues Between Congress, 
                   Administration, and NASA Over Time

    Mr. Hall. Thank you, Madam Chairman.
    General Stafford, you worked in the space program for many, 
many, many years and you spanned a lot of days from Apollo to 
the current shuttle program, and I think you are about as 
knowledgeable as anyone I know, and you know we are looking for 
a way to save the program that I guess the last four or five or 
six Congresses have agreed on to pursue, and that involves 
having to address that four-year gap in there, and if I may be 
wrong, I probably am, but it seems like to me that we need 
about $2 billion a year additional for about four years to make 
that happen. And what that would do would preserve our 
leadership in space, would preserve our space station, would 
preserve our friendship with some partners that have been good 
partners in space. What was your experience during the Apollo 
program in working with Congress and the Administration on 
program management and scheduling issues, and could you 
highlight the major distinctions between then and now? It was a 
lot easier then than it is now, and I think we just have to 
keep insisting that the President either in the next address to 
the Nation comes on in and recommends what we have all asked 
for and what I think everybody on this Committee here wants, to 
save our space station, save our position in space and not have 
to rely on Russia for anything. You might just in a minute or 
so if you can just kind of compare those times with today.
    Lt. Gen. Stafford. Thank you, Mr. Hall. The President's 
policy was carried out completely with the help and approval of 
the Congress. The National Space Council that was chaired by 
the Vice President helped oversee that and the OMB followed in 
line, and as I mentioned just previously, it appears that in 
certain cases the OMB in de facto is setting space policy, and 
this is one of the real issues. Also, we have today Continuing 
Resolutions that we didn't have in those days. But if the 
President sets a policy, it should be carried out and the 
funding you said would certainly do it, so we could have had 
the Ares Orion flying in 2012 or 2013 so there wouldn't have 
been much of a gap in this. Thank you, sir.
    Mr. Hall. Any others want to make any comment on that? You 
are all experienced and you have been around all a while. You 
know, not too many years ago we almost lost the space program 
by one vote in Congress, and that alerted everybody from 
schoolchildren and everybody else that is interested in the 
space program. It even caused a fine old man like Dr. DeBakey 
to come and walk out all four of the floors here in the Rayburn 
Building to talk to everybody, and a lot of them couldn't find 
time to talk to him because they didn't want to tell him no. 
But that following year I think we passed the program by 
something over 100 votes, 120 or something, but then we all got 
together on it. I am just wondering what kind of pressure we 
can put on the President of the United States to come out with 
a recommendation. Of course, back in those days, that is before 
Katrina and before the vicissitudes of nature had set us back 
in several of our states and 9/11 and 8, nine years of war. We 
are in a little different situation. But you know, if you can 
throw away $350 billion on AIG and not even know where it is 
going or not ever receive an accounting for it, they can find 
$2 billion a year for the next four years for us to save a 
program like the space program. It is a lot harder to do now 
but you six men are leaders and more knowledgeable than anyone 
I know--this is the best panel I have seen up here in a long, 
long time--to put your shoulder to the wheel and every chance 
you get talk to the President, talk to the czar, talk to 
whoever you have to talk to to get into it. But we need to save 
this program. We need to go forward with this program and we 
don't need to fall back behind or have to battle with China or 
any other nation. We just have to assert ourselves some way and 
find that money. If we are going to have all these bailouts, 
this is an awfully good place for one right now. Save the 
program. I have even thought about trying to alert all the 
schoolchildren of America for write-ins to get them to write in 
what they think about it because they are the real loser or 
beneficiary of what you do and what this Congress is going to 
do this year and next year with regard to the space program.
    But you see a lot of difference in then and now, don't you, 
Tom?
    Lt. Gen. Stafford. Mr. Hall, I certainly do. It is a 
different era. In the cooperation between the President, the 
Congress, the OMB, it is completely different, sir. I wish it 
could be like that. In fact, it could be possibly a 
recommendation from me to this Committee to say that the OMB 
should follow the policy of the President.
    Mr. Hall. And then we want to talk to the President. I 
yield back. I think I have used my time. Thank you, Madam 
Chairman.
    Chairwoman Giffords. Thank you, Mr. Hall.
    One of the reasons why we have held so many hearings, two 
hearings ago we had a fascinating panel of experts to talk 
about tech transfer from NASA because in so many ways the 
accomplishments of NASA go beyond just exploration or go beyond 
what we can physically see up in space right now, but from the 
airline industry to the medical industry, computers, it has 
been extraordinary the gifts that NASA has given to our country 
and to the world and so part of our job on the Subcommittee is 
to make sure that the American people, the President, other 
Members of Congress understand that as well.
    Next we are going to hear from Ms. Edwards.

           Implementation and Application of Safety Standards

    Ms. Edwards. Thank you, Madam Chairwoman, and thank you to 
the panel. Every time we have these hearings, I learn something 
new. In my mid-20s I recall sitting in front of a monitor at 
Goddard Space Flight Center, the elation of a launch in January 
1986, the confusion thinking that there was something that we 
had done wrong in our communications on that day, and then the 
absolute silence of silence, unlike any I have ever heard over 
our colleagues as we realized the disaster that had happened 
with the Challenger. And I think at that time I think all of 
us, no matter what we did believe, that we paid great attention 
to safety and obviously the investigations that followed 
demonstrated that there were huge gaps in safety, pockets where 
there was a lot of attention to safety and other pockets where 
there wasn't, and we even to this day and after the Columbia 
disaster continue to point to some of those same gaps, and I 
think, you know, safety has to be north, south, east and west 
in NASA whether the services and work is being performed by a 
contractor or internally at NASA and so I appreciate the 
testimony today.
    In looking at the Augustine report, there is really 
actually very scant mention of safety in the report I think as 
General Stafford pointed out and so one of the questions that I 
have really is, and especially with the principles that I think 
Dr. Fragola, you outline, how you would take those principles 
today and actually even apply them to Challenger and to 
Columbia to see whether, you know, these design systems, for 
example, that had been, you know, launched--I don't know--25 
times, I think when the Challenger disaster happened and we 
would have described those as, you know, pretty reliable, but 
whether those principles applied today would allow Challenger 
and Columbia to meet the mark as you have indicated that 
perhaps in the design and the concept of Ares you think that 
that would meet the mark.
    Mr. Fragola. The principal problem with the space shuttle 
is a lack of abort system, the lack of being able to address 
the recovery of the crew given an incident. The shuttle as a 
launch vehicle is among the best, if not the best in the world 
as a reliable vehicle but the shuttle points out very 
dramatically the difference between reliability and safety. I 
would also like to point out, having been involved in the 
original shuttle competition, the reason--one of the reasons we 
sought the shuttle was, we were concerned at the time about 
recovery of the Apollo capsule. We had had one failure where we 
lost one parachute and we were concerned about that system and 
we were therefore interested in designing a system that would 
address the failings of the past, and so we felt that a landed 
system, a system with wings, would improve on the recovery, and 
it certainly has improved on the recovery but it has increased 
the vulnerability in ascent and increased the vulnerability in 
other areas. So one of the things that I think we should learn 
from this is that we can't anticipate all the unknown unknowns 
in a system, and that is one of the reasons why it is essential 
to have a robust and well-tested system that is able to survive 
and abort safely. We didn't do that on the shuttle.
    Ms. Edwards. So Mr. Marshall, I wonder if you would 
describe for me how it is that we could apply a set of safety 
standards and principles both within NASA and also in a 
commercial environment given our experiences?
    Mr. Marshall. Well, you heard earlier that the FAA ought to 
be the licensing authority for commercial venue. We certainly 
agree with that and we think that there is a need to really 
aggressively develop that process. I am not an expert on that 
and haven't participated but my understanding is that the 
process is just beginning. Conversely, NASA establishes the 
crew safety requirements, and this is what I was talking to 
from a commercial venue. We, the ASAP, believe that NASA does a 
great job for its own government-controlled programs but that 
this process really needs to be accelerated from a commercial 
perspective if there is going to be movement and direction in 
that particular arena. So we think that it is a combination of 
both the licensing authority and the user of that, which is the 
NASA authorities, to aggressively develop the human rating 
standards that are necessary to provide for the crew safety.
    Ms. Edwards. Thank you.
    Madam Chairwoman, I know my time is expired. I obviously 
have tons more questions.
    Chairwoman Giffords. Thank you, Ms. Edwards.
    Next we will hear from Mr. Rohrabacher.
    Mr. Rohrabacher. Thank you very much, Madam Chairman, and 
again, thank you for your leadership in this Subcommittee.

    Constellation Program: Human and Certification Options Concerns

    First of all, let me just state, I am not opposed to the 
Constellation concept. I think that from what I have seen, the 
Orion and Ares system has a role to play. I am a bit worried 
that what we have here, however, is a mindset that I have seen 
before and a mindset that has failed before, and that is, 
trying to have one system that will serve all needs and thus 
actually bring down the chance of success of that mission or 
the ability of that mission to actually do a very great job in 
a specific area. I remember the Edsel car was supposed to be 
something for everybody and it turned out to be nobody in 
particular really wanted it because it was designed for 
everybody. I remember the F-111, which was an aircraft that was 
designed supposedly--I remember that during the early 1960s and 
it was supposed to be something that could fulfill every 
mission but then once they built it, none of the military 
people really wanted it because it really didn't fulfill any of 
the missions as well as they had hoped or what they wanted. I 
would hope that with Ares Orion, we are not making that same 
mistake trying to say that we have to have the same rocket and 
transportation system for low earth orbit that we have to have 
for other missions, later on the Moon, and I support the moon 
mission. That is why I think maybe the Ares Orion system is 
important in the long run but why in the short run do we have 
to have it fulfilling the same needs that we could perhaps 
serve--might be better served by making the Delta system, which 
is a very good system, been very reliable, or the Atlas V 
system, and just making them with the ability to carry people 
then and they can, I guess, man certified I guess is the words 
we are looking for. So why is it that we have to have--Mr. 
O'Connor, why is it that we have to have Ares doing everything 
rather than going with trying to do manned certification for 
Delta and Atlas?
    Mr. O'Connor. Well, sir, this is a decision that was made 
some time back when we were looking at the vision and what we 
wanted to do with human spaceflight, and in the context of the 
mission, which was to have something that would take our 
astronauts to the moon as a steppingstone to further out, the 
concept included two different launch vehicles, one heavy and 
one light, and the light one was carrying crew. And by 
definition, the light system that carried the crew had to be 
able to take the crew to low earth orbit. Now, the Orion was 
designed----
    Mr. Rohrabacher. Having to do that doesn't necessarily mean 
it is the most cost-effective and the most efficient way of 
doing it.
    Mr. O'Connor. Right, and I agree. It had to do that as part 
of the lunar mission, and if you simply said let us not worry 
about the lunar mission, let us do something just to low earth 
orbit, then you would start from scratch and say let us do 
something that is just for low earth orbit, and you may not 
have the Ares Orion system.
    Mr. Rohrabacher. We spent a lot of money on the Delta and 
Atlas systems over the years and they have proven themselves in 
terms of actually launch systems. I don't know, we haven't put 
people on them but they have proven very reliable in that. 
Again, I don't--and by the way, I support the moon mission. I 
think the moon mission is a good mission and that is why I 
support the Ares Orion system but suggesting that we then have 
to because that is going to be used for a later mission, we 
have to use that rather than Delta or Atlas, I don't think it 
makes sense. There is something that doesn't--I am going to 
have to study this a little more. It just doesn't seem to come 
together for me that that is a requirement.
    Mr. O'Connor. Yes, sir. You know, when we looked at this--
and I am going to defer to the program manager on this because 
he has looked at it harder than I have but just from my view as 
the safety guy, it seemed to me that either one of those two 
options was an F-111 equivalent. The Atlas and Delta are not 
designed to carry people in space. They don't have the 
structure for it. They were designed for cargo, and they are 
very reliable but they would have to be significantly modified 
in order to do----
    Mr. Rohrabacher. Well, you know, reliability of cargo, what 
we are talking about is human cargo, and I don't see that as 
being in a totally different category. You just want to make 
things a little bit adjusted for human beings.
    Well, my time is up. Thank you very much, Madam Chairman, 
and maybe we can have a second round if we have time.
    Chairwoman Giffords. Indeed.
    Mr. Hanley, would you like to comment?
    Mr. Hanley. Just to address your concern with respect to 
the exploration mission and Ares I, the underpinnings of the 
Constellation's exploration architecture to go to the moon was 
integral to the decision to choose Ares I or something quite 
like it when those decisions were made. We began from the 
process of the design of the Constellation system with the moon 
in mind. The key driving requirements of Constellation, the 
preponderance are for the lunar mission. So we selected it 
because where we want to be taking our risk is on the lunar 
surface, not in the first 100 miles. And we leveraged off of 
the decision that we made on heavy lift, and because Ares I is 
derived from the infrastructure we need for the big rocket, the 
Ares V, you get it at sort of a marginal additional cost. The 
design of the first stage solid and the design of the upper 
stage engine on Ares I are the same assets that are used for 
the Ares V, so the production capacity is common for those.
    Chairwoman Giffords. Thank you, Mr. Hanley, Mr. 
Rohrabacher.
    Ms. Kosmas, please.
    Ms. Kosmas. Thank you, Madam Chairman. Thank you, 
gentlemen, for being here today. This is obviously an issue of 
great importance to us here on the panel and also I think to 
the American public as we move forward and make every effort to 
maintain our leadership in space exploration for all the 
reasons that are obvious to us and that we attempt on a regular 
basis to make obvious to others, so we thank you for being 
here.

              ESAS Recommendations for Human Space Flight

    No question about the fact that safety is a very important 
concern. I want to chat with you a little bit about an article 
that was in today's Orlando Sentinel. I am from central Florida 
where the Kennedy Space Center is and so it is a big issue for 
us in our district with regard to what the next phase of space 
exploration will be, and also a great concern of course for the 
gap, but nevertheless, safety of course is very important. The 
story in today's Orlando Sentinel discusses the 2005 
architecture study, ESAS, recommendation that after two test 
flights, the first five flights of the new rocket and capsule 
deliver only cargo to the International Space Station to 
establish a record of reliability before putting humans on 
board. The ESAS states it takes five flights in addition to the 
two test flights to surpass the shuttle safety level of one in 
100. If there were no cargo flights beforehand, the risk of the 
first crewed flight after the two test flights would be 
approximately one in 40, or approximately two and a half times 
the shuttle. Adding cargo flights to ensure safety would only 
seem to increase the gap in U.S. human spaceflight capability.
    So the question I wanted to ask was beginning with Mr. 
Hanley, I understand that the current plans propose putting 
astronauts aboard Ares I and Orion after only a single unmanned 
flight of the final rocket. Can you discuss this decision in 
light of the ESAS original recommendation and what steps are 
you taking to address this concern?
    Mr. Hanley. Certainly. As part of the program's preparation 
for its program preliminary design review that will be next 
year, next calendar year, we are putting together our 
integrated test and verification plan. The flight in which the 
crew will launch will be informed by that plan and it requires 
an understanding of the test program, and Joe talked about this 
earlier, the test program that goes into verifying that these 
systems will in fact perform the way that the designers believe 
they will. There is a lot of variability in the methods one 
might apply to try to use a crystal ball to predict how 
reliable a particular system will be. Coming up with an 
absolute number is very sensitive to the method or the 
approach, the thought process that you use, and that is what we 
see. So predominantly we use these risk numbers to compare 
alternatives, not necessarily to inform some absolute number of 
what the risk level really is. So with respect to the 
assertions made in the ESAS study versus what we are doing 
today, I would invite Joe to maybe comment because he was 
integral to the ESAS study.
    Mr. Fragola. And since I wrote that section that you 
referred to, that is a great confusion. If they had only gone 
to the page before, they would have seen that that statement 
referred to an advanced engine on the Orion spacecraft using 
LOX/methane. What we were trying to do was to enhance the 
reliability, the mission reliability of the lunar missions with 
a given performance. We were looking at LOX/methane because 
LOX/methane was able to be carried through as a launch 
propellant for Mars. What we wanted to show from a safety 
standpoint was that there was a penalty in immaturity to the 
system if we chose that LOX/methane option. So what you were 
seeing there was that penalty. If we look at the Ares system, 
Orion system today with the propulsion system that is now on 
Orion, which is essentially the same that is on the space 
shuttle OMS systems and has performed absolutely perfectly on 
the OMS and was also on the lunar module descent engine and on 
the command module serving as propulsion system, the immaturity 
of the system drops to almost zero and now the immaturity of 
the system is based on primarily the second stage of the Ares 
system. And if you look at what it takes for that to get to the 
equivalent of the shuttle, it is between one or two test 
flights necessary to get the equivalent of the shuttle. It is 
certainly not going to get to one in 1,000 at that point but we 
are looking at trading off versus when does it get to the point 
that the shuttle, which is what we are flying crew on today. So 
the statement in the Sentinel is correct but it applied to an 
option in the ESAS study, not the one that we are flying today.
    Ms. Kosmas. Thank you. Unfortunately, I am afraid that 
ended up using all my time, but thank you for the answer and I 
will see to it that that information is passed along. Thanks.
    Chairwoman Giffords. Thank you, Ms. Kosmas.
    For the remaining member for our first round is Mr. Hill. 
Mr. Hill.
    Mr. Hill. Well, thank you, Madam Chairman. I got here 
rather late so I need to get caught up on some of the 
conversations you have been having for the last hour or so, so 
I will pass on asking questions.
    Chairwoman Giffords. Thank you, Mr. Hill. We are glad you 
are here.

        Availability and Economic Viability of Commercial Crew 
                               Transport

    We are going to begin a second round. We have not had votes 
yet so it is our good fortune today, and while we have all of 
you here we are going to take advantage of it, so I would like 
to begin. I am going to ask everyone on the panel starting with 
General Stafford if you could answer two questions. Taking 
everything that we have learned today about safety and the 
complexities of what it takes to build these vehicles, is the 
timetable for availability of commercial crew transport truly 
realistic? That is my first question. And the second is, given 
the required steps of everything that factors into building 
these vehicles, do our witnesses believe that would-be 
commercial crew transport service providers be able to garner 
sufficient revenues from non-NASA passenger transport services 
to remain viable over this time period as well? So those are 
the two questions that I have. I know that you gentlemen come 
from different aspects and different angles of this industry. 
You know, the backdrop of course is in light of the fact that 
we have a diminished budget. I mean, if we had sufficient 
budget to do everything, I am sure that all of us on this 
Committee would agree that this is where we want to invest our 
money, I mean, because the benefits that come from both the 
private and public space sector is outstanding and much 
underappreciated. But given the fact that we have finite 
resources, I think that these are two important questions. I 
would like to begin with you, General Stafford.
    Lt. Gen. Stafford. Thank you, Madam Chairman. First, on the 
safety for the commercial crew delivery for government crews, 
the observations in the Augustine report said 2016. If they 
would go to meet the requirements starting with safety and 
mission assurance, I think that would be a very tough goal to 
make it. They could possibly make it. But on the other hand, 
when they said 2017 for the Ares Orion, I do not understand 
that. It should be far sooner than that.
    As far as other customers that the commercial crew delivery 
corporation would deliver to, right now, other than the space 
station, I know of no other ones that would be there at this 
time.
    Chairwoman Giffords. Thank you, General.
    Dr. Fragola?
    Mr. Fragola. Well, certainly the challenge is a potential 
challenge that could be met by the commercial crew. It is a 
question of what the uncertainty involved is, and from my 
perspective based upon history, it would be very uncertain that 
we could meet that kind of a date. Certainly the type of work 
that has gone on in Ares since the time of ESAS to today to 
ensure safety in that vehicle is equivalent to what you would 
have to do on any vehicle, whether it would be a Titan or a 
Delta or an independent commercial launcher.
    I would like to go back to that one thing that I said 
before to answer Mr. Rohrabacher. There is a big difference 
between a crew payload and a payload that is not crew because 
after the accident, the payload that is not crew doesn't care a 
whit about what happened but the payload that is crew cares a 
lot, so what we have to do is to design the abort system 
integral to the failure mechanisms that are on that system and 
that requires a much greater knowledge of your launcher than 
they have today with commercial payloads or for Air Force 
payloads.
    Chairwoman Giffords. Thank you, Doctor.
    Mr. Alexander.
    Mr. Alexander. Thank you. I believe that the timetable as 
laid out by the Augustine Committee is realistic. That is seven 
years from now. Certainly I don't believe that the human rating 
of the launch vehicle is the long pole in the tent. I believe 
it is the development of a capsule to take people to the 
station and back. There are companies that say they can do it 
in significantly faster time than that and there are others 
that say it will take at least that long, and I wouldn't, you 
know, pretend to be the expert that is going to predict exactly 
what it will take. However, I do know that it will take longer 
if we do not start now. As I said before, I don't believe that, 
you know, Ares Orion and commercial crew are competitive. I 
think that you need to do both, so it is not about which one 
gets there first necessarily but I do believe that because 
servicing the station is a simpler mission, less complex, and 
you can use demonstrated reliable launch vehicles that will 
need modifications but not extensive modifications because they 
have a track record of 19 successful launches or heritage of 19 
launches, that that is a realistic timetable.
    Second, as to whether there are viable revenues from non-
commercial or non-government sources, there is already a market 
for private spaceflight participants that have been paying 
between $25 million and $35 million to fly on the Soyuz. Those 
people spent 6 months of their lives learning Russian, training 
on Russian systems separated from their revenue-generating jobs 
that they have. I believe that if the United States industry 
were able to offer that capability, you would have a far 
greater number of people willing to take that on and pay that 
kind of money. Also, you know, with the hope that with 
commercial, the price comes down, that market becomes bigger, 
but there is also a market for other U.S. industries and other 
activities, microgravity research, et cetera, in space that is 
not efficiently served by NASA and the NASA process and I think 
that commercial will be able to find additional revenues there. 
They certainly will not be the bulk of revenues in the 
beginning but there is a place for--or there is a demonstrated 
market there now that will only grow.
    Chairwoman Giffords. Thank you, Mr. Alexander.
    Mr. Marshall.
    Mr. Marshall. Regarding the two questions, is the timetable 
realistic, in the ASAP's 2008 annual report, we made a 
statement that said that there is no evidence to suggest that 
the use of a commercial space industry vehicle can 
significantly close the gap. We stand by that statement. We 
have no evidence that would say otherwise. I think the term 
that is of importance is ``significant.''

                      Orbital Sciences and SpaceX

    The second is, given the steps, is there sufficient revenue 
to provide survivability. I mentioned to you in my opening 
statement that we have gone to both SpaceX and to Orbital 
Sciences. We were at Orbital Science this week, and during the 
presentation we asked their senior management if they had done 
a market analysis to find other revenue sources that would 
address this specific issue. The answer was no, we have not 
done the market analysis because we see no viable commercial 
requirement at this time. Now, I am not trying to put words in 
their mouths. That is just the way I interpreted it. I would 
think that that is a fairly accurate statement.
    Chairwoman Giffords. Thank you, Mr. Marshall.
    Mr. Hanley?

                  Timetable: Commercial Crew Transport

    Mr. Hanley. With respect to timetable, I can really only 
speak to what I would see as the challenges, and Joe has 
touched on them. I think it is--and I would agree with Mr. 
Alexander, I think it is about the spacecraft, it is about the 
launch abort system as well as the rocket. Joe, I think, spoke 
quite eloquently about how it is an integrated system. It needs 
to be designed altogether as an integrated system to be able to 
maximize crew safety, and I think that is where the real 
challenges lie for other developers. That is certainly where 
our focus has been for these four years, and so what kind of--
what that does to the timetable or not I really couldn't 
comment, not having detailed knowledge of the plans and the 
alternatives. So with respect to revenue, I hope to maybe live 
to see the day when I can buy a ride, but as far as revenue, I 
really don't have a comment.
    Chairwoman Giffords. Thank you, Mr. Hanley.
    Mr. O'Connor.
    Mr. O'Connor. I haven't done an independent assessment of 
these schedules but I can just tell you as a safety guy 
watching program and project managers and contractors predict 
schedules for years, as I watch that happen, I have seen that 
sometimes they miss and some of the things that cause them to 
miss schedules is the down time after failure. Another thing is 
the lack of integration up front. If you don't do good 
integration up front, then you pay for it later and it takes 
time. I remember after Challenger we tried to retrofit an 
escape system on the Challenger and we flat couldn't do it. So 
it wasn't even a matter of schedule. It was just too hard. So 
getting early, getting things done quickly in the front part of 
a program that you are going to need later on can help with 
schedule because it takes much longer to fix things than to do 
it right in the first place, so that is all I can add to that, 
and I really haven't looked at commercial revenue at all so I 
wouldn't comment on that.
    Chairwoman Giffords. Thank you.
    Mr. Olson.

                 Ares Program: Safety and Future Impact

    Mr. Olson. Thank you, Madam Chairwoman, and this is a 
question for all of you or anybody who wants to comment, but I 
want to get back to some of the issues, some of the concerns we 
were talking about about the Ares program, and as you all know, 
a couple of weeks ago we had a very successful test of Ares I-
X, a vehicle that had over 700 sensors on board to measure many 
of the factors that that spacecraft was feeling as it went 
through its ascent, and I just want to get some comments from 
all of you. How does that level of technology that we have now, 
how does that increase our ability to develop a vehicle safely 
and not have necessarily the flight test that we had to have in 
the past, and one sort of side question to that is, how does 
development of Ares I help speed up the development of Ares V, 
you know, basically the same system in many, many ways. Does 
that allow us to accelerate the development of the Ares V? Mr. 
Hanley, you first.
    Mr. Hanley. Well, the way I think of it is that by 
developing Ares I we are in fact developing parts of Ares V 
today so we aligned our strategy purposefully back four years 
ago. If you will recall, coming out of the Explorations System 
Architecture Study, the Crew Launch Vehicle, as it was called 
at that time, the Ares I was called, was a four-segment solid 
plus an upper stage that utilized the space shuttle main engine 
and we purposefully at the agency level made a decision to 
change to the five-segment and J2-based upper stage because we 
wanted to leverage the early investment of dollars we were 
making toward building the heavy lift launch vehicle. So that 
is the synergy between Ares I and Ares V that a lot of folks 
miss. So we are building part of the Ares V rocket today with 
the five-segment booster with the J2X engine. We even 
purposefully will be looking to play forward the investment we 
are making in the avionics that guide the rocket as well. The 
hurdles that we face with building a larger rocket really focus 
on the core stage, the massive core stage in that system, and 
those are investments we have yet ahead of us.
    Mr. Olson. Thank you for the answer, Mr. Hanley.
    Any other panel member care to comment? Okay. Well, that 
was my last question, Madam Chairwoman. I yield back the 
balance of my time.
    Chairwoman Giffords. Thank you, Mr. Olson.
    Dr. Griffith, please.

                     COTS vs. Constellation Program

    Mr. Griffith. Thank you, Madam Chair.
    Some in NASA have suggested that by taking on the risk of 
procuring maybe a commercial service to deliver astronauts to 
the space station that we will lower our costs and provide 
greater launch capability, yet the COTS program was to be a 
proving ground for commercial sector to deliver cargo to the 
station but to my knowledge, that has yet to happen. I don't 
know that any of the commercial orbital transportation service 
providers or the funding of that has been able to deliver what 
we had hoped that it would. It seems that we should require our 
commercial providers to prove their ability to deliver on these 
contracts or on these ventures that taxpayer funds have funded. 
And so my question is, and anyone can answer this, the 
commercial orbital transportation services, what evidence do we 
have, what hard evidence do we have that we can rely on them to 
deliver manned spaceflight in a more timely way than we have 
with our Ares I or Constellation project? Is there any 
evidence?
    Lt. Gen. Stafford. Mr. Griffith, as I said, I did extensive 
examination of the Augustine report and I knew many of the 
members and have talked to them, I told them I would be giving 
testimony here today. In fact, this morning I talked to Dr. 
Crowley twice on my cell phone on his idea of multiple 
providers and his assumed cost on those commercial government 
crew delivery vehicles, and then I checked with Mr. Hanley here 
and so it was a wide variance between their assumptions and 
what we have, and also I found that there was also, on the 
Augustine Committee there was somewhat of a wide variance of 
opinions among the committee members, sir.
    Mr. Griffith. Thank you.
    Mr. Alexander?
    Mr. Alexander. Thank you. The question of whether to prove 
cargo first, if you will, before putting people on top, I 
certainly agree with that in terms of demonstrated reliability. 
Those cargo systems that are being developed are being 
developed right now and those will fly many times before people 
are put on those rockets or any new system goes on an Atlas V 
which already has a demonstrated reliable launch record. The 
question of whether cargo has delivered, you know, the programs 
has not been completed yet to first flight. They have not had 
their demonstration flights yet. As Mr. O'Connor said, every 
space program seems to have cost growth and schedule risk, or 
schedule drift, if you will. I would put the record of those 
cargo demonstration programs up against the record of 
government space program developments in terms of cost growth 
and schedule risk, and I think they would compare very 
favorably. So whether they have met all their milestones 
exactly as they originally planned four years ago, I am not the 
expert to speak to that but they are certainly progressing well 
as evidenced by the fact that NASA is paying on those 
milestones and is in agreement that things are progressing 
well. So I do believe that those programs are functioning well. 
I believe that, you know, demonstrated launch vehicles and 
cargo missions will happen before crew missions happen, and 
again, as I said before, the longer we wait to start that 
process of crew activities or commercial crew activities, the 
longer it will take us in terms of shortening any gap or when 
we actually would be able to deliver that service.
    Mr. Griffith. Thank you, Mr. Alexander.

                  Risk Assessment: Commercial Vehicle

    Dr. Fragola, are you involved in the risk assessment 
whether it be the risk assessment of a commercial vehicle for 
delivery of cargo or the development of a commercial vehicle 
for the delivery of our astronauts?
    Mr. Fragola. At this moment, I have no involvement in that. 
However, as part of the review, the independent review, I did 
look at the alternative launch vehicles, particularly Delta IV 
heavy. As part of the ESAS study, we did look at the Atlas V 
single core. By the way, it is important to point out as Mr. 
Alexander has mentioned, the Atlas with the 19 successes is a 
single-core vehicle with a rather limited payload capability to 
orbit as compared to the payloads that we are talking about on 
the Ares I. There is no doubt that the single-core vehicle 
would be more reliable than a triple-core Atlas but a triple-
core Atlas doesn't exist today. We don't have an Atlas heavy. 
The option would be a Delta IV heavy and that was evaluated and 
seemed to be about a factor of two to a factor of three less 
safe than the Ares. But one of the things I wanted to point 
out, as I mentioned, immaturity is very important. One of the 
arguments against the Ares is, well, the first stage of the 
Ares is not equivalent to the SRB on the shuttles, it is a 
five-segment booster. I would point out that we are recovering 
the booster first stage. That is not going to occur on any of 
the commercial alternatives and so the learning we can get from 
inspection post flight is incredibly important to advancing the 
maturity of the vehicle and to proving that we have carried 
over the 255 successful launches of the SRB on the shuttle and 
the Ares I.
    Mr. Griffith. Thank you.
    Thank you, Madam Chair.
    Chairwoman Giffords. Mr. Hall, please.
    Mr. Hall. Madam Chairman, I think you will leave the record 
open for us to write and make inquiries if we need to. With 
that understanding, I will yield my time to Mr. Rohrabacher.

                     Ares, Delta, Atlas: Comparison

    Mr. Rohrabacher. Thank you very much. I just want to get 
into this thing about making some comparisons in terms of the 
alternatives that we have, and Dr. Fragola, I appreciate your 
comments. I think we might disagree but I am really interested 
in learning from you on this because you know much more about 
it than I do. I understand that. But when you are suggesting to 
us that we have to look at the many uses that have been put 
through and the actual track record of the first stage of the 
Ares, that really doesn't count, does it? Because the system 
itself can't be certified as being reliable until the second 
stage, which has never even been built yet, is put into the 
system. Isn't that right? So with that type of analysis, there 
is not even a comparison between the Delta and Atlas in 
reliability because the Ares doesn't even have their second 
stage built yet, which the system will fail if the second stage 
doesn't work.
    Mr. Fragola. That is correct. The second stage is the risk 
driver and that is the reason why we chose a J2X system which 
has heritage both in the RS-68 engine and in the J2 engine and 
the J2-S engine. It is true that the stage and the engine as an 
integral sum has not been----
    Mr. Rohrabacher. You say risk driver, but that risk has 
already been assessed in terms of Atlas and Delta. We have no 
way to even assess whether that risk--what that risk is because 
we haven't even built the second stage----
    Mr. Fragola. Even----
    Mr. Rohrabacher. --to get the system that you are talking 
about.
    Mr. Fragola. Again, the equivalent payload, even on the 
Delta IV heavy, we would have to modify the second stage of the 
Delta IV heavy. There is no way we can get the payload that we 
get so we would have to have----
    Mr. Rohrabacher. Well, that is if you want a payload that 
big, but if you are having medium-sized payloads, it has 
already been proven.
    Mr. Fragola. If you were to decrease the requirements 
significantly down to the payload like Mr. Alexander has spoken 
to, then you would have to--you would be able to use the 
existing second stage----
    Mr. Rohrabacher. And you might want to have a few more 
launches rather than having to launch everything on one rocket. 
That doesn't--it doesn't make sense to me that you just have to 
have everything in a big payload carrier.

                           Orion Space Craft

    Let me get to beside the rocket, and I only have a couple 
minutes left here. I would like to look at the actual 
spacecraft, the Orion spacecraft, as compared to the 
alternatives there as well, and again, I am not opposed to the 
Ares Orion system because I do believe in the moon project. I 
just think that if we try to do everything--the moon project 
has to be the same thing that we rely on for a low earth orbit. 
That may not be the best deal for the taxpayers and it may not 
be as reliable and it may not be as far so that we can bring it 
into play, but I understand Boeing--Boeing is in my district, 
and I seem to remember that they are developing this other 
spacecraft, and why is it that spacecraft--in terms of safety, 
is it more--is the Orion safer than what Boeing is presenting 
to us?
    Mr. Fragola. I guess I am not familiar with the particular 
Boeing spacecraft. I know some other spacecraft. Which one are 
you referring to?
    Mr. Rohrabacher. Well, it is in development right now. I 
understand that it hasn't been flown yet, but I understand that 
they are proposing this. Maybe I----
    Mr. Fragola. I can't comment on a design I haven't seen. I 
haven't seen that yet. If someone would present the design, I 
could look at it.
    Mr. Rohrabacher. And do the NASA people know anything about 
a Boeing proposal on this? So I am wrong then, I have been 
misinformed then that the commercial spacecraft companies are 
actually proposing a spacecraft that would be similar to Orion.
    Mr. Fragola. Well, we visited--similar to Orion, no, but we 
did visit a few people who had mockups of vehicles, but mockups 
of vehicles, we had them in ESAS four years ago. I mean, 
between that and a real design is a far way to come.
    Mr. Rohrabacher. And Mr. Alexander wants to mention 
something here.

                  Commercial Crew Development Program

    Mr. Alexander. If I might, I believe that Boeing has teamed 
with Bigelow Aerospace to propose something under NASA's CCDev, 
or commercial crew development program. So that is at this 
point probably a concept----
    Mr. Rohrabacher. It hasn't actually been designed out and--
--
    Mr. Alexander. Right. They were one of the, you know, 
finalists for the Orion Crew Exploration Vehicle. Lockheed 
Martin ended up winning that program. I am sure that they 
have--their current design has a lot of heritage to what they 
were proposing for Orion but they were not the winner.
    Mr. Fragola. By the way, we saw that vehicle and that 
vehicle's design requirement requires you to rendezvous and 
dock within the first orbit in order to meet the payload, and 
that means that if you don't have proper rendezvous and you 
don't dock the first time, you deorbit, and Bigelow was willing 
to accept that because he was a commercial enterprise, but to 
do that on the station, I don't know that that's something that 
is prudent. If he does that, he limits the payload, limits the 
design. He also doesn't have to carry the things to sustain the 
crew for two or three orbits and that significantly reduces the 
mass of the----
    Mr. Rohrabacher. Thank you very much.
    Thank you, Madam Chairman.
    Chairwoman Giffords. Thank you, Mr. Rohrabacher.
    Ms. Edwards.

                Training for Commercial Space Operatives

    Ms. Edwards. Thank you, Madam Chairwoman. I just have a 
question and it goes to the testimony that you presented, 
General Stafford, with regard to training and your indication 
of how involved and important it is for the crew to really be 
involved in training that simulates off nominal conditions and 
also, you know, the number of hours that are spent with regard 
to safety in every detail. And so I wonder if you could 
actually speak to what you might identify as some of the 
challenges presented for training with commercial space 
operations.
    Lt. Gen. Stafford. Ms. Edwards, to launch, rendezvous and 
then dock with the International Space Station, you would have, 
you know, working with the spacecraft simulator and mockups and 
then you also have integrated simulations with the mission 
control center that, you know, has control of the International 
Space Station. So you would have to go through the 
contingencies and so it would be a whole series of issues and 
that would start with a whole series of just to start with, 
using the launch abort system, the recovery, what action the 
crew would take, egress from it. And so also on these vehicles 
as they are being built, we are talking, I think, 
approximately, Ms. Edwards, two and a half flights per year, if 
I am correct, that the crew would probably be there at the 
factory when the spacecraft was being built too to understand 
it. But also in the simulations, it would be just repeat 
simulations and there is a profile for this and it requires 
really hundreds of hours.
    Ms. Edwards. And do you think that that profile changes in 
any respect with what are essentially sort of off, you know, 
outside of NASA operations? And I also wonder if Mr. Alexander 
could speak to this question.
    Lt. Gen. Stafford. Well, if it is outside of NASA 
operations, I would assume it would not go to the ISS because 
the requirements, you know, you have to go to rendezvous and 
dock with the ISS, a strict number of requirements. In fact, I 
was involved with some of that, having worked with the 
investigator with the Progress colliding with the Mir there on 
the Shuttle-Mir program then. So I think NASA would be involved 
there, and then you have, you know, particularly the commander 
and the pilot would have to be deeply involved and go through 
this and maybe people just along for the payload specialist or 
mission specialist for the ride would not have to undergo near 
that many but the one that is the commander and the pilot would 
definitely have to undergo hundreds of hours on that.
    Ms. Edwards. Mr. Alexander?
    Mr. Alexander. Certainly a rigorous testing program and 
training program would be instituted for any commercial crew 
mission, whether it is a commercial mission just to low earth 
orbit or whether it is carrying NASA astronauts to the space 
station. So obviously everybody on board the vehicle is going 
to have to go through a rigorous training program, and 
certainly the pilot and commander would be much more rigorously 
trained than anybody that is just simply a participant on the 
flight.
    I think in a broader context, you know, right now for any 
U.S. human spaceflight mission throughout our history, it has 
been a mix of government through NASA and industry, U.S. 
industry, building things, and the relationship has been one of 
a seamless, integrated relationship between NASA and industry, 
you know, a certain contractual environment. What we are 
talking about for a commercial crewed program that would fly 
NASA astronauts is still going to involve an intimate 
relationship between NASA and industry. Some of that 
relationship will change based on historical patterns. But it 
is certainly not one without the other, and I think it would be 
a mistake to assume that from a commercial perspective we 
expect to develop something, throw it over the transom and have 
NASA just accept it. NASA is going to be there every step of 
the way. They are going to be intimately involved and that 
certainly will be true for training of NASA astronauts but will 
also be true in the design, testing and production processes.
    Ms. Edwards. So you don't envision any significant change 
to training protocols and requirements with a venture towards 
commercial operations?
    Mr. Alexander. I am not an expert on what those are today 
but there would certainly be rigorous training and there would 
certainly be agreement between NASA and the private sector 
about how that is going to happen and what is expected such 
that by the time a NASA astronaut is on board that vehicle, 
they are not only capable of flying it and capable of flying it 
in off nominal conditions and abort scenarios but that NASA at 
the highest levels all the way up to the Administrator and 
through Bryan O'Connor have the confidence in that system and 
the overall system capability including the people involved.
    Ms. Edwards. Thank you, Madam Chairwoman.
    Chairwoman Giffords. Thank you, Ms. Edwards.
    Ms. Kosmas, please.

               Soyuz Space Craft: Concerns Moving Forward

    Ms. Kosmas. Thank you, Madam Chairman.
    I wanted to chat with you all a little bit about the Soyuz 
that is intended to be used during the gap. I know, Mr. 
O'Connor, you spoke earlier about the history and the fact that 
not that much combined testing was done early on and that we 
made a decision as a Nation to send an astronaut anyway. But I 
think we are a little more enlightened now perhaps. As you 
know, following retirement of the shuttle, NASA is planning to 
rely solely on the Soyuz for astronaut transportation to and 
from the International Space Station, and this will probably 
be, from discussions we are having right now, for at least five 
years. So I would like to ask, General Stafford, you can answer 
it or Mr. O'Connor, last year the Soyuz experienced a few rough 
landings due to malfunctions, and can you discuss NASA's 
assessments following these incidents whether they were 
involved in the assessments following the incidents and the 
decision to continue to use the Soyuz? The other question which 
I will go ahead and ask now is, are we now--is the Soyuz now 
required to meet our U.S. standards for quality, safety, 
environment, wages of workers, financial accountability and 
engineering practices? So are they accountable to us in the 
same way that we would expect our commercial operations to be 
or that we would expect NASA itself to meet? I would appreciate 
if you could address that since it does appear that that is our 
alternative during the five years. General?
    Lt. Gen. Stafford. Thank you, ma'am. As the chairman of the 
ISS Advisory Committee, we meet with our Russian colleagues at 
least twice a year and they have conference calls once a week 
concerning issues that would arise, and on that the Soyuz first 
flew in 1967. There have been two fatalities, one in 1967 and 
one in 1971. Since 1971 they have had 100 percent reliability. 
The basic first stage flew 52 years ago. The second stage in 
the Soyuz has been--is 42 years old. Since 1971 they have had 
100 percent success. They did not meet all of our criteria. In 
fact, I am the only one on the committee here who has been in 
the Soyuz and I did that first one on the Apollo-Soyuz and we 
had them change a couple of their systems before we would fly 
with them and there has been follow-up since then, and I think 
Mr. O'Connor has outlined the fact of what they do with their 
safety and they are very attuned to it, and we are completely 
informed about that. As far as the two reentries on the delay 
of the service module, the separate and all that, they have 
taken into account, explained that, and so to me, it should be 
a situation that is solid again. I would rather have us fly on 
our spacecraft, ma'am, as soon as possible and if we had the 
budget we could do that.
    Ms. Kosmas. Mr. O'Connor?
    Mr. O'Connor. Ms. Kosmas, we were quite concerned with 
these landings. In fact, Peggy Whitson was in one of those and 
it was a pretty interesting ride for her, and would be for 
anybody, and so we offered to help the Russians in their 
investigation. They put together a commission to take a look at 
it. General Stafford and his counterpart in Russia have a 
committee that oversees the safety of the Soyuz flights and 
they were interested. We were all asking questions. We did our 
own independent assessment of what we thought might have 
happened based on what we know about Soyuz' design and we 
compared notes with the Russians. In the end, they didn't get 
to the root cause the way they wanted to but they fixed all the 
possible things that could be the real root cause of this thing 
and they fixed those things to our satisfaction. They shared a 
lot of information with us, way more than they used to in the 
old days. There are some times when we and the Russians do not 
agree on something like, for example, the relative risk of some 
issue that has come up, but by and large they are very open, 
and when we don't agree with one another, we lean back on their 
demonstrated reliability, the quality of their workforce and 
the relationship our engineers have with theirs over a period 
of about 15 years now.
    As for how we are planning to work with them in the future, 
we don't retroactively assign all of our human rating or any 
other kind of requirements on the Russians to participate with 
them as partners. We have an MOU with them. We have signed up 
to extend the MOU to fly our astronauts and those other 
astronauts from Japan, Canada and Europe who depend upon us for 
transportation. It is the Russian transportation that we will 
be providing for them as well. So we take them under our wing. 
We take our responsibility very seriously.
    Ms. Kosmas. Thank you. Unfortunately, the time is up.
    Chairwoman Giffords. Thank you, Ms. Kosmas.
    Because we have a situation where we have time yielded to 
Mr. Rohrabacher, we actually now will go back to Mr. 
Rohrabacher, but I would like to introduce Ken Bowersox, an 
astronaut who has experience in both shuttle and Soyuz. It is 
good to see you today, sir. Welcome to our Committee.
    Mr. Rohrabacher.

                Addressing the Gap in Human Spaceflight

    Mr. Rohrabacher. Thank you very much, Madam Chairman, and 
we are in a little time bind here and I will try to be as quick 
as I can. Let me get to some fundamental issues here.
    The basic challenge that we are facing is to close the gap 
that will be created when the shuttle is grounded as soon as 
possible and with as less risk as possible, and that is the 
challenge that we have. The challenge isn't going to the Moon. 
Right now the challenge we face is closing that gap. In terms 
of servicing the space station and low earth orbit, will the 
Delta system and the Atlas system, those rockets as they are 
now configured, will they be able to lift the payload necessary 
to deliver either a payload or crew to the space station or we 
will have to reconfigure those rockets? Anybody?
    Mr. Alexander. Absolutely those vehicles as they are 
designed now have the performance capability to take a capsule 
for people or cargo to the space station.

                                  Ares

    Mr. Rohrabacher. Okay. When it comes to Ares Orion, they 
need to have something else that is developed and which is 
actually invented or, so to speak, a second stage or that 
system cannot deliver a capsule to the space station. Is that 
correct?
    Mr. Fragola. If it were the Orion capsule, it could not do 
that. For a degraded with payload that is much less than Orion 
and we would do it on a single-core Atlas, we would have to use 
probably an Atlas 431, which includes three solid rocket 
boosters wrapped around a central core, and I doubt that that 
would be able to pass snuff on safety because in the OSP days 
when Bowman did his report, comprehensive report of 
alternatives, they showed that wrapping solids around a liquid 
core is----
    Mr. Rohrabacher. Okay, but I am not talking about Atlas 
here. I just want to get the information about the Ares. We are 
going to have----
    Mr. Fragola. The Ares payload is significantly better than 
any of those alternatives.
    Mr. Rohrabacher. Okay, but it depends on developing a 
second stage that doesn't exist.
    Mr. Fragola. You would need a second stage for the Delta IV 
heavy as well to carry the payload. If you changed the payload 
or you changed the----

                           Delta IV and Atlas

    Mr. Rohrabacher. Does the Delta IV--you are saying that the 
Delta IV cannot carry a payload to the space station without 
something new being put onto the Delta IV? I am trying to get 
at----
    Mr. Fragola. Yeah, for the Orion spacecraft on the Delta IV 
heavy, we would need a new upper stage. We would either have to 
four RL-10s or----
    Mr. Rohrabacher. We just heard the testimony from Mr. 
Alexander----
    Mr. Fragola. He is speaking of a much smaller payload.
    Mr. Rohrabacher. Well, listen, I am not talking about--you 
know, maybe we have to fly more missions to get the same level 
of payload. I am just talking about getting an actual payload 
to the space station. You might have to--it might actually be 
less risky to fly three Delta missions there with a rocket that 
currently we have than to rely on a rocket that has a heavier 
lift but you have to build a whole new second stage which may 
or may be able to be built. Until that thing flies, we don't 
even know if it is going to function.
    Mr. Fragola. I would respectfully suggest that history 
shows us that the first-stage problem is the serious problem, 
and on the Delta 431, which is the only single core that can 
carry the payload that Mr. Alexander is talking about, you 
would have not only a single core but you would have three 
solid rocket boosters, and the Delta II accidents and the Delta 
34D accidents show how important the interaction between the 
solids and the liquids are in a survivable condition. You would 
create a condition if you lost the solid, that would engage 
the----
    Mr. Rohrabacher. I have only got a couple more seconds. But 
the Delta--from my understanding, the Delta and Atlas have a 
very good track record, and what we are saying is, we have a 
track record to actually get things to the station, close that 
gap as compared to an Ares. If our strategy is to depend on 
that, it is to depend on a second stage that hasn't been built 
yet, and I will have to say from my experience, any time you 
don't have a piece of technology that is built and functioning, 
you can have the schedule go way back and the costs go way up 
so we wouldn't be able to close that gap.
    Mr. Hanley. And that is exactly why--you mentioned Boeing 
earlier.
    Mr. Rohrabacher. Yes.
    Mr. Hanley. That is exactly why we have Boeing on contract 
to be producing the upper stage for Ares because they have the 
corporate knowledge and the heritage in producing such systems 
of similar scale and they are bringing--doing a fantastic job 
bringing their expertise----
    Mr. Rohrabacher. It was a good decision to take Boeing----
    Chairwoman Giffords. Mr. Rohrabacher, we only five minutes 
left in the vote so I am going to have to cut you off.
    Mr. Rohrabacher. Thank you very much.
    Chairwoman Giffords. Mr. Hill, my apologies. Okay. We are 
coming down to the minute. We are going to run over. I want to 
thank our witnesses today. It was absolutely brilliant 
testimony. I think we learned a lot. This won't be the first 
time that we address safety. We will come back to this because 
it is so critically important.
    You know, I am sorry Mr. Hall can't be here for the end 
because I really believe what he said initially is so 
compelling and really reflects the sentiment of the Congress. 
We are strongly committed to provide a safe way for our 
astronauts to go to space and to travel back, and I have to say 
that I find the level of safety that has been planned for Ares 
and for Orion and the steps being taken to build safety into 
this Constellation program from the very beginning to be 
something that we have been proud to support for the last four 
years. While I continue to have an open mind, I look to the 
testimony of Mr. Marshall provided and I believe I quote you 
here, ``The ASAP believes that if Constellation is not the 
optimum answer, than any new other design system has to be 
substantially superior to justify starting over.'' Based on 
what we have heard today, and there is more in your written 
testimony, I see no justification for a change in the direction 
on safety-related grounds. Instead, I am in fact impressed with 
the steps that have been to infuse safety into Constellation. 
It is something that of course we are very proud as a country 
we have been able to achieve this.
    That being said, I don't intend, and I hope that people 
don't think that is a competition of commercial versus NASA. It 
is simply not that. We are all really excited and welcome the 
growth of new commercial space capabilities in America. Like 
Mr. Hanley, I too want to go to space and welcome the 
opportunity to do that someday, not for $30 million but maybe 
if the cost comes down. But currently I do not see those 
capabilities as competition with, as Mr. Alexander talked 
about, but rather complementary to our government systems that 
are currently under development. Whatever the Congress may 
decide to do with the question of additional incentives to the 
commercial space industry, of course, in this time of 
constrained budgets is something that really concerns all of us 
and this is why this discussion today has been so important. It 
is a question that needs to be decided on its merits, again, 
not on passion, not on what ifs but the actual reality of what 
is achievable and what can be documented. This is not a 
substitute for a continued commitment to the Constellation 
system that offers incredibly the safety benefits that we have 
heard in the testimony today.
    So thank you, gentlemen, for being here and to the Members 
of Congress, of course, for being here. With that, I will bring 
this hearing to a close by stating that the record will remain 
open for two weeks for additional statements from the members 
and for answers to any follow-up questions that the 
Subcommittee may ask of the witnesses. The witnesses are now 
excused and the hearing is now adjourned. Thank you.
    [Whereupon, at 12:30 p.m., the Subcommittee was adjourned.]
                               Appendix:

                              ----------                              


                   Answers to Post-Hearing Questions




                   Answers to Post-Hearing Questions
Responses by Mr. Bryan O'Connor, Chief of Safety and Mission Assurance, 
        National Aeronautics and Space Administration

Questions submitted by Chairwoman Gabrielle Giffords

Q1.  In your prepared statement, you cite that NASA is beginning 
development of a more concise set of human rating technical 
requirements applicable to NASA developed crew transportation systems 
as well as commercially-developed crew transportation systems or use by 
NASA.

          When do you envision these more concise human rating 
        technical requirements will be defined so that commercial 
        stakeholders can understand NASA's needs?

          Is solely meeting these technical requirements the 
        litmus test NASA should use to determine if a commercial 
        transportation system is safe for its astronauts to use?

A1. NASA has formed a team to develop an implementation plan for human 
rating of commercially-developed crew transportation systems. This plan 
is based on NASA's approach to safety risk management and the existing 
Agency human rating philosophy. This plan will clarify NASA 
expectations, including technical requirements, and will be derived 
from: NASA Procedural Requirements 8705.2 (Human-Rating Requirements 
for Space Systems); Space Shuttle Program 50808 (ISS to Commercial 
Orbital Transportation Services Interface Requirements Document); and, 
other existing NASA requirements documents such as NASA Directives, 
NASA Standards, NASA adopted standards, the Exploration Architecture 
Requirements Document, the Constellation Architecture Requirements 
Document, and the Constellation Human Systems Integration Requirements.
    NASA released the preliminary plan using a NASA Request For 
Information on May 21, 2010. Responses were due on June 18, 2010 and 
NASA is in the process of reviewing and evaluating the responses. NASA 
plans to finalize the Commercial Human-Rating implementation plan in 
time to support an open-competition when NASA pursues the development 
phase of commercial crew transportation systems.
    Meeting NASA Human-Rating requirements is an important part of the 
overall process but not the sole test NASA will use to determine if a 
commercial transportation system is safe for NASA astronaut 
transportation. Any system destined to operate in the proximity of the 
ISS will be subject to the ISS ``Visiting Vehicle'' requirements, for 
example.
    NASA will define, as part of this plan, the appropriate level of 
ongoing government visibility into the development, testing/engineering 
analysis, production and operation of all launch vehicles and 
spacecraft that carry NASA astronauts. NASA will also define its role 
in hazard and risk analysis/acceptance, as well as design and 
operational certification and flight readiness.

Q2.  The Shuttle's operational costs have declined in the past few 
years.

        a.  Do lower operational costs necessarily mean less safety?

        b.  What lessons learned from the way NASA is operating the 
        Shuttle may prove useful to how your office will oversee the 
        safety of future space transportation system, be they 
        government or commercially-provided?

A2. Although the overall annual Shuttle budget has declined over the 
past few years, it should not be interpreted that the decline is in the 
``operational costs'' of conducting Shuttle missions.
    After the Columbia accident in 2003, the Shuttle Program budget was 
significantly increased as NASA pursued parallel paths to address 
findings and recommendations of the Columbia Accident Investigation 
Board. The related costs for design, development, test and 
certification peaked in the 2004-2005 timeframe, and have gradually 
declined since.
    As we approach the retirement of the Space Shuttle Program, NASA is 
gradually closing out the Shuttle Program's production capabilities as 
the last needed hardware and subsystems are making their way through 
the production pipeline. This has led to a further reduction of cost.
    These cost reductions have not and will not impact the focus on 
safety by the Program for the remaining flights.
    Once NASA has developed a strategy for acquisition of any new 
launch, entry, and/or emergency deorbit capability or service, the 
Agency must define its own role in ongoing management oversight and 
technical insight, including certification of the design and operation, 
and readiness of the team for flight, as well as ongoing role in 
problem resolution, sustaining engineering, hazard and risk analysis/
acceptance. These decisions will be based on a number of factors, most 
stemming from hard lessons learned during Apollo 204, Challenger and 
Columbia mishap investigations and recovery. Examples include: a 
respect by all involved for the inherent risks in human spaceflight, 
not only in early development phases, but throughout the lifecycle; the 
need for rigorous checks and balance between the developer and the 
``owner'' of the technical requirements (Technical Authority); the need 
for technical excellence among the development and assurance work 
force, the need to include flight crew in system development as well as 
flight test operations safety-critical decision-making; the necessity 
of continually challenging past assumptions and engineering models as 
part of the ongoing risk management process; and, the importance of 
clear roles and responsibilities and good communications in all 
directions as part of a healthy safety culture.

Questions submitted by Representative Pete Olson

Q1.  Please explain with examples if possible. how NASA uses its human-
rating requirements to tailor the design of a crewed space system such 
as Ares and Orion?

A1. NASA's Human Ratings Requirements document (NPR 8705.2B) applies to 
the integrated flight/ground system, and is based on three key 
principles:

        1)  Human-rating is the process of designing, evaluating, and 
        assuring that the total system can safely conduct the required 
        human missions.

        2)  Human-rating includes the incorporation of design features 
        and capabilities that accommodate human interaction with the 
        system to enhance overall safety and mission success.

        3)  Human-rating includes the incorporation of design features 
        and capabilities to enable safe recovery of the crew from 
        hazardous situations.

    For instance, requirements associated with the first principle 
drive a considerable focus on human factors aspects of the design, such 
as proper layout of cockpit displays and controls, and environmental 
factors such as adequate crew cabin temperature and humidity.
    Separately, requirements associated with the third principle 
stipulate that certain abort and or escape capabilities be present. To 
implement this requirement, significant effort has gone into prelaunch 
and post landing emergency egress capabilities and the design of a 
launch abort system which would be used to pull the crew capsule away 
from the launch vehicle and allow the crew to return to Earth should a 
catastrophic event occur during launch. In light of the Presidential 
direction for FY 2011, it is worth noting that the lessons that NASA 
has learned from all past and present systems pertaining to human 
rating with be utilized, to the best extent practicable, in the 
development of any future vehicle.

Q2.  If the human-rating requirements are the top level requirements, 
how would potential commercial providers gain the necessary insight to 
design a system that meets NASA's requirements? Similarly, how did NASA 
get comfortable enough to finally certify the Russian Soyuz for human 
space flight?

A2. NASA has formed a team to develop an implementation plan for human 
rating of commercially-developed crew transportation systems. This plan 
is based on NASA's approach to safety risk management and the existing 
Agency human rating philosophy. This plan will clarify NASA 
expectations including technical requirements, and was derived from 
NASA Procedural Requirements 8705.2 (Human-Rating Requirements for 
Space Systems); Space Shuttle Program 50808 (ISS to Commercial Orbital 
Transportation Services Interface Requirements Document); and, other 
existing NASA requirements documents such as NASA Directives, NASA 
Standards, NASA adopted standards, the Exploration Architecture 
Requirements Document, the Constellation Architecture Requirements 
Document, and the Constellation Human Systems Integration Requirements.
    NASA released the preliminary plan using a NASA Request For 
Information on May 21, 2010. Responses were due on June 18, 2010 and 
NASA is in the process of reviewing and evaluating the responses. NASA 
plans to finalize the Commercial Human-Rating implementation plan in 
time to support an open-competition when NASA pursues the development 
phase of commercial crew transportation systems. Meeting NASA Human-
Rating requirements is an important part of the overall process but not 
the sole test NASA will use to determine if a commercial transportation 
system is safe for NASA astronaut transportation. Any system destined 
to operate in the proximity of the ISS will be subject to the ISS 
``Visiting Vehicle'' requirements, for example. Other considerations 
are demonstrated reliability, the extent and quality of the developer's 
design, test and evaluation processes as well as their production and 
operations activities.
    NASA will define, as part of this plan, the appropriate level of 
on-going government visibility into the development, testing/
engineering analysis, production and operation of all launch vehicles 
and spacecraft that carry Agency astronauts. NASA will also define its 
role in hazard and risk analysis/acceptance, as well as design and 
operational certification and flight readiness.
    The first step in building confidence in Russia's human spaceflight 
in the early 1990's was to review lessons from the Apollo Soyuz 
program. Then NASA worked closely with the Russian Space Agency, now 
ROSCOSMOS to develop technical and management relationships and to 
understand each partner's roles and responsibilities for safety in the 
program. Before NASA began flying NASA astronauts on the Russian Soyuz, 
NASA performed several reviews of the Soyuz design, manufacturing, 
operations and quality and safety process. Based on these reviews, the 
trust stemming from our government to government relationships, as well 
as the long operational history of the Soyuz (rocket, crew capsule and 
ground systems), NASA developed the confidence to declare the Soyuz 
system acceptable for US astronaut participation. In preparation for 
potential use of the Soyuz design as a U.S. Space Station Freedom crew 
rescue vehicle, and then later in preparation for the joint Shuttle-Mir 
activity, NASA technical experts, including senior safety engineers, 
spent a significant amount of time talking with Apollo-Soyuz veterans, 
visiting with current Russian counterparts, and reviewing the long 
history of Soyuz, Salyut, and Mir operations in an effort to understand 
the Russian approach to human spaceflight safety. From this they were 
able to determine acceptability by equivalence to, if not compliance 
with, NASA technical standards. In March 1995, Norm Thagard became the 
first U.S. astronaut to launch on the Soyuz. He and the other five 
astronauts who spent time on Mir used the Shuttle for subsequent 
transportation, but they all received training in Soyuz as their 
primary escape system. The next American to launch on a Soyuz was Bill 
Shepherd, the Commander of the first Space Station increment in October 
2000. Since then, 14 different NASA astronauts have flown on Soyuz, 
bringing the total NASA astronaut trips to 14 up, and 13 down, several 
of which were made during the post-Columbia Return-to-Flight timeframe. 
With over 15 years of joint operations NASA has gained confidence in 
the Russians systems and operations, as well as their design and 
development philosophy, including not just dependence on system 
reliability but on crew escape and on their extensive system and 
subsystem testing.
    NASA has not certified, and does not intend to ``certify,'' the 
Soyuz for human space flight relative to all NASA's technical 
requirements. NASA continues to approve or clear its participation in 
each flight by maintaining knowledge and insight into the on-going 
Soyuz program, formally approving NASA and NASA-sponsored crewmember 
participation in its own Flight Readiness Review process, and by 
participating in the Russian General Design Review process, which is 
similar to the Agency's Flight Readiness Review process. Additionally, 
since 1995 a joint Russian and NASA committee, the Space Station 
Advisory Committee (Stafford-Anfimov) advises both agencies on the 
operational and safety status for each Soyuz flight.

Q3.  Since Crew Escape Systems, including emergency detection and 
launch abort systems, should be developed in conjunction with the 
launch vehicle, how could NASA evaluate the overall safety of an as-
yet-to-be developed launch vehicle whether provided by a COTS provider, 
United Launch Alliance, or an international partner?

A3. As suggested by the question, the evaluation of abort system 
effectiveness, and human rating in general, requires an integrated 
analysis of launch vehicle, crew capsule, crew, and the abort system 
itself. Any launch vehicle has to be designed to provide critical 
vehicle status and abort triggers to notify the crew vehicle and launch 
escape system that an abort is required or to allow the crew to make an 
abort decision. The design needs to take into account the launch 
vehicle failure modes and the timely detection of these failures. 
Transportation system developers would be required to design the 
integrated vehicle to support the abort trigger requirements. The crew 
escape system would have to be designed so that it can reliably and 
safely pull the crew capsule from the launch vehicle given the failures 
and resulting environments during the critical portions of the launch 
vehicle's flight profile. An integrated safety analysis to review the 
specific implementation would be conducted to assure that effective 
crew escape capabilities are available to address critical failure 
scenarios of the integrated system.
    NASA has spent considerable effort in doing this kind of analysis 
for the baseline architecture. Similar analyses will have to be 
performed for other concepts.

Q4.  From the Safety and Mission Assurance perspective, would you 
elaborate on the potential to close the gap using EELV's, including 
cost information if available?

A4. NASA doesn't human-rate individual components or elements of a 
launch system, so in order to use an EELV that EELV would need to be 
human-rated in combination with all of the flight and ground elements 
needed to accomplish a specific reference mission. The EELVs in 
combination with these other elements (spacecraft, abort/escape/egress 
system, etc.) would need to be human-rated to ensure that collectively 
they provide a sufficient level of safety, and particularly allow for 
survivability of the crew during any potential hazardous situations.
    In 2009, NASA commissioned a study performed by Aerospace 
Corporation to study the feasibility of human rating current EELVs. The 
study concluded that EELVs are ``human-ratable,'' however the cost to 
do so is highly dependent on program requirements, specific 
interpretation of and compliance with NASA's human-rating requirements 
document (NASA Procedural Requirements 8705.2) and especially 
noteworthy the integration of the EELV design with other elements of 
the system. In addition, the study found that the gap between Shuttle 
retirement and availability of a new crew transportation system to ISS 
would not be reduced from the then-current Constellation target 
milestone of March 2015 initial operating capability.

Q5.  Since a significant portion of launch failures are due to human 
error it is critical to have a strong safety culture. The Columbia 
Accident Investigation Board reiterated again the importance of a 
strong safety culture. Would a shift to commercially provided low-Earth 
orbit launch vehicles disrupt that culture at NASA? Could that be cause 
for concern?

A5. Depending on the acquisition approach, contracting with industry 
for a new ISS crew transportation system could represent some changes 
in NASA's traditional human spaceflight processes, including its 
interactions with industry. NASA will ``own'' major NASA-related safety 
requirements (visiting vehicle and human rating), and will establish an 
appropriate forum for verification that the system has met them. To the 
extent that NASA retains accountability for the safety of its employees 
and contractors (crewmembers), it will play a role in technical 
oversight/insight, as well as hazard analysis, and risk assessment and 
acceptance. These processes and relationships, however, are only a part 
of a strong safety culture, the remaining aspects being all about 
communications in all directions. Especially important will be the 
establishment and maintenance of a strong effective dissent and appeal 
system on both the commercial and government side of the relationship. 
NASA is committed to preserving a strong safety culture regardless of 
the acquisition approach.

Questions submitted by Representative Marcia L. Fudge

Q1.  In your prepared statement, you cite that NASA is beginning 
development of a more concise set of human rating technical 
requirements applicable to NASA developed crew transportation systems 
as well as commercially-developed crew transportation systems or use by 
NASA.

          When do you envision these more concise human rating 
        technical requirements will be defined so that commercial 
        stakeholders can understand NASA's needs?

          Is solely meeting these technical requirements the 
        litmus test NASA should use to determine if a commercial 
        transportation system is safe for its astronauts to use?

A1. NASA has formed a team to develop an implementation plan for human 
rating of commercially-developed crew transportation systems. This plan 
is based on NASA's approach to safety risk management and the existing 
Agency human rating philosophy. This plan will clarify NASA 
expectations including technical requirements, and will be derived 
from: NASA Procedural Requirements 8705.2 (Human-Rating Requirements 
for Space Systems); Space Shuttle Program 50808 (ISS to Commercial 
Orbital Transportation Services Interface Requirements Document); and, 
other existing NASA requirements documents, such as NASA Directives, 
NASA Standards, NASA-adopted standards, the Exploration Architecture 
Requirements Document, the Constellation Architecture Requirements 
Document, and the Constellation Human Systems Integration Requirements.
    NASA released the preliminary plan using a NASA Request For 
Information on May 21, 2010. Responses were due on June 18, 2010 and 
NASA is in the process of reviewing and evaluating the responses. NASA 
plans to finalize the Commercial Human-Rating implementation plan in 
time to support an open-competition when NASA pursues the development 
phase of commercial crew transportation systems.
    Meeting NASA Human-Rating requirements is an important part of the 
overall process, but not the sole test NASA will use to determine if a 
commercial transportation system is safe for NASA astronaut 
transportation. Any system destined to operate in the proximity of the 
ISS will also be subject to the ISS ``Visiting Vehicle'' requirements, 
for example.
    NASA will define, as part of this plan, the appropriate level of 
ongoing government visibility into the development, testing/engineering 
analysis, production and operation of all launch vehicles and 
spacecraft that carry NASA astronauts. NASA will also define its role 
in hazard and risk analysis/acceptance, as well as design and 
operational certification and flight readiness.

Q2.  The Columbia Accident Investigation Board (CAIB) recommended the 
establishment of an independent Technical Engineering Authority 
responsible for technical requirements and all waivers to them. In 
response, NASA created the NASA Engineering and Safety Center's (NESC) 
which operationally falls under the responsibility of your office. How 
has that independent center enhanced the safety of human space flight?

A2. In response to recommendations from the CAIB, NASA formalized 
Technical Authority (TA) roles for NASA's Safety and Mission Assurance, 
Engineering and Health and Medical organizations establishing clear 
authority and responsibilities related to the technical requirements 
established by the TA organizations and waivers to those requirements.
    The TAs are a key part of NASA's overall system of checks and 
balances and provide independent oversight of programs and projects in 
support of safety and mission success. Individuals fulfilling the TA 
roles are embedded in their respective technical cadres and 
organizations across the Agency, and are continuously engaged in 
programmatic decision-making processes. They ensure that all opinions 
are heard and engage with line management to ensure that the right 
technical decisions are made with respect to requirements, non-
compliances, hazards, critical items, as well as ensuring work is 
performed to a high standard.
    The NESC was formed in response to CAIB criticism of the safety 
organization's lack of technical depth. Its mission is to perform 
value-added independent testing, analysis, and assessments of NASA's 
high-risk projects to help ensure safety and mission success. The 
organization has established a strong set of processes, technical 
leaders and communities of practice across the Agency and access to key 
technical experts and facilities outside of NASA to allow rapid 
response with the best possible technical capability to the Agency's 
most critical problems. In a typical year, the NESC performs in excess 
of 50 independent assessments for a variety of customers, including, 
but not limited to, the Agency's SMA organizations.
    The Technical Authorities and the NESC operate across all of NASA 
but are particularly important in addressing problems which arise in 
connection with human space flight. The totality of the contributions 
is too great to catalog here, but two examples are illustrative.
    Between the time of STS-114, the return to flight after Columbia, 
and the final preparations for the launch of STS-120 in the fall of 
2007, anomalies with the Reinforced Carbon Carbon panels used on the 
wing leading edges had come to light. All panels show cracking and 
crazing after exposure to high temperatures with damage thresholds 
established for repair or replacement but there was new test data 
potentially indicating the need to repair or replace panels not 
previously suspect.
    The NESC was asked to quickly establish an independent team to 
assess the problem in parallel with the ongoing work being performed by 
the project team. The NESC team performed a great deal of high caliber 
and ground breaking technical work in a short time and recommended both 
a measurement methodology and quantitative threshold. The processes 
established in support of the Technical Authority model for the flight 
readiness reviews and leading to the Certification of Flight Readiness 
ensured that the recommendations were fully considered and led to 
adoption of both the recommended flight worthiness criterion for the 
RCC and a longer term program to better understand the materials and 
utilize nondestructive inspection techniques in support of improved 
flight safety.
    Data from the flight of STS-126 in November 2009 and post-flight 
inspection of the hydrogen flow control valves showed that a large 
piece of a valve poppet had liberated. This had never happened before 
in flight and raised significant safety of flight concerns for STS-119 
since there were multiple scenarios leading to catastrophic failures 
during powered flight. The problem was extremely difficult and the 
first round of reviews could not establish a rationale and supporting 
data to allow a commitment to launch. In response, the Project team was 
augmented with engineering and safety and mission assurance personnel 
from across the Agency to establish and execute a combination of tests 
and analyses to establish the basis for a safety of flight assessment. 
The NESC brought its cadre to bear, both to directly support the 
technical teams and also to provide independent assessments in critical 
areas. Technical authority line managers were strongly engaged both to 
ensure that all possible resources were brought to bear but also that 
the many alternate technical opinions were appropriately heard and 
considered and that a flight rational could be established on a sound 
technical basis. As a result of an extraordinary quantity and quality 
of work done in a very short time, not only was a sound decision basis 
established for the safe launch of STS-119 but the understanding of the 
flow control valve failure modes and effects and non-destructive 
examination techniques were greatly improved. This in turn led to 
greatly improved processes and criteria for all subsequent missions and 
significant reduction in risk.

Q3.  The Augustine Committee has done a commendable job of providing 
options and alternatives for the U.S. Human Space Flight program for 
consideration. However, changes to an ongoing development program carry 
the real threat of major adverse impacts on cost and schedule, 
increased risk and dislocations for the workforce. In this regard, 
please comment on the safety impacts of two potential changes discussed 
in the Summary Report: 1) Reducing Orion crew size; and, 2) Relying on 
commercial crew-delivery service rather than continuing the development 
of Ares 1.

A3. NASA looks at any significant change in architecture or performance 
requirements with an eye toward safety impacts. The decision to reduce 
the crew size from six to four had no direct or indirect adverse 
safety. The primary rationale for the Orion crew size requirement 
change was to simplify design activities and thereby reduce cost and 
schedule challenges while improving mass margins during the Program's 
early phases. Since the maximum crew size requirements were originally 
established at the Constellation Systems Requirements Review in 2006, 
Orion had been pursuing parallel designs for the Space Station six-
person and the Lunar four-person configurations. Therefore, Orion's 
work included multiple designs for crew seat pallets and Environmental 
Control and Life Support hardware, and multiple analyses for 
consumables, stowage, and crew operations. By shifting to a common crew 
size configuration for the Space Station and lunar missions, Orion's 
team would be able to focus activities on a single design and analysis 
set rather than two parallel design efforts.
    The maximum crew size reduction for Orion ISS missions actually had 
operational advantages that improve crew safety:

          The free volume for the crew's on-orbit activities 
        and tasks could be increased by 20-25 cubic feet.

          The nominal and emergency crew egress capability 
        would be improved.

          More stowage volume and mass could be made available 
        for carrying mission equipment and bringing payloads and cargo 
        to the ISS.

    The President's budget ``funds NASA to contract with industry to 
provide astronaut transportation to ISS as soon as possible, reducing 
the risk of relying solely on foreign crew transports.'' In response, 
NASA will use an acquisition approach appropriate to the criticality of 
and risk inherent in the mission. Included will be an acceptable mix of 
NASA technical requirements and industry practices as well as NASA 
technical insight and management oversight. These things, along with 
the design, support and demonstrated reliability of the transportation 
system, will allow NASA to determine when the system will be suitable 
to carry NASA (and International Partner) crews to the ISS.

Q4.  One of the Augustine Committee findings is that investment in a 
well-designed and adequately funded space technology program is 
critical to enable progress in exploration. NASA's space technology 
budget has been severely reduced over time. Power, propulsion, in-space 
refueling, communications and a host of other technologies will be 
crucial for exploration. What safety-related considerations are 
associated with investing in such technologies?

A4. Without new technologies, human exploration of the solar system 
will likely be unaffordable and unsustainable. The safety implications 
of new technologies, however, must be evaluated on a case-by-case 
basis. While the use of new technologies can provide safety benefits, 
e.g., by eliminating risks in existing systems and through increasing 
safety margins, they also generally introduce risks due to immaturity 
of and unfamiliarity with such technologies.
    These impacts must be assessed as part of design and operational 
trade studies. For example, technology development for in-space 
refueling must weigh the safety impact of designs involving an initial 
crew transportation system that fully relies on in-space refueling 
against a crew transportation system that can take advantage of in-
space refueling after the refueling technology has been proven with 
robotic missions.
    However, new technologies are not necessarily used to improve 
safety, and may instead be used to expand mission goals. For example, 
weight savings in one area might be used to increase science/mission 
payload or to increase propellant reserves or shielding. The investment 
in developing and integrating new technologies is essential to ensuring 
that our Nation's space program is engaged in innovations that will 
help NASA find better and safer ways to explore the solar system.

Questions submitted by Representative Dana Rohrabacher

Q1.  In the Launch Services Program NASA has generally required that a 
launcher demonstrate multiple successful flights before being 
considered for use launching science payloads and satellites. In some 
cases, up to 14 successful flights of the rocket were required before 
being used to launch a ``Class A'' satellite. By contrast, the 
Constellation Program is currently planning (subject to review) only 
one full-up test flight before placing astronauts aboard the Orion/Ares 
I. I understand that these two parts of NASA--manned and unmanned--have 
different requirements and operate with different rules, but in both 
cases the overall mission success is a primary objective. Can you 
please explain how these two systems of evaluating launch vehicles have 
evolved so differently, what are the similarities, and in the above 
example how NASA's Constellation program can comfortably accept a plan 
that demands 92 percent fewer test flights than what was required for a 
satellite program?

A1. The most important factor in determining when it is appropriate to 
fly crewmembers on a new test vehicle is the level of confidence the 
team has in safely conducting the test. In the case where NASA 
validates the technical requirements, designs and manufactures the 
flight and ground systems, writes the launch commit criteria and flight 
rules, performs all number of ground tests and engineering analyses, 
and conducts the reliability, safety and risk analyses, it has arguably 
maximized its understanding of and associated confidence in the system. 
Based on this, the team decides when to conduct its first crewed flight 
test. As the distance between NASA and the design, development, 
manufacturing, and operations increases, so does the Agency's reliance 
on demonstrated reliability, and/or other government certifications 
(i.e. Russia's ROSCOSMOS or the U.S.'s Federal Aviation 
Administration). NASA has not come to a final determination on the 
number of test flights that would be required prior to sending NASA 
astronauts into space using the crew launch vehicle under the Program 
of Record.
    Regarding the comparison with the LSP, NASA has a range of options 
available depending on the launch system's proven reliability, the 
value of the payload, and the certification status of the provider. In 
some cases, this program has little insight into, or oversight of, the 
commercial launch providers. In those cases, NASA requires a 
demonstration of 14 successful launches for certification of the launch 
vehicle for high value payloads. This certification option, which is 
rarely chosen, is predicated on an assumption of no prior knowledge 
about launch vehicle performance, and limited government oversight into 
the design and operation. Another option is to fly the NASA payload on 
a relatively new system with as few as three flights (two successes in 
a row), but with substantial NASA process requirements and insight into 
the contractor's design, engineering and operations processes. For 
lower value payloads with a higher risk tolerance, another 
certification category is available. It only requires one successful 
flight of the launch vehicle and a significant technical assessment.
    NASA's ongoing human spaceflight program has established a host of 
safety and mission assurance activities including (subsystem) tests, 
verifications, and analyses, which would establish a level of 
confidence in the vehicle's performance prior to the full-system test 
launches. Decisions regarding the needed number of full-system test 
launches should account for these assurance activities.

Q2.  John Marshall from the Aerospace Safety Advisory Panel (ASAP) said 
in his written testimony that, ``more than two years into the COTS 
program, efforts to develop human rating standards for a COTS-D like 
program have only just begun and no guidance thus far has been 
promulgated. If COTS entities are ever to provide the level of safety 
expected for NASA crews, it is imperative that NASA's criteria for 
safety design of such systems immediately be agreed upon and provided 
to current or future COTS providers.'' What steps is NASA taking to 
address this concern and develop a process that can be used by 
potential COTS-D competitors?

A2. NASA has determined that human rating requirements will apply to 
any crew transportation systems used by the Agency to provide 
transportation to low earth orbit. Consistent with the President's plan 
to ``contract with industry to provide astronaut transportation to the 
International Space Station as soon as possible, reducing the risk of 
relying solely on foreign crew transports . . .'' NASA is using 
American Recovery Reinvestment Act (P.L. 111-5) funds to develop 
guidelines for acquisition and oversight/insight approach in FY 2010. 
NASA's approach to human-rating a transportation architecture for a 
specific mission starts with the initial design phase, and assumes all 
pertinent NASA standards and requirements are followed throughout the 
project. This task will define a minimum set of human rating 
requirements and consolidate them into a single product using a 
development team comprised of representatives from NASA's human space 
flight programs, NASA technical authorities, and the NASA Astronaut 
Office. In addition, NASA will define hazard and risk assessment 
processes and goals and thresholds to support risk acceptability 
decisions. NASA will seek the advice of interested industry 
stakeholders to refine the human rating technical requirements.
    More specifically, NASA has formed a team to develop an 
implementation plan for human rating of commercially-developed crew 
transportation systems. This plan is based on NASA's approach to safety 
risk management and the existing Agency human rating philosophy. This 
plan will clarify NASA expectations, including technical requirements, 
and was derived from: NASA Procedural Requirements 8705.2 (Human-Rating 
Requirements for Space Systems); Space Shuttle Program 50808 (ISS to 
Commercial Orbital Transportation Services Interface Requirements 
Document); and, other existing NASA requirements documents such as NASA 
Directives, NASA Standards, NASA adopted standards, the Exploration 
Architecture Requirements Document, the Constellation Architecture 
Requirements Document, and the Constellation Human Systems Integration 
Requirements.
    NASA released the preliminary plan using a NASA Request For 
Information on May 21, 2010. Responses were due on June 18, 2010 and 
NASA is in the process of reviewing and evaluating the responses. NASA 
plans to finalize the Commercial Human-Rating implementation plan in 
time to support an open-competition when NASA pursues the development 
phase of commercial crew transportation systems.

Q3.  Dr. Fragola indicated during the hearing that a launch vehicle 
with a liquid core and solid strap-ons was likely to present a more 
dangerous, or a more difficult environment for crew escape in the event 
of a launch catastrophe. What is the reason for this, and does it apply 
evenly to shuttle derived concepts such as shuttle-C, or Jupiter Direct 
type designs? Further, it has been reported that pursuant to the 
Augustine committee report, NASA is studying the human rating of heavy 
lift vehicle concepts (or their derivatives) as potential Orion launch 
vehicles. Assuming any new Orion-carrying heavy lift vehicle would use 
a combination of liquid core with solid strap-ons, how does that affect 
the crew escape and Loss of Crew calculations?

A3. The reason that strap-on boosters in general represent a more 
difficult environment for crew escape in event of a launch catastrophe 
includes the following two factors. First, such configurations have 
failure modes that would more readily propagate from one booster to 
another, with the potential to lead to a more energetic post-accident 
environment. Secondly, there is a much greater potential for thrust 
imbalance, leading to greater aerodynamic stresses. These concerns 
apply to Shuttle-derived concepts.
    A better understanding of the specifics and absolute values of the 
relative risks of the various configurations would require simulations 
of the post accident environment and system responses similar to those 
already performed on the Ares I configuration. If Orion and the launch 
abort system remain the same, it would be expected that in the heavy 
lift configuration the factors mentioned above would cause a higher 
risk to the crew than in the Ares I configuration.
    At the same time, compared to side-mount options, this 
configuration would cause the crew to be further removed from the first 
stage, which would actually reduce risk to the crew due to failures of 
the solid/liquid first stage combination. The increased launch 
capability of a heavy lift configuration would further allow for 
modifications to Orion and the launch abort system that enhance crew 
survival capabilities.
                   Answers to Post-Hearing Questions
Responses by Mr. Jeff Hanley, Program Manager, Constellation Program, 
        Exploration Systems Mission Directorate, National Aeronautics 
        and Space Administration

Questions submitted by Chairwoman Gabrielle Giffords

Q1.  What is the basis of NASA's determination that the Ares I/Orion 
combination should be ten times safer than the Shuttle? How confident 
are you that you can achieve that level of safety?

A1. With regard to your questions about the current program of record, 
NASA's Constellation Program was developed with the goal of increasing 
astronaut safety tenfold relative to Shuttle missions based on two key 
directives:

          The May 2004 Astronaut Office Position on Future 
        Launch System Safety, which stated that office's belief that an 
        order of magnitude reduction of risk during the ascent phase of 
        a crewed space mission was possible. This position was written 
        with regard to the Orbital Space Plane booster selection, and 
        in response to the Columbia Accident Investigation Report, and 
        it serves as a goal for increasing system safety during this 
        critical phase of flight.

          The Exploration Systems Architecture Study (ESAS) of 
        November 2005, which suggested that ``. . . crew missions to 
        the ISS may be at least 10 times safer than the Shuttle . . .'' 
        While risk estimates for various phases of flight (e.g., 
        ascent, docking, re-entry, landing) and spacecraft components 
        (e.g., service module) are constantly undergoing review the 
        Constellation Program's Loss-of-Crew (LOC) requirements were 
        derived from the ESAS.

    Probabilistic Risk Analysis (PRA) is a tool used to analyze system 
risks and understand a systems probability of problems and the 
magnitude of impacts due to the problems. Program managers use PRAs to 
assess designs in an effort to judge merits of technical trades. 
Additionally, NASA communicates risks to project, engineers and the 
outside world using PRAs. PRA numbers fluctuate over time as designs 
mature and system trades are accepted.
    From the very beginning, Constellation has been committed to 
building an architecture that effectively balances the use of critical 
design commodities to achieve the optimal safety and mission success 
capability. Therefore, at the time of my testimony, NASA believed its 
ultimate goal of increasing safety tenfold via the utilization of the 
Ares I/Orion combination, while seemingly daunting, would have been 
achievable. However, based on current data, NASA believes the Ares I/
Orion combination overall would be about five times safer than the 
Shuttle. These numbers, however, are averaged estimates and not the way 
that NASA calculates or tracks the PRA of specific vehicles.
    In terms of Ares I/Orion, the current PRA for the integrated stack 
for the Ascent Phase shows a 1 in 1,877 probability LOC. It also 
greatly exceeds the challenging 1 in 1,000 LOC Ascent Phase 
requirement. This is due to both the projected reliability of the Ares 
I launch vehicle and a robust Launch Abort System. For the On-Orbit 
Phase, the current Constellation Program PRA results in a 1 in 521 for 
a 210 day mission. This phase is heavily dominated by the 
micrometeoroid and orbital debris risk to both vehicles. For the entry 
phase, as we have seen through history, is just as demanding as the 
ascent phase. Because of this, NASA has the same challenging 1 in 1,000 
LOC requirement as for the ascent phase. Unlike ascent where there will 
be abort capabilities; there is no easy way to gain significant 
improvement for the entry phase. The risk is dominated by parachute and 
thermal protection system contributions. These systems are currently a 
priority for design improvements as well as a comprehensive test 
program.
    In comparison, the purpose of the Shuttle PRA is to provide a 
useful risk management tool for the Space Shuttle Program to identify 
strengths and possible weaknesses in the Shuttle design and operation. 
Currently, the mean PRA for an entire Space Shuttle mission to the ISS 
(including the ascent, on-orbit and re-entry phases) is 1 in 89, with a 
range of 1:63 to 1:130 (representing the 5th and 95th percentiles). The 
equivalent PRA figure for Constellation is 1 in 406, representing a 4.6 
factor of improvement over the Shuttle risk assessment for the 
equivalent 5 day docked ISS mission.
    As with any PRA of a large, complex, and engineered system, the 
Shuttle PRA is developed for a defined scope, and reasonable 
engineering judgment is used to make assumptions where necessary. 
Therefore, limitations exist as to its use, and the per-mission ratio 
should not be seen as a single-point estimate, but merely the mean 
number in a range of risk. The PRA can be useful in comparing different 
systems (assuming they are calculated using similar bases), and not as 
an absolute risk number. For these and other reasons, it is difficult 
to compare Constellation risk estimates to the Shuttle PRA; NASA has a 
far higher level of knowledge about the Shuttle system and the PRA 
methodologies for operational systems are different from the risk 
estimation methodologies for systems in development.

Q2.  You are having to human-rate the Constellation launch vehicle and 
spacecraft system. How involved a process is that? Is it simple 
compliance with a set of itemized requirements, or is it something more 
involved?

A2. Regarding human-rating, the launch of any spacecraft is a very 
dynamic event that requires a tremendous amount of energy to accelerate 
to orbital velocities in a matter of minutes. There also is significant 
inherent risk that exposes a flight crew to potential hazards. Through 
a very stringent human rating process, NASA attempts to eliminate 
hazards that could harm the crew, control the hazards that do remain, 
and provide for crew survival even in the presence of system failures.
    Human rating is a process that involves more than a simple set of 
design requirements. The process intertwines with the acquisition 
process, starting with initial concept design and progressing through 
all phases of the program. Its progress is checked and reported to 
Agency management at each major acquisition milestone. It includes not 
just requirements compliance, but also consideration of hazards, 
failure modes, escape system effectiveness and limitations, failure 
tolerance, and other safety risks both in flight and on the ground. The 
requirements are all applicable mandatory standards used in designing 
and operating our most important unmanned mission systems, with the 
addition of human crew unique requirements dealing with life support, 
human factors, crew escape/abort and survivability. The scope and 
magnitude of the process is dependent upon the Agency's risk tolerance 
for the particular mission, as well as the complexities and hazards 
associated with the vehicle design and its assigned mission profile. As 
written, NASA's human rating process is structured specifically for 
NASA developed systems, where the NASA program manager is the design 
decision and risk acceptance authority, and the NASA Engineering, 
Safety and Mission Assurance, and Health and Medical Technical 
Authorities have cognizance of the associated standards and 
requirements. However, Agency policy allows some or all of its human 
rating process and requirements to be applied, as it sees fit, to 
systems developed by other organizations or entities as conditions for 
clearance to fly NASA or NASA sponsored crew/passengers.
    For NASA developed systems, human rating certification includes: 
validation by the technical authorities that the design requirements 
are properly tailored to the program; verification that the design 
meets those design requirements (by ground test, analysis, and flight 
test as appropriate); and full-up flight demonstration of an 
appropriate level of system reliability prior to manned flight test and 
prior to full mission clearance. Finally, NASA human rates an entire 
system, including ground elements and operational procedures 
(fundamentally, anything about the flight or ground system that impacts 
flight crew/passenger safety). This means that it looks at integrated 
safety issues and accident scenarios, not just failures at the 
subsystem level.
    Given that safety is NASA's first core value, the Constellation 
Program, had incorporated safety into the Constellation design process 
from the very beginning. In doing so, the Constellation program chose 
to tightly interweave the design and safety team members into the 
decision process, including Engineering, Safety and Mission Assurance 
and Health and Medical technical authorities, so that each have a role 
in the Agency's human rating process. The team has actively worked with 
the design engineers to provide expertise and feedback via various 
assessments and analysis techniques throughout the design maturation 
process.
    Human rating a spaceflight system is not as easy as following one 
document. Instead, it is an intricate, continuing process, involving 
the translation of specific mission requirements into designs that can 
be built, tested, and certified for flight and an understanding of 
risks with mitigation approaches in place. Additionally, before any 
system can be human rated, it must meet all other Agency standards and 
requirements applicable to a specific mission and type of system. 
Therefore, part of the challenge to projects such as Ares I and Orion 
has been that there is currently no single document that spells out 
what they should do to receive a human rating certification from the 
Agency. In turn, this is partly why NASA is investing FY 2009 Recovery 
Act funds to develop a more concise set of NASA human rating technical 
requirements.
    Although NASA does not yet have one consolidated document for human 
rating, the Constellation Program has depended heavily on NASA 
Procedural Requirement 8705.2B, in designing its spaceflight vehicles. 
This document is based on three key tenets:

        1)  Human-rating is the process of designing, evaluating, and 
        ensuring that the total system can safely conduct the required 
        human missions. The mission will have certain mission 
        objectives and system performance requirements that must be 
        met. The mission will also expose the crew to potential hazards 
        that must be considered early in the design process. During the 
        design process, a careful examination of the potential hazards 
        and design features that prevent hazards--known as ``hazard 
        controls''--is undertaken. Hazard controls are features 
        incorporated into the system during the design phase to prevent 
        the occurrence of a hazard. These can take many forms such as 
        incorporating redundant or backup systems and components, 
        application of system margins to ensure function of the system 
        even under the most extreme conditions, proper selection of 
        technical standards for design and construction, and rigorous 
        process controls from early material and component selection 
        through final assembly and checkout operations. Mission 
        objectives and performance requirements may need to be re-
        evaluated to reduce the risk for human spaceflight missions. 
        The balance between system performance and crew safety would be 
        weighed among Engineering, Safety and Mission Assurance, and 
        Crew Health and Medical technical authorities. The outcome of 
        the design will be a balance between maximizing mission 
        objectives while minimizing risk to the flight crew.

        2)  Human-rating includes the incorporation of design features 
        and capabilities that accommodate human interaction with the 
        system to enhance overall safety and mission success. This 
        tenet includes all the aspects of flight crew performance 
        necessary for the crew to successfully carry out their mission, 
        without imposing undo risk to the flight crew. Crew situational 
        awareness, crew commanding, cockpit display design and 
        spacecraft environmental factors all are critical factors that 
        affect a crewmember's performance. For example, proper layout 
        of controls, adequate crew cabin temperature and humidity, and 
        proper mission workload planning all factor into the 
        crewmember's ability to safety operate the system and increase 
        the likelihood of mission success. The same rigor and balance 
        in design trades utilized in tenet one is applied also in tenet 
        two to arrive at the best working environment for the crew that 
        maximizes the probability of mission success, while minimizing 
        the risk to the flight crew.

        3)  Human-rating includes the incorporation of design features 
        and capabilities to enable safe recovery of the crew from 
        hazardous situations. Launch of a crew has significant inherent 
        risks, so even with all the care that goes into system design 
        and development, the system must be designed to accommodate 
        failure. Sometimes failure can be dealt with by designing 
        redundant systems that would allow mission continuation. In 
        some cases, however, mission continuation is no longer possible 
        and steps must be taken to safely return the crew--an event 
        that is usually referred to as a mission abort. In the case of 
        a launch failure, an abort could involve an emergency return of 
        the crew. The Orion vehicle, for example, will have a launch 
        abort system which could be used to pull the crew capsule away 
        from the Ares I launch vehicle and allow the crew to 
        immediately return to Earth should a catastrophic event occur. 
        An abort also can be an operational decision to stop the 
        mission and return the crew if, for example a system has 
        degraded to a point that mission continuation exposes the crew 
        to an increased probability of a catastrophic hazard.

    The President's FY 2011 budget request includes significant 
investments to spur the development of commercial crew and further 
cargo capabilities, building on the successful progress in the 
development of commercial cargo capabilities to-date. A key early step 
to enable commercial crew transport is establishing a concise set of 
NASA human rating technical requirements that would be applicable to 
NASA developed crew transportation systems for Low Earth Orbit (LEO) as 
well as commercially-developed crew transportation systems for use by 
NASA. NASA is investing Recovery Act funds to begin development of 
these requirements. A NASA team has completed an initial set of 
commercial crew human rating requirements documents and commercial 
human systems interface requirements document and the documents are 
currently in the preliminary review cycle. A Request for Information 
will be issued within the next few months to seek industry feedback on 
related human-rating documents. In addition to the human rating 
requirements, NASA is developing an insight/oversight model that will 
contribute to the safe flight and safe return of NASA crew members on 
commercial space vehicles. NASA's years of experience and lessons 
learned with respect to human rating of space systems will help shape 
future systems to be developed in as safe a manner as possible.

Questions submitted by Representative Pete Olson

Q1.  Although the Ares I-X test flight was not an exact replica of the 
Ares 1, it involved a significant effort by the launch team to modify 
the facilities and develop the launch processing requirements and 
procedures to perform a successful test flight. In addition, Ares I-X 
was instrumented with over 700 sensors relaying information about the 
flight. To what extent do test flights improve safety and reliability 
by reducing overall risk? If adequate funding were available would more 
test flights allow you to accelerate the development and achieve an 
earlier crewed flight to shorten the gap?

A1. In general, a comprehensive flight test program is essential to 
understanding the integrated vehicle systems in the actual flight 
environment. Flight test provides engineers with the confidence in and 
understanding of the flight systems. Flight tests can and will reveal 
many of the ``unknown unknowns'' which remain hidden in analysis and 
subsystem (not integrated) testing, thus allowing engineers to solve 
problems before committing high-value payloads or crews to flight. 
Flight tests also enable engineers to better calibrate models so that 
they are more accurate in predicting worst case loads on the vehicle, 
responses of the vehicle's structure, and other parameters that 
ultimately affect final designs for safety,. Furthermore, flight tests 
enable retirement of risks that cannot be fully mitigated through 
ground testing only. Demonstrating factors such as vehicle 
controllability, abort effectiveness, and re-entry and landing 
performance under integrated real-world conditions must occur before 
crewed flight. Flight tests prove these and other critical systems are 
therefore essential to attaining an acceptable risk posture for crewed 
flight.
    Even flight tests of vehicles that are not identical to the final 
operational configuration still provide valuable data, though for 
obvious reasons, the closer the test article can be to final 
configuration, the more useful the test results. For example, NASA's 
Ares I-X test flight afforded NASA the opportunity to collect data that 
would be used to refine computational models and subscale test 
techniques that would be used by Ares I, thus allowing reduction of 
conservatism incorporated into initial models. Other test events, such 
as the recent firing of an Ares first stage development motor, 
designated ``DM-1'', and subsequent static test firings, also 
contribute to analytical model validation and refinement. Such tests 
provide additional real data to anchor analytical models used to 
predict vehicle physics, such as thrust oscillations, specific to Ares 
I. While additional test flights for the program of record could help 
achieve additional risk reduction, NASA will ensure that all future 
cargo and crew systems adequately test all flight systems prior to 
operational use.
    In terms of the Constellation Program, the addition of more test 
flights would not allow NASA to achieve an accelerated first crewed 
flight. Acceleration is not merely a funding matter; the potential for 
acceleration is also influenced by hardware development and system 
testing schedules, and NASA has reached the point where the development 
schedule for most systems could not be accelerated due to testing needs 
and limits on the ability to further accelerate procurements. The 
``long pole'' in getting to human flight is completing the system 
qualification testing, and the associated procurements, fabrication, 
and assembly for the qualification vehicle and hardware. To be clear, 
flight testing is different than qualification testing. Qualification 
testing exercises hardware through the full range of conditions it 
might experience (such as maximum and minimum operating temperatures). 
Flight tests, on the other hand, validate integrated real-world 
performance at a single set of conditions. Additional flight testing 
would not accelerate the Constellation Program's development schedule 
asgiven the long pole lies with qualification testing.

Q2.  Moving NASA beyond low Earth orbit will require a heavy lift 
launch vehicle. Ares 1 is developing many of the components needed for 
the heavy lift vehicle such as 5 segment solids, and the J-2X engines. 
Please comment on the role Ares 1 plays as a risk reduction program for 
the ultimate heavy lift launcher?

A2. Although the President's FY 2011 budget request does not include 
the Ares vehicles, the budget request includes three new robust 
research and development programs that will enable a renewed and 
reinvigorated effort for future crewed missions beyond LEO. One of the 
three programs is a Heavy Lift and Propulsion Technology Program, for 
which $559M is requested in FY 2011 and a total of $3.1B, is requested 
over five years. This aggressive R&D program will focus on the 
development of new engines and propellants, advanced engine materials 
and combustion processes that would increase our heavy-lift and other 
space propulsion capabilities and significantly lower operations costs, 
with the clear goal of taking us farther and faster into space.
    The specific risk reduction achieved by the Ares I work will depend 
on the architecture chosen for a new heavy lift vehicle. However, the 
lessons learned from Ares I will serve to inform those decisions. With 
regard to the current program of record, NASA's Constellation 
architecture was designed to have two lift vehicles--the Ares I Crew 
Launch Vehicle and the Ares V Cargo Launch Vehicle (heavy-lift 
vehicle). The Ares I launch vehicle enabled early design and test of 
critical elements and subsystems that would be required by the later 
Ares V heavy-lift vehicle. Such common elements include the J-2X Upper 
Stage engine, solid rocket motor, avionics and software and other 
systems.
    The Ares I vehicle took Ares V needs into consideration during 
development of the J-2X engine. The J-2X was planned to function as the 
Ares V Earth Departure Stage engine with only minor modifications to 
the Ares I engine. These modifications would be implemented via engine 
modification kits. Likewise, reductions were made to the Ares I/V solid 
rocket motor risks such as motor and nozzle design, materials selection 
and testing, recovery system (parachutes) testing and operations, and 
motor manufacturing.
    Lastly, designing the Ares I allowed NASA to make an important 
technology leap in the design process. By transitioning from a 2-D, 
paper-based vehicle design and verification process to a 3-D model-
based design environment, NASA was able to gain valuable experience 
with a new design system that can reduce costs while also increasing 
system reliability.
    The Program is working to capture all of the knowledge learned from 
development efforts, including test flights. The Program has spent 
significant time recently focusing on its Preliminary Design Review 
(PDR) elements of which concluded in March. NASA believes that 
completing the Constellation PDR will support not only the close-out 
process for Constellation, but also will ensure that historical data 
from Constellation work is documented, preserved and made accessible to 
future designers of other next-generation U.S. human spaceflight 
systems.

Questions submitted by Representative Dana Rohrabacher

Q1.  In the Launch Services Program NASA has generally required that a 
launcher demonstrate multiple successful flights before being 
considered for use launching science payloads and satellites. In some 
cases, up to 14 successful flights of the rocket were required before 
being used to launch a ``Class A'' satellite. By contrast, the 
Constellation Program is currently planning (subject to review) only 
one full-up test flight before placing astronauts aboard the Orion/Ares 
I. I understand that these two parts of NASA--manned and unmanned--have 
different requirements and operate with different rules, but in both 
cases the overall mission success is a primary objective. Can you 
please explain how these two systems of evaluating launch vehicles have 
evolved so differently, what are the similarities, and in the above 
example how NASA's Constellation program can comfortably accept a plan 
that demands 92 percent fewer test flights than what was required for a 
satellite program?

A1. The most important factor in determining when it is appropriate to 
fly crewmembers on a new test vehicle is the level of confidence the 
team has in safely conducting the test. In the case where NASA 
validates the technical requirements, designs and manufactures the 
flight and ground systems, writes the launch commit criteria and flight 
rules, performs all number of ground tests and engineering analyses, 
and conducts the reliability, safety and risk analyses, it has arguably 
maximized its understanding of and associated confidence in the system. 
Based on this, the team decides when to conduct its first crewed flight 
test. As the distance between NASA and the design, development, 
manufacturing, and operations increases, so does the Agency's reliance 
on demonstrated reliability, and/or other government certifications 
(i.e. Russia's ROSCOSMOS or the U.S.'s Federal Aviation 
Administration). NASA has not come to a final determination on the 
number of test flights that would be required prior to sending NASA 
astronauts into space using the crew launch vehicle under the Program 
of Record.
    Regarding the comparison with the LSP, NASA has a range of options 
available depending on the launch system's proven reliability, the 
value of the payload, and the certification status of the provider. In 
some cases, this program has little insight into, or oversight of, the 
commercial launch providers. In those cases, NASA requires a 
demonstration of 14 successful launches for certification of the launch 
vehicle for high value payloads. This certification option, which is 
rarely chosen, is predicated on an assumption of no prior knowledge 
about launch vehicle performance, and limited government oversight into 
the design and operation. Another option is to fly the NASA payload on 
a relatively new system with as few as three flights (two successes in 
a row), but with substantial NASA process requirements and insight into 
the contractor's design, engineering and operations processes. For 
lower value payloads with a higher risk tolerance, another 
certification category is available. It only requires one successful 
flight of the launch vehicle and a significant technical assessment.
    NASA's ongoing human spaceflight program has established a host of 
safety and mission assurance activities including (subsystem) tests, 
verifications, and analyses, which would establish a level of 
confidence in the vehicle's performance prior to the full-system test 
launches. Decisions regarding the needed number of full-system test 
launches should account for these assurance activities.
                   Answers to Post-Hearing Questions
Responses by Mr. John C. Marshall, Council Member, Aerospace Safety 
        Advisory Panel, National Aeronautics and Space Administration

Questions submitted by Chairwoman Gabrielle Giffords

Q1.  As you know, the Augustine Committee projected that commercial 
crew transportation could be available by 2016. It does not appear that 
this projection reflected the time needed for all of the milestones 
that must be met prior to the point at which NASA would be able to use 
such services to fly its astronauts to the ISS such as the time needed 
to get Congressional authorization and appropriation of funds; 
agreement on human-rating and other safety standards and means for 
verifying compliance; development of a regime for certification; and 
contract competition, negotiation and award of contract (S), and 
potential protest(s) by losing bidders. These are no small tasks, and 
it is not obvious that any of them could be skipped if the government 
is to make use of those services.

        a.  In your opinion, what are currently the largest technical 
        challenges or hurdles that potential commercial crew 
        transportation providers are facing that might cause delays to 
        their projected initial operating dates?

A1, 1a. The milestones that you mention are all important. The process 
for enabling the current commercial cargo providers to provide crew 
transportation has not yet been initiated to any significant extent. 
Although there has been considerable discussion about this topic by 
some manufacturers' leaders, and most recently by the Augustine 
Committee, the ``COTS-D'' portion in the current agreements still 
remains a potential add on to the commercial cargo delivery 
demonstration projects. Thus, the ``projected initial operating dates'' 
that might be achieved with the current designs are unclear. This said, 
the two NASA contractors currently in the program have stated that 
their designs could be adapted to human transport. However, they have 
made these statements without having the detailed requirements for the 
necessary safety certifications. This is because NASA has neither 
developed those requirements nor provided them to the contractors.
    Clearly, the single most important technical challenge to 
commercial crew transportation that remains is developing the standards 
by which the suitability for human transport will be judged. Likewise, 
the process and authority for validating that those standards have been 
met--initially in the capability of the design and then through the 
construction and maintenance of the vehicle for its entire life cycle--
also must be developed. Without firm performance criteria and the 
definition of the certification process for these criteria, the 
contractors' abilities to meet any initial operating dates for the 
current designs remains speculative.
    Key hurdles to achieving certifiable crew transportation capability 
include:

        1.  Clear technical criteria for the vehicle's design 
        performance and capability must be established and provided to 
        all entities wishing to vie for providing the service.

        2.  The process for overseeing the design's development and 
        validation must be created.

        3.  The technical details for the necessary data submissions, 
        design reviews, analysis, testing, and validation of results 
        must be established and instituted via contract with the 
        manufacturers.

        4.  The process and authority for overseeing that the necessary 
        safety is maintained through proper maintenance and support 
        throughout the vehicle's life cycle must be developed, 
        approved, and instituted.

        b.  How confident can the Congress be that a commercial crew 
        capability can be operational in 2016 while still having to 
        carry out all of the activities that need to be completed 
        before the first NASA astronaut can safely ride on an 
        operational vehicle to the International Space Station?

A1, 1b. NASA recently has begun to develop definitive standards for 
assessing design capability for crew transport. The criteria for safely 
docking vehicles with the ISS is already published and has been 
provided to the current commercial cargo contractors; however, it must 
be clear that this is only for protection of the ISS and does not 
provide any safety considerations for either humans or cargo inside the 
vehicle. If things move steadily and the Agency receives funding to 
contract for necessary activities, six years seems an adequate period 
to accomplish this objective. However, any effort to assess the 
feasibility of the 2016 operational start date for current designs 
would be premature since assessments of the current design developments 
against the criteria have not taken place. This is principally because 
the criteria necessary for that assessment are not yet fully 
determined. As a reference point, it took 10 years from program 
initiation to first flight for the space shuttle, and 10 years to reach 
the Moon with Apollo. Therefore six years duration, since we are 
building on the foundation of the existing cargo programs, seems like a 
reasonable time period.
    However, there are many variables that can have a profound effect 
on the duration, three of which are particularly noteworthy. First, 
these vehicles and their launch systems have to demonstrate that they 
are capable of reaching LEO and safely delivering cargo to ISS. 
Obviously, success in this endeavor would be a large risk mitigator for 
extending the use of these vehicles to human transport. Second, the 
current designs have to be assessed against the previously described 
criteria, which will in no doubt drive needed design changes or 
additions. These modifications must be within the vehicle's design 
concept, i.e., technically feasible to incorporate into the design 
without causing the approach to be altered fundamentally. Third, these 
changes will have to be described in contractual documents and placed 
in an RFP. That RFP will result in a priced proposal that must be 
negotiated and funded. It has to be presumed that the funding needed to 
incorporate these changes/modifications/certifications will be 
provided.

Q2.  You make it clear in your prepared statement that the ASAP Panel 
recommends that NASA be ``hands-on'' in its approach. Why do you think 
NASA needs to be ``hands-on'' in its involvement?

A2. Without direct involvement in planning, design, testing, and 
validating the design, NASA cannot state with assurance that the 
necessary safety level has been achieved. NASA must stay engaged in the 
entire process to ensure the level of safety is achieved.

Q3.  ``In your written testimony, you state that it is the ASAP 
position that ``NASA is best qualified to be the oversight body for 
each of these actions (demonstration, verification, and certification 
prior to NASA's use for crew transport) as today only NASA has the 
competence in hand to effectively audit the complex technical work 
required.'' Can you elaborate on why the ASAP believes that?''

A3. While NASA currently has no explicit safety requirements for crewed 
COTS systems and will have to tailor the existing processes 
significantly, it is the only agency in the US Government that has a 
knowledge base for the complex tasks necessary to determine whether a 
given space vehicle is safe enough to carry US astronauts. This 
knowledge base includes the myriad technical standards that hard won 
experience has shown to be essential to ensure inherent safety for the 
hardware. It also includes the test and evaluation capabilities and 
human rating process capabilities (noted previously) that validate 
proposed designs as safe for these astronauts. Please note that mission 
safety approval for NASA crew member transport to LEO, ISS docking and 
return is not the same as safety approval for private launches, for 
which the FAA is, and should remain, responsible.

Q4.  In the ASAP's 2008 Annual Report, the panel notes that ``NASA has 
an important one-time opportunity to better interweave safety as a 
consistent and more powerful operating parameter by hardwiring safety 
into the fabric and procedures of the new flagship exploration program, 
Constellation.''

     How would NASA infuse a similar strong safety culture into the 
agency if NASA were to purchase crew services from a commercial 
provider in lieu of developing the Constellation launch system?

A4. In our 2008 Annual Report regarding Constellation safety 
opportunities, the ASAP wrote: NASA should institutionalize safety 
programs, systems, processes, and reporting procedures including:

          Robust, well-publicized safety programs that mirror 
        industry best practices, including using current world-class 
        systems and incentives as models

          A safety management system that tracks accidents, 
        mishaps, close calls, audit results, lessons learned, and data 
        trends for these and other leading indicators

          Consistent methodologies to identify hazards and to 
        manage, articulate, and reduce risks

          Defined, timely process for investigating, analyzing, 
        and reporting on accidents

          More rapid and thorough determination of root causes

          Standardized accident report format, timeline, 
        database, and metrics

          Timely, possibly Web-based distribution of lessons 
        learned to prevent mishap recurrences

    Most of this still applies with little or no modification. However, 
the structure NASA will use to gain the insight and / or oversight to 
implement a safety program for commercial providers remains to be 
determined. Certainly, the U.S. Department of Defense (DoD) and the 
aerospace industry have learned how to work together to benefit safety 
when DoD engages in contracts with private industry for both weapon 
systems and critical services. Perhaps the DoD approach offers a good 
model.
    In the ASAP's opinion, a sufficient safety program cannot be 
established in a ``hands-off' contractual relationship.

Questions submitted by Representative Pete Olson

Q1.  Since a significant portion of launch failures are due to human 
error it is critical to have a strong safety culture. The Columbia 
Accident Investigation Board reiterated again the importance of a 
strong safety culture. Would a shift to commercially provided low-Earth 
orbit launch vehicles disrupt that culture at NASA? Could that be cause 
for concern?

A1. The ASAP believes that a good safety culture is advisable for any 
organization, regardless of its work, and ideally is present due to 
ethical leadership, good systems, and the correct ``tone at the top.'' 
The ASAP continues to assess NASA's safety culture, and while progress 
has been made since the CAIB report, our reports contain additional 
recommendations relative to safety culture. It is difficult and rare 
for an organization to achieve a ``perfect'' safety culture, and it is 
even more difficult to maintain one over time.
    In this regard, NASA will need to ensure that any organization that 
may provide a crewed vehicle in the future actually will value a strong 
safety culture. Role modeling and ensuring a strong safety culture 
among NASA's contractors and potential partners will remain a 
difficult, yet doable, leadership task. Establishing a good safety 
culture in one's own organization is hard work. Fostering it within 
another organization, where one does not have complete control, is even 
more difficult. NASA has experience working with many contractors and 
has been vigilant in establishing good safety partnerships with them. 
It is the Panel's expectation that the current emphasis on contractor 
safety would continue if firms were contracted for Low Earth Orbit 
(LEO) launches, and that NASA would continue to work to improve its own 
safety culture and the safety culture of those firms.

Questions submitted by Representative Dana Rohrabacher

Q1.  What does the Aerospace Safety Advisory Panel believe are the most 
important steps to enable NASA to seriously consider, evaluate, and 
possibly implement a commercial crew competition?

A1. On numerous occasions, the ASAP has addressed the urgent need for 
establishing the human rating requirements, airworthiness criteria, and 
certification requirements for a possible commercially developed 
vehicle that may be used to transport NASA crew. It is essential that 
these requirements be considered and, as appropriate, incorporated into 
the on-going design phase as early as possible. However, the scope of 
this question extends beyond the preparedness activities that are 
needed to ensure that an acceptable level of safety is achieved. To a 
large extent, it is equally important to ensure that the program's 
budgeting and planning process is initiated quickly. With this in mind, 
the ASAP notes the following serious challenges that will need to be 
met to successfully implement a commercial crew competition and offers 
the following observations:

        A.  NASA has not yet committed to developing a commercial crew 
        transportation capability. If NASA elects to proceed in that 
        direction, a strong message needs to be communicated publicly 
        that commercial crew transportation is a priority NASA mission 
        and the mission's requirements and objectives must be clearly 
        stated. NASA should take steps to ensure that the impending 
        Administration's decision for Exploration (based on the review 
        of the Augustine's human spaceflight study) re-affirms the need 
        for NASA to assist in developing a commercial crew transport 
        capability.

        B.  It is not yet known which organization within NASA would 
        assume responsibility for developing and implementing this 
        program. Therefore, NASA will need to identify the Program 
        Manager and provide adequate resources to address the 
        performance, technical, schedule, and cost requirements and 
        analyses in formulating the overall program plan.

        C.  NASA has not developed a program, acquisition strategy, 
        budget, or initiated the legislative process necessary to 
        obtain authorization for a COTS-D vehicle. Currently, NASA only 
        has an option to exercise a COTS-D (crew transport) program 
        under the Commercial Cargo and Crew Transportation Program. 
        Space X currently has an unfunded Space Act Agreement option to 
        demonstrate a COTS-D program. While NASA may also conduct a new 
        competition for one or more crew demonstration partners, plans 
        for implementing these options cannot go forward without 
        authorized funding.

        D.  NASA needs to determine to what extent and how it will be 
        involved in the commercial providers' processes and activities 
        for defining the appropriate oversight and insight to ensure 
        astronaut safety so that potential commercial partners can be 
        informed.

        E.  NASA needs to determine to what extent it may provide 
        enabling technologies and capabilities, including actual 
        hardware or designs (such as that for the Orion), so that 
        potential commercial partners can be informed.

Q2.  During the Q&A period, you mentioned that the ASAP had visited 
with Orbital Sciences regarding their COTS development program, and 
stated that they did not see any existing commercial market for cargo 
(and potentially crew) delivery to ISS. Did you ask the same 
questions(s) of SpaceX, and what was their response?

A2. The original question by Chairwoman Giffords was ``. . . do our 
witnesses believe that would-be commercial crew transport service 
providers be able to garner sufficient revenues from non-NASA passenger 
transport services to remain viable over this time period as well?'' My 
response to this question where I noted that we asked Orbital Science 
if they had done a market analysis to find other revenue sources was 
directly to the issue of crew transport services, not commercial cargo 
markets. This said, SpaceX management was not asked this question. 
Neither did they indicate whether alternative markets have been 
identified for their vehicle.
                   Answers to Post-Hearing Questions
Responses by Mr. Bretton Alexander, President, Commercial Spaceflight 
        Federation

Questions submitted by Chairwoman Gabrielle Giffords

Q1.  What is the industry's understanding of NASA's human-rating and 
safety requirements, both technical and operational? Is there an 
expectation by the industry that finalized requirements will be 
developed in conjunction with NASA?

A1. The Aerospace Safety Advisory Panel correctly points out that NASA 
has not yet developed standards and processes for human-rating 
commercial vehicles. Until such time as commercial human-rating 
standards are determined, industry continues to develop vehicle 
hardware based on the only standards available: those NASA established 
for its own vehicles, known as NPR (NASA Procedural Requirement) 
8705.2B, effective May 06, 2008.
    Early dialogue between NASA and the commercial spaceflight sector 
on the nature of human-rating requirements for commercial systems is 
crucial, with demonstrated reliability, robust test flights, and a 
reliable crew escape system being key. To work with NASA and the FAA, 
US. industry has established a Commercial Orbital Human Spaceflight 
Safety Working Group, under the leadership of the Commercial 
Spaceflight Federation. The goal of the effort is to develop industry 
consensus on principles for safety of commercial orbital human 
spaceflight. Consensus has been reached among a number of companies on 
fundamental principles that will form the basis for our engagement with 
the FAA and NASA, but much more work remains to be done.

Q2.  During the hearing, Mr. Marshall said that some entities might not 
agree to a ``hands-on'' NASA role. Have federation members discussed 
what activities and level of scrutiny by a federal entity would amount 
to a ``hands-on'' relationship with which they could not agree? Can you 
provide examples of the types of activities and level of scrutiny that 
would create an unacceptable ``hands-on'' relationship? What level of 
NASA involvement would be acceptable?

A2. The commercial spaceflight industry believes strongly in the 
importance of a close relationship with NASA. The level of oversight 
and insight shared between NASA and FAA is a critical topic that is 
being addressed by, among other bodies, the Commercial Orbital Human 
Spaceflight Safety Working Group. Since NASA, FAA, and commercial 
spaceflight providers are just beginning their dialogue, it is not yet 
possible to state whether any specific requirement will be a subject of 
dialogue or discussion between the stakeholders.
    As NASA Administrator Charles Bolden stated February 1: ``Now, as 
50 years ago when we upgraded existing rockets for the Gemini program, 
NASA will set standards and processes to ensure that these commercially 
built and operated crew vehicles are safe. No one cares about safety 
more than I. I flew on the space shuttle four times. I lost friends in 
the two space shuttle tragedies. So I give you my word these vehicles 
will be safe.'' The commercial spaceflight industry will work closely 
with Administrator Bolden and others to make sure that this objective 
is realized.

Q3.  Your prepared statement does not directly address how experience 
in reentry and landing will be obtained by potential commercial 
providers. By what means and in what timeframe will the commercial 
space transportation industry secure such experience?

A3. Reentry and landing is a critical portion of human spaceflight that 
is essential to safety. It is our expectation that commercial providers 
will not place astronauts on an untested capsule, but rather these 
systems will have gained flight experience with reentry and landing 
before commencing manned flights with NASA astronauts aboard. In 
addition to full orbital flight tests, commercial providers may also 
conduct suborbital tests, either as part of a subscale test launch or 
as a test of the launch abort system, which will therefore provide 
additional experience with the reentry and landing phases of the 
mission profile. As no provider agreements for a full Commercial Crew 
program have yet been signed, the exact timeframe is yet to be 
determined on a per-company basis. Further, US. aerospace companies 
have been a part of every US. human spaceflight since the program began 
and have substantial technical expertise in reentry and landing systems 
and environments.

Q4.  In your prepared statement, you state that in addition to FAA's 
existing regulatory authority as codified in U.S. law, industry will 
satisfy customer-specific requirements levied by NASA in partnership 
with industry. With regards to your reference to existing FAA 
authority, are you proposing that NASA astronauts fly under ``informed 
consent'', which is the existing regulatory framework?

A4. The Federal Aviation Authority's Office of Commercial Space 
Transportation currently levies different requirements for different 
categories of individuals, which include ``crew'' and ``space flight 
participants.'' The exact nature of the regulatory framework that would 
apply to NASA astronauts will require dialogue between NASA, the FAA, 
and the commercial space industry. Through the Commercial Orbital Human 
Spaceflight Safety Working Group, industry stands ready to engage in 
this dialogue and determine the best path forward. However, it is 
vitally important for the viability of future commercial human 
spaceflight providers that launches be conducted under the same legal 
and regulatory framework, regardless of whether the customer is the 
U.S. government or a private entity.

Questions submitted by Representative Marcia L. Fudge

Q1.  The discussion of safety requirements for crew and passengers on 
commercial transportation systems has, up to now, primarily focused on 
suborbital flights. Has the commercial space transportation industry 
identified any additional safety-related R&D requirements to enable 
future orbital flights by commercial crewed transportation systems?

A1. As compared to suborbital flights, orbital flights have more 
demanding engineering requirements in specific areas, such as: higher 
heat loads on re-entry, more powerful and longer engine firings, 
additional risk due to micrometeroid impact, more involved 
communications downlink to Earth, additional attitude control 
requirements, more complex abort scenarios, etc. Since the commercial 
crew program could be seen as commercializing accomplishments similar 
to those of the 1960s Gemini program, none of these problems require 
new technology to solve, but they would all benefit from additional R&D 
to improve capability, reduce risk, and reduce costs.

Q2.  Are there any R&D efforts currently underway at NASA's Glenn 
Research Center that would have applicability to potential commercial 
human space transportation systems? Does the commercial space 
transportation industry have suggestions on how NASA's Center R&D 
programs could contribute to enhancing the safety of potential 
commercial human space transportation systems?

A2. Yes, there are multiple R&D efforts currently underway at Glenn 
Research Center that would be useful for commercial human space 
transportation providers. Facilities such as the Plum Brook Station 
(PBS), which has significant capability for full-scale upper-stage 
engine testing under simulated high-altitude conditions, would be 
useful to commercial providers. Plum Brook has the Space Power Facility 
as well as a hypersonic wind tunnel and cryogenic test facilities. 
Research in the fields of combustion, reacting flow systems, fluids, 
and materials testing of structures for atmospheric and vacuum/space 
environments are some of the areas of interest to the industry. Other 
R&D efforts underway at Glenn's Zero Gravity Drop Tower and the 
Spacecraft Propulsion Research Facility will also help enable future 
innovation for commercial space launch providers. Some ways in which 
NASA's Center R&D programs could contribute to commercial spaceflight 
safety is through easier access to government test facilities, as well 
as enhanced interchange of technical information from NASA.

Q3.  If NASA were to use commercial transportation systems to fly its 
astronauts to the International Space Station, would the commercial 
space transportation industry envision these astronauts being 
passengers or crew members? What sort of training would the industry 
envision as needed for these astronaut passengers? If spacecraft are 
piloted by provider crew members, how would their training differ from 
that received by NASA's astronaut passengers?

A3. The exact regulatory framework that would apply to NASA astronauts 
will require dialogue between NASA, the FAA, and the commercial space 
industry. Through the Commercial Orbital Human Spaceflight Safety 
Working Group, industry stands ready to engage in this dialogue and 
determine the best path forward for the FAA, NASA, and commercial 
industry.

Questions submitted by Representative Pete Olson

Q1.  In preparation for commercial attempts to deliver cargo to the 
International Space Station, the COTS providers have been working 
closely with NASA to evaluate whether they can comply with NASA's 
Visiting Vehicle requirements that govern proximity operations around 
the ISS. Is there anything preventing NASA from working with potential 
commercial providers, whether COTS companies or United Launch Alliance, 
to establish the safety requirements processes and identify the 
modifications that would be required for those vehicles to meet NASA's 
human-rating requirements?

A1. We do not believe at this time that there are any obstacles to 
cooperation between NASA and commercial companies in the development of 
safety requirements processes and identification of needed 
modifications to vehicles. The Aerospace Safety Advisory Panel recently 
stated that NASA should ``accelerate the level of effort underway'' to 
develop these commercial requirements. The commercial spaceflight 
industry is ready to work with NASA on these critical issues, and in 
fact has already begun engaging with NASA through the Commercial 
Orbital Human Spaceflight Safety Working Group. While the Commercial 
Spaceflight Federation has taken the lead in organizing the effort, the 
working group includes representatives from a broader spectrum of 
companies, including several of the major aerospace primes and more 
traditional government space contractors. The goal of the effort is to 
develop industry consensus on principles for safety of commercial 
orbital human spaceflight. So far, we have met among industry and have 
begun to engage NASA and the FAA.

Q2.  Recently there seems to be a great deal of interest among the 
potential commercial space providers to enlist the government as the 
primary buyer of space systems. Presumably, this is because the 
government is currently the only known market for these services, 
although the industry is hopeful that non-governmental buyers will 
emerge. If no outside commercial market materializes, as was the case 
with early claims that a backlog of commercial satellites would help to 
reduce the cost of the development and operations of EELVs, wouldn't 
the governments' costs ultimately be higher since it would eventually 
have to pay for all the development and operational costs?

A2. The Augustine Committee stated the following findings in its final 
report:

         ``During its fact-finding process, the Committee received 
        proprietary information from five different companies 
        interested in the provision of commercial crew transportation 
        services to low-Earth orbit. These included large and small 
        companies, some of which have previously developed crew systems 
        for NASA. The Committee also received input from prospective 
        customers stating that there is a market for commercial crew 
        transportation to low-Earth orbit for non-NASA purposes if the 
        price is low enough and safety robust enough, and from 
        prospective providers stating that it is technically possible 
        to provide a commercially viable price on a marginal cost 
        basis, given a developed system.

         None of the input suggested that at the price obtainable for a 
        capsule-plus expendable-launch vehicle system, the market was 
        sufficient to provide a return on the investment of the initial 
        capsule development. In other words, if a capsule is developed 
        that meets commercial needs, there will be customers to share 
        operating costs with NASA, but unless NASA creates significant 
        incentives for the development of the capsule, the service is 
        unlikely to be developed on a purely commercial basis.''

    That is, the Augustine Committee found that non-NASA customers for 
commercial crew services did exist, but not in sufficient quantity for 
the business cases of private companies to close if they had to fund 
the development entirely on their own. On the other hand, if private 
industry and NASA share the development costs, then all parties will 
benefit. In particular, one additional market has been proven on a 
small scale, which is private citizens paying to travel to space. Over 
$150 million has been already paid by seven private citizens to travel 
on a Russia Soyuz to the International Space Station, at a steady rate 
of about one mission a year. In fact, the demand for this service has 
continued to increase despite an almost doubling of price from under 
$20 million per seat to now over $35 million per seat. Furthermore, 
when Commercial Crew taxi services begin in the United States, demand 
will rise because would-be travelers, who are often business leaders 
running companies, will no longer have to spend six months training in 
Russia with limited contact with the outside world. Since American 
services will not require overseas training of that duration, will not 
require learning the Russian language, and will likely undercut the 
Russians in per-seat cost, the market is likely to increase for private 
space travelers.
    Other, not yet proven, markets for additional flights of the 
capsules include: (a) sovereign clients, in which other countries 
purchase seats on American vehicles rather than the Russian Soyuz, and 
(b) industrial clients: since as Commercial Crew reduces the cost and 
increases the frequency of access to space, there could be increased 
interest in on-orbit industrial applications.
    When considering the potential of other markets, it is important to 
note that all Commercial Crew providers will use launch vehicles that 
already exist, such as the Atlas V, or in the late stages of 
development, such as the Taurus II and Falcon 9, and all of these 
vehicles will launch satellites and cargo before putting astronauts on 
board. Accordingly, it is already the case that a proven commercial 
market exists for at least the launch vehicle portion of each rocket-
and-capsule system. Spreading the costs of a commercial system between 
the cargo, satellite, and crew markets will reduce the burden for each 
customer (NASA, DoD, and commercial customers).

Q3.  Given that the emerging commercial providers appear to believe 
strongly in an evolutionary approach to design and safety innovation to 
be achieved through flight experience gained from revenue flights 
undertaken without any prior safety certification regime, wouldn't 
premature reliance on the government as the dominate or only customer 
inhibit the ability of the emerging commercial providers to sustain the 
innovation they believe is essential to their long-term commercial 
success?

A3. As the Augustine Committee stated the following findings in its 
final report: ``unless NASA creates significant incentives for the 
development of the capsule, the service is unlikely to be developed on 
a purely commercial basis.'' With NASA as a significant early customer, 
commercial industry will still be able to more rapidly incorporate 
innovations and technology upgrades than under a government program 
designed to for a 20-to-30 year operating lifetime.

Q4.  What do potential commercial crew transportation services 
providers consider to be an acceptable safety standard to conform to if 
their space transportation systems were to be chosen by NASA to carry 
its astronauts to low Earth orbit and the ISS? Would the same safety 
standard be used for non-NASA commercial human transportation missions?

A4. Safety is paramount for the commercial spaceflight providers. 
Indeed, commercial vehicles such as Atlas V and Delta IV, developed 
with substantial private funding and engineering expertise, are already 
trusted to launch key government national security assets upon which 
the lives of our troops overseas depend. Since probabilistic risk 
assessment calculations account for part failure, and do not account 
for most of the root causes of accidents historically, such as human 
error or design flaws, and since even reliable vehicles have 
historically suffered a period of ``infant mortality,'' the commercial 
spaceflight industry believes that they will in fact achieve higher 
safety than that of government systems that intend to put human beings 
aboard on early orbital flights of the system. Commercial industry 
believes safety must include the following:

          Demonstrated reliability through multiple orbital 
        unmanned flights of the full system

          Not placing crews on initial flights, since early 
        flights are historically most risky

          A highly reliable crew escape system

          Standards-driven design and operations

    Industry believes that the safety of commercial spaceflight must be 
significantly greater than that of the space shuttle in order to be 
successful. In addition to the FAA's existing regulatory authority, as 
codified in U.S. law, industry will satisfy customer-specific 
requirements levied by NASA in partnership with industry. This process 
has already begun with the cooperation of the stakeholders involved. 
NASA and FAA will be there every step of the way, and will have 
oversight during design, testing, manufacturing, and operations.
                   Answers to Post-Hearing Questions
Responses by Dr. Joseph Fragola, Vice President, Valador, Inc.

Questions submitted by Chairwoman Gabrielle Giffords

Q1.  The Augustine Committee's report cited five basic questions that 
could for the basis of a plan for the U.S. space flight program, but 
``how could crew safety be dramatically improved'' was not one of them. 
Should it have been? And if so how would it have informed their 
deliberations?

A1. It is my opinion that the question of how could crew safety be 
dramatically improved should have not only been one of the five basic 
questions for the basis of a plan of the U. S. space flight program, 
but that it should have been the primary question. In fact it is 
difficult for me to understand how a committee could, on the one hand 
state that crew safety was the sine qua non of their work, and yet not 
include crew safety as a primary question. I believe if they had 
included it as a primary question they would have understood better how 
deliberately during ESAS, and subsequent to ESAS in the development of 
the Ares I vehicle design the thrust of all decision making was toward 
the development of a dramatically safer crew launcher than heritage 
systems such as the Space Shuttle or commercially available systems, 
such as Atlas or Delta.

Q2.  Reliability and safety seem to be used interchangeably by some 
when discussing crew safety. Are they really the same thing, and if not 
what is the distinction? How important a distinction is it?

A2. There is a lot of confusion in the meaning of the term safety. The 
definition varies and to some, particularly those in the systems safety 
community, safety includes any significant loss. Those in the risk 
assessment community include only losses of life. However neither 
community would accept the fact that the terms reliability and safety 
are interchangeable when it comes to loss of life. The important issue 
to recall as it relates to launch vehicles is that reliability is 
indistinguishable from safety for unmanned spacecraft payloads, but the 
two are crucially different for manned space vehicles. This is because 
of the important distinction between relatively benign vs. catastrophic 
failure modes, and because of the existence of an abort system.
    These distinctions mandate that safety consider the additional 
probability of the crew surviving conditioned on a mission failure. 
This latter conditional probability depends on the severity of the 
initiating mission loss accident and the robustness of the abort 
system. A good example would be Apollo 13. The mission failed in such a 
severe way that not only was the Command and Service Module disabled, 
but all the services in the service module were destroyed. This implied 
that the abort system, the Lunar Module, had to be robust enough not 
only to perform the electric power functions of the CSM, but also to 
provide all the other life sustaining functions until the Command 
Module could be employed for re-entry. A less severe accident, say a 
benign engine failure of the Service Module engine, would have not 
required the additional risk of conversion of the CO2 
extraction system for example. The point is that the abort system must 
be robust enough to address the full spectrum of post accident 
conditions and allow the crew to survive them. So the conditional 
probability of an effective abort given a LOM event is an important 
distinction between reliability and safety.

Q3.  How does one calculate meaningful safety characteristics such as 
loss of crew for vehicles that have not yet entered the hardware phase?

A3. Crew safety can never be guaranteed even with a vehicle that has 
been built and has had a significant record of mission success. However 
this does not mean that designs that include certain features are not 
more likely to produce a safer design than those that are not. In 
particular in my testimony I provided four rules that I believe would 
enhance the safety of a new launcher:

        1.  Make it as inherently safe as possible. That is, make it 
        reliable AND select a design with benign failure modes.

        2.  Separate the crew from the likely source of failure. That 
        is, put them on top of the stack where ``God meant them to 
        be''.

        3.  Establish credible abort triggers balancing warning time 
        with the threat of false positives.

        4.  Include an abort system tested and verified for robustness 
        for safe escape and recovery.

    To calculate meaningful safety characteristics for vehicles that 
have not entered the hardware phase one uses historical operational 
data from heritage systems to establish a ``surrogate'' model of the 
new design to estimate the inherent safety, that is mission 
reliability, and the spectrum and post incident environments likely for 
credible mission loss events. A surrogate is constructed for a new 
launcher much in the same way that an opening price is established for 
a new initial product offering in the marketplace. That is, in the case 
of an IPO the analyst looks at comparables that are in the market, 
their product lines, and their associated market prices, and constructs 
a ``shadow price'', by reflecting the product line of comparables onto 
the product line of the IPO and adjusting for competitive distinctions. 
This shadow price becomes the opening market price. In the case of a 
safety surrogate, the analyst reviews all type comparables, in this 
case launchers, their historical heritage launch reliabilities and risk 
driving features, and constructs a ``shadow risk'' reflecting these 
features and associated risks onto the features in the new launcher 
adjusting for differences that make a difference in the risk driving 
elements of the new launcher design.
    Once the surrogate is established each of the credible incident 
environments are simulated to determine the physical impact of the 
radiative, impulse pressure wave, and fragmentation environments on the 
crew safe abort given the stack geometry, launch abort system design 
and crew module fragilities, throughout the ascent trajectory. The 
combination of the geometry, post accident insult environment and the 
fragilities of the crew module forecast the overall abort effectiveness 
of the configuration given the inherent reliability of the launcher 
once deployed.
    This approach is distinguished from the more traditional launch 
reliability approach used in the past by its reliance on historical 
data, the establishment of a vehicle surrogate from the top down, that 
is on a functional not component basis, so as to capture the primary 
causes of historical failures, and the use of first principles physics 
codes to establish the post accident environments and the corresponding 
abort effectiveness.
    It is believed that employing such an approach provides estimates 
of loss of crew probabilities, within reasonable uncertainty bounds, so 
as to allow for discrimination of the crew safety potential among 
proposed designs.

Q4.  What are the key determinants in designing an effective abort and 
escape system? What compromises should be avoided?

A4. The most important determinants in designing an abort system are 
the balancing of escape acceleration and acceptable g load on the crew 
so as to provide for maximum separation distance from the approaching 
hazards without endangering the crew further during the abort and the 
avoidance of false positives that would cause aborts from an acceptable 
system. What should be avoided is to use the abort system as a crutch 
against unacceptable inherent safety for example, by claiming 
indefensibly high levels of abort effectiveness.

Q5.  What safety considerations should guide the Congress' evaluation 
of the implications of NASA relying solely on commercially provided 
crew transport and ISS crew rescue services?

A5. As was mentioned, even a significant record of mission success is 
not enough to ensure safety at dramatically higher levels than those 
currently provided by the shuttle. Congress should require that NASA 
become involved in a wholesale evaluation of the design features of 
each proposed design including that of the crew module. and the launch 
abort system. This evaluation should include the heritage of those 
features in terms of their historic performance especially as it 
relates to the post incident conditions that would be imposed on the 
crew. Congress should require that NASA impose strict first principles 
physics based simulations to establish a credible estimate of the abort 
effectiveness to be applied to the integrated crew launch stack, 
including the launcher, the launch abort system, and the crew module. 
Congress should also require that NASA establish resident inspectors at 
the production facilities of all the major manufacturers of the launch, 
crew module, and launch abort system. It also should require process 
control and inspection during manufacturing and testing, and the 
identification and close out of anomalies including design and or 
process changes implemented and their effectiveness. Finally Congress 
should require that NASA impose a strict and challenging ground and 
flight test program for the proposed launch abort system, including a 
full up flight test of the system to ensure its robustness.

Q6.  The Augustine Committee's report mentioned that a leading 
objective of the ESAS effort was to minimize the gap between the last 
shuttle flight and that of the new vehicle. You were a member of the 
study. Were there any other major objectives?

A6. Yes there were. The most important major objective, and the one 
that I was most intimately involved in, was to ensure that the CAIB 
recommendation that the replacement crew launcher for the shuttle would 
be an order of magnitude safer than the shuttle. Other major objectives 
were to fit into the funding profile, to allow for payload performance 
objectives to be met, and to ensure that the architecture chosen was 
capable of enabling a path forward to a crewed lunar and eventually a 
crewed Mars mission.

Q7.  How meaningful are the distinctions between the Loss of Crew 
figures for different options contained in the Exploration Systems 
Architecture Study (ESAS)?

A7. The ESAS, as its name implies, was directed at the selection of an 
architecture to enable exploration beyond low earth orbit. The focus 
was therefore on discriminating among the suggested alternative 
architectures, and associated elements, so that the most effective one 
would be selected to be carried forward. In this regard the Loss of 
Crew estimates made at the time of ESAS were directed at highlighting 
differences that made a difference among the alternatives. The 
estimates were not intended to represent the absolute Loss of Crew risk 
of any of the alternatives but rather to distinguish among them. In 
particular, estimates of the abort effectiveness of the various 
alternatives were based upon rough estimates of the post accident 
physics, and not on the more detailed first principles physics code 
results subsequently obtained for the Ares I vehicle as it has 
progressed through development.

Q8.  Having been on the ESAS effort, you have a unique perspective on 
what would be needed to replicate similar analyses of alternatives your 
team did not consider. If NASA was to be directed to perform a similar 
safety analysis on another alternative, what is the rough estimate of 
the cost and time it would take to perform the physics based analysis 
that was done for the recommended launch alternatives--those that 
resulted in Ares I and Ares V.

A8. First I have to correct two impressions that seem to be included in 
the question that are not precisely correct. The ESAS team considered 
many of the alternatives that have been subsequently suggested 
including the shuttle side-mount, and the EELV alternatives of the 
Atlas V and Delta IV families, we just did not consider them in the 
detail that we subsequently did for the selected Ares I alternative. 
Also, we did not, at least at the last of my involvement, consider the 
detailed physics analysis that we had performed on Ares I on the Ares V 
vehicle because subsequent to ESAS we were not considering it as a 
potential crew launcher.
    The performance of a similar analysis to another alternative would 
depend on how much of the work we have done so far could be used and 
how readily available finite element models of the alternative would 
be. The physics work would have to be done on a massively parallel 
computational system such as the Pleiades project at the NASA Advanced 
Supercomputing (NAS) Division at Ames. This Supercomputer is dedicated 
to the Exploration program so a cost is not available. We do know that 
it took 5 million hours of equivalent CPU time for the Ares I analysis. 
These estimates assume the availability of a basic understanding of the 
aerodynamics, trajectory information of any of the alternate vehicles, 
which are generated as a matter of course in the design process by the 
aero analysis teams at MSFC and ARC. That is, this information would 
have to be generated in order to perform a meaningful evaluation of 
abort effectiveness. NASA JSC has already completed some exploratory 
work on the side-mount. If this work not sufficient additional 
exploratory CFD would have to be performed whereas existing Orion abort 
trajectory/aerodynamic information for Ares I could be used to arrive 
at a first order approximation for other in-line concepts.
    The calendar time estimated for the side-mount would be 6 months if 
extra work were required and 4 months for each of the other concepts. 
The labor costs would vary depending on the concept, but a rough 
estimate of the cost would be between $250-350K per concept. However 
the actual cost would have to be negotiated between NASA Ames and its 
chosen contractor and work could be done in parallel if multiple 
concepts are to be considered.

Q9.  In your opinion, what would be required in practice to implement 
the Augustine Committee's suggestion that NASA exercise a strong 
oversight role in assuring commercial vehicle safety?

A9. To a degree this question has already been answered in the answer 
to question 5, but a summary of what would have to be done is mentioned 
here. Firstly NASA would have to appoint a team of people to sit down 
with the proposed commercial supplier and learn the launch vehicle from 
top to bottom. Then the team would have to develop an understanding of 
the relationship of the various systems and components implementing the 
various critical functions on the proposed launcher and that of the 
historical heritage of launchers. The NASA team would then have to 
develop a surrogate of the proposed launcher by relating its critical 
functional implementation and associated failure modes to the 
historical heritage data set. The former analysis would attempt to 
establish the mission reliability of the proposed launcher in a crew 
application. (Note: This would be different from the launcher mission 
reliability in a payload application due the integration impact of the 
crew module and support systems module and the launch abort systems and 
due to modifications of the launcher systems, such as the addition of 
red lines on the engines and abort triggers on the vehicle.) The latter 
would establish the post accident conditions that would need to be 
modeled using the first principles physics simulations to establish the 
abort effectiveness.
    Then, if the launcher is seen to have met the minimum conditions 
for consideration as a crew launcher, NASA would have to establish an 
on site inspection team at the facility of the manufacturer of all the 
major elements of the design. The contractor would be required to 
involve NASA in all the major tests performed on the vehicle and the 
associate launch abort system and crew module and its support systems 
module, review all anomalies and work with the contractor to close them 
out by design or manufacturing process changes. In short NASA would 
have to perform the same investigation it has had to perform on the 
Russian Soyuz, plus the additional manufacturing and process inspection 
that it has been unable to conduct on Soyuz in order to ensure that the 
launcher has been developed as an equivalent to a NASA developed 
vehicle.

Questions submitted by Representative Pete Olson

Q1.  Part of NASA's rationale for selecting a solid rocket motor for 
the first stage of the Ares 1 is that it is inherently a simpler design 
with few moving parts. But other U.S. systems using liquid propulsion 
have been highly reliable as well. Taking into account their entire 
lifecycle, can you comment on the overall safety records of solids vs. 
liquid rocket motors and whether this should be a factor in the overall 
architecture? If a proposed commercial crew system relies on liquid 
boosters, or a combination of liquid and solid, how does that affect 
the Loss of Crew calculations.

A1. There is no doubt that liquid propulsion systems, especially those 
that have been proposed prior to the Ares I, have been shown to be 
highly reliable. In fact the work performed prior to and during the 
ESAS study indicated that a single core liquid would be an equivalent 
approach with the Atlas V being slightly preferred to the Delta IV from 
a safety perspective. The problem was that the payload of these 
vehicles was so limited that it was considered unacceptable as a crew 
replacement for the shuttle for either the lunar or ISS mission. The 
only single core alternative that had the thrust. capable of carrying 
the required payload was the 2.5 million pound thrust shuttle solid, 
(now about 3.0 million pounds with the 5th segment added). To compete 
with this capability the heavy EELV alternatives versions had to be 
considered and it is the addition of the two strap-on liquid core 
boosters that made the alternatives significantly more risky than the 
single core solid. In addition to the simple multiplication of engines 
and propulsion systems, which have been shown historically to be launch 
vehicle risk drivers, there were the additional fuel load and the 
potential for thrust imbalance problems. In addition, for the Delta IV 
heavy, the only heavy currently in operation, has flame pit H2 burn-off 
problems at liftoff. All of these contribute to the post accident risk 
consequences. It is the combination of the increased mission risk of 
the triple core heavy lift launcher and the post accident abort 
environment that causes the EELV alternatives to be forecasted to have 
almost three times the launch risk of the Ares I as I mentioned in my 
testimony.
    So if a single core liquid booster would be able to lift the 
required six passenger Orion to the ISS, especially if it were the 
Atlas V, it would be a competitor to the Ares I, but we would have to 
fly at least two, and possibly three Atlas Vs to meet the payload 
requirement. Even though the Atlas V might expose the crew to an 
individual launch risk equal to that of the Ares I, the cumulative risk 
of multiple launches would again be significantly higher than a single 
Ares I launch even without considering the benign failure impact of the 
dominant solid booster failure modes. Therefore if crew safety is to be 
a significant discriminator among alternatives then it should be a 
factor in the overall architecture, and if it is the sine qua non as 
the Augustine report indicates then it should be the most critical 
factor.
    Strap-on boosters in general represent a more difficult environment 
for crew escape in event of a launch catastrophe because they increase 
the probability of involvement of greater amounts of fuel in the post 
accident environment. This is true for both liquid and solid tandem or 
barreled boosters. However since liquid engines can be monitored and 
shut-down and since a significant portion of a liquid booster risk is 
in benign shutdown the impact on Loss of Crew risk is not as severe as 
with solids. When solids are used as either strap-ons (either tandem or 
barreled) to the central core booster the predominant historical 
failure modes of the solid, case breach or soft-goods (as in the case 
of the Challenger accident) or nozzle burn through, interact with the 
liquid core if the hot gas jet impinges upon the core as in the case of 
Challenger and the Delta II and Titan 34D accidents. The probability of 
this occurring is higher with a barreled solid because of its closer 
proximity to other solids and the liquid core so the solid angle of 
impingement is greater. However with tandem boosters there is the 
additional problem of thrust imbalance. That is the imbalanced thrust 
from one side to the other of the stack can cause significant abnormal 
additional loads on the stack that can cause aerodynamic breakup even 
if the hot gas plume does not impinge on the central core. This is 
particularly a problem when the tandem solid boosters are large and 
represent a major portion of that boost thrust as is the case for the 
shuttle and the Titan 34D. In fact post flight analysis of the 
Challenger accident indicated that the thrust imbalance was such that 
aerodynamic breakup would have probably occurred without impingement.
    This post-accident interaction effect was known well before ESAS 
and was documented as part of the previous OSP investigations contained 
in the Bullman Report that I am unable to attach because of ITAR 
restrictions, but which has been supplied to the Subcommittee staff. In 
fact the Bullman participants were so aware of this fact that they 
recommended that solids not be used in a configuration of any future 
crewed vehicle. Specifically they recommended:
    R8.2-2  Unless the Program is able to generate new data that 
demonstrates that SRM explosions are ``abortable,'' the program should 
not plan to use ELV configurations with strap-on SRMs for crewed 
flights of the spacecraft. In addition to the stack explosion issue, 
the inability to terminate SRM thrust and its affects on separation 
profile must be assessed. Refer to the report reliability discussion 
for a quantitative discussion.
    Thus, in answer to the second part of the question, yes the post 
accident impact of strap-on boosters would be felt for all cases and 
this is one of the reasons why, independent of the increased risk of 
additional hardware, a single core booster, either solid or liquid, is 
to be preferred to any configuration that would use strap-ons. Now the 
degree to which the incorporation of strap on boosters impacts the Loss 
of Crew risk depends on the type of strap-on and the overall 
configuration. In general liquid strap-ons have less of an impact than 
solids, and configurations with the crew on top have less of an impact 
than side-mount configurations. This can be seen in the comparative 
analysis chart given in my testimony where the liquid strap on 
configurations are slightly less risky than the solids, and the in-line 
Ares V crewed configuration is less risky than the shuttle derived 
side-mount. This figure can be used to grossly estimate the relative 
risk of the various strap-on configurations and explains why any of 
them, solid or liquid, in line or side-mount, would be expected to be 
more risky than the single core solid Ares I configuration. However, to 
understand the specifics and absolute values of the relative risks of 
the various configurations would require detailed post accident 
physical simulations similar to those already performed on the Ares I 
configuration.

Questions submitted by Representative Dana Rohrabacher

Q1.  During the Q&A period, you seem to be explaining that in order to 
get the performance necessary to loft a crew capsule on an Atlas-class 
vehicle would require an Atlas 431 (or equivalent) with three strap-on 
boosters. Would you please explain the design and safety considerations 
associated with crew escape using existing or modified EELVs?

A1. The safest configurations, whether solid or liquid, are single core 
vehicles. This is not only because of the simpler design but also 
because of the limited fuel load and the elimination of potential 
interaction impacts subsequent to mission failure all of which increase 
the hazard potential of the post failure environment that the abort 
system must negotiate.
    So if a single core liquid booster would be able to lift the 
required six passenger payload to the ISS, especially if it were the 
Atlas V, it would be a competitor to the Ares I, but we would have to 
fly at least two, and possibly three Atlas Vs to meet the payload 
requirement. Even though the Atlas V might expose the crew to an 
individual launch risk equal to that of the Ares I, the cumulative risk 
of multiple launches would again be significantly higher than a single 
Ares I launch even without considering the benign failure impact of the 
dominant solid booster failure modes.
    Strap-on boosters in general represent a more difficult environment 
for crew escape in event of a launch catastrophe because they increase 
the probability of involvement of greater amounts of fuel in the post 
accident environment. This is true for both liquid and solid tandem or 
barreled boosters. However since liquid engines can be monitored and 
shut-down and since a significant portion of a liquid booster risk is 
in benign shutdown the impact on Loss of Crew risk is not as severe as 
with solids. When solids are used as either strap-ons (either tandem or 
barreled) to the central core booster the predominant historical 
failure modes of the solid, case breach or soft-goods (as in the case 
of the Challenger accident) or nozzle burn through, interact with the 
liquid core if the hot gas jet impinges upon the core as in the case of 
Challenger and the Delta II and Titan 34D accidents. The probability of 
this occurring is higher with a barreled solid because of its closer 
proximity to other solids and the liquid core so the solid angle of 
impingement is greater. However with tandem boosters there is the 
additional problem of thrust imbalance. That is the imbalanced thrust 
from one side to the other of the stack can cause significant abnormal 
additional loads on the stack that can cause aerodynamic breakup even 
if the hot gas plume does not impinge on the central core. This is 
particularly a problem when the tandem solid boosters are large and 
represent a major portion of that boost thrust as is the case for the 
shuttle and the Titan 34D. In fact post flight analysis of the 
Challenger accident indicated that the thrust imbalance was such that 
aerodynamic breakup would have probably occurred without impingement.
    This post-accident interaction effect was known well before ESAS 
and was documented as part of the previous OSP investigations contained 
in the Bullman Report that I am unable to attach because of ITAR 
restrictions, but which has been supplied to the Subcommittee staff. In 
fact the Bullman participants were so aware of this fact that they 
recommended that solids not be used in a configuration of any future 
crewed vehicle. Specifically they recommended:
    R8.2-2  Unless the Program is able to generate new data that 
demonstrates that SRM explosions are ``abortable,'' the program should 
not plan to use ELV configurations with strap-on SRMs for crewed 
flights of the spacecraft. In addition to the stack explosion issue, 
the inability to terminate SRM thrust and its affects on separation 
profile must be assessed. Refer to the report reliability discussion 
for a quantitative discussion.
    Thus, in answer to the second part of the question independent of 
the increased risk of additional hardware, a single core booster, 
either solid or liquid, is to be preferred to any configuration that 
would use strap-ons because it presents a less hazardous post mission 
failure escape environment. Now the degree to which the incorporation 
of strap on boosters impacts the Loss of Crew risk depends on the type 
of strap-on and the overall configuration. In general liquid strap-ons 
have less of an impact than solids, and configurations with the crew on 
top have less of an impact than side-mount configurations. This can be 
seen in the comparative analysis chart given in my testimony where the 
liquid strap-on configurations are slightly less risky than the solids, 
and the in-line Ares V crewed configuration is less risky than the 
shuttle derived side-mount. This figure can be used to grossly estimate 
the relative risk of the various strap-on configurations and explains 
why any of them, solid or liquid, in line or side-mount, would be 
expected to be more risky than the single core solid Ares I 
configuration. However, to understand the specifics and absolute values 
of the relative risks of the various configurations would require 
detailed post accident physical simulations similar to those already 
performed on the Ares I configuration.
                   Answers to Post-Hearing Questions
Responses by Lt. Gen. (Ret.) Thomas Stafford, United States Air Force

Questions submitted by Chairwoman Gabrielle Giffords

Q1.  As you know, the Augustine Committee projected that commercial 
crew transportation could be available by 2016. It does not appear that 
this projection reflected the time needed for all of the milestones 
that must be met prior to the point at which NASA would be able to use 
such services to fly its astronauts to the ISS such as the time needed 
to get Congressional authorization and appropriation of funds; 
agreement on human-rating and other safety standards and means for 
verifying compliance; development of a regime for certification; and 
contract competition, negotiation and award of contract(s), and 
potential protest(s) by losing bidder(s). There are no small tasks, and 
it is not obvious that any of them could be skipped if the government 
is to make use of those services.

          In your opinion, what are currently the largest 
        technical challenges or hurdles that potential commercial crew 
        transportation providers are facing that might cause delays to 
        their projected initial operating dates?

          How confident can the Congress be that a commercial 
        crew capability can be operational in 2016 while still having 
        to carry out all of the activities that need to be completed 
        before the first NASA astronaut can safely ride on an 
        operational vehicle to the International Space Station.

Q2.  What was the extent of the testing and analyses performed on the 
Gemini spacecraft and Titan launch vehicle before NASA was comfortable 
with system's safety? How ``simple'' was it to build safety into 
Gemini.

Q3.  I understand that training for off-nominal operations is an 
important facet of crew training. Astronauts are acquainted with how to 
identify these off-nominal operations and apply ways to respond to 
them. During your illustrious career in human space flight, how 
important was training for off-nominal operations to enhance safety? 
What level of training would need to be performed to fly NASA 
astronauts on commercial transportation systems?

Q4.  Do you have any concerns regarding the option of canceling Ares I 
to go to the ISS and relying on a new set of would-be commercial 
providers? Is there a risk of being in a situation where those emerging 
enterprises are deemed ``too important to fail'' and we end up having 
to support them at whatever cost and time it takes?

A1, A2, A3, A4. Chairwoman Giffords--With respect to your first 
question, I agree that the projections from the Augustine Committee did 
not reflect the time needed for milestones and issues that must be met 
for a certified rocket and a certified spacecraft before NASA 
astronauts would be launched to the International Space Station. As 
described in my testimony a human-rate launch vehicle and spacecraft 
must start from the first time drawings are put together. All of the 
issues you outlined can add a considerable length of time to the 
process. I have great confidence that to ``really certify human-rated 
spacecraft with a launch vehicle will not be ready any sooner by any 
proposed commercial vehicles than those by NASA.'' Ares I Orion would 
have flown in 2013, but funds were taken to fly the Space Shuttle and 
complete the ISS due to the OMB not allowing NASA to request the 
adequate funding. As I outlined in my testimony, I doubt that the 
President was aware of the gap that OMB was causing in the schedule by 
not allowing NASA to request adequate funding and would require our 
crews and international partner crews to pay to fly on Russian launch 
vehicles and spacecrafts. I agree that this is no small task and do not 
see any items skipped if the government uses a commercial provider.
    My opinion is that there are large technical challenges for 
potential commercial crew provided rockets and spacecrafts to meet the 
NASA Office of Safety and Mission Assurance requirements to meet 
initial operational dates. In response to your second point, as I 
expressed, due to experience in the Gemini and Apollo, I flew on three 
different types of vehicles and four different types of spacecraft and 
I do not feel that Congress can be confident that a commercial crew 
vehicle will be operational in 2016 and carry out all of the activities 
to be completed before a NASA crew is launched.
    With regard to your second question, NASA required 39 months of 
testing and analysis on the Titan II launch vehicle and similar time on 
the Gemini spacecraft prior to the first launch. The major Titan II 
components, tanks, and structures for the Gemini spacecraft were built 
at the Martin Denver plant then shipped to a separate controlled 
assembly line at Martin's Baltimore plant. Here modifications were made 
to the booster and a series of safety modifications, including the 
Emergency Detection System, were installed on the booster. Most people 
today do not realize that there was a completely separate assembly line 
for the Gemini Titan II launch vehicle. The first and second stage 
Aerojet engines powered the Titan and were built in Sacramento under 
the special quality conditions; then shipped with an escort to the 
Martin plant where they were installed on the vehicle. These escorts 
stayed with the engines all the way through to Launch Pad 19 until 
launch.
    With regard to your third question, to the four prime missions that 
I flew and three back-up crew missions that I was a member of, we 
literally spent hundreds of hours in the factory for each mission. We 
also spent hundreds of hours in the spacecraft processing, testing, and 
checkout before launch. For simulations we worked hundreds of hours and 
ran all of the nominal and off nominal operations and all emergency 
situations. Many of the simulations were integrated with the Mission 
Control Center. The level of training needed to fly astronauts on 
commercial transport systems should be no less than our previous 
experience.
    With regard to your fourth question, I do not have concerns that 
Ares I, which has been designed from every piece part up onward to meet 
the NASA Mission and Safety Assurance and human rated factors similar 
to what we did on the Apollo program. With commercial providers, I know 
that none will start from the beginning design of the launch vehicle 
for human rated requirements. As I pointed out, the Gemini Titan 
Program was a high risk demonstration program. We knew that certain 
areas of launch from the time of ignition throughout the launch profile 
and into orbit, would be hazardous if not fatal, if failure occurred.
    With respect to the latter part of your fourth question, ``Is there 
a risk of being in a situation where those emerging enterprises are 
deemed `too important to fail' and we end up having to support them at 
whatever cost and time it takes'', the answer is emphatically yes. Once 
the program starts and encounters major technical and cost difficulties 
it is very difficult to stop unless the program is cancelled.

Questions submitted by Representative Pete Olson

Q1.  In your testimony you spoke briefly about the relationship between 
the President, the OMB, and the Congress in setting and carrying out 
our space programs. Would you please elaborate on what you see as the 
strengths, weaknesses, and potential problems impacting our nation's 
ability to carry out effective space policies?

A1. Ranking Member Olson--In answer to your question in relation to the 
President, OMB, and Congress in a setting to carry out the US Space 
program, the political forces have been very visible in the last 18 
years vs. what is experienced from the start of the human space flight 
program. In the many times that I have testified in front of 
Congressional bodies (Senate and House), the most important issue I 
have emphasized is that we need is a long range strategic plan that the 
country can follow with only slight modifications. This fact was 
brought out vividly by the Columbia Accident Investigation Board.
    My first recommendation to the Augustine Committee was to 
reestablish the National Space Council since it was written into law 
with the efforts of Senate Majority Leader, Lyndon Johnson, in 1958. 
Under this law, the President can enact the council and it worked 
extremely well during the Mercury, Gemini, and Apollo programs. It was 
also effective for four years under President George W. H. Bush. 
Without a strategic oversight group such as the National Space Council, 
you will have second level tier individuals like those in the OMB who 
makes major acts on programs. For example, I am sure that the President 
did not recognize at the time that an individual in 2004 told NASA that 
they have 15 flights to finish the Space Shuttle project by 2008 and 
this was during the time that the Space Shuttle was still grounded 
after the Columbia accident, which would result in the US buying 
launches from the Russians for many years. This is the same second tier 
level individual, at the OMB, who arbitrarily set the date at 2015 for 
the termination of US funding of this great international multi-partner 
laboratory and spacecraft, the ISS.

Questions submitted by Representative Dana Rohrabacher

Q1.  There have been suggestions that a smaller, simpler vehicle 
designed just to access low Earth orbit and the International Space 
Station could be developed faster and less expensively than Orion. 
Furthermore, such a vehicle might be more easily lofted using either 
existing or modified EELV's. From your experience aboard the two-person 
Gemini spacecraft, do you see any reason why a smaller version of a 
capsule would be any simpler or less expensive to certify as human-
rated?

A1. Mr. Rohrabacher--To provide a safe launch of a spacecraft on a 
rocket booster to orbit a human crew is always a major disciplined 
task. Whether you go beyond LEO or not, the same discipline would have 
to be followed whether the spacecraft is to fly to the moon or Mars, or 
only operate in only LEO, would require the same discipline to achieve 
LEO and safely return. A larger more complex spacecraft naturally costs 
more than a smaller spacecraft. We do not need as extensive systems and 
fuel as for a Mars spacecraft would require as compared to LEO.
    My recommendation would be for the development of a crew module in 
a block series (i.e. Block I, II, III), LEO, Moon, or Mars mission. The 
smaller version would be only somewhat less expense to certify safety 
for a crew.

                                   
