NASA Johnson Space Center Oral History Project
Edited Oral History Transcript

Bryan D. O'Connor
Interviewed by Rebecca Wright
Houston, Texas – 28 December 2012

Wright: Today is December 28th, 2012. This oral history interview is being conducted with Bryan O’Connor in Houston, Texas. Interviewer is Rebecca Wright, assisted by Rebecca Hackler at the Johnson Space Center History Office. Mr. O’Connor is the former Chief of NASA’s Office of Safety and Mission Assurance and has served in a number of safety related roles for the space agency throughout the past 25 years. Although he retired from NASA in 2011, he currently serves as a member of the NASA Aerospace Safety Advisory Panel. He’s talking with us today about NASA’s involvement with commercial partners.

Thank you again for squeezing us in your busy schedule. If you can get your mind back around 2005, you had been the chief of safety for a couple years. It was a lot of change that year for NASA management structure. [Sean] O’Keefe left. Mike [Michael D.] Griffin comes in as [NASA] Administrator. [William H. “Bill”] Gerstenmaier had been made AA [Associate Administrator] for Space Ops [Operations Directorate], [Scott J.] Horowitz for Exploration [Systems Mission Directorate]. For Constellation [Program Manager], [Jeffrey M.] Hanley was named, and [Michael T.] Suffredini was [Manager of] ISS [International Space Station Program Office].

Then in October of that year, the Commercial Orbital Transportation Systems [COTS] Program Office was established here at JSC. They had plans to solicit proposals from industry for Earth-to-orbit spaceflight demonstrations. Then just a couple months after that there was the announcement for the Round 1 selection. Could you go back to that time period and tell us what your thoughts were and how you were involved with those issues?

O'Connor: When they first came up with COTS—and it was before the establishment of this program office it was designed to have four phases, A, B, C, D. The A, B, C versions of COTS I thought were reasonably aligned with the types of things that we had done before, and certainly consistent with the Space Act [Agreement (SAA)]. I thought it was a reasonable undertaking, the A, B, C COTS, because it was aligned with helping emerging spaceflight companies to develop Earth-to-orbit cargo transport capabilities.

There would be benefits to NASA in this, indirect benefits, because we were going to need something to eventually help with transportation of cargo. One of the things that had come out of the [Space Shuttle] Columbia [STS-107] accident was that we decided that in the future it would be a good idea if we flew the cargo on an unmanned vehicle and flew the crews on their own human rated systems. Then if we wanted them to go together somewhere outside of low-Earth orbit, ideally you could rendezvous those together and join them up once you got past the ascent. But then again, on entry you wouldn’t have the crew coming back with the cargo either. They would separate and come in as a crew module.

That concept is the kind of thing that we thought was meant by separating crew and cargo. COTS was a way of saying, “If we’re talking about low-Earth orbit, why should NASA continue to develop such a capability when it looks like from these studies by Futron and others that there could also be a commercial (as in non-government) need for cargo to low-Earth orbit? Why not let the commercial guys do that? Let’s help them out, let’s facilitate it. Let’s encourage it and support it, but let’s not develop it ourselves.” When I looked at COTS A, B, C with their Space Act Agreements, it was really all about facilitating commercial people to do something with investments rather than contracts; I saw the indirect benefit to us. But as the lawyers reminded us from day one, you’ve got to be careful with Space Act Agreements if they begin to look like you’re getting around the acquisition rules to get products or services on the cheap by avoiding contracts. That’s why people were careful when they talked about these things, most of the time. Sometimes they forgot about it, and they started talking about how COTS will procure some capability with lower cost. The lawyers would have to tug on them and say, “Let’s not say it that way. Indirect benefits to partnerships and all these kinds of less direct relationships will keep us out of trouble.”

I was okay with A through C, but [COTS] D threw me because COTS D was a demonstration of a human transport capability. I thought that’s where NASA probably ought to get more involved than simply facilitating with money and advice, because we were the only people actually doing that kind of mission in this country. Anybody else who wanted to do human spaceflight outside of NASA would have an awful lot on their plate. I had trouble figuring out how we would do that in the Space Act Agreement, which to me is like a grant. How would NASA do justice to safety in a grant environment where oversight is non-existent and where human safety is such a high risk factor?

Normally when NASA does grants it’s not for high safety risk things. Maybe for research, where people have to volunteer for some risky research things, but that falls under a very rigid regime that’s government regulated. It may involve some kind of aircraft flight or something. But again that’s regulated by the FAA [Federal Aviation Administration]. When people are doing relatively high risk things in a commercial environment under regulatory regimes that are well established and in place, like the FAA aircraft regs [regulations] and OSHA [Occupational Safety and Health Administration] and the medical community, that’s one thing. But here’s a case where not only is NASA the only ones who have really run human spaceflight development activities, we’re also in this unusual place since 2004 where there’s no FAA regime for human commercial spaceflight safety oversight.

Not only that, but they’re prohibited from putting such a regime out there. When I read the 2004 Commercial Space Act, which came out about the same time we’re talking about COTS, I was blown away by the obvious lack of interest in safety of the crew and participants. In fact I saw it as even worse than lack of interest, it was a prohibition against regulating safety, publishing rules, regs or even guidelines for crew and passenger safety.

COTS D looked to me like we were trying to encourage and facilitate commercial people, to take a lot of risk with their employees without any kind of top cover safety regulatory regime out there. Of course this sort of thing actually happened when Space Ship One [Mojave Aerospace Ventures] flew out in Mohave with test pilots. When they flew those several (purely commercial) test flights on Space Ship One, the FAA had the regulatory responsibility for those activities, but their scope was limited to public safety, people on the ground, the uninvolved public. When they went out to license those three-, four-minute high altitude zero-g flights, they laid down all the rules that would be appropriate to make sure that people on the ground were safe from this operation. Beyond that, they weren’t allowed to lay any rules down about the safety of the crew member.

Now as it turns out, when they put those rules in place to make sure that the public was safe, some of them actually indirectly protected the safety of the crew, because that vehicle was manually flown. The FAA did have rules that would protect the crew member from injury and health problems, but only because he was the key part of the range safety system. If you asked the FAA, “What sort of rules would you have put in place if he were carrying passengers?” they would have said, “That’s outside of our scope, because passengers would not be part of the range safety system.”

Burt [Elbert L.] Rutan and the designers had to design the thing to meet FAA’s requirement to keep the crew member alert and capable. But the FAA did not take a look at his egress system. If they had a crash landing on the runway can the crew member get out safely? That was outside the FAA’s scope. Of course the FAA is all over that on airliners. They make sure that the slides are going to work and people can get out in case of crash landings or landing in the water. But for human spaceflight, that was out of scope for them, outside their authority.

The 2004 Commercial Space Act amendment said that this prohibition against putting rules in place that protect the crew and passengers uniquely is in effect until 2012 or until there’s been an accident where that accident would take lives. Only then could they publish some occupant safety regs.

But since the Space Ship One test flights there haven’t been any commercial flights with people. The notion of this 2012 deadline was that after 2012 the FAA would then be authorized to publish regulations. When they wrote that law, they thought there’d be lots and lots of flying going on between then and 2012, and a lot of learning to go on in this regulation-free environment, where the companies would not be slowed down by having to design systems in compliance with a bunch of FAA regs, and therefore able to get their test flights out and learn a lot faster. It didn’t work out that way. There just haven’t been any flight tests, even without regulations. It’s just hard to do. It takes a while to get that kind of capability.

The FAA tells me, by the way, that they have no near term intention of publishing crew safety regulations, even after 2012. They believe that the spirit of the 2004 Act was to give a regulatory-free environment to these companies to allow them to be creative and to not be slowed down by a bunch of technical requirements they have to meet while they develop their systems.

With the 2004 Commercial Space Act in mind, and this idea of NASA having a hands-off grant process to facilitate commercial people developing human spaceflight systems, I thought NASA was in a dilemma, because legally, or maybe even just morally, COTS D looked to me like incentivizing people other than the government to go out and put their employees at a high risk with no downside for us, because in a Space Act environment we wouldn’t be responsible for safety of those flights. They’re not our contractors. They’re simply partners in whom we invest. If they want to take high risk, it’s up to them, not us.

At some point there around 2004, ’05 timeframe, I went to Mike Griffin and asked that the General Counsel would be there, as well as Bill Gerstenmaier. I think he was in place by then in his new job. The purpose of the meeting was to make sure that we were all in synch on this idea of human transport in the COTS environment and to decide whether there was as legal issue for us as far as the safety of the partner’s crew member or just a moral one or none.

When we were getting ready for that meeting, it occurred to me that this may be more than COTS D, because even in COTS C, the company may decide to demonstrate a cargo-carrying vehicle that is crewed. What would our obligation as NASA be in sponsoring with these SAAs a human-piloted cargo demonstration in COTS C or D?

Not long after though, the COTS C question went away, because none of the competitors who we selected for COTS C had any plans to fly people on the cargo missions. They were all going to be unmanned, so that became a moot point. But the COTS D question still remained.

When we had the meeting, the General Counsel, Mike [Michael C.] Wholley, said that he and his people had looked at this, and there was no legal issue with this, that NASA was not legally responsible for the lives of people who were at risk in a Space Act Agreement environment. Morally, he said, of course might be different, after all, the perception of the public would be that this was a NASA problem if somebody on a COTS development got hurt, but again, legally we’d probably be okay. The reason was it’s not a contract. It’s a partnership, and as long as it remained that way, and it was a voluntary thing on the other side by the partners, it was okay from a government liability point of view.

Now it was during that meeting—I don’t know if I mentioned this last time or not—that Mike Griffin pulled me aside and said something to the effect of let’s not worry about COTS D. He said that what we were trying to do here was to facilitate commercial cargo capability, and that’s a reasonable thing to do. He admitted that COTS D had thrown in on top of this the human safety thing. It was apparent to me there was some pressure on him from elsewhere to show COTS D in our plan, and to satisfy some external stakeholder’s desires. I don’t know whether it was the administration or Congress, but I know there was a pretty strong lobby of commercial human spaceflight advocates outside of NASA pushing for this sort of thing. Mike said we should keep it on the books. But then he said, “Don’t worry. COTS D will never happen.”

I said, “Okay, fine, we’ll just keep an eye on it and press on.” I guess at some point we may have to think harder about this, if it looks like COTS D stays on the books. But right now he’s telling me not to worry about it. We have a lot of other things to worry about. This shouldn’t be one of them.

I remember talking to Bill Gerstenmaier early on about all this equipment and samples, when it became apparent that the Shuttle was going to go out of commission before the Space Station. I guess that discussion was going on about that same time. The President [George W. Bush] had come out before that when Sean O’Keefe was still here and said that the Space Shuttle would fly till it completed the Space Station in 2010. The policy actually had both those things – complete the Space Station and a date. A bunch of us who had been around Space Shuttle and Space Station realized that this was a real policy shift, because the Space Station was designed and developed to be assembled and logistically serviced by the Space Shuttle, but the role of the Shuttle was not to be to transport crews. That was the Soyuz’s job. It’s been the Soyuz’s job for years (ever since the early 90s when the current Space Station design was approved).

A little side note. I still to this day hear people saying when the Shuttle went out we lost our ability to put people on the Station, and now we have to depend on the Russians. We’d been depending on the Russians for transport of people to the Space Station long before Shuttle went out. Shuttle’s job was to build it and to take pieces of cargo and science up and down, and the people transport has been the Soyuz’s job. I don’t quite agree with how some people talk about that.

But it is true that when Shuttle goes away we don’t have the ability in the United States to use a US crew transport. We have nothing to back up the Russians. That’s true. But I thought we had decided that quite a long time ago, not just recently.

When we decided that the Shuttle was going to be at the end of assembly rather than the end of Station, here’s another dilemma. How do we deal with the down mass? The Japanese have an up mass system, the HTV [H-II Transfer Vehicle]. The Europeans have the ATV [Automated Transfer Vehicle] for up mass. The Russians have the Progress [vehicle] for up mass. Soyuz isn’t really a cargo vehicle, but there’s a little bit of cargo that it takes up and down. But basically there’s no down mass capability after Shuttle. That means we won’t be able to bring down a bad CMG [Control Moment Gyroscope, attitude control device] or big LRUs [Line Replaceable Unit, modular component] that might fail, because all you can bring down after Shuttle is stuff that fits in the Soyuz, and that’s not much, especially when it’s full of people, which is its primary function.

What about all of the Human Research Program cargo, blood samples, urine samples, saliva samples, the experimental results from these life science experiments that are critical to getting us to Mars someday? A lot of that has to come down. We don’t actually do the analysis of those things on orbit. Did somebody forget to tell the President that when he decided we don’t need it [the Shuttle] beyond assembly? I don’t know. I don’t know all the details there, but obviously we’re going to need something if we really believe that that science on ISS is important.

The cargo up and cargo down was important, and when I talked to Gerstenmaier he thought this was really good that we facilitate commercial. There were a couple companies out there, Orbital [Sciences Corporation] and certainly SpaceX, that were just starting to talk about how they might be able to do something like this. Of course then that played out, and they became our contracted cargo vehicles of choice for the Space Station.

When Gerstenmaier thought about potential for future commercial human transport activities, he told me that he believed that the best way to do that would be allow these companies to get their feet wet with cargo, to get lots and lots of experience transporting cargo up and down, to develop these new rockets and get lots of experience and learning from the not so critical missions, and then they might be ready to develop crew modules and fly people.

That’s the way he looked at it, that COTS D to him was something that really should be downstream, after they’ve been able to get a lot of experience in the commercial cargo environment. Now at some point this whole term COTS went away. We phased out of it at the end of the COTS C demos. It had other names. I’ve heard four or five different ones now, CCiCap [Commercial Crew Integrated Capability] and Commercial Crew Program. The COTS program goes away at the end of COTS, a new program team phases in and has its own agreements with companies, mostly the same ones, to continue their development under a different program office oversight.

Unlike what Mr. Griffin told me, COTS D didn’t really go away, it just got a different name, and now it’s Commercial Crew. It’s really hard to ignore commercial crew development now, because it’s got legs on it, and we’ve put out requirements and talked a lot about how to acquire it. They’re not talking about waiting until companies get lots and lots of data from unmanned launches, but to actually develop a commercial crew vehicle and see if we could then certify it somehow with very little flight test

What made me a little nervous was that as we transitioned into this commercial cargo environment, the commercial cargo thing became what I think of as a low constraint, relatively easy ramp into flying NASA material to the Space Station, with none of the certification rigor that you see when we bring on a new rocket to fly satellites under the Launch Service Program, [LSP] in Florida. The decision was don’t do it with the LSP program. They have a contract, and a rigid certification which covers all aspects of the flight, because they’re all about making sure that we get satellites to orbit that work. They don’t want to drop them in the drink. Although they’re not human crewed—they don’t worry about entries—they certainly are some of the best experts in the agency on ascent and getting expensive payloads to orbit. But, we’re not going to use that approach.

What we’re going to do with commercial cargo is just stay hands off on ascent and entry. No rules, no regs, no NASA certification for that. The only thing NASA will certify is to make sure that when the cargo vehicle gets close to the Space Station, then we’ll oversee its ISS safety there, making sure it doesn’t pose a risk to ISS hardware or crew.

They’re going to look at all of the same proximity operations and docked operations as they would for any vehicle that goes up and latches on to the Space Station, but they won’t look at all at ascent and entry. Of course the FAA doesn’t look at ascent and entry either, other than its risk to public safety. The reliability of it as a cargo carrier is something that we’re hoping comes out okay, and we’re offering advice if they ask for it, but we’re not overseeing that development or operation.

As you’ve seen SpaceX has operated in that relatively hands off environment and delivered cargo to the Space Station, once on the COTS demo flight, and then on the first CRS [Commercial Resupply Services] contract.

Wright: Was the Safety Office and you, or one of your designates involved with those interface documents that were created to certify that the vehicle could go to the Station?

O'Connor: Yes. But the only thing that was in scope was the proximity and docked operations. The launch and the entry, the ascent, till you get close proximity—they call it the ellipsoid—was out of scope for our community. When the visiting vehicle is within that ellipsoid then it’s within NASA certification territory. That was all done per the book and just like we normally do, and the ISS Safety team was and is integrally involved in that.

Even though in the COTS environment there was no contract with SpaceX to do the demonstration—it was strictly a Space Act Agreement—because they said that during that demo they didn’t want to just go demonstrate a low-Earth orbit and a virtual rendezvous with some object and then come down, which would have satisfied our COTS C demo milestone. Going to the Space Station was not required in COTS C demos. But when the company asked to go to the Space Station as part of that demonstration, then we were able to certify against our regulations, our rules, and to sign off that yes you’re certified to get within our ellipsoid and join up and dock and depart.

I make that point because the legal guys reminded us that you cannot put requirements on people in these Space Act Agreements, because requirements and certification implies buying a service or a product, a delivery, something like that, and that’s not what we’re doing. That was a demo. But if they ask to go up to the Space Station and we say, “Yes, but we have to certify that you’re safe for our system and people.”

Wright: Were you part of the safety review panel?

O'Connor: Yeah, sure.

Wright: Could you share some of the discussion?

O'Connor: It was only for the initial cert [certification], and it was, as mentioned earlier, scope limited. Subsequent readiness reviews were not brought to headquarters, but rather they were conducted at JSC at the Center level, same as the other cargo vehicle missions. ISS has straightforward requirements. We’ve been through them before with ATV, HTV, Soyuz, lots of experience with that. It took the new companies a while to understand the requirements, but they eventually got to where everybody agreed with them. To the extent that there were waivers and some residual risk, it was very limited. They were able to meet the requirements by and large. Those where they couldn’t quite do it, the rationale was fine. Our SR&QA community was fine with it. Looked good. We certainly wondered about what happens if they plop it into the drink, but that was out of scope. We had no oversight of that, or if they burn up on entry.

What that does is it says okay, wait a minute. We have this very rigid regime of government accountability we’ve put in place for expensive high priority satellite launches (also called commercial launches). Then over here for ISS cargo, we have what most people thought was really expensive high priority stuff going up and down to the Space Station. Why is it that the science satellite launch guys in the Launch Service Program have to spend all this time, attention, money, put out contracts, certify, do all that in the interest of getting science payloads to orbit reliably, yet over here we have people that are hands off taking cargo to and from the Space Station?

That was another big meeting at NASA Headquarters [Washington, DC]. It came to the highest level. The question was, should we be flying these really expensive and important payloads to the Space Station with an uncertified launch vehicle? Isn’t that a policy shift for the agency?

What we agreed in the meeting was that we have not changed our policy. The ELV [Expendable Launch Vehicle] policy allows us to contract a company to fly a low priority payload, a low cost, low value, low stakes. Any number of things can cause a payload to be considered to be what they call Class D. Class D payloads are the kind of payloads that we fly on the low reliability sounding rockets out of [NASA] Wallops [Flight Facility, Wallops Island, Virginia]. They purchased these surplus Army rockets that they’ve made into sounding rockets that go up for their short 20-minute mission, and they take measurements in the high atmosphere or pictures of the Earth, etc. They don’t spend much money on the payloads, because when we have these low reliability rockets, we can’t afford to be sending expensive payloads up to gather science. The payloads by definition are what they call Class D low cost, high risk tolerance.

If we did have something really important and critical to the mission of the Space Station that needed to go up or down, we wouldn’t fly it on these uncertified vehicles. We would fly it on the International Partner systems, because that’s the only other capability we have. All of these systems are certified to standards NASA concurs in for reliability.

Now granted, NASA has not certified reliability of the launch vehicle for HTV and ATV. Why should NASA certify the US launch vehicles that go up and take payloads to and from the Station?”

NASA depended on the Japanese to certify their launch vehicle, and the European Space Agency to certify theirs for reliability. They put a lot of stock in those agencies doing the right thing. The right thing for them was to make sure those launch vehicles were capable of doing a really important mission. If for no other reason, just the grief they would catch in their own country if a Japanese launch vehicle is launching an HTV up to the Space Station with a lot of ISS payloads, and it goes in the drink, the prestige of Japan would be at stake for such a loss. The Japanese Space Agency has done a lot to make sure those vehicles are good vehicles.

Without NASA, there is no government agency making sure that SpaceX is going to be a reliable launch vehicle. FAA doesn’t oversee mission reliability. Public safety is the only scope they have. If NASA is not going to do it, that means that there’s no government oversight at all of this particular launch vehicle going to and from the Station ellipsoid. Again, when we officially declared those payloads Class D equivalent and we said that we would not fly Space Station-critical cargo to and from the Station on those vehicles, that got us out of that dilemma.

I think it raises other questions, like if all we’re doing is Class D equivalent logistics on Space Station, isn’t that [ISS Program] an awfully expensive program. Awfully expensive. We spend a few million on sounding rockets. We’re spending $2 billion a year on Space Station to do Class D science? Is that what this means? People don’t want to talk about that. When I would ask that next question, they just—please go away. This is hard enough as it is.

I say that in that way tongue in cheek to just show you that we’re hanging it out there. Now speaking personally, once the agency wrote down this is Class D equivalent, my concern about not certifying the launch vehicle to do the mission was pretty much allayed. I thought fine, this is good. In fact there’s some goodness in this in that it allows these companies to go basically with no NASA oversight. It’ll make them go quicker. Yeah, there may be an accident or two here and there. But they’re not going to be bogged down by NASA contract and certification process, and it’ll allow them maybe to get more flights out in a shorter period of time to learn from. Then with that in mind, they’ll get more experience. That’s good for the commercial people and it is a bit of goodness for NASA as well.

I don’t think it’s better than NASA certifying those vehicles, because that’s another way to get goodness in a launch vehicle. Taking the time to do it right has proven time and again to be the best way to develop these launch vehicles. We found that out the hard way in the ELV and the EELV [Evolved Expendable Launch Vehicle] world, that it’s best to get in there with the contractors and lay down the standards, and then certify that they met them, and get your overseers comfortable that these things are designed for reliability than to just hope that they are and save everybody a lot of money by not having oversight, because the accident rates are higher that second way. History says they’re going to be higher.

Wright: Did you feel that your confidence level was where it needed to be when SpaceX did their first demo to the Station?

O'Connor: No, not for a human launch. But it was OK for the cargo mission, and it was considering that it’s Class D payloads. But the reason I started with the word no is that that cannot be how we do human spaceflight. Of course, we cannot declare astronauts Class D payload. We will certify to our human rating standards the commercial human transport system.

Now as soon as you say that, the lawyers come in and say, “You can’t do that on a Space Act Agreement. You can’t put requirements on your partner in an investment. You just can’t do it, because now you’re buying a service or a product. The product is the cargo on orbit, or the people on orbit. If you’re buying those kind of things, you’re not in a partnership, a Space Act environment.”

Now somebody along the way has said that this Space Act Agreement approach is a really good deal. Look how little it has cost NASA to get that cargo demo up to the Space Station. Look how few bucks NASA had to pay for that SpaceX cargo delivery flight. Now the fact that most of the money that it took to develop that “commercial” capability was NASA money is glossed over a little bit. It may be a partnership, but, we’re paying most of the money.

The fact is though that the money we paid in COTS and CRS demo is quite a bit less than if we had contracted for a full development of that vehicle from day one. It’s been cheap. A lot of people think therefore that’s a good model for the future, as in commercial crew, let’s do that cheap thing again. Of course the commercial advocacy out there is pushing on that too. See how easy this was, if you government guys just get out of our way.

FAA got out of their way in 2004. They didn’t have regulatory speed bumps. Now NASA is out of their way, and paying a whole lot of money. Basically hands off. Here’s a bunch of money. We’re here if you need us. There’s this little cert thing for prox ops [proximity operations] we’ll deal with you on, but other than that have a ball. Wouldn’t that be a great model for human transport too? That’s where we’ve had several discussions and meetings, and we’ve decided we just can’t do that. It’s not going to work. All the rationale for doing these other things that way just doesn’t apply to human (or as some call it, “biological”) cargo.

So, for crew, we have decided, NASA has decided, that in order to certify these vehicles it needs to be in a contract environment. Now they tried to push that off as far as they could. On this last iteration of the Space Act Agreement regime, I had a dissenting vote when it came to the acquisition strategy meeting. Unfortunately, it didn’t get adjudicated until after I retired. I heard that after I left Charlie [Charles F. Bolden] decided to override my dissent and go ahead and continue the Space Act Agreement regime for Commercial Crew Development for the first phase of it when the contractors are munching on the NASA requirements and making sure that they’re okay and they understand them, and running their designs across it to see how they’re doing. I had argued for a contract, and in fact a cost type contract as opposed to fixed-price, because my experience told me that there’ll be a lot of issues that come up we don’t even know about yet. You need to have a contract to do development work so that you can formally issue requirements and you can formally start the certification process as early as you can.

There were a lot of people that thought I was way off base because they said that certification is what you do at the end. They argued for letting the partners go on a contract-free, hands-off environment as long as they can. Then when it’s time for NASA to ask, “can we fly on this thing?” then we would put a contract in place and certify it. I told them that that’s not my understanding of certification. My understanding of certification is that it has three Vs. The first V is validation. This validation means, “Are the requirements valid?” That’s done at an early stage called System Requirements Review [SRR]. SRR is part of your certification that says here are my requirements. You and I have signed up to them on the dotted line somewhere, and where we couldn’t agree we have put work in effect to come up with waivers, deviations, exceptions to those requirements. We have reworded the ones we didn’t agree on and gotten them to where we’re comfortable with them. We have tailored our requirements to your concept, because there’s no perfect set of requirements anywhere. There’s always going to be something about those requirements that just don’t work for that particular company or design concept.

When the NASA program folks said we don’t need a contract up front, or there’s no real risk up front, it’s pretty easy things to do up front, pretty straightforward, I disagreed. I wrote a paper on it and turned it in as part of my dissent. Part of my rationale was that we don’t have a set of requirements for human spaceflight that has made it past PDR [Preliminary Design Review] since 1972, because every other Earth-to-orbit transport system that we’ve tried to start developing since then, the NASP [National Aero Space Plane], the OSP [Orbital Space Plane], even a couple of shots at an escape vehicle that would do entry from the Station that would be an American one, ACRV [Assured Crew Return Vehicle], and then more recently the Constellation concept—none of those has survived past PDR.

You don’t really validate a set of requirements until you have run them through and designed, developed and flown something, allowing you to say, “That set of requirements, we all signed up up front on what we thought was the right requirements, but there were a lot of changes that came later because we weren’t as smart as we thought we were, and we learned some things in flight, so we had to change the requirements.”

The plan said that later on when the higher risk work comes, the other two Vs, why, maybe we’ll think about a contract then. I had big trouble with that. I told them I didn’t think that was a good idea, and that they’re just kicking the can downstream. But if there are problems with it, that’s what they’ll do. They won’t have the money and the time to really deal with these things up front like you should, because they decided not to do a good cost contract for the first part of this. But again I asked them, “Why did you do it that way? It’s just not the standard acquisition approach for high risk high stakes activities.”

The answer was we don’t have the money. We’re just not getting the money we need to do this the traditional way. Okay, I don’t think anybody is going to die because of this, because they’re going to kick it downstream. Your schedule may suffer. It could be a bow wave that you’re pushing out just so you can say you’ve gotten fast, quickly through the first part here. But if you’re kicking problems out further on, because you don’t have the money to pay for them, someday you’re going to have to fix those things. It’s harder to fix them later than earlier. Here we have this flight system that’s pretty much all designed. They haven’t had an SRR on it yet. The contractor says, the company, SpaceX, says, “Don’t worry. We know what your requirements are. We built this thing to comply with them. We think it’ll be fine.” But there’s nothing formal there, because we weren’t allowed to be formal, and had to limit our reviews to informal winks and nods (as the companies called them).

Wright: Before you left, I’ve found some testimony that you gave to a congressional committee that talked about a requirements document that was in process of being written, that you had hoped would be done by the end of 2010. Was that a completed document to formulate these guidelines?

O'Connor: Yes. It’s what we called the 1100 series of requirements. These are the Commercial Crew Program Office requirements documents, although they are not actual requirements until there’s a contract to put them on.

There’s been a lot of back-and-forth. There were a lot of people who are pretty proud of the requirements. They think they’re in pretty good shape. As a skeptic, my thought was, “Yeah, I bet they’re saying that now, but there will be a few things that are just going to hang everybody up. It’d be good to deal with those up front.” Some of the things I worry about is the safety factor of structures for human spaceflight is 1.4. It’s 1.25 for ELVs. Now some people argue and say, “They’re too conservative over there on the human side.” Yeah, that may be true. But there’s usually some reason behind almost every one of these requirements. They weren’t arbitrary. They wanted a little extra margin on the human side. The difference between a 1.25 and a 1.4 rocket could be that if the rocket loses control and it starts yawing into the wind, the wind will break it up, and wouldn’t it be nice if you had a little bit more time to escape the crew before it actually breaks up. That could be just one example of why some of the rules are different for the manned and the unmanned.

The second V is verify compliance with those requirements. This is where you’ve agreed on the requirements. Now you’re going to do your design, and you’re going to show the design to the overseer, the government certifier, which would be us. The certifier is going to say, “Show me the data from your ground tests or your analysis that says that you’re meeting this requirement that we laid on you.” They will show us the data and then we will agree (or not) and sign off on it (or not). Part of that gets done at the critical design review, because that’s about the time where you got 90 percent of your drawings complete, and you’re certifying to the government that the design is going to be okay. Then the rest of it is a bunch more testing that you do between CDR and when the design and flight certification happens at the end.

But that second V is about what happens in that part of the development – verifying compliance. Again, where there’s not compliance, is it okay? That part of the discussion is of great importance to me from Shuttle experience, because that’s where you talk about variances (like waivers). Variances are where you talk about residual risk. Residual risk is where almost all your discussions are held when you get up there close to the first flight. Nobody’s discussing the design that’s compliant at that point. They’re talking about the things that aren’t, and why is that okay, and what is the risk, does anybody know, do we really believe this risk analysis that says risk is in the yellow, maybe it’s in the red. Those are the discussions you have at the end. But that’s all part of that second V, verification of compliance.

Then the third V is another validation. This validation is in-flight validation. You’re validating that the system actually works in flight in a real environment, that’s flight test. That’s another big issue because right now the commercial crew guys are talking about maybe one test flight. I keep thinking, look, we can’t have our cake and eat it too. Gerstenmaier from day one when I first talked to him about this had it right. If you’re going to do a hands-off development where the government responsible for the safety of crew members decides they’re not going to get involved very much in the front part, and they’re going to do Space Act Agreements and fixed-price contracts where they just stand back and watch and hope and claim that all the risk is on the other guy rather than on us, at some point you can’t say that anymore, because we’re flying our people. When you do that, what are you going to base that okay to go fly on?

Here we are someday in 2018 or so if we’re lucky, the SpaceX guys are ready to fly the first test flight. Because they’re finally on a contract, even though the two crew members on that first test flight are SpaceX crew members, there’s still NASA accountability because they’re contractors. We, NASA, are accountable for our contractors’ safety and health on things that we pay them to do, just as if they were government employees. No difference at all. Same accountability.

Now part of that is just my understanding of that and my assumption about that. The lawyers could possibly say, “No, that’s wrong, there’s a little difference there.” Whatever. But I have always thought about our contractors as part of our accountability. After all, when a contractor gets hurt here at JSC inside our gate, it’s a NASA accident. We have a NASA accident investigation. We decide what it was the contractor did and we did and how to avoid this in the future. It goes on the books as a JSC NASA accident. Contractor injury.

That’s the model I’m thinking of when we talk about contractor test flight. Whether it’s all contractors or some mixed crew or even if it’s NASA astronauts flying the first test flight doesn’t matter. We’re going to be saying, “You guys go and fly on this new vehicle that hasn’t flown a human spaceflight yet so that we can get off of the Soyuz.” Which, by the way, by this time will have had something like 130 flights in a row without a failure, and will have very high demonstrated reliability. I know it’s a foreign machine, and there’s this big thing about Americans shouldn’t be flying our astronauts on Russian space vehicles. But is that a good enough reason why you would put people at risk on something that hasn’t been demonstrated yet at all? What are we going to think about that decision if it fails and we lose a crew?

We took people off the Soyuz, which was a certified system and highly reliable, and put them on this experimental flight system so that we could have an American launch vehicle. Now after the accident and the memorial services attended by the President, the Presidential Commission is going to come in and they’re going to ask us questions. “Why were you doing this? Tell us again why you were putting people at risk when you had a perfectly acceptable alternative here.”

“Well, because we don’t like the idea of putting Americans on Russian vehicles.” Then they’ll point to our space policy, which says that we’re doing partnerships and in the future our partnerships will not necessarily be NASA-led. We’ll fly to the Moon or to Mars or whatever, and we’ll just be one of the partners. Having the Russians or the Germans or somebody else in charge where they’re the lead and we’re the backup or we’re the lead, we’re not hung up on that anymore. It’s okay to put the partners in the critical path.

This is what we’re saying right now, with one exception. Transport to the Station, that’s got to be American. The idea of how we acquire this human spaceflight system is a big deal. Not only was I opposed to fixed-price contracts, which is what people said we’re going to be using on this system, when we finally get to contracts, but certainly I was opposed to Space Act Agreements any more than we needed to. The latest plan is that when they get through this CCiCap Space Act Agreement thing, there’s a $10 million fixed-price contract to do the first phase of certification work. There are three companies that are going to get these $10 million contracts. The idea behind these contracts is to do what I consider to be the first V, validating that the requirements are good. They still don’t have an SRR to formalize that. Why, I just don’t understand that. But they’ll have to have some way to have formal signatures by NASA on a set of requirements that says, “We’ve all agreed on these, and here they are.” Maybe they just don’t want to call it an SRR for some reason.

I didn’t like the idea of that first phase being fixed-price, but again, I wasn’t even around when that decision was made. What I thought was irrelevant. I know that there are some in NASA who felt the same way. My replacement, Terry [Terrence W.] Wilcutt was on the same wavelength, the Chief Engineer, same thing. Again, the program said that again, if there’s a problem in this first phase we can always kick it into the second phase where maybe we’ll have some other kind of contract mechanism.

Right now they’re talking about when they do the second phase, get through this first $10 million thing, fixed-price, that anything that’s too hard to do in a fixed-price environment they’ll pick up in the second phase. They’ll have another competition to see who wins the second phase. I think they’re going to go down to two companies then. In that phase, that’ll take them right up to flight test.

I’m a little concerned they may talk themselves again into another fixed-price contract for that. Then the question will be, “Where do you kick things then?” Into flight test? Is that where you put the problems? In the flight test phase? I don’t know. I don’t get that. But I told you about some meetings where we made some decisions and talked about some of these. There was a meeting in 2010 where we talked about this business of fixed-price versus cost contracts in the Office of the Deputy Administrator. She chaired the meeting, and told us that we had direction to go with fixed price from the White House, so there was no need to discuss.

Now personally I thought that was a little unusual, to get that sort of direction from the White House. As far as I was concerned though, that didn’t end it for me as far as the worrying about how to deal with risks. It’s still important for NASA to say, “Okay, if we have some constraints we’ve been given by the administration or by the Congress, and they cause residual risk, it’s up to us to make sure they know what we know about that risk. You’re having us do something that causes risk. We’re going to need some money to mitigate that. Or whatever.”

You don’t just blindly accept high risk designs or operations without honest assessment and analysis—because after an accident they will all say, “NASA said they could do this. They didn’t complain about it. I think you can’t just take something like that and say, “I guess we’re done with that issue.” It ended the meeting. It didn’t end the worry.

Up till the time I left I was saying that we really need to work on convincing people that cost contracting is the right way to do this, because that’s the way you deal with changes. That’s the way you accept the risk that’s rightfully yours. Nobody in government is supposed to be doing fixed-price contracts on things where it’s high stakes and high risk, and where your requirements are not well known. Those are the three things that all the schools will tell you. If you got fuzzy requirements—and by golly, if we don’t, nobody does—you got fuzzy requirements and it’s high stakes and high personal safety risk, that’s when it’s okay to do, and in fact encouraged to do cost type contracts. Because those are the contracts where you can make changes really quickly. They are consistent with the notion that the contractee, not the contractor, the government that’s putting out the contract, rightfully is obliged to accept the risk. The contractor does what they’re told to do and advises these guys that they’re taking risk, but the risk is really not on the contractor. It can’t be, if we’re accountable for crew safety.

Wright: Bryan, did the conversations change in any way after Constellation was canceled?

O'Connor: Yes. A lot of them did. When the Constellation was canceled, that’s when we knew for sure that we were either going to have to buy crew rides from the Soyuz or we were going to have to do commercial crew. Before Constellation was canceled, the idea was that transport to and from the ISS, i.e., the NASA mission of crew to orbit, was going to be done by Constellation. If there was a commercial crew facilitation activity going on, it wouldn’t have anything to do with Space Station. It would just be grants to people who someday want to fly people to and from space. We’ll give some money, we’ll give some advice. We’ll be encouraging. We’ll help them out. But we’re not going to do NASA missions with that new vehicle, because we have Constellation.

The idea there was that that—they called it a launch vehicle. Ares I was going to fly lots of flights, flying people to and from the Space Station with the crew capsule. That’s how we would really get a lot of test-flying going on that would be helpful later for the Ares V when it would fly the capsule modified with different crew size to and from the Moon and then Mars.

When Constellation went away, then we knew for sure we were going to have to discuss whether or not this commercial crew thing is just facilitating a pure commercial activity or actually buying a service for us. That second thing is what of course came out of that, because about the same time we were canceling Constellation, we were claiming that we cannot any longer depend on the Russians, or it’s not right to depend on the foreigners for transport, even though we’ve been doing it for 10 years, and didn’t think it was too bad. Now all of a sudden it’s bad.

I can tell you one thing I have determined from all this is that the commercial crew lobby is very powerful. Mr [Elon] Musk is very very persuasive, smart as a whip, of course very efficient and very creative guy. Just a genius. But also knowledgeable enough of how to work with the government to really get a bunch of people in the Beltway environment on his side.

I’m sure he was very much welcomed by the long-suffering commercial transport, commercial rocket people out there who for many many years had been complaining about how hard it is to make money and to do commercial launches of anything with those Boeing and Lockheed people out there taking up all the government contracts.

He has convinced the government to do pretty much a hands off thing; very little oversight to get a lot of money from the government to do missions that the Boeings and Lockheeds charge us a lot of money for. I think the end result may be the history books will look at this, and they’ll look at guys like me as a bunch of naysayers. But the real result will be that wow, spaceflight finally became cheap when these SpaceX guys were allowed to do design, development and ops without any oversight. That’s fine and good. I just hate the idea that we may lose somebody in the process, in our zeal to do this faster, better, cheaper thing.

Wright: We understand when the COTS program opened up that they had a person, or a component of safety. Was that any way connected with your office? Were you getting reports of safety on how they were developing and laying out their plan to do the work?

O'Connor: Not really. There was one guy down at JSC who was accountable to the Johnson Space Center Director through his Safety Directorate. They’re the ones that had the oversight of that program, not Headquarters, because it was a JSC program.

His name was Mark Erminger. Now I occasionally would communicate with Mark, and he and I knew each other for years. He would let me know what was going on. Sometimes I would ask him, “What do you know about this? I’m hearing that such and such happened on a test or something. What are you hearing?” He would send me the SpaceX press release. I said, “Hell, I could have got that.”

He says, “Yeah but they don’t tell us much, and we’re not in their knickers. It’s really a laid-back sort of oversight. We’re trying not to get in their way.” So, yeah I can say there was a safety guy there, but he really wasn’t anything like what we do with our contracts and our normal development programs.

Wright: Do you think your involvement with the Aerospace Safety [Advisory] Panel [ASAP] will have any influence on further development of the crew?

O'Connor: I was encouraged when I came onto the Aerospace Safety Advisory Panel because several of the people on there had the same kind of concerns I did. But they were so far behind in timing. The ASAP wasn’t really plugged in that well, because they’re a FACA [Federal Advisory Committee Act] committee. The idea at NASA is that you don’t tell FACA committees anything that’s not public, because their work is all public. If we’re doing predecisional discussions, and a decision has not yet been made by the Administrator.

Now think about that. Sometimes a discussion happens here, and then it works to this level, and then this level, and this level. It’s over a year. That whole time, that whole discussion is predecisional. It’s not public until the very end of that time. Then it becomes public. Then you go tell the ASAP, “Here’s what we decided.” The ASAP’s job, by its congressional charter, is to advise the agency on its program plans and operations. When the ASAP hears about something after it’s been discussed within the agency for a year and then decided and signed off on by agency leadership, and then the ASAP comes in and says that was a dumb idea, is that really advice? It’s not. ASAP has been working this way for many years. I think it’s worthless when we operate that way.

That’s why Vice Admiral Joe [Joseph W.] Dyer, chairman of the ASAP, has been working real hard with the agency—to try to get the agency to plug us in early on predecisional matters in ways that are considered to be working discussions and therefore not necessarily public. Too many in NASA think about this public thing too strictly. The ASAP does have the ability to receive briefings that are predecisional. As long as they don’t make them public and treat them accordingly it’s okay for them to do that. They just can’t take that information and put it in their public records. It has to be treated as data gathering.

I think the agency is coming around now. They’re actually asking for advice when they’re thinking about things now. Then the ASAP can give them their thoughts on various matters. But the lawyers tell us that you can’t use the word advice unless you’re in the FACA environment because that’s what ASAP is, a FACA thing. The word advisory has a legal meaning, which is tied to public material. You can give your thoughts or your comments or questions. You can give everything except advice when you go to these working meetings. It’s a strange environment. That’s why I don’t get these advisory councils. What kind of advice is that?

Wright: I don’t know.

O'Connor: We think you guys decided wrong. Is that advice? How much use is that? That’s another bugaboo.

Wright: During your retirement you’ve been doing some contracting work. You’ve been able to apply some of those lessons learned with these commercial agencies?

O'Connor: Yes, a little bit. Well, I’ve had one get-together with Orbital where they asked me to just come in and take a look at what they were doing about their Glory [satellite] and OCO [Orbiting Carbon Observatory] failures. Remember, they put those two satellites in the water in a two-year period of time. Turned out it was probably the same cause. They were really frustrated and so was NASA. In each case, the payload fairing didn’t open, so the satellite was too heavy and it went in the drink. Several hundred million dollars’ worth of important science down the tubes.

The Orbital guys asked me shortly after I retired, “Would you mind coming and looking at what our mishap investigation came up with, and then what our return to flight plan looks like, to see if you think we’re missing anything?”

It’s the kind of thing somebody like me has done before. It’s fresh eyes, I come in from the outside. But I’ve told all these folks that I really can’t do any consulting, because several have asked me to consult on human spaceflight. I said, “If you guys are working with the commercial crew NASA activities or with any NASA human spaceflight things like the SLS [Space Launch System] and the MPCV [Multi-Purpose Crew Vehicle] programs, I’m not going to work for you on those, because I think that would be a conflict with my ASAP job, because that’s almost all we look at in ASAP.

I keep my consulting to things not human spaceflight. Then if the ASAP ever wants to go and talk to somebody about something that I’m consulting on, I simply recuse myself. I don’t mind recusing myself from something like that.

Wright: That sounds good. We thank you for squeezing us in.

O'Connor: Thanks for your interest.

Wright: We certainly learned a lot. We appreciate you being here. Thanks, Bryan.

[End of interview]