You never want to get so comfortable when you’re training that you think, “Ho hum, here we go again, playing ‘astronaut in peril.’ ” For a sim to work, you really have to buy into it. Fidelity helps: we train to fight fires on the ISS, for instance, in a full-scale simulator that is pumped full of real smoke—so full that, in one sim our crew did in the service module shortly before my last flight, we couldn’t see our own feet by the time we managed to get our gas masks on. As commander, I decided, “The smoke is too thick, let’s close the hatches and regroup in another module to figure out how to work the problem.” This led to a rather spirited debrief afterward with the Russian team running the exercise. I’d responded perfectly by American standards—NASA trains us to close off the burning segment, save the crew, then figure out how to fight the fire—but the Russian philosophy is different. They want us to stand and fight the fire. Their reasoning is that the rescue vehicle, the Soyuz, is docked at one end of that service module. As I explained to the trainers afterward, we would’ve been delighted to stop and fight, only, the sim was a little too realistic. I had to respond the way I would in real life: in a terrible fire, with such thick smoke, I’d opt to go with NASA’s procedures and save the crew, not the lab—after all, we’d still have food, water and communications capability even if we lost the service module. A sim, on Earth, is the right place to expose these kinds of philosophical disconnects and resolve them. Next time we did this sim, the Russians compromised: they filled the service module with a level of smoke that we all agreed made it possible and sensible to stand and fight.
The notion that a fire might break out while we were on the ISS was not hypothetical: in 1997, two years after I visited, an oxygen-generating canister did start a fire on Mir. The crew worked the problem, throwing wet towels on the canister until they extinguished the flame; their spacecraft was smoke-filled and they didn’t have enough masks left afterward, but everyone survived. That incident reminded everyone that there’s a good reason we train for disaster. Space exploration is inherently dangerous. If my focus ever wavers in the classroom or during an eight-hour simulation, I remind myself of one simple fact: space flight might kill me.
To drive that message home, we have what we euphemistically refer to as “contingency sims”—death sims, actually—which force us to think through our own demise in granular detail: not only how we’d die, but what would happen afterward to our families, colleagues and the space program itself. These are table-top sims, primarily for the benefit of management, so they don’t occur in an actual simulator but in a boardroom with people participating via speakerphone if necessary. Everyone who in real life would be involved in dealing with an astronaut’s death takes part: doctors, space program administrators, media relations people—even the dead astronaut.
A death sim starts with a scenario—“Chris is seriously injured on orbit,” say—and over the next few hours, people work through their own roles and responses. Every five to ten minutes whoever is running the exercise tosses what we call a “green card” into the mix: in essence, a new wrinkle. The cards are devised by the training team, whose job it is to conjure up as many realistic twists and turns as possible; no one else in the sim knows in advance what is on the cards, and we respond as though these things are actually happening. One green card might be, “We’ve just received word from the Station: Chris is dead.” Immediately, people start working the problem. Okay, what are we going to do with his corpse? There are no body bags on Station, so should we shove it in a spacesuit and stick it in a locker? But what about the smell? Should we send it back to Earth on a resupply ship and let it burn up with the rest of the garbage on re-entry? Jettison it during a spacewalk and let it float away into space?
While people are discussing how quickly my body would start to decompose and what kind of help my crewmates might need to deal with the trauma, they are hit with another green card: “Someone has just tweeted that there’s been an accident on the ISS, and a New York Times reporter is calling to find out what’s going on.” New problems, while the old ones are still being dealt with: How should the PR people respond? Should NASA or the CSA take the lead? When will a statement be issued and what should it say? The green cards start coming faster and faster, posing new problems, just as would happen in real life: Who should tell my parents their son is dead? By phone or in person? Where will they even be—at the farm or at the cottage? Do we need two plans, then, depending on where my mom and dad are?
As is probably clear by now, death sims are not weepy, griefstricken affairs. They’re all about brass tacks. Although family members aren’t required to participate, Helene has joined in several times because she has discovered that taking the time to verbalize what you think you would do in the worst-case scenario quickly reveals whether you’re really prepared or not. During a contingency sim before Expedition 34/35, for instance, she realized that her plan to trek in the Himalayas while I was in space for five months was wonderful—unless something went seriously wrong during my mission. The green cards in the sim forced us to figure out who would contact our kids if I died (quite possibly a reporter, we realized, if their mother was on a mountaintop) and how quickly Helene could get to Houston to be with them (not very, considering how many connecting flights she’d need to take). We had to think about the minutiae that would become highly relevant if I died on the ISS: cell reception in remote hill towns in Asia, for instance, and how the difference in time zones would affect her ability to get in touch with key decision-makers in Houston. The upshot of all this was that Helene decided to save the Himalayas for another year and hike in Utah instead. In fact, everyone who participated in the sim discovered weaknesses in their own planning and went back to the drawing board on a few items. (Except me, but that’s what happens when you’re dead.)
Sometimes a sim is a proving ground where you demonstrate how well-rounded your capabilities are, but more often, it’s a crucible where you identify gaps in your knowledge and encounter domino effects that simply never occurred to you before. When I first started training with Roman Romanenko, my crewmate on that last mission and the commander of our Soyuz, we did a re-entry sim together in the simulator in Star City. Roman had actually flown in a Soyuz before and I had not, so my main goal was just to help out where I could. At one point, I noticed that the oxygen tank inside our capsule was leaking a little bit. It didn’t seem like a big deal. We had multiple tanks and the leak was tiny. We kept concentrating on the complex tasks associated with re-entry, but then it hit me: that tank is leaking into a really small capsule, which means the oxygen level is rising to the point where everything may become flammable, so now we may have to depressurize the cabin to avoid a fire—but if we do, we may not have enough oxygen to get home.
A normal, gradual re-entry was out of the question. It didn’t matter if we were anywhere near Kazakhstan. We had to turn that spaceship around and drop to Earth, immediately, or we’d die. But I didn’t know the fastest way to turn the Soyuz around and Roman was already knee-deep in another procedure, so we missed the very narrow window when we still had a chance to save ourselves. What had initially seemed like a subtle failure—a tiny leak in an oxygen tank—wound up killing us.
Roman and I hadn’t really understood the operational impact of a leaking tank, but we sure did after that sim, and in subsequent training, we came up with a much better response. A sim is an opportunity to practice but frequently it’s also a wake-up call: we really don’t know exactly what we’re doing and we’d better figure it out before we’re facing this situation in space.
While play-acting grim scenarios day in and day out may sound like a good recipe for clinical depression, it’s actually weirdly uplifting. Rehearsing for catastrophe has made me positive that I have the problem-solving skills to deal with tough situations and come out the other side smiling. For me, this has greatly reduced the mental and emotional clutter that unchecked worrying produces, those random thoughts that hijack your brain at three o’clock in
the morning. While I very much hoped not to die in space, I didn’t live in fear of it, largely because I’d been made to think through the practicalities: how I’d want my family to get the news, for instance, and which astronaut I should recruit to help my wife cut through the red tape at NASA and the CSA. Before my last space flight (as with each of the earlier ones) I reviewed my will, made sure my financial affairs and taxes were in order, and did all the other things you’d do if you knew you were going to die. But that didn’t make me feel like I had one foot in the grave. It actually put my mind at ease and reduced my anxiety about what my family’s future would look like if something happened to me. Which meant that when the engines lit up at launch, I was able to focus entirely on the task at hand: arriving alive.
Although simulating a catastrophe does get you accustomed to the idea that it could happen, you’re never inured to the point of indifference. I doubt I will ever be able to forget the morning of February 1, 2003. I’d flown back to Houston from Russia the night before, and forgot to turn my phone back on until Helene and I were driving to brunch in the morning. As soon as I did, I saw I had a massive number of messages; she checked her phone, and so did she. We didn’t have to listen to them to know something terrible had happened. Our friends on Columbia were coming home that day. We turned the car around and drove back to the house with an awful, awful feeling, like all the air had gone out of everything.
I turned on the TV and immediately there it was, a replay of Columbia’s disintegration in the skies not all that far from our home. My eyes filled with tears even before I’d really processed the information, and Helene crumpled to her knees, weeping. The sudden, irretrievable loss was devastating. We knew all seven astronauts on that Shuttle. We’d shared the same dream. We cared about their spouses and children. The commander of that mission, Rick Husband, was my classmate at test pilot school; we’d sung together and worked on a research project together. Rick had signed on to help out my family at one of my launches, and wound up cheerfully driving to Orlando when my parents got stranded there and bringing them back to Cape Canaveral. Great guy, close friend. I mourned, and still mourn, his death and the deaths of our six other friends on that flight.
I also felt a huge sense of disappointment and responsibility: I was part of a program that had let this happen. When I got to the office an hour or so later, they were already mounting teams to go help pick up the pieces of our colleagues and their spaceship, which had been scattered across the state because of the way the Shuttle broke apart. I helped out at JSC and did what I could for Rick’s family. But there wasn’t much anyone could do. Highly talented, hard-working, genuinely nice people had been killed doing their jobs, through no fault of their own. It was a terrible, needless waste.
Yet I never considered leaving NASA, nor was it ever a topic of discussion with my family. I hadn’t been assigned to another Shuttle flight and didn’t think I ever would be, so there was no threat to my own safety. My job was to help others fly safely, and the Columbia disaster only strengthened my sense of purpose. We had to persuade the world all over again that the Shuttle was safe to fly and that the work the crew had been doing was vitally important and should be continued. Like most people at NASA, I felt that accomplishing those two things was the best way to honor Columbia’s crew, and I’m sure it’s what they would have wanted. I’ve never known an astronaut who doesn’t believe that the work we do is far more important than we are as individuals.
I’m extremely proud to have been part of the effort to figure out how to identify, prevent and mitigate risks so the Shuttle could fly again without harming one more person. There were three things we had to do: one, decrease the chances of damage during ascent; two, figure out a better way to recognize, while the Shuttle was still in space, whether there had been any damage; three, come up with ways to repair damage on orbit. Shortly after Columbia, I became Chief of Robotics at the NASA Astronaut Office, responsible for developing space robotics techniques and hardware and making sure astronauts and cosmonauts knew how to use them, so I was very involved in helping figure out solutions to the last two challenges. Actually, every single person in our organization got behind the effort, despite the fact that morale was low and public support for the space program was even lower.
We were entirely successful. We changed how we attached and inspected foam; we devised a way to survey the vehicle once it was on orbit (we repurposed some unused Canadarm hardware to build a kind of boom for the Shuttle, then mounted a camera on it so we could survey all the most fragile parts of the spaceship); we figured out how to use a special type of glue during an EVA to fix any damage—and we always had a rescue Shuttle standing by in case the first one got in trouble. The Shuttle became a much safer vehicle and we never lost another crew member. I never had another opportunity to fly on one, but I would’ve done so in a heartbeat.
The reason is not that I have a death wish. I’m not even a thrill-seeker. Few astronauts are. Strapping yourself on top of what is essentially a large bomb is plenty risky—there’s no need to up the ante. I’ve never been interested in the just-for-the-hell-of-it rush of, say, bungee jumping. If you’re an adrenaline junkie, I understand why you’d find that exciting. But I’m not, and I don’t.
To me, the only good reason to take a risk is that there’s a decent possibility of a reward that outweighs the hazard. Exploring the edge of the universe and pushing the boundaries of human knowledge and capability strike me as pretty significant rewards, so I accept the risks of being an astronaut, but with an abundance of caution: I want to understand them, manage them and reduce them as much as possible.
It’s almost comical that astronauts are stereotyped as daredevils and cowboys. As a rule, we’re highly methodical and detail-oriented. Our passion isn’t for thrills but for the grindstone, and pressing our noses to it. We have to: we’re responsible for equipment that has cost taxpayers many millions of dollars, and the best insurance policy we have on our lives is our own dedication to training. Studying, simulating, practicing until responses become automatic—astronauts don’t do all this only to fulfill NASA’s requirements. Training is something we do to reduce the odds that we’ll die. Sometimes, as with Challenger and Columbia, a vehicle fails and there’s absolutely nothing the crew can do. But sometimes there is. Astronauts have survived fires on the launch pad and in space, ballistic landings where the Soyuz has come back through the atmosphere like a rock hurled from space—even a collision that punctured a spacecraft and caused sudden depressurization. In a real crisis like that, a group hug isn’t going to save you. Your only hope is knowing exactly what to do and being able to do it calmly and quickly.
My kids used to make fun of me for having more homework than they did and for taking it a lot more seriously, too. But when the risks are real, you can’t wing it. The person that homework should matter to most of all is me. Having safety procedures down cold might save my life someday, and would definitely help me avoid making dumb mistakes that actually increased the risks. No matter how bad a situation is, you can always make it worse. Let’s say the Soyuz engines start failing going into deorbit burn, so I shut them off, but then can’t start them again—well, I just took a big problem and made it huge.
Preparation is not only about managing external risks, but about limiting the likelihood that you’ll unwittingly add to them. When you’re the author of your own fate, you don’t want to write a tragedy. Aside from anything else, the possibility of a sequel is nonexistent.
A few years ago our band was playing a gig in Houston when a woman came up to the stage and asked, “Do you know ‘Proud Mary’? I’ll sing it.” She carried herself with supreme confidence and even looked a bit like Tina Turner, so we said, “Sure!” She came on the stage, grabbed the mic with authority, we started playing the song—and she didn’t start singing. I thought, “Oh, she just doesn’t know where to come in,” so I helped her with the first verse. But, it quickly became apparent, the only words she actually knew w
ere “Rolling on the river.” She’d belt those out at the appropriate moments and then kind of hum her way through the rest of the lyrics. Clearly, she’d assumed that as soon as she had a microphone in her hand, she’d magically turn into Tina Turner. Perhaps even more foolishly, we’d just assumed that she was prepared. That was a big assumption given the North American subculture of pretense, where watching Top Chef is the same thing as knowing how to cook.
When the stakes are high, preparation is everything. In my day job, the stakes are highest during dynamic operations, when variables change rapidly, triggering chain reactions that unfold in a hurry. Now, this isn’t always the case in space. Sometimes you have a fair amount of time to deal with a problem, even a serious one. The ISS, for instance, drifts around the world like a miniature moon, with no engines firing, and would continue to do so even after a complete electrical failure. Everything could fizzle out, reducing the Station to a lifeless hulk, but we’d be fine for days—enough time to attempt quite a few different repairs and then, if nothing worked, bail out and head back to Earth in our Soyuz. If, however, a small meteorite smacked into the side of the Station—suddenly, you’re into dynamic ops. Now there’s a timeline, every second counts, and you’d better do things in the correct sequence or you’re going to die.
The most dynamic operations occur during launch and deorbit burn, when engines are firing, so we simulate contingencies and malfunctions during those two phases of space flight hundreds if not thousands of times. If the engine malfunctions during deorbit burn in the Soyuz, for instance, you know you’re not going to re-enter the atmosphere the way you wanted. Maybe you won’t land where rescue vehicles are waiting to meet you. Maybe instead of pulling 4 g, or four times the force of gravity on Earth, it will be more like 8 or 9 g, which is not just extremely uncomfortable but also more dangerous; plus, you’ll need extra strength, given the physical pressure on your body, simply to reach up and flip the switches that control the vehicle. Or maybe the rocket won’t be set up right and you’ll skip off the atmosphere, like a stone across a pond, and then not have enough fuel left to attempt the deorbit burn later. Or maybe the Soyuz will simply break into pieces and burn up in the atmosphere.