In this excerpt from An Astronaut’s Guide to Life on Earth, astronaut Chris Hadfield writes about waking up in space to the sound of a fire alarm, and simulating his own death with “contingency sims.”
In addition to his illustrious career as an astronaut, Chris is well known as the astronaut who sang David Bowie’s “Space Oddity” aboard the ISS in an endearing viral video.
Read part one of our excerpt here.
An Astronaut’s Guide to Life on Earth (Book Excerpt: Part 2)
Feeling ready to do something doesn’t mean feeling certain you’ll succeed, though of course that’s what you’re hoping to do. Truly being ready means understanding what could go wrong – and having a plan to deal with it. You could learn to scuba dive in a resort pool, for instance, and go on to have a wonderful first dive in the ocean even if you had no clue how to buddy breathe or what to do if you lost a flipper. But if conditions were less than ideal, you could find yourself in serious danger. In the ocean, things can go wrong in one breath, and the stakes are life and death. That’s why in order to get a scuba license you have to do a bunch of practice dives and learn how to deal with a whole set of problems and emergencies so that you’re really ready, not just ready in calm seas.
For the same sort of reasons, trainers in the space program specialize in devising bad-news scenarios for us to act out, over and over again, in increasingly elaborate simulations. We practice what we’ll do if there’s engine trouble, a computer meltdown, an explosion. Being forced to confront the prospect of failure head-on – to study it, dissect it, tear apart all its components and consequences – really works. After a few years of doing that pretty much daily, you’ve forged the strongest possible armor to defend against fear: hard-won competence.
Our training pushes us to develop a new set of instincts. Instead of reacting to danger with a fight-or-flight adrenaline rush, we’re trained to respond unemotionally by immediately prioritizing threats and methodically seeking to defuse them. We go from wanting to bolt for the exit to wanting to engage and understand what’s going wrong, then fix it.
Early on during my last stay on the ISS, I was jolted to consciousness in the middle of the night: a loud horn was blaring. For a couple of seconds I was in a fog, trying to figure out what that unpleasant noise was. There were four of us in the American section of the Station then, and like prairie dogs, we all poked our heads up out of our sleep pods at the same time to look at the panel of emergency lights on the wall that tell us whether we should be concerned about depressurization, toxicity or some other potential fatal disaster. Suddenly all of us were wide awake. That deafening noise was the fire alarm.
A fire is one of the most dangerous things that can happen in a spaceship because there’s nowhere to go; also, flames behave less predictably in weightlessness and are harder to extinguish. In my first year as an astronaut, I think my response to hearing the alarm would have been to grab an extinguisher and start fighting for my life, but over the past 21 years that instinct has been trained in, represented by three words: warn, gather, work.
“Working the problem” is NASA-speak for descending one decision tree after another, methodically looking for a solution until you run out of oxygen. We practice the “warn, gather, work” protocol for responding to fire alarms so frequently that it doesn’t just become second nature; it actually supplants our natural instincts. So when we heard the alarm on the Station, instead of rushing to don masks and arm ourselves with extinguishers, one astronaut calmly got on the intercom to warn that a fire alarm was going off – maybe the Russians couldn’t hear it in their module – while another went to the computer to see which smoke detector was going off. No one was moving in a leisurely fashion, but the response was one of focused curiosity; as though we were dealing with an abstract puzzle rather than an imminent threat to our survival. To an observer it might have looked a little bizarre, actually: no agitation, no barked commands, no haste.
The next step is the gather, so we joined the Russians in their part of the Station to start working on the problem. How serious was the threat? So far, all the signs were reassuring. We couldn’t smell smoke of see flames. Maybe one little wire had melted somewhere, or the detector was responding to dust. We talked to Mission Control in Houston and in Moscow, but as we investigated, checking the module where the detector had been triggered, it seemed more and more likely that we were dealing with a simple malfunction. Finally, everyone agreed that it had been a false alarm, and we headed back to our sleep stations. An hour later, when the fire alarm sounded again, we repeated the warn, gather, work protocol just as before. The response was similarly calm, though not perfunctory – possibly something had been slowly smoldering for the past hour. As it turned out, nothing had. The detector was a lemon, that’s all. I remember thinking, “That was a little like a sim, only better, because now I get to sleep.”
I doubt anyone’s heart rate increased by more than a beat or two while we were dealing with those fire alarms, even during the first minutes when the threat of a raging inferno seemed most real. We felt competent to deal with whatever happened – a sense of confidence that comes directly from solid preparation. Nothing boosts confidence quite like simulating a disaster, engaging with it fully, both physically and intellectually, and realizing you have the ability to work the problem. Each time you manage to do that your comfort zone expands a little, so if you ever face that particular problem in real life, you’re able to think clearly.
You never want to get so comfortable when you’re training that you think, “Ho hum, here we go again, playing ‘astronaut in peril.’” For a sim to work, you really have to buy into it. Fidelity helps: we train to fight fires on the ISS, for instance, in a full-scale simulator that is pumped full of real smoke – so full that, in one sim our crew did in the service module shortly before my last flight, we couldn’t see our own feet by the time we managed to get our gas masks on. As commander, I decided, “The smoke is too thick, let’s close the hatches and regroup in another module to figure out how to work the problem.” This led to a rather spirited debrief afterward with the Russian team running the exercise. I’d responded perfectly by American standards – NASA trains us to close off the burning segment, save the crew, then figure out how to fight the fire – but the Russian philosophy is different. They want us to stand and fight the fire. Their reasoning is that the rescue vehicle, the Soyuz, is docked at one end of the service module. As I explained to the trainers afterward, we would’ve been delighted to stop and fight, only, the sim was a little too realistic. I had to respond the way I would in real life: in a terrible fire, with such thick smoke, I’d opt to go with NASA’s procedures and save the crew, not the lab – after all, we’d still have food, water, and communications capability even if we lost the service module. A sim, on Earth, is the right place to expose these kind of philosophical disconnects and resolve them. Next time we did this sim, the Russians compromised: they filled the service module that we all agreed made it possible and sensible to stand and fight.
The notion that a fire might break out while we were on the ISS was not hypothetical: in 1997, two years after I visited, an oxygen-generating canister did start a fire on Mir. The crew worked the problem, throwing wet towels on the canister until they extinguished the flame; their spacecraft was smoke-filled and they didn’t have enough masks left afterward, but everyone survived. That incident reminded everyone that there’s a good reason we train for disaster. Space exploration is inherently dangerous. If my focus ever waivers in the classroom or during an eight-hour simulation, I remind myself of one simple fact: space flight might kill me.
To drive that message home, we have what we euphemistically refer to as “contingency sims” – death sims, actually – which force us to think though our own demise in granular detail: not only how we’d die, but what would happen afterward to our families, colleagues and the space program itself. These are table-top sims, primarily for the benefit of management, so they don’t occur in an actual simulator but in a boardroom with people participating via speakerphone if necessary. Everyone who in real life would be involved in dealing with an astronaut’s death takes part: doctors, space program administrators, media relations people – even the dead astronaut.
A death sim starts with a scenario – “Chris is seriously injured on orbit,” say – and over the next few hours, people work through their own roles and responses. Every five to ten minutes whoever is running the exercise tosses what we call a “green card” into the mix: in essence, a new wrinkle. The cards are devised by the training team, whose job it is to conjure up as many realistic twists and turns as possible; no one else in the sim knows in advance what is on the cards, and we respond as though these things are actually happening. One green card might be, “We’ve just received word from the Station: Chris is dead.” Immediately, people start working the problem. Okay, what are we going to do with his corpse? There are no body bags on Station, so should we shove it in a spacesuit and stick it in a locker? But what about the smell? Should we send it back to Earth on a resupply ship and let it burn up with the rest of the garbage on re-entry? Jettison it during a spacewalk and let it float away into space?
While people are discussing how quickly my body would start to decompose and what kind of help my crewmates might need to deal with the trauma, they are hit with another green card: “Someone has just tweeted that there’s been an accident on the ISS, and a New York Times reporter is calling to find out what’s going on.” New problems, while the old ones are still being dealt with: How should the PR people respond? Should NASA or the CSA take the lead? When will a statement be issued and what should it say? The green cards start coming faster and faster, posing new problems, just as would happen in real life: Who should tell my parents their son is dead? By phone or in person? Where will they even be – at the farm or at the cottage? Do we need two plans, then, depending on where my mom and dad are?
As is probably clear by now, death sims are not weepy, grief-stricken affairs. They’re all about brass tacks. Although family members aren’t required to participate, Helene has joined in several times because she has discovered that taking the time to verbalize what you think you would do in the worst-case scenario quickly reveals whether you’re prepared or not. During a contingency sim before Expedition 34/35, for instance, she realized that her plan to trek in the Himalayas while I was in space for five months was wonderful – unless something went seriously wrong during my mission. The green cards in the sim forced us to figure out who would contact our kids if I died (quite possibly a reporter, we realized, if their mother was on a mountaintop) and how quickly Helene could get to Houston to be with them (not very, considering how many connecting flights she’d need to take). We had to think about the minutiae that would become highly relevant if I died on the ISS: cell reception in remote hill towns in Asia, for instance, and how the difference in time zones would affect her ability to get in touch with key decision-makers in Houston. The upshot of all this was that Helene decided to save the Himalayas for another year and hike in Utah instead. In fact, everyone who participated in the sim discovered weaknesses in their own planning and went back to the drawing board on a few items. (Except me, but that’s what happens when you’re dead.)
Sometimes a sim is a proving ground where you demonstrate how well-rounded your capabilities are, but more often, it’s a crucible where you identify gaps in your knowledge and encounter domino effects that simply never occurred to you before. When I first started training with Roman Romanenko, my crewmate on that last mission and the commander of our Soyuz, we did a re-entry sim together in the simulator in Star City. Roman had actually flown in a Soyuz before and I had not, so my main goal was just to help out where I could. At one point, I noticed that the oxygen tank inside our capsule was leaking a little bit. I didn’t seem like a big deal. We had multiple tanks and the leak was tiny. We kept concentrating on the complex tasks associated with re-entry, but then it hit me: that tank is leaking into a really small capsule, which means the oxygen level is rising to the point where everything may become flammable, so now we may have to depressurize the cabin to avoid a fire – but if we do, we may not have enough oxygen to get home.
A normal, gradual re-entry was out of the question. It didn’t matter if we were anywhere near Kazakhstan. We had to turn that spaceship around and drop to Earth, immediately, or we’d die. But I didn’t know the fastest way to turn the Soyuz around and Roman was already knee-deep in another procedure, so we missed the very narrow window when we still had a chance to save ourselves. What had initially seemed like a subtle failure – a tiny leak in an oxygen tank – wound up killing us.
Roman and I hadn’t really understood the operational impact of a leaking tank, but we sure did after that sim, and in subsequent training, we came up with a much better response. A sim is an opportunity to practice but frequently it’s also a wake-up call: we really don’t know exactly what we’re doing and we’d better figure it out before we’re facing this situation in space.
While play-acting grim scenarios day in and day out may sound like a good recipe for clinical depression, it’s actually weirdly uplifting. Rehearsing for catastrophe has made me positive that I have the problem-solving skills to deal with tough situations and come out the other side smiling. For me, this has greatly reduced the mental and emotional clutter that unchecked worrying produces, those random thoughts that hijack your brain at three o’clock in the morning. While I very much hoped not to die in space, I didn’t live in fear of it, largely because I’d been made to think through the practicalities: how I’d want my family to get the news, for instance, and which astronaut I should recruit to help my wife cut through the red tape at NASA and the CSA. Before my last space flight (as with each of the earlier ones) I reviewed my will, made sure my financial affairs and taxes were in order, and did all the other things you’d do if you knew you were going to die. But that didn’t make me feel like I had one foot in the grave. It actually put my mind at ease and reduced my anxiety about what my family’s future would look like if something happened to me. Which meant that when the engines lit up at launch, I was able to focus entirely on the task at hand: arriving alive.