NASA calls off the Swift rescue: a lesson in retrofits

NASA has called off the Swift rescue mission, and the Neil Gehrels Swift Observatory is now expected to burn up in Earth's atmosphere later this year. Ars Technica reported on Wednesday's announcement that NASA and Katalyst Space Technologies are giving up on the robotic recovery attempt.

I don't normally write about spacecraft. I'm writing about this one because the failure chain reads exactly like the ones I see in small software teams, only with a $500 million price tag attached.

---

🛰️ What actually broke, in order

The rescue satellite was called Link. It launched on July 3 with a single job: fly up to Swift, grab it with three robotic arms, and push it into a higher orbit before atmospheric drag finished the job.

Spec	Link rescue satellite
Size	About a refrigerator
Capture method	Three robotic arms
Main propulsion	Three xenon electric thrusters
Attitude control	Three reaction wheels + cold gas thrusters
Contract value	$30 million
Build-to-launch time	Nine months

In late July, Link spun out of control. Katalyst hasn't said why, but the outcome is public: two of its three reaction wheels stopped working, and the cold gas thrusters used for fine pointing had problems too. That left three low-impulse plasma thrusters as the only way to control the orientation of a satellite moving at nearly 5 miles per second.

Katalyst's official language was "ongoing attitude control issues." Translated: the thing that pointed the spacecraft died, and everything else on board depended on pointing.

---

⏱️ Nine months bought speed and spent margin

NASA awarded the contract less than a year ago. A first-of-its-kind satellite normally takes several years to get to a launch pad. Katalyst did it in nine months, because NASA set a hard deadline: launch by this summer or Swift is gone anyway.

Ars Technica's framing is the part worth stealing. The schedule "forced hard trade-offs, with the schedule driving engineers to tolerate technical risks they might not otherwise accept."

That is not a space problem. That is every compressed sprint you have ever worked.

What a normal timeline buys	What a compressed one usually cuts
Long-duration ground testing	Shortened test campaign
Independent failure paths	Shared components across "redundant" units
Spare margin on consumables	Just-enough sizing
Rehearsed off-nominal procedures	"We'll figure it out if it happens"

Three reaction wheels sounds like redundancy. It is only redundancy if the three can fail independently. Two dying in the same event suggests they could not. I've shipped the software version of this: three app servers, one database, one deploy script, and a straight face when someone asks if we're highly available.

Key takeaway: Redundant components are not redundancy. Independent failure paths are redundancy. Counting boxes tells you nothing about whether they die together.

---

🔌 The design decision that doomed Swift was made 22 years ago

Here is the line from the reporting that stuck with me:

"Swift lacks thrusters to maintain its orbit, so a rescue effort like Katalyst's Link mission was the only way to keep the $500 million observatory going."

Swift was built for a two-year design life and has run for nearly 22 years. Astronomers still use it to detect and locate gamma-ray bursts, the most powerful explosions known, because its mix of multi-wavelength instruments and fast pointing lets other telescopes follow up quickly. It succeeded past anyone's expectations, and it is dying because two decades ago nobody built in a way to raise its orbit.

Run the arithmetic on what that omission cost:

Item	Figure
Swift observatory	~$500 million
Attempted retrofit (Link)	$30 million
Retrofit as share of asset	~6%
Retrofit success	None

A 6% surcharge to bolt on a capability that was never designed in, and it still didn't work. Designing that capability in from the start would have cost a fraction of that, on the ground, where you can test it.

---

🛠️ The same shape, on a single small VPS

Small teams here ship on tight budgets, and I include myself. The Swift pattern shows up as:

1. A database with no tested restore. Backups exist. Nobody has ever restored one. That is a backup you are hoping about, not one you have.
2. No migration path. Schema changes are applied by hand in production because the migration tool was "for later."
3. A deploy with no rollback. You can push. You cannot un-push.
4. Credentials with no rotation path. Rotating the key breaks three services nobody documented.
5. No health check that actually fails. It returns 200 as long as the process is alive, which tells you nothing.

Each of these is a missing thruster. Everything works until the day you need to change orbit, and by then the retrofit costs more than the original build and probably doesn't land.

The cheap fix is a rehearsal, not a rewrite:

# Restore last night's dump into a scratch database and count rows.
# If this fails, your backup is decorative.
sqlite3 /tmp/restore-test.db ".restore backups/$(date +%F).db"
sqlite3 /tmp/restore-test.db "SELECT COUNT(*) FROM users;"

If that restore drill runs on a schedule, check the schedule expression itself before you trust it. A backup cron that silently never fires is the most common version of this failure I see, and our cron expression builder will tell you the next few fire times in plain English.

---

💡 What this means for you

NASA Administrator Jared Isaacman said the mission "does not change why this mission was worth attempting," and I agree with that. Taking a smart risk on a nine-month build and losing is a defensible outcome. Katalyst CEO Ghonhee Lee framed the goal now as building "a repeatable playbook" for future servicing missions, which is the right salvage.

But the expensive lesson is not the one about risk appetite. It's this:

Bottom line: The rescue was called off this week. The decision that made a rescue necessary was taken 22 years earlier, by leaving out the interface that would have let anyone help later.

Three things to do this week, none of which need a budget:

• Pick your most valuable system and ask what its missing thruster is. The change you cannot make without a rebuild. Write it down.
• Run one recovery drill end to end. Restore a backup, roll back a deploy, rotate one key. Time it. The number will surprise you.
• Stop counting redundant boxes and start listing shared dependencies. One power supply, one config file, one AZ, one maintainer with the only SSH key.

Swift outlived its design life by a factor of eleven and produced science nobody had promised. That is a win. It just should not have ended this way, and the reason it did is sitting in most of our stacks right now, waiting.