1. What Apollo 13 teaches about risk

Jim Lovell and Jeffrey Kluger’s Lost Moon is the best engineering thriller I know that is also true. The spacecraft did not fail because nobody thought about the risks. It failed because a particular risk — the oxygen tank — was underestimated, and because the systems were not designed to absorb the failure. The lesson is not to eliminate every risk. It is to know which risks you are accepting and why.

For the keeper demo, there are many things that could go wrong. Most of them are recoverable or unimportant. Three are not.

2. Risk one: the target is not where we think it is

A spent upper stage’s published orbit is a prediction, not a measurement. Atmospheric drag, solar pressure, and outgassing shift the orbit. Before the servicer can approach, it must find the stage and estimate its motion from closer range. If the relative navigation fails here, nothing else matters.

Retirement plan. Use ground radar and laser ranging to update the target ephemeris. Design the approach with a wide safety corridor so the servicer can replan if the target is off its predicted track. Test the relative navigation stack in hardware-in-the-loop simulation against a variety of tumbling targets before launch.

3. Risk two: contact goes wrong

Touching a tumbling, non-cooperative object is the most dangerous phase. The capture interface could miss, snag, or bounce. Contact could set the target tumbling faster or create debris. The servicer could be damaged.

Retirement plan. Build a capture interface with a large tolerance zone — a magnetic pad, a soft gripper, or a net — rather than a precision docking probe. Test contact dynamics in a flat-floor or air-bearing facility. Program the servicer to back away immediately if contact forces exceed a threshold. Practice the abort more than the success case.

4. Risk three: the spacecraft fails before it gets there

Small spacecraft have limited redundancy. A power regulator, a radio, a flight computer, or a propulsion valve can end the mission. The servicer might launch successfully and then die during phasing.

Retirement plan. Use a conservative bus design with flight-proven components. Run a long-duration thermal-vacuum test. Implement watchdogs and fault-protection routines that default to safe states. Keep the mission simple enough that a single failure does not cascade into loss of spacecraft.

5. What honest risk management looks like

These three risks are not independent. If the target state is uncertain and the contact interface is unforgiving, the spacecraft will spend more propellant and time in proximity, which increases the chance of a subsystem failure. The design has to be robust across all three, not just optimized for one.

The most valuable pre-launch activity is not building better hardware. It is running integrated simulations where navigation errors, contact failures, and subsystem faults happen at the same time. That is where the real bugs hide.

What this changes

  • The keeper demo is now framed around three retireable risks: target state uncertainty, contact dynamics, and spacecraft reliability.
  • Each risk has a concrete retirement plan based on testing and margin rather than better analysis.
  • The next leisure entry can estimate the cost and schedule of this risk-retirement work.