Cassini was deliberately flown into Saturn in September 2017 while still working perfectly, because the alternative was letting a dying spacecraft carrying Earth bacteria eventually drift into Enceladus, a moon with a liquid ocean and hydrothermal vents on its floor.

On 15 September 2017, Cassini entered Saturn’s atmosphere while eight of its instruments were still returning data. The spacecraft had not suffered a terminal failure. NASA sent it into the planet on purpose.

The reason was not simply that a long mission needed a dramatic ending. Cassini was running low on the propellant required to control its trajectory. Once that control disappeared, the agency could no longer guarantee that the spacecraft would stay away from Enceladus and Titan, two moons whose environments had become far more interesting during the mission than anyone understood when Cassini left Earth in 1997.

NASA was protecting those moons from a possibility, not responding to detected contamination. No one found living bacteria on Cassini in 2017, and an impact with Enceladus was considered unlikely rather than inevitable. The concern was that hardy terrestrial microbes might have survived somewhere on or inside the spacecraft and, over a long enough period, an uncontrolled orbit might eventually end at a moon.

I find the decision more interesting with those qualifications intact. Cassini was destroyed not because it had stopped working, but because its own discoveries had changed what responsible operation now required.

Cassini was still operating, but “perfectly” needs qualification

Cassini launched in October 1997 and entered orbit around Saturn in June 2004. Its primary tour was designed to last four years. NASA then approved an Equinox Mission and a seven-year Solstice Mission, carrying the spacecraft through changing seasons and extending its work at Saturn to 13 years.

By 2017, the radio, flight computer, attitude-control system and much of the science payload could still do useful work. Cassini transmitted measurements during its final descent. That is the meaningful truth inside the claim that it was “working perfectly”.

But it was a nearly 20-year-old machine in an environment of radiation, temperature swings and repeated gravitational encounters. More importantly, it had used almost all the rocket propellant needed for course corrections. NASA’s Grand Finale overview says that leaving the spacecraft unchecked would eventually have prevented operators from controlling its course.

The limiting resource was therefore not scientific curiosity or electrical power. It was the ability to decide where the spacecraft would go next.

Enceladus changed the meaning of an accidental impact

When Cassini was designed, Enceladus was a small, bright moon with an uncertain interior. The mission found jets of water vapour and ice erupting from warm fractures near its south pole. Gravity and rotation measurements later supported a global saltwater ocean beneath the ice.

The seafloor story developed from particles and gases collected above the moon. In 2015, Hsiang-Wen Hsu and colleagues reported nanometre-scale silica grains in Nature. Their size and composition were consistent with hot water reacting with rock at temperatures above about 90 degrees Celsius, followed by rapid transport from the ocean floor to the plume.

Cassini then detected molecular hydrogen during an October 2015 pass through the plume. Water reacting chemically with rock was the leading continuing source, providing another line of evidence for hydrothermal activity.

No spacecraft has seen a vent on Enceladus’s seabed. NASA’s hydrothermal activity summary is explicit about that. “Vents” are the physical interpretation that best connects the silica, hydrogen and water-rock chemistry, not structures Cassini photographed.

In my earlier article on Enceladus’s salts, hydrogen and phosphorus, I followed how those separate measurements built the case for habitability. None showed life. Together they made careless contamination harder to dismiss as a remote housekeeping issue.

“Earth bacteria” describes a risk, not a confirmed passenger

Spacecraft are assembled by people, in buildings on Earth, from components made in terrestrial factories. Cleaning reduces their biological burden, but a large spacecraft is not assumed to be absolutely sterile.

NASA’s Cassini end-of-mission FAQ explains the concern in cautious terms. Experiments outside the International Space Station have shown that some microbes and microbial spores can survive for years in space, even without air or water and with little shielding from radiation. Cassini contained seams, insulation and enclosed spaces that could offer more protection than a fully exposed surface.

That does not mean viable organisms remained after two decades. NASA did not sample the spacecraft before destroying it, so the question was not answerable. Planetary protection works by managing a low-probability consequence before the uncertainty becomes an accident.

Nor would a spacecraft striking surface ice automatically deliver bacteria into the ocean tens of kilometres below. Survival through impact, radiation, freezing and later transport would all matter. The immediate scientific problem was simpler: once terrestrial material reached a world being studied for habitability, future measurements could become harder to interpret.

An uncontrolled Saturn orbit would not remain predictable forever

Cassini could not simply be switched off and left in a neat orbit. Saturn’s system is gravitationally busy. Titan was used repeatedly to reshape the spacecraft’s path, while other moons and Saturn’s non-uniform gravity also affected its motion.

As long as propellant remained, navigators could measure the orbit and correct it. Once the reserves fell below what manoeuvres required, the team would lose that option. The risk was not that Cassini was already falling towards Enceladus in September 2017. It was that nobody could guarantee the path over the very long term.

Titan mattered too. Beneath its dense atmosphere and hydrocarbon landscape, Cassini data support a buried water ocean. I wrote about the surface side of that moon in an article on Titan’s methane rain, rivers and lakes. Enceladus received the stronger planetary-protection emphasis because its ocean-linked plume made it a particularly direct target for future sampling.

A dormant spacecraft would still be several tonnes of terrestrial hardware moving through that shared system. Passivity was not the same as safety.

NASA considered other endings

The plunge was not a last-minute reaction. According to NASA’s 2017 end-of-mission press kit, the preferred outcome had long been disposal in Saturn’s upper atmosphere, while the specific Grand Finale design had been part of the plan since 2010.

Mission planners considered parking Cassini in a long-lived orbit and examined other destinations. The spacecraft may have had enough propellant for a few additional years under some scenarios. Those years offered less science than the chosen sequence, and they did not resolve the long-term planetary-protection obligation as cleanly.

The Grand Finale turned disposal into a new observing campaign. Cassini completed 22 passages through the unexplored gap between Saturn and its innermost ring. The orbits refined measurements of Saturn’s gravity and magnetic field, sampled particles and gases, and returned close views of the rings and atmosphere.

A distant Titan encounter on 11 September, nicknamed the goodbye kiss, gave the final gravitational nudge that placed Cassini on an impact course. After that point, the end no longer depended on a large final engine burn.

The final signal was science, not a farewell message

During the last hours, Cassini emptied its recorder to Earth, turned its main antenna towards Earth and began sending atmospheric measurements in real time. The spacecraft could not store data for later because there would be no later pass.

NASA’s end-of-mission timeline records the final sequence. Atmospheric drag began pushing Cassini away from its Earth-pointing orientation. Its thrusters rose from 10 per cent to full capacity in roughly a minute as the flight system fought to keep the antenna aligned.

Then the radio beam moved off Earth and the signal stopped. The data reached the Deep Space Network station near Canberra about 83 minutes after the events had occurred at Saturn. By the time controllers saw the line go flat, Cassini had already been destroyed.

This is why describing the spacecraft as functional is fair. It was measuring, correcting its attitude and transmitting until the atmosphere exceeded what its thrusters could resist. “Perfectly” is less useful because it hides the dwindling propellant that made a controlled ending necessary.

Planetary protection preserves the meaning of future evidence

The phrase planetary protection can sound as though NASA believed an Enceladus ecosystem was waiting beneath the ice. It did not. Cassini found a potentially habitable environment, which is different from finding an inhabited one.

The policy protects the integrity of the search. A later mission detecting an unusual organic molecule or microbe-like structure needs to distinguish an extraterrestrial signal from material carried outwards by an earlier spacecraft. Preventing contamination also avoids altering a place before we understand it.

That problem is becoming more relevant as the category of ocean worlds grows. In my article on six moons thought to hide subsurface oceans, the striking pattern was how often improved measurements reveal liquid water where sunlight cannot maintain it. More promising environments create more destinations that must be approached with care.

Cassini’s destruction was therefore part of the mission’s science logic. The spacecraft had produced evidence that made Enceladus more valuable, then removed itself before failing propulsion could turn that value into a contamination risk.

NASA did not know whether Cassini carried a surviving microbe, whether its orbit would ever intersect Enceladus, or whether anything from an impact could reach the ocean. It knew that those uncertainties would become impossible to manage once control was lost. Saturn provided a disposal site where heat, pressure and depth would destroy and dilute the spacecraft, while the final approach still returned measurements.

On the available evidence, that is the precise version of the story: a working observatory, an expiring ability to steer it, an unlikely but permanent risk, and a controlled end chosen before control disappeared.