When an expensive AI server in a ground-based data center develops a bug, engineers can usually reboot it remotely. But put that server in orbit, 400 kilometers above Earth, circling the planet roughly every 90 minutes—and who handles the restart?
Difference One: Software Needs Armor
If an app crashes on Earth, you can usually just reopen it. If onboard satellite software crashes, the consequences can range from losing contact with a payload to losing control of the entire spacecraft. That makes defensive design a central principle of flight software.
- Watchdog timers: If the software freezes, an independent hardware circuit detects that it has stopped responding. Once a preset timeout expires, it triggers a reset without waiting for a command from the ground.
- Two-out-of-three voting: Critical calculations can run on three redundant processing channels. A result is accepted when at least two agree, helping protect against a single-event upset that flips a bit from 0 to 1.
- Worst-case timing: For critical real-time tasks, engineers must establish worst-case execution times and ensure that deadlines can be met. “It might occasionally run a little slowly” is not an acceptable assumption for a safety-critical control function.
In plain English: writing satellite software is closer to developing an airliner’s flight-control system than building an app for your phone.
Difference Two: Updates Arrive Over the Air—but Require Extreme Care
Traditional satellites were generally designed around a fixed mission, with limited scope for changing their capabilities after launch—even when software patches were possible. A new generation of software-defined satellites makes in-orbit reconfiguration a much larger part of the design. Through over-the-air (OTA) software updates, ground teams can upload new code, replace software modules, fix bugs, deploy new algorithms and adjust tasks without replacing hardware.
But updating a satellite requires far more caution than updating a phone. Before deployment, new software must undergo extensive testing on ground-based simulators or representative hardware. Depending on the spacecraft’s architecture, a staged update may load the new version into a backup partition, verify it, and only then switch it into active use. A tested rollback path is essential. A failed phone update may require a factory reset; a failed satellite update can put an investment worth hundreds of millions of yuan at risk.
Jargon Card: Software-Defined Satellites
A software-defined satellite uses software to configure a substantial share of its functions, while the hardware provides the underlying capabilities. It might run a remote-sensing analysis today, deploy a new algorithm tomorrow, or reconfigure a communications service later—provided its installed payloads and hardware support those tasks. Software alone cannot turn an imaging-only satellite into a communications satellite.
In plain English: instead of remaining tied to its original configuration, a satellite can gain capabilities throughout its operational life.
Difference Three: One Satellite, Multiple Roles—and a New Cost Equation
The ultimate value of software-defined architecture is its potential to turn a dedicated satellite into a more versatile platform. One example is Pengcheng Nanke-1, launched on September 20, 2026. The 150-kilogram satellite combines a 5G non-terrestrial network (NTN) base station and core network, a 100 Gbps satellite-to-ground laser communications payload, and an AI computing payload. It was described as integrating communications, sensing, intelligence and computing, while exploring “multiple uses and integrated functions on a single satellite” (China Securities Journal, September 20, 2026).
Return to the total cost of ownership (TCO) discussion. If a satellite can take on additional roles through software updates, its development cost can be spread across more services, increasing the value delivered over its lifetime. Hardware lowers costs through production at scale; software adds value through reuse. These are two complementary routes to improving constellation economics.
Key Figures
- Pengcheng Nanke-1: A 150-kilogram satellite integrating a 5G NTN base station and core network, a 100 Gbps satellite-to-ground laser communications payload, and an AI computing payload to explore multiple uses and integrated functions on one spacecraft (China Securities Journal, September 20, 2026).
- Orbital period: Roughly 90 minutes per orbit for a satellite at the low-Earth-orbit altitude used in this example—a basic reference point from the 101 series. The precise period depends on orbital altitude.
- Three-Body Computing Constellation: Peak computing capability reaches up to 744 TOPS, or 744 trillion operations per second, on a single satellite, according to Zhejiang Lab. As onboard computing capabilities and workloads expand, software reliability remains essential.
Further Thinking
There is a security question worth remembering: if a satellite supports OTA updates, attempts to install unauthorized software become part of the threat landscape. Cyberattacks are already a constant concern on Earth. What could happen if an attacker compromised a satellite in orbit?
One Sentence to Remember
Earlier satellites were largely defined at launch; software-defined satellites can keep evolving in orbit—reshaping the value they deliver throughout their lifecycle.
That lifecycle perspective also matters when procuring a satellite: the platform, payloads and upgrade strategy need to support the services you intend to deliver. STARPATH GLOBAL draws on China’s expanding satellite manufacturing capacity to offer international customers competitively priced satellite, payload and assembly, integration and test (AIT) solutions. To explore a configuration that fits your mission and budget, discuss your requirements with STARPATH GLOBAL, including the hardware capabilities needed to support future software upgrades.
