Why subsystems are the right mental model for satellites
A satellite is not a single machine. It is a tightly coupled federation of six or seven engineering disciplines that share mass, volume, power, thermal capacity, and data bus bandwidth, all wrapped inside a structure that has to survive launch loads north of 6g axial and 25g random vibration. When engineers at operators like Maxar, Planet, Airbus, Thales Alenia, or a NewSpace shop like Loft Orbital or Terran Orbital sit down to review a spacecraft, they never talk about the satellite as one object. They talk about EPS, TCS, ADCS, propulsion, C and DH, TT and C, and the payload. Each acronym is a subsystem team, a set of interfaces, a mass and power budget line, and a set of failure modes that must be traded against every other subsystem.
This piece is the technical walkthrough we wish every new satellite engineer got in their first week. If you are moving from aerospace generalist work into a subsystem seat, or transitioning from a related domain like avionics or embedded systems, the map below is the one that will let you read a spacecraft ICD (interface control document) without getting lost. It is also the map that hiring managers assume you already have when you interview for a subsystem role at a prime contractor or an operator.
We will walk through the platform subsystems in the order they typically appear in a mission concept review: structure and mechanisms first, then EPS, then thermal, then attitude determination and control, propulsion, on-board computing, telemetry and command, and finally payload integration. Along the way we will name specific parts, specific vendors, and the tradeoffs that come up in real design reviews. If you want a program that teaches this material with hands-on integration and testing labs, Refonte Learning runs a satellite engineer program built around exactly this subsystem decomposition.
The reason this decomposition matters is that spacecraft design is dominated by budgets that couple across subsystems. A heavier reaction wheel means more mass for the structure to carry, which means less delta-v from the propulsion subsystem, which means a shorter mission life, which changes the required radiation tolerance of the OBC, which changes the mass again. Nothing is local. You cannot understand any one box on a spacecraft block diagram without understanding what it takes from and gives to every other box. That is why we teach subsystems as a graph, not a list.
Structure, mechanisms, and the mass budget that governs everything
Before we touch electronics, the spacecraft has to be a physical object that survives launch and holds its geometry in orbit. The structure subsystem provides load paths from the launch vehicle interface (typically a 937 mm, 1194 mm, or 1666 mm Marman clamp band, or an ESPA ring port for rideshares) up to every mounted component. It also defines the thermal and electrical grounding topology, because the primary structure is usually the reference for chassis ground and for radiative heat rejection to deep space.
Materials selection is dominated by specific stiffness. Aluminum 7075-T6 and 6061-T6 dominate small satellite buses because of machinability and cost. Titanium (Ti-6Al-4V) shows up at fitting interfaces and propellant tank bosses where load concentrations demand it. Composite face sheets over aluminum honeycomb cores are the standard for panels above a few kilograms because they trade off mass against bending stiffness better than monolithic metal. For CubeSats, machined 6061 rails and pockets are still overwhelmingly the norm, and the CubeSat Design Specification (CDS) constrains the outer envelope tolerances to within fractions of a millimeter.
Mechanisms are the moving parts. Deployable solar arrays, deployable antennas, hold-down and release mechanisms (HDRMs), gimbals for high-gain antennas and optical payloads, and shutter mechanisms for radiators or star trackers. Every mechanism is a reliability liability, because you get exactly one chance for it to work. The industry preference has moved away from pyrotechnic release, which contaminates optics and shocks nearby electronics, toward non-explosive actuators (NEAs) using shape memory alloys or fusible links. Ensign-Bickford and TiNi Aerospace parts show up on almost every western spacecraft.
The deliverable that comes out of structures and mechanisms work is the mass budget. Every subsystem gets a mass allocation, and mass margin is tracked religiously through PDR, CDR, and delivery. A typical NASA guideline is 30 percent mass margin at PDR, 20 percent at CDR, and 10 to 15 percent at flight readiness. When margin gets tight, painful conversations follow. Do we descope a payload channel? Do we accept a smaller propellant tank and a shorter mission? Do we move from a 12U to a 16U bus? These are not paper exercises. They are the decisions that determine whether the program flies at all.
Electrical Power Subsystem (EPS): where the energy comes from
EPS answers a simple question with a lot of engineering behind it: where does every watt on the spacecraft come from, and where does it go when the spacecraft is in eclipse? The answer decomposes into four functional blocks: generation, storage, regulation and distribution, and protection.
Generation: solar arrays
Almost every operational satellite generates power from photovoltaics. The dominant cell technology in 2026 is triple-junction gallium arsenide (GaInP/GaAs/Ge), delivering beginning-of-life efficiencies of 30 to 32 percent at AM0 spectrum, from vendors like Spectrolab, Azur Space, and CESI. Degradation is driven by displacement damage from trapped-particle radiation and by UV darkening of coverglass adhesive. A LEO mission at 550 km will lose perhaps 3 to 5 percent of array output over five years. A GEO or MEO mission passing through the Van Allen belts will design for 15 to 25 percent end-of-life degradation.
Array sizing is a function of average orbital power demand, eclipse fraction, sun angle profile, and pointing accuracy. A rigid deployable panel on a 500 kg LEO earth observation satellite might carry 2000 to 4000 GaAs cells to deliver 1.5 to 3 kW at end of life. For a CubeSat, body-mounted plus deployable panels typically deliver 20 to 80 W.
Storage: batteries
Lithium-ion is the universal choice. Cell chemistries vary: LiCoO2, NMC, and increasingly LiFePO4 for missions that prize cycle life over energy density. Cell suppliers include Saft (VES16, VES180 series), EaglePicher, GS Yuasa, and for CubeSats, off-the-shelf 18650 cells that have been screened and tested. Battery packs are sized for depth-of-discharge (DoD) limits, typically 20 to 40 percent for LEO missions that will see 30,000 to 40,000 charge-discharge cycles over five years.
Regulation and distribution: the PCDU
The Power Conditioning and Distribution Unit (PCDU) is the beating heart of EPS. It manages solar array regulation (peak power tracking or direct energy transfer), battery charge control, bus voltage regulation (28 V for most spacecraft, 50 V or 100 V for high-power comms satellites, 12 V or unregulated for CubeSats), and switched power distribution to every load through latching current limiters (LCLs) and foldback current limiters (FCLs). Airbus, Terma, and Thales dominate the European PCDU market. In the US, Vicor bricks and custom designs from primes are more common.
The failure modes to design against are latch-up in downstream loads, short circuits on power buses, and stuck-on switches. LCLs are the standard defense: they trip at a programmed threshold, latch off, and require ground command to reset. Refonte Learning covers PCDU architectures and switching topologies with hands-on lab exercises. For a compensation view on this specific specialty, see our breakdown of salary by subsystem, where EPS engineers consistently land in the upper band because the role sits on the critical path for every mission.
Thermal Control Subsystem (TCS): keeping electronics inside their operating envelope
Space is not cold. Space is empty. A component in sunlight with no radiator will happily climb past 150 C. A component in shadow with no heater will drop below minus 100 C. TCS keeps every part of the spacecraft inside its qualification temperature range, typically minus 20 to plus 60 C for electronics, plus 5 to plus 25 C for batteries, and much tighter ranges (fractions of a degree) for optical payloads and atomic clocks.
Passive control does most of the work. Multi-layer insulation (MLI) blankets, typically 15 to 20 layers of aluminized Mylar or Kapton separated by Dacron netting, wrap the spacecraft and reduce radiative coupling to space by roughly two orders of magnitude. Second-surface mirrors (silver Teflon or OSRs, optical solar reflectors) provide low absorptivity and high emissivity surfaces on radiator panels, rejecting internal dissipation while minimizing solar heating. Paints are chosen for their alpha/epsilon ratio: white paints like AZ-93 for radiator surfaces, black paints for internal cavities where you want radiative equilibration.
Active control adds heaters, heat pipes, loop heat pipes, and in high-power comms platforms, deployable radiators and pumped fluid loops. Constant conductance heat pipes (CCHPs) using ammonia as the working fluid are ubiquitous, embedded in radiator panels to spread heat from dissipative units like traveling wave tube amplifiers (TWTAs). Loop heat pipes handle higher heat loads and longer transport distances but are more complex. Heaters are simple Kapton film resistive elements, controlled by thermostats or by software loops running on the OBC reading platinum resistance thermometers (PRTs) or thermistors.
The engineering artifact that governs TCS is the thermal model, typically built in Thermal Desktop or ESATAN-TMS, with radiative view factors computed by ray tracing over a mesh of the spacecraft geometry. Hot cases and cold cases are analyzed across the full range of solar beta angles, eclipse durations, and internal dissipation profiles. Correlation to test data comes from thermal balance testing in a thermal vacuum chamber, where the spacecraft is instrumented with dozens to hundreds of thermocouples and subjected to solar simulation lamps or IR cage heaters. The test-model correlation is a formal deliverable, and margins are tightened accordingly.
Failure modes are subtle. A partially blocked radiator, a degraded MLI seam, a heater stuck on, or a thermostat that fails closed can all silently drift the spacecraft toward a thermal cliff. TCS anomalies are among the hardest to diagnose from the ground, which is why our anomaly response playbook dedicates a full section to thermal signatures in telemetry.
Attitude Determination and Control Subsystem (ADCS)
ADCS keeps the spacecraft pointed where the mission needs it pointed. For an earth observation satellite, that means nadir pointing with arcsecond-class stability. For a communications satellite in GEO, it means antenna boresight locked to a subsatellite point within a few hundredths of a degree. For a science mission like a space telescope, it can mean milliarcsecond stability over hundreds of seconds.
ADCS decomposes into sensors, actuators, and control law.
Sensors
Star trackers are the gold standard for attitude determination, delivering 1 to 10 arcsecond three-axis accuracy by imaging star fields and matching them to onboard catalogs. Vendors include Ball Aerospace (CT-2020, HAST), Sodern (Auriga, Hydra), Terma (HE-5AS), and Blue Canyon Technologies (Nano Star Tracker) for small satellites. Sun sensors are simpler and cheaper: coarse sun sensors give hemispherical presence detection, fine sun sensors deliver arcminute accuracy. Magnetometers measure the local geomagnetic field vector and provide a coarse attitude reference in LEO. Inertial measurement units (IMUs), typically MEMS or fiber optic gyros (FOGs) or ring laser gyros (RLGs) for high-end missions, propagate attitude between star tracker updates. Honeywell HG9900 series and Northrop Grumman LN-200 are common IMU choices.
Actuators
Reaction wheels are the workhorse. Four wheels in a tetrahedral or pyramidal configuration provide three-axis control with one-fault tolerance. Momentum storage ranges from 0.02 Nms for CubeSats (Blue Canyon RWp015) up to 100 Nms or more for large spacecraft (Rockwell Collins Teldix RSI series, Honeywell HR14 and HR16). Magnetorquers, essentially electromagnets that torque against Earth's magnetic field, provide low-authority control in LEO and are the standard mechanism for wheel momentum desaturation. Control moment gyroscopes (CMGs) offer higher torque authority than reaction wheels and appear on agile earth observation platforms like WorldView and Pleiades. Thrusters (from the propulsion subsystem) provide the highest authority control and are used for slews, safe-mode recovery, and orbit maneuvers.
Control law
The attitude control law runs on the OBC or a dedicated ADCS processor at a rate of 1 to 10 Hz for typical spacecraft, up to 100 Hz or more for agile platforms. Quaternion-based extended Kalman filters fuse sensor measurements into an attitude estimate. PID or LQR controllers compute torque commands, which are allocated across the wheel array by a pseudoinverse. Sun-safe and rate-damping modes provide fallback autonomy when the primary control chain loses lock, using magnetometers and sun sensors and magnetorquers only.
ADCS failures are among the most dramatic. A wheel bearing failure, a star tracker blinding event, a gyro drift excursion, or a control law instability can send the spacecraft into an uncommanded tumble that consumes propellant, drops the array off the sun, and endangers the mission. Every ADCS engineer knows the stories.
Propulsion: from cold gas to Hall thrusters
Propulsion delivers delta-v for orbit insertion, station keeping, collision avoidance, and end-of-life disposal. It also provides high-authority attitude control torque via reaction control thrusters. The choice of propulsion technology drives mass, complexity, and mission architecture more than almost any other subsystem decision.
Cold gas
Stored inert gas (nitrogen, argon, xenon) expelled through a nozzle. Specific impulse (Isp) of 40 to 80 seconds. Simple, reliable, non-toxic, but heavy per unit of delta-v. Common on CubeSats and inspector satellites where total delta-v is modest and safety and cost dominate.
Monopropellant
Hydrazine (N2H4) decomposed over an iridium-on-alumina catalyst bed (Shell 405 or its European equivalent). Isp of 220 to 240 seconds. Ubiquitous on satellites from the 1970s through today. The problem is toxicity: hydrazine is carcinogenic and requires SCAPE suits and specialized handling. The industry is transitioning to green monopropellants: AF-M315E (ASCENT) in the US and LMP-103S (HPGP) in Europe, both delivering higher Isp (250 to 270 seconds) and dramatically simpler handling. We cover this transition in depth in green propulsion systems.
Bipropellant
Monomethyl hydrazine (MMH) and nitrogen tetroxide (NTO) hypergolic pair. Isp of 300 to 320 seconds. Standard for large GEO comms satellites and interplanetary probes where the delta-v budget for orbit insertion is measured in kilometers per second. Aerojet Rocketdyne R-4D and Ariane Group S400 are the workhorses.
Electric propulsion
Hall effect thrusters (SPT-100, PPS-1350, BHT-600, Busek BHT series) and gridded ion thrusters (NSTAR, NEXT, RIT) deliver Isp of 1500 to 4000 seconds, an order of magnitude better than chemical propulsion. The tradeoff is thrust: an electric thruster produces tens to hundreds of milliNewtons, so maneuvers take days or weeks rather than minutes. Xenon is the traditional propellant; krypton and iodine are being adopted for cost reasons. Electric propulsion has become the default for GEO station keeping and for constellations like Starlink, where the mass savings translate directly into more revenue-generating payload per launch.
Propulsion is also the subsystem with the most safety-critical ground handling. Hydrazine loading operations require multi-agency clearance, exclusion zones, and specialized equipment. This is one reason propulsion engineers command a compensation premium.
On-Board Computer (OBC) and Command and Data Handling (C and DH)
The OBC is the spacecraft's brain. It executes flight software, sequences timelines, monitors telemetry, executes fault detection isolation and recovery (FDIR), routes commands to subsystem controllers, and stores payload and housekeeping data.
Processor choice is dominated by radiation tolerance. In LEO, total ionizing dose (TID) over five years is modest (a few krad), and single event effects (SEE) are the main concern. In GEO or MEO, TID climbs to 30 to 100 krad and SEE from heavy ions becomes severe. The processor families you will encounter include:
- RAD750 (BAE Systems): PowerPC-derived, 200 MHz, 200 krad TID tolerant. The Mars rovers Curiosity and Perseverance, the James Webb Space Telescope, and dozens of other flagship missions fly RAD750s. Roughly 200,000 USD per unit.
- LEON3-FT and LEON4 (Cobham Gaisler, now Frontgrade Gaisler): SPARC V8 architecture, developed by ESA. GR712RC is a dual-core LEON3-FT ASIC that dominates European small satellite designs. GR740 is a quad-core LEON4 running at 250 MHz.
- Sabertooth and other Xilinx-based platforms: rad-hard FPGA (Virtex-5QV, Kintex Ultrascale, Versal AI Core for newer designs) implementing soft-core processors or accelerators for payload data processing.
- ARM Cortex-based COTS parts: dominate CubeSat and low-cost commercial platforms, protected by watchdogs, error-correcting memory, and lockstep redundancy in software.
Flight software runs on real-time operating systems: RTEMS, VxWorks, and increasingly cFS (NASA's Core Flight System) as an open architecture layer. The software structure follows a strict hierarchy: hardware drivers, subsystem managers, a bus manager (MIL-STD-1553B or SpaceWire or CAN), an FDIR engine, a command dispatcher, and a telemetry formatter. Every command has a critical or non-critical classification, an authorization chain, and often a time-tagged execution buffer so ground controllers can uplink sequences hours or days in advance. See our writeup of command and control systems for the ground-side view of how commands actually reach the OBC.
Memory architecture matters. SRAM for fast working memory, MRAM or FRAM for non-volatile configuration storage, SDRAM with EDAC for large buffers, and NAND flash with scrubbing for bulk storage. Every memory technology has a different SEE profile and needs a different scrubbing and refresh strategy.
Telemetry, Tracking, and Command (TT and C) and payload downlink
TT and C is how the spacecraft talks to the ground. It splits into a low-rate command uplink, a low-rate telemetry downlink, and (usually separately) a high-rate payload data downlink.
S-band (2 to 4 GHz) is the traditional TT and C frequency, using CCSDS-standard framing, Reed-Solomon or turbo coding, and PSK modulation. Command uplink rates are typically 2 to 64 kbps. Telemetry downlink rates are 32 kbps to a few Mbps. Vendor examples: L3Harris, General Dynamics, Syrlinks EWC series for small satellites.
X-band (8 to 12 GHz) is the standard for payload downlinks on earth observation satellites, delivering 300 Mbps to 1 Gbps or more with high-gain antennas and DVB-S2 or CCSDS 131.2-B modulation. Ka-band (26 to 40 GHz) pushes into multi-Gbps downlinks and is now standard on the largest EO platforms. Optical links (laser communication terminals from Tesat, Mynaric, or Space Micro) are moving from demonstration to operational, promising tens of Gbps and immunity from RF spectrum congestion.
Antenna choices span omnidirectional patch antennas for LEOP and safe-mode contact, mid-gain horns, and high-gain steerable reflectors or phased arrays for payload downlink. Link budgets are the engineering artifact: transmit power, antenna gain, path loss, atmospheric attenuation, receiver noise, modulation and coding gain, all balanced against a required link margin (typically 3 dB minimum).
The ground side of the link is a whole separate discipline. If you are new to it, our writeup on ground segment vs space segment walks through how ground stations, mission operations centers, and network operations centers integrate with the on-orbit fleet.
Payload: the reason the spacecraft exists
Every other subsystem exists to serve the payload. Payloads fall into three broad classes:
Imaging payloads: optical (Maxar's WorldView Legion at 30 cm resolution, Planet's SuperDove at 3 m resolution), infrared (thermal IR sensors for wildfire and climate), synthetic aperture radar (Capella, ICEYE, Umbra at sub-meter resolution independent of weather and daylight), and hyperspectral (Planet's Tanager, Pixxel's Firefly). The payload defines the pointing accuracy requirement for ADCS, the thermal stability requirement for TCS, the data volume that drives the downlink budget, and often the orbit altitude and inclination.
Communications payloads: bent-pipe transponders, digital payloads with on-board processing and beam-forming, inter-satellite links. Modern comms payloads on satellites like Viasat-3 or Starlink v2 carry hundreds of digitally shaped beams, thousands of watts of RF power, and require the entire spacecraft to be organized around the payload's thermal and power demands.
Science payloads: magnetometers, particle detectors, spectrometers, gravity gradiometers, atomic clocks. These payloads often demand exotic thermal control, ultra-quiet EMC environments, and precise attitude knowledge.
Payload integration is where the whole spacecraft comes together. Alignment measurements are made with theodolites and laser trackers to arcsecond precision. Payload-to-star-tracker alignment budgets are one of the tightest tolerance chains on the vehicle. Bakeout campaigns purge outgassing volatiles before optical surfaces are exposed. Electromagnetic compatibility testing verifies that payload receivers do not see interference from PCDU switching, reaction wheel harmonics, or radio transmitters.
Integration, verification, and validation
Subsystems only earn their name when they work together. The integration flow at any operator or prime follows a similar pattern:
- Unit-level qualification (thermal cycling, random vibration, EMC, radiation)
- Subsystem integration and functional testing
- Spacecraft-level integration with mass simulators as needed
- Environmental testing: thermal vacuum, thermal balance, sine and random vibration, acoustic, shock
- Mission simulation and end-to-end testing with the actual ground segment
- Launch site processing and propellant loading
Environmental test levels come from standards like GEVS (GSFC-STD-7000), ECSS-E-ST-10-03, or MIL-STD-1540. Random vibration test levels are typically 6.8 grms qualification, 8.0 grms acceptance is a common misconception; acceptance is usually lower than qualification. Thermal vacuum campaigns run four to eight thermal cycles between qualification hot and cold plateaus, with functional testing at each temperature extreme.
Defect discovery follows a well-known distribution. Roughly half of all defects found during integration are workmanship: a missed torque, a mis-routed harness, a solder joint, a connector pin bent during mate. Another quarter are design margin issues that only appear under environmental stress. The remainder are software bugs, procedural errors, and ground support equipment problems. This is why test-as-you-fly is the mantra: exercise every operational mode, every FDIR trigger, every command sequence, before the vehicle ships.
What to study next
If this walkthrough clarified what a satellite actually is, the next step is to go deep on the subsystem that matches your background. Electrical and power engineers gravitate to EPS. Mechanical and thermal engineers to structure and TCS. Controls people to ADCS. Chemical and mechanical to propulsion. Embedded software and computer engineers to OBC and flight software. RF engineers to TT and C. Optical and instrument specialists to payload.
Whichever subsystem you pick, spend time reading real spacecraft ICDs, real anomaly investigation reports (the NASA lessons learned database and ESA's anomaly database are both public and gold), and real design review packages if you can find them. Watch launch and commissioning campaigns. Read the CCSDS blue books for TT and C. Read ECSS standards for the European view. Read GEVS for the NASA view. Nothing substitutes for reading the primary sources.
Refonte Learning built its satellite engineer program around this subsystem decomposition, with hands-on labs in EPS design, thermal modeling, ADCS simulation, flight software on real rad-hard-adjacent hardware, and a capstone integration project. Whether you join us or study on your own, the map is the same: master one subsystem deeply, learn to read the interfaces to every other subsystem fluently, and never forget that the spacecraft is a system, not a bag of parts. That is how you become a satellite engineer worth hiring in 2026 and beyond.