Home › Library › Glossary › Spacecraft Systems › C&DH
🛰️ Spacecraft Systems

Command & Data Handling (C&DH)

Also known as: Command and Data Handling, OBC, Onboard Computer

Quick answer

Command and data handling (C&DH) is the spacecraft's brain: the onboard computer that executes commands from the ground, runs the flight software, collects telemetry from every subsystem, stores payload data and feeds it to the radio. Everything the satellite does routes through it.

📘 Full definition✓ Reviewed 2026-09-07
Command and data handling is the avionics subsystem at the centre of every spacecraft: an onboard computer (or redundant pair) plus data buses, memory and interface electronics that together run the vehicle. Upward, it receives and validates commands from the ground — immediate actions, stored sequences to execute later, software updates — and distributes them to subsystems over standard buses. Downward, it gathers housekeeping telemetry from hundreds of sensors (temperatures, voltages, wheel speeds, tank pressures), packs it into frames, and hands it to the communications system alongside the payload's science or imaging data, buffered in solid-state recorders between ground contacts. It also hosts the flight software: the control loops, mode logic and — critically — fault management, the watchdog layer that detects anomalies and drops the spacecraft into a safe mode (Sun-pointed, minimal loads, waiting for the ground) when something looks wrong. Space computing's defining constraint is radiation: processors must tolerate bit-flips from charged particles, so C&DH design leans on hardened or error-corrected electronics, voting architectures and conservative margins — one reason flight computers trail consumer hardware by generations while far exceeding it in reliability.
Processor
RAD750, LEON, FPGA
Redundancy
Typically dual-redundant
Storage
Solid-state recorder (SSR)
Key Function
FDIR (fault detection)

Understanding C&DH

Buses, recorders and the data pipeline

Inside the vehicle, standardised buses — MIL-STD-1553, SpaceWire, increasingly Ethernet derivatives — carry commands out and telemetry back on strict schedules. Payload data flows separately at much higher rates into solid-state recorders (terabits on modern imagers), then out through the downlink when a ground station rises. Sizing that pipeline — instrument rate versus storage versus contact minutes per day — is one of mission design's fundamental sums.

Redundancy and the art of not dying

Flagship C&DH is built to survive its own failures: dual computers in hot or cold standby, cross-strapped interfaces so either computer can reach either radio, watchdog timers that reboot a hung processor, and memory scrubbing that repairs radiation-flipped bits in the background. Fault trees are rehearsed on the ground in exhaustive simulation — the quiet reason spacecraft routinely outlive their design lives by decades.

See it live Every dot on the globe is a computer flying itself between ground contacts. Open Live Globe →
📖 Learn More

Frequently Asked Questions

They optimise for a different axis: predictable operation through radiation strikes, vacuum, thermal cycling and fifteen-year missions without a reboot technician. Radiation-hardened processes lag commercial fabs by design generations, and extensive error detection eats performance. The trade is shifting — many smallsats now fly commercial processors with software-level protection.
The spacecraft's crouch position. Fault-protection software sheds non-essential loads, points solar arrays at the Sun, ensures a low-rate communication path, and stops executing the sequence that may have caused trouble — then waits. Most anomalies you read about ("the observatory entered safe mode") are this system working exactly as designed.
Layers: link-level error correction, cryptographic authentication on modern missions, command counters preventing replays, and plausibility checks in flight software. Critical actions (firing thrusters, releasing deployables) often require armed-then-execute pairs so no single corrupted frame can trigger them.

Sources & References

Definitions are reviewed against primary sources. Last reviewed: 2026-09-07.