Sometimes, despite all ground testing, a new build of software can break a satellite. How does one put in protections to keep this failure from being a permanent failure?
For example, what do you do if for some reason the new software isn't 100% updated? Or if there was an unintended consequence of the new build? How can you ensure you can always fix a problem caused by a software bug?