Redundant flight computers and the voting algorithm

You’re strapped into a spacecraft hurtling toward Mars. One computer glitch, and you’re a memory. That’s why engineers don’t trust a single brain with your life. They use redundant flight computers—multiple independent systems running the same code—and a voting algorithm to decide which answer is right. This isn’t a gimmick. It’s how every serious spacecraft stays alive when radiation, heat, or plain old hardware failure tries to kill it.

Redundancy sounds simple: copy the computer three times, and if one fails, the others carry on. But the devil is in the implementation. A single computer can suffer a “single-event upset” when a cosmic ray flips a bit in memory. That can turn a “0” into a “1,” commanding your thrusters to fire when they shouldn’t. If you have only one computer, you’re dead. If you have two, and one goes rogue, you don’t know which one to trust. That’s where the voting algorithm comes in.

The most common setup is triple modular redundancy, or TMR. Three identical flight computers each run the same software, receive the same sensor data, and compute the same outputs. A voting circuit compares their results. If two computers agree and one disagrees, the majority vote wins. The outlier is ignored, and the spacecraft keeps flying. This is the same logic used in aircraft fly-by-wire systems, nuclear reactor controls, and the Space Shuttle’s primary avionics software suite. The Shuttle used four redundant computers with a fifth backup, but the principle is identical: out-vote the glitch.

Don’t assume the voting algorithm is a simple tally. In high-reliability systems, the vote happens at the hardware level, often in dedicated comparators or field-programmable gate arrays. This prevents a software bug in one computer from corrupting the voting logic itself. The algorithm also has to handle what engineers call “babbling idiot” failures, where a computer goes completely haywire and spews nonsense on the data bus. The voter must detect that and isolate the broken unit before it drowns out the good ones.

But here’s the kicker: even TMR isn’t foolproof. A common-mode failure, where all three computers share the same design flaw or are hit by the same radiation wave, can take them all down simultaneously. That’s why aerospace engineers use dissimilar redundancy when the stakes are astronomical. The Boeing 777’s fly-by-wire system, for instance, uses three computers running different hardware and different software. If one fails due to a coding error that exists only in its codebase, the others, running different code, are immune. Spacecraft like the Orion crew capsule roll with dissimilar processors and operating systems precisely to avoid a single point of failure.

You might wonder why we don’t just use one ultra-reliable computer. The answer is cost and physics. Hardening a single computer against radiation means using specialized, slower, and astronomically expensive chips. A radiation-hardened processor can cost tens of thousands of dollars and run at a fraction of the speed of a commercial chip. Meanwhile, three commercial-grade chips, each costing a few hundred bucks, can run rings around it in raw performance when protected by TMR and voting. The trade-off is that you need the software and the voter to manage the complexity, but modern embedded systems make that manageable.

What happens when a vote comes back 2-1 against your survival? The voting algorithm doesn’t care about drama. It executes the majority command. If one computer says “fire left engine” and two say “do nothing,” the thrusters stay off. The system logs the dissenter, marks it for maintenance, and continues with the two remaining computers. If a second computer fails, you’re down to one. At that point, the spacecraft enters a degraded mode, often calling ground control for help. That’s why most deep-space missions have a watchdog timer and a backup command path that can reboot the entire voting network.

In real terms, every modern launch vehicle and crewed spacecraft you’ve heard of relies on some form of redundant computers with voting. SpaceX’s Falcon 9 uses triple-redundant processors on the Merlin engines, with cross-strapping that allows any computer to talk to any engine controller. NASA’s Perseverance rover runs two main computers—one primary, one backup—with hardware voting on critical commands like braking. The voting algorithm is not glamorous. It’s a handful of logic gates and a few lines of firmware. But it’s the difference between a routine flight and a debris field.

So when you’re watching a launch livestream and the announcer says “systems nominal,” understand that behind that calm phrase, three computers are screaming at each other, a voting circuit is picking a winner, and your ride is still alive because some engineer decided not to trust a single machine with your future. That’s the quiet, boring miracle that makes space travel possible.