Not really, what you're describing is profoundly difficult to do, and probably intimately related to a couple concepts in theoretical computer science:

1. Byzantine fault tolerance

Does your system maintain functioning even in the face of arbitrary adversaries embedded in the system?

2. Homomorphic cryptography

Can you execute meaningful computations on untrusted computers such that someone with total physical control could not discern the nature of the data or the computations being run?

Both problems are monstrously hard, open problems. They both impose extremely large computational costs as well, albeit in different ways. It's doubtful that an agency will consider these cost effective barring some radical innovation.

Edit: It looks like the two other replies address the issue of "suppose I have one or more systems that might fail, but not in an adversarial way." Intelligence agencies do not like to make that assumption, and so what is fine for NASA may not suffice to answer your quandary. NASA may produce 3, 5, 7, or more identical computers which then operate via a voting protocol to act. Unfortunately, if one of those machines is compromised, so is the data on it, and I am not sure what proofs NASA has for the reliability of their system if the machine could be compromised to produce arbitrary output.

The voting approach works you just need 2n+1 computers from different manufactures to protect from n compromised designs.

The issue with 2 is even if they can't get information an easy DOS attack is a useful and you can't tell which is correct. So, 3 manufactures protects you if 1 is working for the enemy but not 2.

Others have commented on here before about how that idea is incorporated into flight control systems.

Here's an example with the Boeing 777 that uses separate architectures:

>The aircraft has triple redundant digital autopilot and flight director designed by Rockwell Collins. The BAE Systems (formerly Marconi Avionics) triple digital primary flight computers provide control limits and commands flight envelope protection. Each of the three primary flight computers contains three different and separate set of 32-bit microprocessors, Motorola, Intel and AMD, to manage the functions of fly-by-wire.

- http://777boeing.com/boeing-777-cockpit/

If I remember correctly, that doesn't mean all three autopilots are talking to each other discussing what the best course of action is, it just means that when one fails or is shut off by the pilot that the next auto pilot system in line gets control.

If I also remember correctly, subsequent backup auto pilot systems usually only do the basics, so they can't compare and contrast with the first main auto pilot system on a lot of different actions.

They also write it in Ada to prevent many issues.

Yes. You just did (more or less).

Someone even could _write_ a "safe" operating system. That's what NASA did (they worried about bugs, not security, but that doesn't matter much) for the space shuttle. http://www.atarimagazines.com/compute/issue132/92_Space_shut...:

"Since the computers are essential, NASA decided to use five identical computers in operation for critical periods like launch and landing. Four of the units operate together, and if one has a different result, it's presumed wrong and is "outvoted." The fifth computer is programmed separately from the other four and acts as a backup to prevent possible generic software errors from causing problems."

And, of course, for that application, you cannot have the "won't get a meaningful result" outcome often. That's why they made the effort to make that unlikely (http://www.fastcompany.com/28121/they-write-right-stuff)

Becuase of the extra effort needed, the resulting OS may lack features, though.

At one point IBM mainframes used to run the same instructions on multiple cores to avoid potential errors introduced by gamma radiation or hardware failures. The engineer who explained this to me said that as cpu's get smaller the potential for gamma radiation strikes to cause calculation errors grows or damage to circuits that could cause long term defects in their processing.