"Since the computers are essential, NASA decided to use five identical computers in operation for critical periods like launch and landing. Four of the units operate together, and if one has a different result, it's presumed wrong and is "outvoted." The fifth computer is programmed separately from the other four and acts as a backup to prevent possible generic software errors from causing problems."
Someone even could _write_ a "safe" operating system. That's what NASA did (they worried about bugs, not security, but that doesn't matter much) for the space shuttle. http://www.atarimagazines.com/compute/issue132/92_Space_shut...:
"Since the computers are essential, NASA decided to use five identical computers in operation for critical periods like launch and landing. Four of the units operate together, and if one has a different result, it's presumed wrong and is "outvoted." The fifth computer is programmed separately from the other four and acts as a backup to prevent possible generic software errors from causing problems."
And, of course, for that application, you cannot have the "won't get a meaningful result" outcome often. That's why they made the effort to make that unlikely (http://www.fastcompany.com/28121/they-write-right-stuff)
Becuase of the extra effort needed, the resulting OS may lack features, though.