How NASA Built the Fault-Tolerant Computer for Artemis II

Unlike Apollo's 1MHz computer and roughly 4KB of erasable memory, Orion has software directly managing most of the spacecraft's safety-critical functions.

The core is a fail-silent design. Orion combines 2 Vehicle Management Computers, 2 Flight Control Modules per computer, and self-checking pair processors inside each FCM, adding up to effectively 8 CPUs running the flight software in parallel. If radiation corrupts a calculation, that channel doesn't output a wrong answer — it silently drops out, and the system selects the next output from a prioritized healthy channel.

This architecture is specifically designed with transient errors during passage through the Van Allen belts in mind. NASA explains that even if 3 FCMs are lost within 22 seconds, the last remaining one can carry the system through safely. A dropped FCM isn't discarded entirely — it can resync its state and return during flight.

Synchronization is achieved via time-triggered Ethernet and ARINC653-based scheduling. The system operates in major frame / minor frame units, and all FCMs are forced to receive the same inputs, run the same application code, and produce the same outputs. Clock drift on each FCM is recalibrated every second, and if a deadline is missed, that module automatically goes into silence/reset/resync.

Hardware and networking are also built with multiple layers of defense.

• Triple-modular-redundant memory corrects single-bit errors every time it's read.
• Network interface cards continuously compare 2 lanes, turning bit flips into fail-silent events.
• The network is duplicated across 3 separate planes.

To guard against the possibility of a common-mode failure in the primary system, Orion carries a completely separate Backup Flight Software (BFS) on separate hardware, with a separate OS and simplified, independent code. BFS stays on standby at all times, and if all primary computers fail, it automatically takes over and can carry the dynamic phases of the flight through to completion.

A dead bus situation — a total loss of power — is also assumed. Once power is restored, the vehicle enters safe mode: it first stabilizes, then points its solar arrays toward the sun, orients its tail toward the sun for thermal stability, and then reestablishes communication with Earth. In the meantime, the crew can manually reconfigure life support or put on their spacesuits.

Going from Apollo to Artemis, software complexity has grown significantly. Software now even manages thermal valves and power relays, so NASA validates the system against extreme latency and communication failures through full-environment simulation, Monte Carlo stress testing, and large-scale fault injection. The piece concludes that this spacecraft's resilience-oriented design could serve as a reference for reliability engineering in ground-based systems as well, such as self-driving cars and industrial power grids.