How NASA built Artemis II’s fault-tolerant computer • Hacker News Board

Re: How NASA built Artemis II’s fault-tolerant computer

#51

Post by kube-system » Fri, Apr 10, 2026, 3:35 AM UTC

voodoo_child wrote: post #24

y1n0 wrote: post #16

NASA didn't build this, Lockheed Martin and their subcontractors did. Articles and headlines like this make people think that NASA does a lot more than they actually do. This is like a CEO claiming credit for everything a company does.

Nice “well, actually”. I’m sure Lockheed were building this quad-redundant, radiation-hardened PowerPC that costs millions of dollars and communicates via Time-Triggered Ethernet anyway, whether NASA needed one or not.

Probably, if it already wasn’t developed for DoD.

For example, the OS it seems to be running is integrity 178.

https://www.ghs.com/products/safety_critical/integrity_178_s...

Aerospace tech is not entirely bespoke anymore, plenty of the foundational tech is off the shelf.

Historically, the main difference between ICBM tech and human spaceflight tech is the payload and reentry system.

Re: How NASA built Artemis II’s fault-tolerant computer

#52

Post by BobbyTables2 » Fri, Apr 10, 2026, 3:36 AM UTC

mvkel wrote: post #32

dmk wrote: post #3

The quote from the CMU guy about modern Agile and DevOps approaches challenging architectural discipline is a nice way of saying most of us have completely forgotten how to build deterministic systems. Time-triggered Ethernet with strict frame scheduling feels like it's from a parallel universe compared to how we ship software now.

If you look at code as art, where its value is a measure of the effort it takes to make, sure.

In that case, our test infrastructure belongs in the Louvre…

Re: How NASA built Artemis II’s fault-tolerant computer

#53

Post by aidenn0 » Fri, Apr 10, 2026, 3:40 AM UTC

object-a wrote: post #9

How big of a challenge are hardware faults and radiation for orbital data centers? It seems like you’d eat a lot of capacity if you need 4x redundancy for everything

You don't need 4x redundancy for everything. If no humans are aboard, you have 2x redundancy and immediately reboot if there is a disagreement.

Re: How NASA built Artemis II’s fault-tolerant computer

#54

Post by dyauspitr » Fri, Apr 10, 2026, 3:46 AM UTC

dmk wrote: post #3

The quote from the CMU guy about modern Agile and DevOps approaches challenging architectural discipline is a nice way of saying most of us have completely forgotten how to build deterministic systems. Time-triggered Ethernet with strict frame scheduling feels like it's from a parallel universe compared to how we ship software now.

Agile is not meant to make solid, robust products. It’s so you can make product fragments/iterations quickly, with okay quality and out to the customer asap to maximize profits.

Re: How NASA built Artemis II’s fault-tolerant computer

#55

Post by geomark » Fri, Apr 10, 2026, 3:46 AM UTC

I sure wish they would talk about the hardware. I spent a few years developing a radiation hardened fault tolerant computer back in the day. Adding redundancy at multiple levels was the usual solution. But there is another clever check on transient errors during process execution that we implemented that didn't involve any redundancy. Doesn't seem like they did anything like that. But can't tell since they don't mention the processor(s) they used.

Re: How NASA built Artemis II’s fault-tolerant computer

#56

Post by stodor89 » Fri, Apr 10, 2026, 4:08 AM UTC

mvkel wrote: post #32

dmk wrote: post #3

The quote from the CMU guy about modern Agile and DevOps approaches challenging architectural discipline is a nice way of saying most of us have completely forgotten how to build deterministic systems. Time-triggered Ethernet with strict frame scheduling feels like it's from a parallel universe compared to how we ship software now.

If you look at code as art, where its value is a measure of the effort it takes to make, sure.

Or if you're building something important, like a spaceship.

Re: How NASA built Artemis II’s fault-tolerant computer

#57

Post by nickff » Fri, Apr 10, 2026, 4:09 AM UTC

dyauspitr wrote: post #54

dmk wrote: post #3

The quote from the CMU guy about modern Agile and DevOps approaches challenging architectural discipline is a nice way of saying most of us have completely forgotten how to build deterministic systems. Time-triggered Ethernet with strict frame scheduling feels like it's from a parallel universe compared to how we ship software now.

Agile is not meant to make solid, robust products. It’s so you can make product fragments/iterations quickly, with okay quality and out to the customer asap to maximize profits.

“Agile” doesn’t mean that you release the first iteration, it’s just a methodology that emphasizes short iteration loops. You can definitely develop reliable real-time systems with Agile.

Re: How NASA built Artemis II’s fault-tolerant computer

#58

Post by georgehm » Fri, Apr 10, 2026, 4:11 AM UTC

>Effectively, eight CPUs run the flight software in parallel. The engineering philosophy hinges on a >“fail-silent” design. The self-checking pairs ensure that if a CPU performs an erroneous calculation >due to a radiation event, the error is detected immediately and the system responds.

>“A faulty computer will fail silent, rather than transmit the ‘wrong answer,’” Uitenbroek explained. >This approach simplifies the complex task of the triplex “voting” mechanism that compares results. > >Instead of comparing three answers to find a majority, the system uses a priority-ordered source >selection algorithm among healthy channels that haven’t failed-silent. It picks the output from the >first available FCM in the priority list; if that module has gone silent due to a fault, it moves to >the second, third, or fourth.

One part that seems omitted in the explanation is what happens if both CPUs in a pair for whatever reason performs an erroneous calculation and they both match, how will that source be silenced without comparing its results with other sources.

Re: How NASA built Artemis II’s fault-tolerant computer

#59

Post by jakeinspace » Fri, Apr 10, 2026, 4:24 AM UTC

y1n0 wrote: post #16

NASA didn't build this, Lockheed Martin and their subcontractors did. Articles and headlines like this make people think that NASA does a lot more than they actually do. This is like a CEO claiming credit for everything a company does.

True, but BFS was mainly done in-house. Source: my best friend and I worked on some parts of it.

Re: How NASA built Artemis II’s fault-tolerant computer

#60

Post by vasco » Fri, Apr 10, 2026, 4:27 AM UTC

dmk wrote: post #3

The quote from the CMU guy about modern Agile and DevOps approaches challenging architectural discipline is a nice way of saying most of us have completely forgotten how to build deterministic systems. Time-triggered Ethernet with strict frame scheduling feels like it's from a parallel universe compared to how we ship software now.

It's not like the approach they took is any different. Just slapped 8x the number of computers on it for calculating the same thing and wait to see if they disagree. Not the pinnacle of engineering. The equivalent of throwing money at the problem.