This answer explains what software powers the Falcon 9 launch vehicle.

The flight software is written in C/C++ and runs in the x86 environment. For each calculation/decision, the "flight string" compares the results from both cores. If there is a inconsistency, the string is bad and doesn't send any commands. If both cores return the same response, the string sends the command to the various microcontrollers on the rocket that control things like the engines and grid fins.

The microcontrollers, running on PowerPC processors, received three commands from the three flight strings. They act as a judge to choose the correct course of actions. If all three strings are in agreement the microcontroller executes the command, but if 1 of the 3 is bad, it will go with the strings that have previously been correct. The Falcon 9 can successfully complete its mission with a single flight string.

What is a "flight string"?


1 Answer 1


No specific knowledge of Falcon, but a "string" in avionics terminology means a element of a redundant flight control system consisting of a flight computer and a data bus to a set of sensors and effectors. Here's a schematic from the Shuttle showing one flight computer (on the left, labled GPC for General Purpose Computer) interfacing to four separate flight control strings. The four strings relate to Shuttle's (generally) quad redundant avionics, the three strings in your question imply that Falcon has triple.

A string is composed of two FC data buses: one from the first group (FC1, 2, 3, or 4) and one from the second group (FC5, 6, 7, or 8). Vehicle hardware is segmented into these groups to facilitate GPC command of these components for redundancy, to allow for nominal mission operations in the event of a loss of one string caused by a GPC or MDM failure, and to allow for safe return to Earth in the event of the loss of a second string.

enter image description here

During ascent and entry, when there are four PASS GNC GPCs in the redundant set, each is assigned a different string to maximize redundancy. All flight-critical hardware units are redundant, and the redundant units are on different strings. The string concept provides failure protection during dynamic phases by allowing exclusive command of a specific group of vehicle hardware by one GPC, which can be transferred to another GPC in case of failure. All or part of one string can be lost, and all avionics functions will still be retained through the other strings.

enter image description here

Images from Shuttle Crew Operations Manual, page 2.6-7 & 8

Acronymology (see list in image)

  • $\begingroup$ I never understood what happens if the unit making decisions against the redundant strings dies? Above I think the question would translate to "What happens if the GPC dies?" Where is the redundancy for that? $\endgroup$
    – fionbio
    Commented Jul 15, 2022 at 13:55
  • 1
    $\begingroup$ @fionbio There is some information in this answer space.stackexchange.com/a/9828/6944 but if you would like more details, please feel free to ask a new question. Welcome to space stack exchange! $\endgroup$ Commented Jul 15, 2022 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.