A recent question "Back up plan to use LOX-RP1 for Apollo mission" has an answer stating

Another example is that some spacecraft have a backup flight software system written by a group of developers who are firewalled from the developers who write the primary flight software system.

Which raises the question, what missions have done, are doing, or will do this in the past/present/future?


Shuttle had this; it had five onboard General Purpose Computers (GPCs).

For dynamic flight phases (launch and landing) four of the GPCs ran the Primary Avionics Software System (PASS) coded originally by IBM, later by USA.

The fifth GPC ran the Backup Flight System (BFS); a bare-bones implementation designed just to get you safely to orbit or landing, coded originally by Rockwell International, later by Boeing. To keep it from being completely unused on nominal missions, it also performed some Systems Management (SM) functions, like turning cooling systems on, and had some crew displays of SM information.

The BFS monitored the PASS via the flight critical data buses so that it acted as a "hot spare", ready to be engaged instantly if needed.

The BFS was not used nominally in orbital operations. Should a complete PASS failure have happened on-orbit, the BFS had the capability to get the Orbiter back.


Since the BFS, if it were ever to be used, would probably have been when the Orbiter was going out of control, it was simple to start. Just mash the red button on either hand controller; that killed the PASS and engaged the BFS.

enter image description here

(personal photo from Shuttle Mission Simulator)

One could demonstrate their newbie status by mistaking this for the push-to-talk button.


In addition to the Shuttle, referenced nicely in Organic Marble's answer, Apollo had an Apollo Abort Guidance System. The sole responsibility of this system was to abort the Moon landing in case the primary flight system failed.

Some of the visiting vehicles to the International Space Station have / had a backup flight system, mostly for handling aborted rendezvous attempts. For example, the Japanese H-II Transfer Vehicle (HTV) has an Abort Control Unit. This system not only has an independent dissimilar fight software system, it also has independent dissimilar sensors.

The Orion spacecraft currently being built has a limited capability backup flight software system. Since Orion enters the atmosphere with crew aboard, its backup flight software includes entry capabilities, as did the Shuttle's Backup Flight System.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.