Dragon Flight Computer

The Dragon Flight Computer is the brain of SpaceX’s Dragon spacecraft. Instead of one costly, specially built “space” processor, it uses a small team of ordinary computers that constantly check each other’s work and vote on every decision.

Quick facts

• What it is: The fault-tolerant flight-control computer system aboard SpaceX’s Dragon spacecraft (Cargo Dragon, Crew Dragon, and the original Dragon 1).
• Design philosophy: Reliability comes from a triple-redundant design, not from per-chip “radiation hardening.” As SpaceX’s John Muratore put it, “The parts aren’t hardened, the design as a total system is hardened.”
• Central computers: Dragon carries three flight-computer units, described as six computers working in three pairs that cross-check one another.
• Across the whole spacecraft: roughly 18 triply redundant processing units, on the order of 54 processors spread through Dragon’s systems.
• Processors: commodity, off-the-shelf dual-core processors, not expensive purpose-built space chips.
• Memory: error-correcting (ECC) memory that detects and repairs corrupted data.
• Software: Linux-based flight software written largely in C and C++.

What it is and how it works

The Dragon Flight Computer is not a single brain but a small cluster of identical, everyday computers all running the same flight software at the same time. Every critical decision, such as firing a thruster or opening a valve, is worked out independently by several processors, and even by the two cores (the two separate processing units) inside a single chip. The answers are then compared.

This is sometimes called an “actor and judge” scheme: the flight computers are the actors that each propose a command, and a separate voter is the judge that compares those proposals. If they all agree, the command runs. If one disagrees, the majority outvotes it using a “Byzantine generals” voting method, a classic technique for reaching the right answer even when one participant is giving bad information. The correct command still goes out, and the confused computer performs a fast soft reboot (a quick restart of just the software) to resync and rejoin the group.

Disagreements happen because space is full of radiation. A cosmic ray can flip a single bit in memory, a “single-event upset” or “soft error,” turning a 1 into a 0. Error-correcting memory catches and repairs many of these flips automatically; the voting system handles the rest. The software runs on a Linux kernel tuned for fast, predictable response.

Why it matters

Traditional spacecraft relied on radiation-hardened chips that were slow, costly, and often a decade behind ordinary computers. Dragon proved a different path: cheap commercial processors made trustworthy through aggressive redundancy and voting. Think of it like asking three calculators the same math problem and trusting the two that agree, rather than buying one armored calculator that costs a fortune.

This “radiation-tolerant by design” approach, shared with the Falcon 9 rocket, gives SpaceX faster, more powerful, cheaper flight computers and the freedom to improve them quickly. It also meets NASA’s strict rule that the spacecraft must survive a computer failure without losing control. It is the system that lets Dragon steer itself to the International Space Station and, on Crew Dragon, safely carry astronauts.

Notable examples

• Dragon 1 (Cargo Dragon): the first commercial spacecraft to be recovered from orbit (December 2010) and, in May 2012, the first to berth with the ISS, all guided by this triple-redundant computer.
• CRS-1 (October 2012): during SpaceX’s first operational cargo mission, a radiation hit corrupted a Dragon computer unit, which automatically soft-rebooted and recovered, proving the design in flight.
• Crew Dragon (Dragon 2): the same fault-tolerant avionics carried NASA astronauts on Demo-2 (May 2020) and supports autonomous docking with the ISS.
• ISS proximity operations: near the station, two computer strings must continuously vote on critical commands with a third in reserve, so a single failure still leaves two agreeing, satisfying NASA’s fault-tolerance requirement.