>>9234
Довольно подробный расклад на эту тему, правда инфа могла устареть:

SpaceX uses an Actor-Judge system to provide triple redundancy to its rockets and spacecraft. The Falcon 9 has 3 dual core x86 processors running an instance of linux on each core. The flight software is written in C/C++ and runs in the x86 environment. For each calculation/decision, the "flight string" compares the results from both cores. If there is a inconsistency, the string is bad and doesn't send any commands. If both cores return the same response, the string sends the command to the various microcontrollers on the rocket that control things like the engines and grid fins.

The microcontrollers, running on PowerPC processors, received three commands from the three flight strings. They act as a judge to choose the correct course of actions. If all three strings are in agreement the microcontroller executes the command, but if 1 of the 3 is bad, it will go with the strings that have previously been correct. The Falcon 9 can successfully complete its mission with a single flight string.

The triple redundancy gives the system radiation tolerance without the need for expensive rad hardened components. SpaceX tests all flight software on what can be called a table rocket. They lay out all the computers and flight controllers on the Falcon 9 on a table and connect them like they would be on the actual rocket. They then run a complete simulated flight on the components, monitoring performance and potential failures.

SpaceX engineers perform what they call "Cutting the strings" where they randomly shut off a flight computer mid simulation, to see how it responds.

Dragon uses a similar triple redundant system for its flight computers.

Bonus: Dragon V2 control panels are modified 17" Tesla Model S touchscreens and include the same Nvidia Tegra SoCs. They are not part of the flight hardware and are only used to display the GUI. After talking with the Dragon team at GDC2016, it appears Tesla hardware is not used. They do use some interesting software on Dragon 2. They use Chromium and JavaScript for the Dragon 2 flight interface. The actual flight computers still run on C++.

Source: Discussion with various SpaceX engineers at GDC 2015/2016
____________________
In case anyone is wondering, the reason for the triple redundancy is that solar radiation can cause bits to flip e.g. from 0 to 1, which can completely throw out calculations. So, there have to be a number of cores in agreement so that if one of the cores has been affected by a bit flip, it can be detected.

You say there are "3 dual core x86 processors" but then later in a couple of places you refer to "both cores". Is that a typo, or is one of the cores functioning as a judge, not as an actor? If that's the case, then it doesn't sound like triple redundancy. (Only one level of redundancy on the actors, and no redundancy on the judge.)

Each dual core processor runs a version of the flight software on each core. So there is in effect 6 processes running the flight software at any one time. The outputs from each core are compared in processor, and then the result from each processor is compared using the actor-judge model.
https://space.stackexchange.com/questions/9243/what-computer-and-software-is-used-by-the-falcon-9