13 November 2026
The backup that wasn't a copy
Apollo 11 flew two guidance systems built on different principles, and needed both. Ariane 5 flew two identical ones, and one fault stopped both. That difference has a name, and NoWayOS is built to be on the right side of it.
Everybody knows you should have a backup. Fewer people ask the awkward follow-up: a backup of what, exactly?
Five alarms
On 20 July 1969, Apollo 11's lunar module was a few minutes from the surface of the Moon when its guidance computer raised an alarm the crew had to ask Mission Control about. Then another. Five in all, in the last stretch of the descent.
The computer was overloaded. What it did next is one of the great pieces of engineering in the story: each time, it restarted, dropped the work that could wait and picked the work that couldn't straight back up. The landing went on.
That's the part everyone tells. The part worth telling next happened the following day.
The second system
The lunar module carried a second guidance system, and it was not a spare copy of the first. A different company built it, on a different principle. The main system kept its bearings with a platform that swung freely on gimbals. The second had no gimbals at all: its sensors were bolted straight to the spacecraft, and it worked out which way was up by arithmetic.
It was there to fly the crew back to orbit if the main system ever stopped. During the landing it wasn't called on.
Then, on the way back up to dock with the command module, a run of manoeuvres took the main system's platform into the one position a gimballed platform can't cope with, and it lost its attitude reference. The crew switched to the second system to hold the spacecraft steady, and docked.
The second system could not have failed the same way. It didn't have the part.
Two of the same
Now the other story. In 1996 the first Ariane 5 lifted off with two inertial reference units to tell it which way it was pointing: one working, one standing by. They were identical, down to the software.
Thirty-seven seconds in, a number inside that software grew too large for the space set aside for it. The stand-by unit stopped. The working unit, running the same code on the same flight, stopped as well. The inquiry's report is public, and it is blunt: there was nothing to switch to, because the backup had already gone the same way.
Two copies. One fault. Nothing left.
What engineers call it
A fault that takes out a system and its spare together is a common-cause failure. The defence against it is diverse redundancy: a second system built differently enough that what stops the first isn't in the second.
The Space Shuttle flew this way. Four of its flight computers ran one company's software; the fifth ran software written separately by another. Four copies protect you from a computer that breaks. They don't protect you from a program that's wrong, because all four are running it.
It isn't free. The Shuttle's first launch was called off when the fifth computer and the other four couldn't agree on the time. Two designs are more work than one, and they have to be made to meet.
Where NoWayOS comes in
Most dedicated devices today run one of a very small number of general-purpose operating systems. So do their backups. When a flaw turns up in a browser engine, a desktop or a kernel of tens of millions of lines, or when a bad update goes out, it turns up everywhere that software runs, on the same day.
A NoWayOS device is different underneath. Its kernel is seL4, about 10,000 lines. Everything of ours above it is written in Rust. It has no browser engine, no desktop and no shell, so a flaw in one of those is not in it.
That means NoWayOS doesn't have to replace what you run to be useful. It can stand beside it: a second way to do one essential job, built on a different principle.
What it doesn't do
Diversity has limits, and we'd rather you heard them from us.
It gives a NoWayOS device different faults, not none. It does nothing for what two systems share: the power, the network, the services behind them, or a mistake in what the job was meant to be. And some of NoWayOS's open-source parts are used in other software too, which is why every image lists every component it contains, so you can read what it has in common with the system next to it.
NoWayOS is in development, so this is a role it is designed for, not one it has filled yet. The Security page says what it rests on.
Apollo's engineers didn't carry a second system because they expected the first to fail. They carried it because they couldn't prove it wouldn't, and they made sure that whatever stopped the first would find nothing familiar in the second.