So could someone design a "safe" operating system? Such that would distribute the workload on two computers from two manufacturers, so that if either computer was compromised by a different party, they wouldn't get any meaningful result?
1. Byzantine fault tolerance
Does your system maintain functioning even in the face of arbitrary adversaries embedded in the system?
2. Homomorphic cryptography
Can you execute meaningful computations on untrusted computers such that someone with total physical control could not discern the nature of the data or the computations being run?
Both problems are monstrously hard, open problems. They both impose extremely large computational costs as well, albeit in different ways. It's doubtful that an agency will consider these cost effective barring some radical innovation.
Edit: It looks like the two other replies address the issue of "suppose I have one or more systems that might fail, but not in an adversarial way." Intelligence agencies do not like to make that assumption, and so what is fine for NASA may not suffice to answer your quandary. NASA may produce 3, 5, 7, or more identical computers which then operate via a voting protocol to act. Unfortunately, if one of those machines is compromised, so is the data on it, and I am not sure what proofs NASA has for the reliability of their system if the machine could be compromised to produce arbitrary output.
The issue with 2 is even if they can't get information an easy DOS attack is a useful and you can't tell which is correct. So, 3 manufactures protects you if 1 is working for the enemy but not 2.
Here's an example with the Boeing 777 that uses separate architectures:
>The aircraft has triple redundant digital autopilot and flight director designed by Rockwell Collins. The BAE Systems (formerly Marconi Avionics) triple digital primary flight computers provide control limits and commands flight envelope protection. Each of the three primary flight computers contains three different and separate set of 32-bit microprocessors, Motorola, Intel and AMD, to manage the functions of fly-by-wire.
If I also remember correctly, subsequent backup auto pilot systems usually only do the basics, so they can't compare and contrast with the first main auto pilot system on a lot of different actions.
Someone even could _write_ a "safe" operating system. That's what NASA did (they worried about bugs, not security, but that doesn't matter much) for the space shuttle. http://www.atarimagazines.com/compute/issue132/92_Space_shut...:
"Since the computers are essential, NASA decided to use five identical computers in operation for critical periods like launch and landing. Four of the units operate together, and if one has a different result, it's presumed wrong and is "outvoted." The fifth computer is programmed separately from the other four and acts as a backup to prevent possible generic software errors from causing problems."
And, of course, for that application, you cannot have the "won't get a meaningful result" outcome often. That's why they made the effort to make that unlikely (http://www.fastcompany.com/28121/they-write-right-stuff)
Becuase of the extra effort needed, the resulting OS may lack features, though.