Extreme redundancy

 If the whole idea is to leverage redundancy then the groups who author the launch control code for the Space Shuttle have made this an extreme sport. They have two separate isolated teams--working in different parts of the country--who both implement against exactly the same spec but are allowed no cross-communication at all. They plan their design independently and code independently to produce two programs that both do exactly the same thing, but not the same way. Both programs are installed on redundant computers aboard the Shuttle, each receiving the same input and issuing the same commands to control thrusters and flight surfaces. Only one program is allowed to be dominant, but its output is compared against the output of its sister program to make sure they're exactly the same. If there's a deviation then ground control can pick which one "wins" the argument, or abort the mission.