I have a friend that used to do embedded programming for nuclear power plants. From what he said they have 5 systems, two running software from vendor a, two f

I have a friend that used to do embedded programming for nuclear power plants. From what he said they have 5 systems, two running software from vendor a, two from vendor b, and another running software from vendor c for failsafe. A quorum have to agree, if any don't it gets pulled out of service and analyzed why it wasn't the same output. If you get down to one there is still a mechanical failover but at that point you're already bringing things down. 3 at any time was considered a critical failure. Two at once would be full stop time. I'd presume planes are similar. I know the space shuttle did the same at least so I assume the technique is common.