>>2017184My recollection of this is pretty shit, but I vaguely recall that a certain military aircraft flight control system used 4 sub-systems, but each system implemented different-but-redundant "rules." So system A handles rules 1 & 2, B handles rules 2 & 3, C handles 3 & 4, and D handles 4 & 1.
So if one of the rules was producing dysfunctional behavior, there would only be 2 systems impacted, and the other 2 systems have completely independent copies of the three remaining (presumably non-dysfunctional) rules.
