Many years ago I wrote navigation software for ocean going vessels/ships. We used double and triple redundancy on many of our sensor types. We generally used three control computers that would 'vote' before deciding to make vessel navigation changes. We also always included a "Dead man's switch" that allowed the bridge crew to take control at any time.

I can't even imagine designing aerial vehicle autopilot without redundency. The stakes are too high...

I would be interested in having a look at the statistical model they used to prove 'the system was reliable with zero-redundancy'. While designing these systems for ships the only way we were able to get an error probability near zero was when we used triple redundancy.