Design control-system redundancy by mapping shared dependencies, separating power and network paths, defining failover behavior, exposing degraded operation, and proof-testing every tolerated fault.