Redundant Safety Controllers